Edit tour

Windows Analysis Report
LDlanZur0i.exe

Overview

General Information

Sample name:	LDlanZur0i.exe renamed because original name is a hash value
Original sample name:	3b58529670cc2c98fb964a9a2c36fa9f.exe
Analysis ID:	1540862
MD5:	3b58529670cc2c98fb964a9a2c36fa9f
SHA1:	8575d737bb6bf1ff5c1b603c48a63f9abd0ac5ea
SHA256:	60477891a177629200ba4f8039b5b42351dccdfd9bc404c0a004a8a387a4de82
Tags:	64exetrojan
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Javascript uses Websockets

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML page contains hidden javascript code

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

LDlanZur0i.exe (PID: 8112 cmdline: "C:\Users\user\Desktop\LDlanZur0i.exe" MD5: 3B58529670CC2C98FB964A9A2C36FA9F)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3600 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7236 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7344 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7400 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7468 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7492 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7532 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7820 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2112 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7896 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2968 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 768 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6468 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5884 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7860 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6036 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 5904 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 6812 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5668 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6060 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 5420 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7988 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7184 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7348 cmdline: taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 3600 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7416 cmdline: taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7344 cmdline: C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 7560 cmdline: taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 7468 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7820 cmdline: sc stop HTTPDebuggerPro MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7532 cmdline: C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

sc.exe (PID: 7896 cmdline: sc stop HTTPDebuggerProSdk MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 2112 cmdline: C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chrome.exe (PID: 7860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8760 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 8768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: LDlanZur0i.exe

ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: LDlanZur0i.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9229F6D strtol,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,_strdup,CertOpenStore,GetLastError,free,free,CryptStringToBinaryA,CertFindCertificateInStore,fopen,fseek,ftell,fseek,malloc,fread,fclose,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,CertCloseStore,calloc,CertFreeCertificateContext,fclose,free,CertFreeCertificateContext,free,calloc,	0_2_00007FF7A9229F6D
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9245B00 CertOpenStore,GetLastError,CertCreateCertificateChainEngine,GetLastError,CertGetCertificateChain,GetLastError,CertGetNameStringA,malloc,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertFreeCertificateChainEngine,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,	0_2_00007FF7A9245B00
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924CE70 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7A924CE70
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924EF60 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7A924EF60
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A922C250 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7A922C250
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A922C240 CryptHashData,	0_2_00007FF7A922C240
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9229260 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF7A9229260
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A922C1F0 CryptAcquireContextA,CryptCreateHash,	0_2_00007FF7A922C1F0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9246420 GetLastError,CreateFileA,GetLastError,GetFileSizeEx,GetLastError,malloc,ReadFile,strstr,strstr,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,GetLastError,CloseHandle,free,	0_2_00007FF7A9246420
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9229330 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7A9229330

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: -----BEGIN PUBLIC KEY-----		0_2_00007FF7A920F110
Source: LDlanZur0i.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

0_2_00007FF7A9238B30

Phishing

Javascript uses Websockets

Source: https://discord.com/invite/privatecommunity

HTTP Parser: !function(){if(null!=window.websocket){if(function(n){try{var o=localstorage.getitem(n);return null==o?null:json.parse(o)}catch(n){return null}}("token")&&!window.__overlay__){var n=null!=window.discordnative||null!=window.require?"etf":"json",o=window.global_env.gateway_endpoint+"/?encoding="+n+"&v="+window.global_env.api_version;null!=window.discordnative&&void 0!==window.uint8array&&void 0!==window.textdecoder?o+="&compress=zstd-stream":void 0!==window.uint8array&&(o+="&compress=zlib-stream"),console.log("[fast connect] "+o+", encoding: "+n+", version: "+window.global_env.api_version);var e=new websocket(o);e.binarytype="arraybuffer";var i=date.now(),w={open:!1,identify:!1,gateway:o,messages:[]};e.onopen=function(){console.log("[fast connect] connected in "+(date.now()-i)+"ms"),w.open=!0},e.onclose=e.onerror=function(){window._ws=null},e.onmessage=function(n){w.messages.push(n)},window._ws={ws:e,state:w}}}}()

Source: https://discord.com/invite/privatecommunity

HTTP Parser: Base64 decoded: 189,120,125,1,61,161,133,255

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.10:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.10:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.10:50116 version: TLS 1.2

Source: LDlanZur0i.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Plus\x64\Release\EpicGames.pdb source: LDlanZur0i.exe

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 67MB

Source: global traffic

TCP traffic: 192.168.2.10:49913 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: Joe Sandbox View	IP Address: 162.159.136.234 162.159.136.234
Source: Joe Sandbox View	IP Address: 162.159.138.232 162.159.138.232
Source: Joe Sandbox View	IP Address: 104.26.0.5 104.26.0.5

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A9224A90 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,

0_2_00007FF7A9224A90

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /privatecommunity HTTP/1.1Host: discord.ggConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /invite/privatecommunity HTTP/1.1Host: discord.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/69646.2af8e3f2e60b2cca1cbf.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/591980d24607547de30a.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2917679ca8a08c390036.css HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/8234e0a75aa9afb205bd.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b21c5111a12372139409.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/8bd8143eff37936894aa.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/452d7be36bf4b23241bd.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/48a594e29497835802fe.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/f5b8aa3411dfc24ff2e6.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Context-Properties: eyJsb2NhdGlvbiI6IkFjY2VwdCBJbnZpdGUgUGFnZSJ9X-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/29a63f12209c956d9204.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/55ad931ed92a15c15709.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1f7f046253c197b5a419.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/29a63f12209c956d9204.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d67c5e680608266a1f63.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/55ad931ed92a15c15709.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1bab9b095996b8d024ce.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/assets/ac625b77a0bab0ee72df.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d86788be99e870993214.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a14c32460cf87caa605c.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/94ec0c2b39908933eed3.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/36e086bbcea2eace814d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/6df906184440a6461f5c.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b8160243347055e1f278.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2597d11c1e039607373e.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oLccZzNnxRyp9t2&MD=TWwp6veN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/5430e9964fe8364e084d.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ab03f7053698d417194c.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/9017b7062734e72bb476.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d67c5e680608266a1f63.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1f7f046253c197b5a419.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1bab9b095996b8d024ce.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/d86788be99e870993214.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000Range: bytes=160675-160675If-Range: "3b74671903d935a08dc04acef440c188"
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/a14c32460cf87caa605c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/94ec0c2b39908933eed3.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/6df906184440a6461f5c.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/36e086bbcea2eace814d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000Range: bytes=160675-168788If-Range: "3b74671903d935a08dc04acef440c188"
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b8160243347055e1f278.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/1222195a37d6dd10994e.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/c1b53be672aac192a996.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/invites/privatecommunity?with_counts=true&with_expiration=true HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Fingerprint: 1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-VlkX-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/2597d11c1e039607373e.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/5430e9964fe8364e084d.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ab03f7053698d417194c.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/ecff74bf4394e6e58dd1.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000; cf_clearance=ZM33j.4CRMpH4cZpFgcP51Y19.dM7YrYLtu3Ergrmoo-1729754190-1.2.1.1-ds3Qy3OAkJM2I1cCftn3bECRwJtW8dUYIxblpAfQwOpKQTI0rhpLKL9rrKviVaGrYPmts6ZukdYNjbo30UocNJZxRAwr5KmRV876UMkSRUkb1RvtJwxP3ulyqf7ytn2yvdGS9nYhM75JeVN5MYQG52IF9wUQCbS1HN.OZUykO_AKP1j06rPOIoUnHoS6I_WwzkqUq50bfCCzGphiGwSlihfQcZX6S.SZEzR0uQ9ClHGdbUK0s6ifUySJ_jLrYBRRcTTglx08Hy.c.iOr0FbNxdJjy0plZDpR8cj8emKuwWq3Ridb8xWPTxT6PaJzaKczkFiI2q5gyyI3rtv.qvSYrld9VJEsGnbjNfy2w30_SmcKWtrEjVkmfAbVmynYoL_0
Source: global traffic	HTTP traffic detected: GET /assets/914a97ac83e173c66dd7.woff2 HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://discord.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000; cf_clearance=ZM33j.4CRMpH4cZpFgcP51Y19.dM7YrYLtu3Ergrmoo-1729754190-1.2.1.1-ds3Qy3OAkJM2I1cCftn3bECRwJtW8dUYIxblpAfQwOpKQTI0rhpLKL9rrKviVaGrYPmts6ZukdYNjbo30UocNJZxRAwr5KmRV876UMkSRUkb1RvtJwxP3ulyqf7ytn2yvdGS9nYhM75JeVN5MYQG52IF9wUQCbS1HN.OZUykO_AKP1j06rPOIoUnHoS6I_WwzkqUq50bfCCzGphiGwSlihfQcZX6S.SZEzR0uQ9ClHGdbUK0s6ifUySJ_jLrYBRRcTTglx08Hy.c.iOr0FbNxdJjy0plZDpR8cj8emKuwWq3Ridb8xWPTxT6PaJzaKczkFiI2q5gyyI3rtv.qvSYrld9VJEsGnbjNfy2w30_SmcKWtrEjVkmfAbVmynYoL_0
Source: global traffic	HTTP traffic detected: GET /assets/9017b7062734e72bb476.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64 HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280 HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/invites/privatecommunity?with_counts=true&with_expiration=true HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /api/v9/auth/location-metadata HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0=X-Fingerprint: 1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-VlkX-Debug-Options: bugReporterEnabledsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Discord-Timezone: America/New_YorkX-Discord-Locale: en-USsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000; cf_clearance=ZM33j.4CRMpH4cZpFgcP51Y19.dM7YrYLtu3Ergrmoo-1729754190-1.2.1.1-ds3Qy3OAkJM2I1cCftn3bECRwJtW8dUYIxblpAfQwOpKQTI0rhpLKL9rrKviVaGrYPmts6ZukdYNjbo30UocNJZxRAwr5KmRV876UMkSRUkb1RvtJwxP3ulyqf7ytn2yvdGS9nYhM75JeVN5MYQG52IF9wUQCbS1HN.OZUykO_AKP1j06rPOIoUnHoS6I_WwzkqUq50bfCCzGphiGwSlihfQcZX6S.SZEzR0uQ9ClHGdbUK0s6ifUySJ_jLrYBRRcTTglx08Hy.c.iOr0FbNxdJjy0plZDpR8cj8emKuwWq3Ridb8xWPTxT6PaJzaKczkFiI2q5gyyI3rtv.qvSYrld9VJEsGnbjNfy2w30_SmcKWtrEjVkmfAbVmynYoL_0
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/jsd/r/8d782e389ce26b1c HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/23a7a3fd6624342117bf.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/assets/591980d24607547de30a.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000; cf_clearance=ZM33j.4CRMpH4cZpFgcP51Y19.dM7YrYLtu3Ergrmoo-1729754190-1.2.1.1-ds3Qy3OAkJM2I1cCftn3bECRwJtW8dUYIxblpAfQwOpKQTI0rhpLKL9rrKviVaGrYPmts6ZukdYNjbo30UocNJZxRAwr5KmRV876UMkSRUkb1RvtJwxP3ulyqf7ytn2yvdGS9nYhM75JeVN5MYQG52IF9wUQCbS1HN.OZUykO_AKP1j06rPOIoUnHoS6I_WwzkqUq50bfCCzGphiGwSlihfQcZX6S.SZEzR0uQ9ClHGdbUK0s6ifUySJ_jLrYBRRcTTglx08Hy.c.iOr0FbNxdJjy0plZDpR8cj8emKuwWq3Ridb8xWPTxT6PaJzaKczkFiI2q5gyyI3rtv.qvSYrld9VJEsGnbjNfy2w30_SmcKWtrEjVkmfAbVmynYoL_0
Source: global traffic	HTTP traffic detected: GET /assets/0e5029fd9cd4812b6712.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b9995525a52dc58aecf5.svg HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64 HTTP/1.1Host: cdn.discordapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=rGUlasQNksofdy0B05mHTa4U2JUywEUjOo_z.PHXz2k-1729754191-1.0.1.1-Yue9r5fVKnAN25SwQkVY8MykwHyvhh0kYX9kDmq_JuRlkNk3RFhgb6lb5M0Hp1fJxVIgee1SoU7LhsDQ_PgcAg; _cfuvid=2VIXX86oAwaLGcbSvuxP_KscoAveRyZtCfXbI7iPfdo-1729754191671-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280 HTTP/1.1Host: cdn.discordapp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=QROVZGd2nlZDDHYx4647DaOGvaGdLigj0a6edSC3YEg-1729754191-1.0.1.1-G32yE0uIFrKDeXnnchmaWXEIDJwvURSCOccFydWGv9uxJcAGPUoW_L_mm.y9X5OIZN2KzxaW_RWTCzrKtG1pUg; _cfuvid=9N_3DkhZC4NrkCl6AjNsVvTH7q1tsnMyXgNYadYIA4g-1729754191909-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/23a7a3fd6624342117bf.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/favicon.ico HTTP/1.1Host: discord.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://discord.com/invite/privatecommunityAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000; cf_clearance=ZM33j.4CRMpH4cZpFgcP51Y19.dM7YrYLtu3Ergrmoo-1729754190-1.2.1.1-ds3Qy3OAkJM2I1cCftn3bECRwJtW8dUYIxblpAfQwOpKQTI0rhpLKL9rrKviVaGrYPmts6ZukdYNjbo30UocNJZxRAwr5KmRV876UMkSRUkb1RvtJwxP3ulyqf7ytn2yvdGS9nYhM75JeVN5MYQG52IF9wUQCbS1HN.OZUykO_AKP1j06rPOIoUnHoS6I_WwzkqUq50bfCCzGphiGwSlihfQcZX6S.SZEzR0uQ9ClHGdbUK0s6ifUySJ_jLrYBRRcTTglx08Hy.c.iOr0FbNxdJjy0plZDpR8cj8emKuwWq3Ridb8xWPTxT6PaJzaKczkFiI2q5gyyI3rtv.qvSYrld9VJEsGnbjNfy2w30_SmcKWtrEjVkmfAbVmynYoL_0
Source: global traffic	HTTP traffic detected: GET /assets/0e5029fd9cd4812b6712.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /assets/b9995525a52dc58aecf5.svg HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/favicon.ico HTTP/1.1Host: discord.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oLccZzNnxRyp9t2&MD=TWwp6veN HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: keyauth.win
Source: global traffic	DNS traffic detected: DNS query: discord.gg
Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com

Source: unknown

HTTP traffic detected: POST /api/1.1/ HTTP/1.1Host: keyauth.winAccept: */*Content-Length: 58Content-Type: application/x-www-form-urlencoded

Source: LDlanZur0i.exe	String found in binary or memory: http://185.101.104.122/plushvibronkz.exe
Source: LDlanZur0i.exe	String found in binary or memory: http://185.101.104.122/plushvibronkz.exeC:
Source: LDlanZur0i.exe	String found in binary or memory: http://185.101.104.122/plussemhvibronkz.exe
Source: LDlanZur0i.exe	String found in binary or memory: http://185.101.104.122/plussemhvibronkz.exeC:
Source: chromecache_159.39.dr, chromecache_189.39.dr	String found in binary or memory: http://discord.gg/fortnite).
Source: chromecache_176.39.dr	String found in binary or memory: https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=51
Source: LDlanZur0i.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: LDlanZur0i.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com
Source: chromecache_159.39.dr, chromecache_189.39.dr	String found in binary or memory: https://discord.com/
Source: chromecache_159.39.dr, chromecache_189.39.dr	String found in binary or memory: https://discord.com/blog/important-policy-updates)
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ar
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=bg
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=cs
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=da
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=de
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=el
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=en-GB
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=en-US
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=es-419
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=es-ES
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=fi
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=fr
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=he
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hi
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hr
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=hu
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=id
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=it
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ja
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ko
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=lt
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=nl
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=no
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=pl
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=pt-BR
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ro
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=ru
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=sv-SE
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=th
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=tr
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=uk
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=vi
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=zh-CN
Source: chromecache_176.39.dr	String found in binary or memory: https://discord.com/invite/privatecommunity?locale=zh-TW
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity5;
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunity?;
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityJ
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityV8
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunitya:v(#
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityi&zs
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityo
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityt
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityu:B(%
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/privatecommunityy
Source: chromecache_176.39.dr	String found in binary or memory: https://discordapp.com
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/ace
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://keyauth.win/api/1.1/og5
Source: LDlanZur0i.exe, 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://keyauth.win/api/1.2/
Source: chromecache_159.39.dr, chromecache_189.39.dr	String found in binary or memory: https://support.discord.com/hc/en-us/articles/4410339366295-Paid-Services-Terms).
Source: chromecache_159.39.dr, chromecache_189.39.dr	String found in binary or memory: https://twitter.com/discord).

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.5:443 -> 192.168.2.10:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.10:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.10:50116 version: TLS 1.2

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A924CE70 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7A924CE70

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A92189B0	0_2_00007FF7A92189B0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A92169B0	0_2_00007FF7A92169B0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9217CF0	0_2_00007FF7A9217CF0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9229F6D	0_2_00007FF7A9229F6D
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9201560	0_2_00007FF7A9201560
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A921F5C0	0_2_00007FF7A921F5C0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9234A20	0_2_00007FF7A9234A20
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9245B00	0_2_00007FF7A9245B00
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A92089C0	0_2_00007FF7A92089C0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A91FAC2D	0_2_00007FF7A91FAC2D
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9227CF0	0_2_00007FF7A9227CF0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A91FEBA0	0_2_00007FF7A91FEBA0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924CE70	0_2_00007FF7A924CE70
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924EEF0	0_2_00007FF7A924EEF0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A91FDE10	0_2_00007FF7A91FDE10
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A922A02C	0_2_00007FF7A922A02C
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A922A035	0_2_00007FF7A922A035
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A923D250	0_2_00007FF7A923D250
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A91FD280	0_2_00007FF7A91FD280
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9213360	0_2_00007FF7A9213360
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9225410	0_2_00007FF7A9225410
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9210630	0_2_00007FF7A9210630
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9239550	0_2_00007FF7A9239550
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A91F958D	0_2_00007FF7A91F958D
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A92405B0	0_2_00007FF7A92405B0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A922C600	0_2_00007FF7A922C600
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A92415E0	0_2_00007FF7A92415E0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9219870	0_2_00007FF7A9219870
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A92228C0	0_2_00007FF7A92228C0
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A91F976B	0_2_00007FF7A91F976B

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A9250266 appears 47 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A9218EB0 appears 35 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A921A440 appears 34 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A921A2D0 appears 37 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A9203060 appears 49 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A921A360 appears 33 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A9210270 appears 70 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A92159A0 appears 377 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A9215B20 appears 322 times
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: String function: 00007FF7A9218DE0 appears 46 times

Source: classification engine

Classification label: mal56.phis.winEXE@81/175@17/11

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A9201E7E FormatMessageA,strchr,_errno,_errno,GetLastError,SetLastError,

0_2_00007FF7A9201E7E

Source: C:\Users\user\Desktop\LDlanZur0i.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03

Source: LDlanZur0i.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LDlanZur0i.exe

ReversingLabs: Detection: 39%

Source: LDlanZur0i.exe

String found in binary or memory: iphlpapi.dllif_nametoindexkernel32LoadLibraryExA\/AddDllDirectory0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ(nil)(nil)I32I64%ld.%ld$@

Source: unknown	Process created: C:\Users\user\Desktop\LDlanZur0i.exe "C:\Users\user\Desktop\LDlanZur0i.exe"
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.37.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: LDlanZur0i.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: LDlanZur0i.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: LDlanZur0i.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: LDlanZur0i.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: LDlanZur0i.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: LDlanZur0i.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: LDlanZur0i.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: LDlanZur0i.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: LDlanZur0i.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Loader Valorant Plus\x64\Release\EpicGames.pdb source: LDlanZur0i.exe

Source: LDlanZur0i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: LDlanZur0i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: LDlanZur0i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: LDlanZur0i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: LDlanZur0i.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A92189B0 WSAStartup,WSACleanup,GetModuleHandleA,GetProcAddress,strpbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,GetSystemDirectoryA,LoadLibraryA,free,GetProcAddress,if_nametoindex,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoA,QueryPerformanceFrequency,

0_2_00007FF7A92189B0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro

Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\LDlanZur0i.exe

API coverage: 4.3 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}R
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h&zr
Source: LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D: %\|(

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A924FD7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7A924FD7C

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A9250118 memset,GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7A9250118

Source: C:\Users\user\Desktop\LDlanZur0i.exe

0_2_00007FF7A92189B0

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924FA24 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7A924FA24
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924FD7C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A924FD7C
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A924FF24 SetUnhandledExceptionFilter,	0_2_00007FF7A924FF24

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1	Jump to behavior
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerPro	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop HTTPDebuggerProSdk

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T	Jump to behavior

Source: C:\Users\user\Desktop\LDlanZur0i.exe

Code function: 0_2_00007FF7A924FF94 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7A924FF94

Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9224A90 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,memcmp,closesocket,closesocket,closesocket,closesocket,	0_2_00007FF7A9224A90
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9234A20 calloc,strchr,strncpy,strchr,strncpy,strchr,strtoul,strchr,strtoul,getsockname,WSAGetLastError,free,WSAGetLastError,memcpy,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,	0_2_00007FF7A9234A20
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A9217660 memset,strncmp,strncmp,strchr,htons,atoi,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	0_2_00007FF7A9217660
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A923B520 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7A923B520
Source: C:\Users\user\Desktop\LDlanZur0i.exe	Code function: 0_2_00007FF7A923B780 calloc,calloc,calloc,bind,WSAGetLastError,	0_2_00007FF7A923B780

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	4 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Extra Window Memory Injection	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LDlanZur0i.exe	39%	ReversingLabs	Win64.Trojan.Lazy
LDlanZur0i.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
discord.gg	162.159.136.234	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
keyauth.win	104.26.0.5	true	false	unknown
discord.com	162.159.138.232	true	false	unknown
cdn.discordapp.com	162.159.135.233	true	false	unknown
www.google.com	142.250.185.196	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://discord.com/assets/9017b7062734e72bb476.svg	false	unknown
https://discord.com/assets/5067a2ec1b24a6de868c.js	false	unknown
https://discord.com/assets/a5ec2b74d0cc337d4481.svg	false	unknown
https://discord.com/assets/ea8b2ed5e609f40e7f7b.js	false	unknown
https://discord.com/assets/23a7a3fd6624342117bf.svg	false	unknown
https://discord.com/assets/1f7f046253c197b5a419.js	false	unknown
https://discord.com/assets/5430e9964fe8364e084d.svg	false	unknown
https://discord.com/assets/ecff74bf4394e6e58dd1.woff2	false	unknown
https://discord.com/assets/d86788be99e870993214.js	false	unknown
https://discord.com/assets/1222195a37d6dd10994e.woff2	false	unknown
https://discord.gg/privatecommunity	false	unknown
https://discord.com/assets/af5116b1db004acbdb8b.svg	false	unknown
https://discord.com/assets/webMinimal.183cbc8427e6b143ce21.js	false	unknown
https://discord.com/assets/f5b8aa3411dfc24ff2e6.woff2	false	unknown
https://discord.com/assets/af6b8f380faee0e9f47d.js	false	unknown
https://discord.com/assets/c1b53be672aac192a996.woff2	false	unknown
https://discord.com/assets/sentry.d30fc24f50e5e3e76b3e.js	false	unknown
https://discord.com/assets/914a97ac83e173c66dd7.woff2	false	unknown
https://discord.com/assets/591980d24607547de30a.css	false	unknown
https://discord.com/api/v9/auth/location-metadata	false	unknown
https://discord.com/assets/8234e0a75aa9afb205bd.woff2	false	unknown
https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css	false	unknown
https://cdn.discordapp.com/icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64	false	unknown
https://discord.com/api/v9/science	false	unknown
https://discord.com/assets/b21c5111a12372139409.woff2	false	unknown
https://discord.com/assets/89b7ddebcacbe8dfbd3a.js	false	unknown
https://discord.com/assets/b8160243347055e1f278.js	false	unknown
https://a.nel.cloudflare.com/report/v4?s=CvsC9ZRhOS8bRjjmZdwAayb4QnglHbGE1wQQM1BQc8ydbfEArSh3OLDYqLQaAHNlpmOsMgXGEPFMm9gWCcysdcbePTei11X0LJbtjFzlLGet13DAE3YVnMTiXqe7	false	unknown
https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280	false	unknown
https://a.nel.cloudflare.com/report/v4?s=TYhwyRODXBsslD0FhDkacu6t1ShNc4EQntt%2B%2FUP2fkyphOQf27RUCi0Rj7qHXZgWs4DQWBbdsvb9ohqvto1Tpc1afHr4X4ZbSG%2BcuyfzEGNrbMJydf9oa3nH6oH6	false	unknown
https://discord.com/assets/2597d11c1e039607373e.svg	false	unknown
https://discord.com/assets/2917679ca8a08c390036.css	false	unknown
https://discord.com/assets/410a2166a48c9e482e2a.svg	false	unknown
https://discord.com/assets/94ec0c2b39908933eed3.js	false	unknown
https://discord.com/assets/a6f6204cd40c3c5f5c14.js	false	unknown
https://discord.com/assets/a14c32460cf87caa605c.js	false	unknown
https://discord.com/invite/privatecommunity	true	unknown
https://discord.com/assets/05bd1eb5dea5ee3387f4.js	false	unknown
https://discord.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?	false	unknown
https://discord.com/assets/0e5029fd9cd4812b6712.svg	false	unknown
https://discord.com/assets/8bd8143eff37936894aa.woff2	false	unknown
https://discord.com/assets/6df906184440a6461f5c.js	false	unknown
https://discord.com/assets/55ad931ed92a15c15709.js	false	unknown
https://discord.com/assets/452d7be36bf4b23241bd.woff2	false	unknown
https://discord.com/assets/d67c5e680608266a1f63.js	false	unknown
https://discord.com/assets/ab03f7053698d417194c.svg	false	unknown
https://discord.com/assets/fdc71c23d09e18e94ce2.js	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://twitter.com/discord).	chromecache_159.39.dr, chromecache_189.39.dr	false		unknown
http://185.101.104.122/plushvibronkz.exeC:	LDlanZur0i.exe	false		unknown
https://discordapp.com	chromecache_176.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=ko	chromecache_176.39.dr	true		unknown
https://discord.com/	chromecache_159.39.dr, chromecache_189.39.dr	false		unknown
https://keyauth.win/api/1.1/ace	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.haxx.se/docs/http-cookies.html#	LDlanZur0i.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=es-419	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ar	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ro	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ja	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=ru	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=bg	chromecache_176.39.dr	true		unknown
https://keyauth.win/api/1.1/og5	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keyauth.win/api/1.2/	LDlanZur0i.exe, 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmp	false		unknown
https://support.discord.com/hc/en-us/articles/4410339366295-Paid-Services-Terms).	chromecache_159.39.dr, chromecache_189.39.dr	false		unknown
https://discord.com	chromecache_176.39.dr	false		unknown
https://discord.com/invite/privatecommunity?locale=uk	chromecache_176.39.dr	true		unknown
https://discord.gg/privatecommunitya:v(#	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/invite/privatecommunity?locale=pt-BR	chromecache_176.39.dr	true		unknown
https://discord.com/blog/important-policy-updates)	chromecache_159.39.dr, chromecache_189.39.dr	false		unknown
http://185.101.104.122/plussemhvibronkz.exe	LDlanZur0i.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=el	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=th	chromecache_176.39.dr	true		unknown
http://185.101.104.122/plussemhvibronkz.exeC:	LDlanZur0i.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=cs	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=da	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=tr	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=zh-CN	chromecache_176.39.dr	true		unknown
https://discord.gg/privatecommunity5;	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityi&zs	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/invite/privatecommunity?locale=de	chromecache_176.39.dr	true		unknown
http://discord.gg/fortnite).	chromecache_159.39.dr, chromecache_189.39.dr	false		unknown
https://discord.gg/privatecommunityV8	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/invite/privatecommunity?locale=lt	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=en-GB	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=zh-TW	chromecache_176.39.dr	true		unknown
https://discord.gg/privatecommunityt	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityy	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C299000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.gg/privatecommunityo	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://curl.haxx.se/docs/http-cookies.html	LDlanZur0i.exe	false	URL Reputation: safe	unknown
https://discord.gg/privatecommunityu:B(%	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://discord.com/invite/privatecommunity?locale=en-US	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=vi	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=nl	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=fi	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=sv-SE	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=no	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=fr	chromecache_176.39.dr	true		unknown
https://discord.gg/privatecommunity?;	LDlanZur0i.exe, 00000000.00000002.1368030627.000002770C2C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.101.104.122/plushvibronkz.exe	LDlanZur0i.exe	false		unknown
https://discord.com/invite/privatecommunity?locale=es-ES	chromecache_176.39.dr	true		unknown
https://discord.com/invite/privatecommunity?locale=id	chromecache_176.39.dr	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.136.234	discord.gg	United States	13335	CLOUDFLARENETUS	false
162.159.138.232	discord.com	United States	13335	CLOUDFLARENETUS	false
104.26.0.5	keyauth.win	United States	13335	CLOUDFLARENETUS	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
162.159.135.232	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
162.159.134.233	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.10
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540862
Start date and time:	2024-10-24 09:15:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LDlanZur0i.exe renamed because original name is a hash value
Original Sample Name:	3b58529670cc2c98fb964a9a2c36fa9f.exe
Detection:	MAL
Classification:	mal56.phis.winEXE@81/175@17/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 43 Number of non-executed functions: 247
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.23.99, 142.250.186.174, 66.102.1.84, 34.104.35.123, 184.28.90.27, 2.19.126.163, 199.232.210.172, 172.217.18.106, 142.250.185.138, 142.250.186.42, 142.250.185.106, 142.250.181.234, 142.250.186.138, 142.250.184.234, 142.250.185.202, 142.250.185.170, 216.58.212.170, 216.58.206.42, 142.250.185.234, 172.217.23.106, 142.250.186.74, 142.250.185.74, 142.250.74.202, 142.250.185.195, 142.250.74.206
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LDlanZur0i.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.136.234	http://relay.csgoze520.com/	Get hash	malicious	Unknown	Browse
	https://hkdiscord.antsoon.com/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Python.Stealer.1210.4443.27895.exe	Get hash	malicious	Python Stealer, Discord Token Stealer	Browse
	http://www.cyclic.sh/pricing	Get hash	malicious	HTMLPhisher	Browse
	bang_executor.exe	Get hash	malicious	Dicrord Rat	Browse
	noway-2D8EB.exe	Get hash	malicious	Dicrord Rat	Browse
	SecuriteInfo.com.Exploit.Shell.29354.24275.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Exploit.Shell.29354.24275.exe	Get hash	malicious	Unknown	Browse
	1EdVSOmvh0.exe	Get hash	malicious	Dicrord Rat	Browse
	YEM2yTzOK9.exe	Get hash	malicious	Dicrord Rat	Browse
162.159.138.232	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse
	S_code_runner.ps1	Get hash	malicious	Unknown	Browse
	cr_asm3.ps1	Get hash	malicious	Unknown	Browse
	cr_asm.ps1	Get hash	malicious	Unknown	Browse
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse
	cr_asm_hiddenz.ps1	Get hash	malicious	AsyncRAT, XWorm	Browse
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse
104.26.0.5	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.16492.21964.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	570ZenR882.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	570ZenR882.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	Ff0ZjqSI9Y.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	Y41oVdYohe.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	webhook.ps1	Get hash	malicious	Unknown	Browse	162.159.137.232
	S_code_runner.ps1	Get hash	malicious	Unknown	Browse	162.159.138.232
keyauth.win	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7613.15918.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.31663.10814.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.Win64.MalwareX-gen.27133.15456.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.7443.30781.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Win64.MalwareX-gen.11163.24254.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	SecuriteInfo.com.FileRepMalware.12632.12594.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
discord.gg	SecuriteInfo.com.Win64.MalwareX-gen.18133.14409.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.135.234
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse	162.159.134.234
	SecuriteInfo.com.Win64.Evo-gen.30154.6249.exe	Get hash	malicious	Unknown	Browse	162.159.134.234
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	U7TJ7Rq13y.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.133.234
	Sv6eQZzG0Z.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	162.159.135.234
	https://bafybeihwopeeamsw6gk3vbg3wbftvt3n2qngbzo5a4hlnpvlv4hc3vvmyy.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.136.234
	http://bafybeid2klgyiphng6ifws5s35aor57wfi3so6koe2w4ggoacn6gqghegm.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	162.159.135.234
cdn.discordapp.com	FvmhkYIi5P.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	FvmhkYIi5P.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	https://cdn.discordapp.com/attachments/1238968627324125338/1296061386824093747/shortlist.zip?ex=6710eaba&is=670f993a&hm=26822365df14863bfea627ad912a327a69fb54ae8b0d7ba1003822b35800c605&	Get hash	malicious	Unknown	Browse	162.159.129.233
	https://cdn.discordapp.com/attachments/1238968627324125338/1296061386824093747/shortlist.zip?ex=6710eaba&is=670f993a&hm=26822365df14863bfea627ad912a327a69fb54ae8b0d7ba1003822b35800c605&	Get hash	malicious	Unknown	Browse	162.159.130.233
	asegurar.vbs	Get hash	malicious	Unknown	Browse	162.159.129.233
	SecuriteInfo.com.Win64.MalwareX-gen.20317.810.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	SecuriteInfo.com.Win64.Evo-gen.30154.6249.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	asegurar.vbs	Get hash	malicious	Unknown	Browse	162.159.129.233
	https://buxb0t.github.io/https-www.instagram.com-reel-CtFCB1_MvyH-	Get hash	malicious	HTMLPhisher	Browse	162.159.135.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
CLOUDFLARENETUS	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbPPsSPtBC4KXSPVJqWhtiFImaGOc8X-2FzF8FDlXshHtRJ6TIRZ6EeMzJLIlgf-2Fs2kSJOxf8XTG62Elbh9rqy-2FQ2QNZGXB54Mkq5upaOHB9GHJaF-2B3b4F-2FMyEt0RGHLDpLKRhLl9mxjPD0y5Swi37OTA-3DOBST_mhsMQQwIM9hexyWqOlUPbBh1Ydv5cYoDRZfJchLEEeKy4ZjgP9CBDSdvgDFEefqBVXHw4Mv6KQHsP3gT468tApWXvWK-2FeXhqGfYYlnX46U5WmntG47XCU85W-2B7YcCKnv6RkyD-2BGsL6eKQti9UGCTMQ9mNlYRCUnfVenBdKFDHBLCSg5nmfwfVylxfV1LsL0vuEyDgr8SC57Mq-2BhfexPfdy0Rg72muov-2F70SqaHW8j0XfAmx9zQy8hYRRlnIIGbyzjoQcdYcq0btsMQpdS6jNo-2BNvozXopiqu0Jz-2B-2B25Gyoj-2FyIelIDkNiGA84aUyGyfbMNmoNmmLB38ufi9uQKhxSQ-3D-3D	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	MV EAGLE EYE RFQ-92008882920-PDF.vbs	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	https://t.co/yXelyYqHRk	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	http://jedox-couriers.com/5g/domain.php/domain..html?#infoland@hdel.co.kr	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
	https://linkednnn.weebly.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 13.107.246.60 173.222.162.55
3b5074b1b5d032e5620f69f9f700ff0e	4aOgNkVU5z.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	xVmySfWfcW.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	dGuXzI4UlT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	vjlICWbvGT.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.0.5
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.26.0.5
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.0.5
	scan_doc20241024.vbs	Get hash	malicious	Remcos	Browse	104.26.0.5
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.0.5
	FedEx Shipping Document_pdf.html	Get hash	malicious	Unknown	Browse	104.26.0.5

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9828506517747595
Encrypted:	false
SSDEEP:	48:82VbdNjTQKfHeidAKZdA1uehwiZUklqehTy+3:82J0KXsy
MD5:	C717AF857E3931D5D8BA6DF36A6E856B
SHA1:	8376D0B1EC74F34632C94AE9687D1B5BDDFA3FB2
SHA-256:	E9D63829CC236F876B9A722484829278B37A256D1343E311C0185CF2523AA517
SHA-512:	06ABC9D266D080C0EF6B4DEFD3B513C5FCA4C08E421F4C56D2758E3599F6915B10C6A1E72FB5DEF582F809B84E2528E88EACCAE7AAFD8C09E33DC139F80142EE
Malicious:	false
Preview:	L..................F.@.. ...$+.,........%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXY.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXY.:....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXY.:...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.:....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............b......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9990682676730365
Encrypted:	false
SSDEEP:	48:8qVbdNjTQKfHeidAKZdA1Heh/iZUkAQkqehcy+2:8qJ0KR9Qxy
MD5:	112CBCA0BD929F2BDE0160A2EE356BB9
SHA1:	B3914873A2D44C515A1FCF430AF8FD0823BBF939
SHA-256:	C1347B8911121D445C439C7316A772E885BF66D541F80BCA496493B88AD10F9B
SHA-512:	5F22887A59B572D5E00088D401213CFEE0D6AB72A96EDD1F72026278BD1A81B695D978FF37C382A5C6738D6B6B76FEA7F66911A2240AD614A1C9C994B47376EB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....@...%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXY.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXY.:....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXY.:...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.:....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............b......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006846039161895
Encrypted:	false
SSDEEP:	48:8FVbdNjTQbHeidAKZdA149eh7sFiZUkmgqeh7s6y+BX:8FJ0xnoy
MD5:	672CBDDFE629ADC63CC0A5B4B1D041E9
SHA1:	8CCE7EBAA5EA2B7AEC345C800D74E8C12BC17F7C
SHA-256:	0C93C59CBFFCEE544200126CB28EDFF9EF074832DD90C4DCC425EDBEC2D117AB
SHA-512:	0DA6DDAA9313FB6DAD9ABDF7A9B1408B4C21864BA5A416D66C46BD52434A07D7165C7A1D9D2B25B065FDE14B308F401C15E25EBDD79A7641CF3B8D928EA1645C
Malicious:	false
Preview:	L..................F.@.. ...$+.,....K..r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXY.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXY.:....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXY.:...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.L....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............b......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9952740639904647
Encrypted:	false
SSDEEP:	48:8H/VbdNjTQKfHeidAKZdA14ehDiZUkwqehQy+R:8H/J0Kiiy
MD5:	7EECACF42D0B0F7BF03F3E23B2E3A1FA
SHA1:	DD556818DF881BCB0B96B80AA685E37E166E7140
SHA-256:	AA3D46FFA2FE8BF5DAA04EE1AFA14B5D6366B9977EC1FF9782A003492AC044ED
SHA-512:	038B4392006590DC53A82C84620E41550FE29511C4D1CF0C2ADEE787E0D385D5C476CFE849E1E4E373B0BDAE7FA9F6D35B5F076CC1F1B76C51B75A28CB9500BB
Malicious:	false
Preview:	L..................F.@.. ...$+.,........%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXY.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXY.:....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXY.:...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.:....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............b......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985999375171583
Encrypted:	false
SSDEEP:	48:8u/VbdNjTQKfHeidAKZdA1mehBiZUk1W1qehWy+C:80J0KC92y
MD5:	4C559C6999DA0138769BCBED6B63EC1F
SHA1:	69556EBFA3430A099B78B7051419EAEF2B1B1D9E
SHA-256:	E1508AB1B5BC5D8586A837F94B7EF599895D62FCF4C5626D1CCF633C28DA7AC4
SHA-512:	B3F99157F1342704C2138F8150AF201E9A5A68665BB85DF38634A1B50D2AE45D70DA15C361EF68CFC008AA8654F777FD19DED88BB30C11AF2253370CE4307A1E
Malicious:	false
Preview:	L..................F.@.. ...$+.,........%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXY.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXY.:....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXY.:...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.:....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............b......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 06:16:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9954109584166653
Encrypted:	false
SSDEEP:	48:8mVbdNjTQKfHeidAKZdA1duT1ehOuTbbiZUk5OjqehOuTboy+yT+:8mJ0KJTyTbxWOvTboy7T
MD5:	4D1381FD36C73060A61A31F1B109D1AF
SHA1:	63DE7C3945CBFE321B685C0C3E6B8B268B67AC38
SHA-256:	E372E1F1A4CE3B429BD7685614C792806AC709DA0204FA1753D48E7553E97A65
SHA-512:	D99F839A7F7E5F3F1DE76574DCDE8F1856DA468CE1B7CE59414E7AA005A14FCEB4D676E162975278B669D531B10D6255D031C2982E1DD4B1551FC2B9D409F138
Malicious:	false
Preview:	L..................F.@.. ...$+.,........%......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IXY.:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY.:....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VXY.:....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VXY.:...........................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VXY.:....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............b......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	87973
Entropy (8bit):	5.125806607183933
Encrypted:	false
SSDEEP:	1536:f0kGwo/3g1MGEN6UCSQyYHhU58xxfrDX/5CF+gD58G3LpV9H5B7va:f0kGDZc
MD5:	E05640582E20F17E0F1797160B67DCD4
SHA1:	DCB27383F5836437E5433C7CCB5981E94826EE00
SHA-256:	E9DEEBCC271633C282AB3FE440CE81A196ECE4F402804FE8940030F98C563475
SHA-512:	60CDDA59E85FDED81B351614DAF3D40B30F939F7F8D9B586F516165699822E8F07F344CDD3709DCF6ADA350C725330DF26B6947322F154AB54D02C5AF3AAD71B
Malicious:	false
URL:	https://discord.com/assets/b9995525a52dc58aecf5.svg
Preview:	<svg width="1440" height="900" viewBox="0 0 1440 900" preserveAspectRatio="xMinYMin slice" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)"><path d="M1440 0H0v900h1440V0Z" fill="url(#c)"/><path d="M1440 0H435.551v620.81H1440V0Z" fill="url(#d)"/><path d="M1440 341.601H484.351v558.38H1440v-558.38Z" fill="url(#e)"/><path d="M1440 0H427.5v690.995H1440V0Z" fill="url(#f)"/><path d="M787.663 810.02c330.987-141.179 530.547-416.834 445.727-615.692C1148.57-4.53 811.492-51.288 480.502 89.891 149.512 231.07-50.048 506.725 34.772 705.583c84.821 198.858 421.901 245.616 752.891 104.437Z" fill="url(#g)"/><path d="M1024.18 825.565c290.6-123.952 456.96-386.723 371.57-586.916-85.39-200.193-390.19-261.999-680.792-138.047-290.602 123.952-456.959 386.724-371.569 586.917 85.389 200.193 390.19 261.998 680.791 138.046Z" fill="url(#h)"/><path d="M673.907 771.815c264.238-112.707 429.363-319.136 368.823-461.073-60.538-141.936-323.823-165.631-588.061-52.924C190.431 370.5

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3146
Entropy (8bit):	4.484082045212369
Encrypted:	false
SSDEEP:	48:C4LO/K7oWBkomgBkRzd0kJBJkI8JkINGD/dYk2kahkzd/FnLgkpmZ5ZOE83VCn:RO/IS53JBJbKbN4WQbMRZmEAI
MD5:	81084FF5A27B6E6FF487E479C37D1660
SHA1:	81A274F69A1358F85715A0FEA227730D795CB353
SHA-256:	075DE1D6EA4FB470197A88BA371F60F70B819B250CB5AF8BD6A4794B1A9CA4A1
SHA-512:	CCCD00A5C013B130BE0A8466F903F7EEE9306518DFAA8758849027EBC1829EA2A6B7516E4D2070B110A12EC7EB559E3B75D256AD1B07BE3FD8595C0E430DC0D5
Malicious:	false
URL:	https://discord.com/assets/ba88bbd1342d3f000e33.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19">. <defs>. <style>. .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225}. </style>. </defs>. <g id=".._2" data-name=".. 2">. <g id="Layer_1" data-name="Layer 1">. <path class="cls-1" d="M89.59 19.89 84.93 8.38a5.51 5.51 0 0 0-7.19-3l-5.67 2.25A12.42 12.42 0 0 0 56 .91L45.48 5.16c-1.84 4.11-5.48 9.72-11.59 9.52a8.55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3.04-7.19ZM11.65 52.94a2.76 2.76 0 0 1-3.59-1.52l-3.63-9A2.76 2.76 0 0 1 6 38.87l4-1.65 5.69 14.07ZM22.33 39.6a3.72 3.72 0 1 1 2.06-4.85 3.71 3.71 0 0 1-2.06 4.85Zm33.36-1.55-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2058
Entropy (8bit):	4.614306214221163
Encrypted:	false
SSDEEP:	48:CVHe7HtOty0VulV1/8CXP0Cjek7aj4clug9ai:iANEyxx8UPTXaj4cogIi
MD5:	E1349377226366F95F85AB9EAC4586D3
SHA1:	9A3A00B6E6AB0A240363F4E4DB2F5288227FF76B
SHA-256:	2CA673A9914A35A230469A8A0FD6B4DB293B236DEA391633B53339AFE577A92E
SHA-512:	7C16967D1960CDE4914F71B6FE347A7764AAED42366A87920597D225F3874B5B34A00C5089564BEBF0A919C419049DB99B27128CC81BC28A1492460FD199F9E7
Malicious:	false
URL:	https://discord.com/assets/a5ec2b74d0cc337d4481.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve">. <defs>. <clipPath id="a" clipPathUnits="userSpaceOnUse">. <path d="M0 36h36V0H0v36Z"/>. </clipPath>. <mask id="b">. <g>. <rect x="0" y="0" width="100" height="100" fill="white" />. <path d="M11.708 29.849a1.296 1.296 0 1 0-2.591-.001 1.296 1.296 0 0 0 2.591 0" fill="black"/>. </g>. </mask>. </defs>. <g>. <g>. <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)">. <g>. <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.504 31.474 6 26.459 6h-15.71C6.607 6 3.727 13.224 6.75 17.438c0 0 4.5 3.5 6 .812" fill="white"/>. </g>. <g>. <path d="M13.008 17.864C8.02 10.927 6.968 6 10.75 6c-4.142 0-6.577 6.187-4.468 11.031.463 1.064 1.758 2.492 1.758 2.492l4.18.008c.162-.32.598-1.366.79-1.667" fill="white"/>. </g>. <g>. <path d

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13325)
Category:	dropped
Size (bytes):	13374
Entropy (8bit):	5.33229367944175
Encrypted:	false
SSDEEP:	192:c9jPMDYeG0dPbPDjzw4WDhiElYrskCLdHWQBC7dr1m+8LBpDtOnyUotvLfQE2u:c9jPMRLjZ0usbxwdr1QBpDtOy3JT
MD5:	D0C788B157FF96A2DD902C97BFC889F6
SHA1:	6CDE0BD611B34B15CA15437CA5AC4F77DE01ADA8
SHA-256:	05A00FBAFFC4A7254C9B631FF0E81BE546DC275BE1D6F992C36849222D0B73F7
SHA-512:	170615E3DE829D517662BE32C762B76B013163FA040C2EEDF89C865A9CEE1CEEDA7EE305BE27CD3A724832571A94B5A26FB3BB9D9A1D1C5386081F206A1E1436
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){var e=r(622281),o=String,i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not an object")}},953326:function(t,n,r){var e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},332916:function(t,n,r){var e=r(581031),o=e({}.toString),i=e("".slice);t.exports=function(t){return i(o(t),8,-1)}},381740:function(t,n,r){var e=r(740362),o=r(666061),i=r(347722),u=r(97131);t.exports=function(t,n,r){for(var c=o(n),f=u.f,a=i.f,s=0;s<c.length;s++){var p=c[s];!e(t,p)&&!(r&&e(r,p))&&f(t,p,a(n,p))}}},251069:function(t,n,r){var e=r

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	1066
Entropy (8bit):	7.8048030316845365
Encrypted:	false
SSDEEP:	24:w0Hm4yTnGeVfIFHU9HFbYMdL36oSMkKwzSwgvyQfpbfzu:w0Hm4AxWFHYeMZ36oSMS2wgpnu
MD5:	BD7895F71FAD6D9263981408ECCB3EF2
SHA1:	0DECC92425C58B121B6117B90EBFC89DE7397B8C
SHA-256:	927248AC3A7C831DC3DB7E45CEA4A7112F5BA02309227DDE46454F07CF773DB8
SHA-512:	CE7EBDA208426FBFC7E1A3F00ADD50A3944543385D6D2F0F29C1ABFB1653A1C8539D32C8C41FCA0BA6D71F9C65E09D21C6ADE661CD3719D5E7FF4A372FF0A32F
Malicious:	false
URL:	https://cdn.discordapp.com/icons/1230227842877620359/a_75aa56a5faded73ac41ce0fac1e7d74c.webp?size=64
Preview:	RIFF"...WEBPVP8 .........@.@.>m..F$"..0......l....z..0?K.w....y.s..............S.?......h.....2>......j..{+....`...D. .........&...!..5w.8.S..VH.:b...-l..A_.......NVl0e..t..Q4hl..tCv...cB.&H......0`.>.]..(.n<6L]u.....M...%WN...>.......".../a .7FT.X..-.:....?.6Z[oO=^.==.).............y...Cn.}..0.fh.3.a....=k....O.^J4'..W."W....'...0.3.~.H..=....CT..W.kTVm.1.D.Rx6@.J..<.]~{4..h....u.42P........6vk.S...eF..fL..!..t0zO..h..Z....B....t.e..w:.......)...._.`E..-r..'"O.D..N.e.u..vp@...dd.............H.$.C.........c...ay.....I,c.2i..a.s.H...&..<:.3..!../..............?...rb"..9..r.q..g.{..E.A.].Rk.y..p[%..m.E]._m.........\....."<S.?......^........qU...L......4LE.q...?......E.n.p%5.54...f....5...g]...'...O....S.>+..DM4o.=.=.....[..5b..9...?y..cF.b...1..+.y...o.}.......>T=..........I....uc........^.....yT0...=#..i{....i..M1;...i.....g...3...g.~.].;.....0.Na......0.F....G.....&.[.+..>\|...9=..P......I.A.R.bT....8...C^q.N.....e;[..bm.{}.[P.y...

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24565
Entropy (8bit):	6.000976601202208
Encrypted:	false
SSDEEP:	384:xakxHbO0x9ipfSEuH44B445H44Q544Aq44Q4P44ZF944Q4Q4424Qb444nxWl444p:xZxH5ripqEuH44B445H44Q544Aq44Q4+
MD5:	EC2C34CADD4B5F4594415127380A85E6
SHA1:	E7E129270DA0153510EF04A148D08702B980B679
SHA-256:	128E20B3B15C65DD470CB9D0DC8FE10E2FF9F72FAC99EE621B01A391EF6B81C7
SHA-512:	C1997779FF5D0F74A7FBB359606DAB83439C143FBDB52025495BDC3A7CB87188085EAF12CC434CBF63B3F8DA5417C8A03F2E64F751C0A63508E4412EA4E7425C
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V......... ..$...:..(....... ..... ..........................................dX2.dX..dW..dW..dX..dX..dX..dX2.........................dW..dW..dX..eX..eX..eX..eX..eX..eX..dW..dW..dW..............dW..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........dW..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW......dX2.dW..eX..eX..\|q......eX..eX..eX..eX......\|q..eX..eX..eX..eX2.dW..eX..eX..........................................eX..eX..eW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..............eX..........eX..............eX..eX..dW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..~s..................................~s..eX..eX..dW..dW..eX..eX..eX..................................eX..eX..eX..dW..dX2.eX..eX..eX..h[..........{p..{p..........h[..eX..eX..dW..eW2.....dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........eX..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..e

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21762)
Category:	dropped
Size (bytes):	21811
Entropy (8bit):	5.462655463719556
Encrypted:	false
SSDEEP:	384:f1bjtqrVapZjquHCWnJcJhcby8XziQBy6HUKVMov5hHKs80K:JjtOVaJDnJcPc+EWQ8EM65RR8l
MD5:	0FBB77D1B69F18DF0FDCF836DE1C4106
SHA1:	E8CE4037B97732809F1E1BF24992959C678F2118
SHA-256:	279E49A00A41A18545CF319B5A8B571FD48CFCC4B78A361BBE75A33CE7A4F71A
SHA-512:	F73E3B25561D0D3307C7DD9D505F84101897CFA70737D757AED8D95BDC6A2CE116FD114674DD0BBE666AABE2176B0EEF150A5D4EE2C7C3CCE815A5CA73215D03
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r,n){var e=n(838957),o=TypeError;t.exports=function(t,r){if(e(r,t))return t;throw o("Incorrect invocation")}},212036:function(t){t.exports="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),x=n(641236),b=n(457507),T=n(644659),E=T.enforce,I=T.get,R=a.Int8Array,m=R&&R.prototype,O=a.Uint8ClampedArray,M=O&&O.prototype,F=R&&A(R),U=m&&A(m),_=Object.prototype,L=a.TypeError,B=x("toStringTag"),C=b("TYPED_ARRAY_TAG"),S="TypedArrayConstructor",P=u&&!!w&&"Opera"!==p(a.opera),V=!1,N={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,U

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12394)
Category:	downloaded
Size (bytes):	12443
Entropy (8bit):	5.622820681358379
Encrypted:	false
SSDEEP:	192:KO87cE+wCFgcmzFFLiMx+vomnNST2kYLAZVeOhRido3ARvVppn8pZl:KO6cE+wCFgFLGvomNSBYL1eROY
MD5:	1FB8462302F6FBB9323F187505F5393F
SHA1:	B1FE31671174AA0BC7DFBFCC942AEFBFCBDB55BA
SHA-256:	CBFC3F32A1493FB38FD92BE4BC61035CB4948B6CF91AE5CC0038006AC753EA98
SHA-512:	22B96DA64E536EE01CDC30946AF83FCA8BF939A41443C8E9F7E7D296388FC94E3BED12E1FCE20B7E5E31E7611B1DC4CE235DBD1B3B61CC4A6F77350749C86BFF
Malicious:	false
URL:	https://discord.com/assets/a14c32460cf87caa605c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width='66' height='38' style='fill: rgb(0, 0, 0); stroke: rgb(0, 0, 0);'%3E%3C/rect%3E%3C/svg%3E"},850259:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.779 31.864 192.122 31.864 L 68.122 31.864 C 66.465 31.864 65.122 30.521 65.122 28.864 L 65.122 14.864 C 65.122 13.207 66.465 11.864 68.122 11.864 Z M 68.122 35.864 L 262.122 35.864 C 263.779 35.864 265.122 37.207 265.122 38.864 L 265.122 48.864 C 265.122 50.521 263.779 51.864 262.122 51.864 L 68.122 51.864 C 66.465 51.864 65.122 50.521 6

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	168789
Entropy (8bit):	5.612789333447181
Encrypted:	false
SSDEEP:	1536:lvVvKVPI1oqgO/usjA1vkY0JCxf7UG/9rHUQNbsbkb5a05VGOEc2+hzuy6fvxO7a:uVPIgPvEc7N/9rNhbYy6w7XvXcZ
MD5:	3B74671903D935A08DC04ACEF440C188
SHA1:	7B2C8D8AE72E5E2DA1BA4440722810565E11084C
SHA-256:	4AC4D0F31456B9D1741A52E5C54089952219E0C2287D83B81F12C94468DB3B03
SHA-512:	7F465558B1D640EEC9639921A70C0C0A9AE8BD7F95D0EE098B0553A7B84C5B983A9140FA48C45453FD8E39FAB7188000A2A0628300C4CEF9FE3F2742C20F1C62
Malicious:	false
URL:	https://discord.com/assets/bd0ab83c61025d7c7000.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.svg"},806848:function(e){e.exports="/assets/6183fdc13d8046fd5bda.svg"},512266:function(e){e.exports="/assets/a2d51a24d014f52f83a6.png"},105020:function(e){e.exports="/assets/89ea0e62d0f8ffa67a17.svg"},211095:function(e){e.exports="/assets/86755fd1deda5cb45518.svg"},640356:function(e){e.exports="/assets/3880dc73d6be9d91ef36.svg"},515695:function(e){e.exports="/assets/450a761db3bfe89ca9b9.png"},892235:function(e){e.exports="/assets/48f03d965f1e82275006.svg"},375673:function(e){e.exports="/assets/3cf7f333e815240d3294.svg"},73962:function(e){e.exports="/assets/ed7318a94c14ce41d11d.svg"},689411:function(e){e.exports="/assets/831c999494cb5e095eae.svg"},2984:function(e){e.exports="/assets/0e5029fd9cd4812b6712.svg"},575703:function(e){e.exports=

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20669)
Category:	dropped
Size (bytes):	20718
Entropy (8bit):	5.5874718820742
Encrypted:	false
SSDEEP:	384:C4bQLjJHzjDcPDvYcJG9SAcksEi4aim6pvnVETji:DbQtjorYqG9e426PEa
MD5:	A2754ACCDA171158F8F581AD49DFBB9C
SHA1:	F619D690525B7ECA8BF70B9C24CBC58A3E092F1F
SHA-256:	606458816E822D1D0904C62D1E90C1595419CD92377055C63812BA63E00C3CDB
SHA-512:	F752422F8DE3B430832E43758F4C117D0D1FFB863CEDB95AA354635CC82DCC73F1371DA51626FFD76345D600970338DA4A2CD8F10739445C0123D990BD732CD5
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];r.Z.dispatch({type:"GIFT_CODE_RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.jr)(i.sku_id)}catch(e){}return r.Z.dispatch({type:"GIFT_CODE_RESOLVE_SUCCESS",giftCode:i}),{giftCode:i}}catch(t){throw r.Z.dispatch({type:"GIFT_CODE_RESOLVE_FAILURE",code:e,error:t}),t}}i=n(775644).Z,t.Z={resolveGiftCode:E,async fetchUserGiftCodesForSKU(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;r.Z.dispatch

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.7861988241054
Encrypted:	false
SSDEEP:	3:t6WH7W+IjSKcvUVYEo0LvDmJS4RKb5KVErcHNDPqdcJqGrqL0:t6AbzUOC3mc4slmNDiiAe
MD5:	7D883BA72B5DBC0229F5D1980205EE34
SHA1:	678BDA23DF97E8B9C3B15E71C41E7B215D043F22
SHA-256:	53A0F1F10860A6E4CF9BD3B4949C5DDE68888DBC96BA0DA1020C5958EFC214A5
SHA-512:	E040F62517C951A0AB2ABC5038F22456E5862166E2A2346345464B9C4B63271CFBD1220BB14D2C39D7FACFD008848ACE682420F1EFE9F4F29265D7177A3C7E16
Malicious:	false
Preview:	<svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	dropped
Size (bytes):	2750
Entropy (8bit):	5.460366645013334
Encrypted:	false
SSDEEP:	48:F0fzk02vWrc1AKTMSTEcr9rTOLBsmPBo/6XgpdgwrIsi5dEk+MQwq2kWkGRv6hvr:ek02hfMXcKs+lXyisi5CkiPrWk+Ch/Ew
MD5:	390A7AB1F964AA8CB1B87DD13732C3BC
SHA1:	CEA52AC6FA0CDF49A18D51C8CD8A5C4FB52DEAC9
SHA-256:	BEDD382930BA4E10DFA902BF833195911F82E754223441446E9D7CC45B01110F
SHA-512:	4B799488E35C5B933E9B1BA6AB335E2EAD6D625D3DC1FEC19DD80F48B9B7996171BEC24513095F3F1BAA9C8B7675FA4E527B763AEED26B69273BF2DCED014D3F
Malicious:	false
Preview:	(()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VERY_HARDCORE=5]="VERY_HARDCORE";let u={0:"NONE",4:"NONE",1:"CASUAL",2:"CASUAL",3:"COMPETITIVE",5:"COMPETITIVE"}},945124:function(t,r,n){n.d(r,{y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array.from(r.traits).filter(r=>t.traits.includes(r)).length),n}},866762:function(t,r,n){n(312677);var e=n(945124);self.addEventListener("message",t=>{var r,n;let{data:{unsortedClans:i,id:u,criteria:o}}=t;let a=(r=i,n=o,r.map(t=>({...t,affinity:(0,e.y)(t,n)})).sort((t,r)=>{var i,u;let o=null!==(i=r.affinity)&&void 0!==i?i:(0,e.y)(r,n);return o-

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	85
Entropy (8bit):	4.551717768643883
Encrypted:	false
SSDEEP:	3:YIzRNgQCWYFHAM0EoM2dX/gQcMJcgwU:YIlNgXWYv0ER2dZTt
MD5:	3FD9422F62CE6B5FD0788A2D4CD0D3CF
SHA1:	C620C11AE0A45A2C50B09B933A392BECACD71332
SHA-256:	D8984222943F079A0EB7A24CF6A904F23275AC4F1E27E3C05D10556F210009DB
SHA-512:	2C00BC4399703F2A1C8DDAA6B9D78A6F2E0B4FC1FDCD95291AE7969A0E3A9D41486A0E7DB57B18BD8454E8337DED6EDCA8A64F13B531A8FB649C45AE4C734AD0
Malicious:	false
URL:	https://discord.com/api/v9/auth/location-metadata
Preview:	{"message":"The resource is being rate limited.","retry_after":4.659,"global":false}.

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1108
Entropy (8bit):	5.359578028959659
Encrypted:	false
SSDEEP:	24:Y74WU4bejvfkjyDEfXgAh/4ACjsY384W9iiex4grjh:Y741gerKyDEfbftY384Swx4UN
MD5:	E2CD13D6C4B1EF7E464FD22FBC18BA56
SHA1:	478AC70BFFF328092BC4A88898AD5ECB7232AB23
SHA-256:	B48B77DEC8C7D5A0953A7F8F06E363884387239A5A3BF9B9BD63945B68FE3A2B
SHA-512:	53F927063C760D199A8A11733AF3CB821C53BEF30EFAF4D113970CDE2AA6791E1FBED06EB947A707CC4316CAFA799CAE1B88A00280C05C6AE89BBF48C3B84A4C
Malicious:	false
URL:	https://discord.com/api/v9/invites/privatecommunity?with_counts=true&with_expiration=true
Preview:	{"type":0,"code":"privatecommunity","expires_at":null,"guild":{"id":"1230227842877620359","name":"\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\udc15\ud835\udc00\ud835\udc13\ud835\udc04 \ud835\udc12\ud835\udc13\ud835\udc0e\ud835\udc11\ud835\udc04 \ud83d\udd10","splash":"04b58b5d8c863962ccdac305e5ee1269","banner":"0ada4913f44d405e7a85ad7d492c34fd","description":null,"icon":"a_75aa56a5faded73ac41ce0fac1e7d74c","features":["BANNER","PRIVATE_THREADS","ROLE_ICONS","THREE_DAY_THREAD_ARCHIVE","MEMBER_PROFILES","ENABLED_MODERATION_EXPERIENCE_FOR_NON_COMMUNITY","ANIMATED_BANNER","SOUNDBOARD","COMMUNITY","ANIMATED_ICON","NEWS","INVITE_SPLASH","VANITY_URL","SEVEN_DAY_THREAD_ARCHIVE"],"verification_level":4,"vanity_url_code":"privatecommunity","nsfw_level":0,"nsfw":false,"premium_subscription_count":56},"guild_id":"1230227842877620359","channel":{"id":"1230229306408697856","type":0,"name":"\ud83c\udf10\u30fb\ud835\udc12\ud835\udc08\ud835\udc13\ud835\udc04-\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\ud

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39424, version 2.66
Category:	downloaded
Size (bytes):	39424
Entropy (8bit):	7.995696618521677
Encrypted:	true
SSDEEP:	768:RtWd6RsrMjeX+oUMPzo4niAVyynUFTyEatQHzV2h2TzpLJD5JoswdZB:/y6RsbDRzookyncNMQHzAALRovL
MD5:	7F63813838E283AEA62F1A68EF1732C2
SHA1:	C855806CB7C3CC1D29546E3E6446732197E25E93
SHA-256:	440AD8B1449985479BC37265E9912BBF2BF56FE9FFD14709358A8E9C2D5F8E5B
SHA-512:	AAEA9683EB6C4A24107FC0576EB68E9002ADB0C58D3B2C88B3F78D833EB24CECDD9FF5C20DABE7438506A44913870A1254416E2C86EC9ACBBCC545BF40EA6D48
Malicious:	false
URL:	https://discord.com/assets/ecff74bf4394e6e58dd1.woff2
Preview:	wOF2..............\|`.......B..........................Z.. .`..P..B..W.....,..U.6.$..`..r.. ..n..F..5[.V...n.<..j.......n....G...T...asj...nV..W........L6.0...U+.....5.M3gx..j.Ic.&..- ...<"....r..N(B..0..2`..(TI0\|.N..n`..W..b....\|.gX....={...S\..C...J...._.RY..dR...\.>.Z...yG.F.9.i...vn..!F.U....1.-u.....Z.S...k....0\|..2.$D..<L..E.....H.p.....]..Lu.......t.2..Mq.B.+..r}.....&XBU/...T."..?U'T.2....\|J]...!....C2e.\I..PQ-+s.....5..G.?b.,`. )....s..A........)..z.".U.=....".M..m...c...HQs..Q...]..bE...8..d8.C233..p..l.&"C../%2R......s.$..@....1....J]U.....w..G0.....l..X......L.......z...)rD../...r.LC.T.$A. .. A.Y!.6...It....jG.t..w./...y.X..;......~_..[...^9'.B...#..Ol.....f....F.b....g?...x.-.....i.-Kx...U.k.JG..6.q:..1.a....?....f......m.....K3...4=UK....t...o..s.Dm.9.n./.._K..JSM...T...3.H........6"3...w..>.Kb.g..............F@..E.R.+%<G..U.\|6.....(S..MRt...zy.O..#P..........X.t.uj...s....#z..F...X..U.5.cT).Q...Y....pa.z.

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 187596, version 2.459
Category:	downloaded
Size (bytes):	187596
Entropy (8bit):	7.998767209907151
Encrypted:	true
SSDEEP:	3072:K0d28YLkf9Vu/DwPCe7XSk5tMaLtI70HVGkQdd7gOnhXfCdFJYC7Ofrgm6ME+y8L:vw8YLkf9Vu/DoXHtMaJI84kQn7gOd6d+
MD5:	E55012627A8F6E7203B72A8DE730C483
SHA1:	4C43B88403EC9C3053D74B4C502BCAF99F594C57
SHA-256:	8390503760C8F26556001A28E7D95E4A237A4780E7CEEEBF0853CE252FDE4BA8
SHA-512:	05BFB6311B7F78F8F85E43F3C9C87447138237B8897C68EFFA4C877509296F0A7252070F8BBA79C6561FF91C6759058F0DA5A10C1DB19C1FF0443FEE49BF62A5
Malicious:	false
URL:	https://discord.com/assets/914a97ac83e173c66dd7.woff2
Preview:	wOF2...............P...j..................................v.`..:..... ....6.$...@...D.. ......\..[.H........{....5....q..eH...Z...x.v..%U....6.~..9 ..Z..v6.(.L.....g.=l..d.....q4....................y..^~...i...LA.j...y "..@p.9.A...(.O,....B.X%O.J.....O.h.`.A..3.-.6.....I......30.Fs.....N.%h..~.8.7...(...Pkq.{...+..$..\k?^@.z>...3.....>r..W....3.nk..Oz.g.F!.v...!...m..".). .u`........._EU....d!...]#.`..}..KsP.]=.k..).N...DE....#Ae......h'..9.V.....N.6.....w....zA%A.. G.G.J1.@..{ym.....Cx......D+UE...:..x.\|r\|fG..0iX..31O/..\..\|...b-.&yIq..].".6].N..!u...5..hG.k..x.Z..Mr.6@2).t..v......T....2<XA.m.c..-....P.g;...H.p....v..0..:.nR.u.~........!..c..-!4..S.J1p....D...z..%......_..,.2..h....W..{..'A..(....9.<...z!B.&.B2....}.(.!$.{./.....K.v7...#..#~.u...b;....2.}0dV.$.y.?.=.....T%`..+........h.Gi\.S.2..G.Y.fp..h..`.9.I..D..G_.OU.<r.<.0.A}..J.2....i..b..4.....Z;..V:+....;......S!..............1..T....0.^bE..Z\|N}..<.....Y..O..>+.ss.y .......~....t...9$.m

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9310)
Category:	downloaded
Size (bytes):	9359
Entropy (8bit):	5.630050363226493
Encrypted:	false
SSDEEP:	192:fcLtSa9QY4Cg9OcfTp1tOxyoZA0ab0KPqO2Lk2mMATw2DxnE7LoT:6WCQdfTLteyoZA0ab0KPqO2Lp+w2DxEo
MD5:	52287A03A33104E4E3508B67501DB130
SHA1:	B131FDFAA0259B1226B6EDF3BF5820C60A25FCAB
SHA-256:	A690D620CF44F9CAEF92F4943B977D45EF082F2280D16B7D6EE3B76157812310
SHA-512:	F4C83E10C7FB93CAA7F0B183D49DEFC53D21B8CC7CABAAD79ED36974F53DF01F87D45CF3452F7F3C2BF86168D3DC488296C6EA57279B4A2CDC083A2747AD97BE
Malicious:	false
URL:	https://discord.com/assets/af6b8f380faee0e9f47d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signup:(t,e)=>u.Z.post({url:o.ANM.HUB_WAITLIST_SIGNUP,body:{email:t,school:e},trackedActionData:{event:r.NetworkActionNames.HUB_WAITLIST_SIGNUP,properties:t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SEND,body:{email:t,guild_id:n,allow_multiple_guilds:e,use_verification_code:!0},trackedActionData:{event:r.NetworkActionNames.HUB_EMAIL_VERIFY_SEND,properties:t=>{var e;let n=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.has_matching_guild;return(0,i.iG)({has_matching_guild:n})}}})).body,async verify(t){if(null!=t)try{var e;let n=awa

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	109613
Entropy (8bit):	5.4029332021931715
Encrypted:	false
SSDEEP:	1536:fCBKa1oPP8sGolumyOSsN5VYpLUBDL2QPidmHTRWisxpLAkF+d10J:qB9C81a5YpL5kl9sxpTa10J
MD5:	80F500D4D0495E5C74E9B92CBC26F088
SHA1:	A2C3F68D87AD8F793935FA7B8D05A0A2D635C4E0
SHA-256:	407002AD3FD8CF26EF02A802DD0D4DB7BFF395D8C22F5F8580CA6CE65A797238
SHA-512:	500C40BF257E7F4098B3B64CEDD49D8612FAF8B254CF496019C5B579C784A416F466C6BAC174B5317A663071E736C2DF82D22E6A7F88AF664BC421A974ABDF59
Malicious:	false
URL:	https://discord.com/assets/55ad931ed92a15c15709.js
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|(255&e.charCodeAt(++r))<<24))1540483477+(((t>>>16)1540483477&65535)<<16),t^=t>>>24,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)^(t=(65535&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16),((o^=o>>>15)>>>0).toString(36)}},230371:function(e,t){"use strict";t.Z=function(e){var t={};return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}},184826:function(e,t){"use strict";t.Z=function(e){function t(e,t,o){var r=t.trim().split(h);t=r;var i=r.length,a=e.length;switch(a){case

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x540, components 3
Category:	downloaded
Size (bytes):	33094
Entropy (8bit):	7.662961138741444
Encrypted:	false
SSDEEP:	384:lgO9OMfES6EqMU9mmYJIbvXWQGA7DC5QC1QP9HfPt6r5esdEiExCbli1zqlYlBaJ:lJU5zGQswlE1TEx8kzqloBYA8R
MD5:	7E3C950F6514CEAEC263944BB6149A6B
SHA1:	D60A06B2724156F2C808648E8B5D8D543D93B084
SHA-256:	2CFA6F333D5A195FDFC244B2F3FBEDBAC858071EEC196BCA300808BAC20BF273
SHA-512:	AF8A05BDB2900D7D06D782309340941C4A0C6623F60F672AD4342A474F17CC76A987584D7EEB8D64D8960D6126A7A9FDB3E847D70DE8BD06C6BBAC24F6851D77
Malicious:	false
URL:	https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=1280
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U..........(...(..o.~....O...(...(...(..^....^......(...(...#.....~....(...(...._.-!.ZZ.(...(...F...KH.t.)h...(...(..^....^......(...(...#.....~....(...(...._.-!.Z.Z(...(...F...KH.t.(.h...(...(...E...ZE...Z.(...(...O.?AKI.G.)h...(...(..U..........(...(..o.~....O...(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U.........

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12394)
Category:	dropped
Size (bytes):	12443
Entropy (8bit):	5.622820681358379
Encrypted:	false
SSDEEP:	192:KO87cE+wCFgcmzFFLiMx+vomnNST2kYLAZVeOhRido3ARvVppn8pZl:KO6cE+wCFgFLGvomNSBYL1eROY
MD5:	1FB8462302F6FBB9323F187505F5393F
SHA1:	B1FE31671174AA0BC7DFBFCC942AEFBFCBDB55BA
SHA-256:	CBFC3F32A1493FB38FD92BE4BC61035CB4948B6CF91AE5CC0038006AC753EA98
SHA-512:	22B96DA64E536EE01CDC30946AF83FCA8BF939A41443C8E9F7E7D296388FC94E3BED12E1FCE20B7E5E31E7611B1DC4CE235DBD1B3B61CC4A6F77350749C86BFF
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width='66' height='38' style='fill: rgb(0, 0, 0); stroke: rgb(0, 0, 0);'%3E%3C/rect%3E%3C/svg%3E"},850259:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 193.779 31.864 192.122 31.864 L 68.122 31.864 C 66.465 31.864 65.122 30.521 65.122 28.864 L 65.122 14.864 C 65.122 13.207 66.465 11.864 68.122 11.864 Z M 68.122 35.864 L 262.122 35.864 C 263.779 35.864 265.122 37.207 265.122 38.864 L 265.122 48.864 C 265.122 50.521 263.779 51.864 262.122 51.864 L 68.122 51.864 C 66.465 51.864 65.122 50.521 6

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1131565
Entropy (8bit):	5.877306362220961
Encrypted:	false
SSDEEP:	12288:BMrA+2Uf/GNe5hxEhraL6OFn7RcYxUgRHp09/V+KtlzJ/871zWUjEG6T7b:BMrZ5fyXvOFn7RfdHp0FV+vzWUoG2
MD5:	4F8F7AC8F509D88D00832626B0034B06
SHA1:	1EB4AA922A3585CF75D1D327456BE75C2D5B7691
SHA-256:	75121705F4F16884C3A4B4E8823088807C10D215EEFB26A8188B8421D8A13D91
SHA-512:	62F992FC3F9C3B1FFA50ECC096C8A117E9B855C4856A9D5413BB9B2EE93A44038D67D097E14CDECABF6E07538A1E1156A78718645272E9496F75B005A4B2A009
Malicious:	false
Preview:	(()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(e)}function o(e,t){this.value=e,this.sign=t,this.isSmall=!1}function E(e){this.value=e,this.sign=e<0,this.isSmall=!0}function i(e){this.value=e}function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return e[0];case 2:return e[0]+1e7e[1];default:return e[0]+(e[1]+1e7e[2])*1e7}return e}function u(e){for(var t=e.length;0===e[--t];);e.length=t+1}function I(e){for(var t=Array(e),r=-1;++r<e;)t[r]=0;return t}function R(e){return e>0?Math.floor(e):Math.ceil(e)}function N(e,t){var r,n,a=e.length,_=t.length,o=Array(a),E=0;for(n=0;n<_;n++)E=(r=

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11498)
Category:	downloaded
Size (bytes):	11547
Entropy (8bit):	5.654551838352384
Encrypted:	false
SSDEEP:	192:632FaInJkXD9sQex9Wlp4JG+xyhyTBwFRAD0C+eN1Z0:632UK2XD9sQex9Wj4JG+xS0yba0
MD5:	AC6CE4E7FF5F746693AB549F03BE7ADE
SHA1:	2A3F2AFB8955C4218FDE52112D6F2E0E96CBD666
SHA-256:	233B97D0C0F688815243BCED54A8E2B633F60622B8704676F1E7C8F3051E19A1
SHA-512:	6F9EFF5DBC54D96955A801E0BB5A15E08989A8569018C223E0A079BFA03CAB090ADB545A5145EE934B848D2DF677493EF90E8A42D801817A4EA9BCBFC16F5DCD
Malicious:	false
URL:	https://discord.com/assets/fdc71c23d09e18e94ce2.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/assets/17a91e9b4e7eb3921ed5.svg"},73117:function(e,s,n){e.exports=n.p+"39b91170d9f2309e4c5e.mov"},988868:function(e,s,n){e.exports=n.p+"15aad6b83736f221e23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246db4b38a.mp4"},470794:function(e){e.exports="/assets/7df11a68a272724be266.png"},886777:function(e,s,n){e.exports=n.p+"b235c36699192662a3fe.webm"},588705:function(e,s,n){n.d(s,{R:function(){return f}}),n(411104);var t=n(200651),a=n(192379),l=n(442837),r=n(481060),i=n(388905),u=n(686546),o=n(925329),c=n(372769),m=n(726745),d=n(973616),I=

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20669)
Category:	downloaded
Size (bytes):	20718
Entropy (8bit):	5.5874718820742
Encrypted:	false
SSDEEP:	384:C4bQLjJHzjDcPDvYcJG9SAcksEi4aim6pvnVETji:DbQtjorYqG9e426PEa
MD5:	A2754ACCDA171158F8F581AD49DFBB9C
SHA1:	F619D690525B7ECA8BF70B9C24CBC58A3E092F1F
SHA-256:	606458816E822D1D0904C62D1E90C1595419CD92377055C63812BA63E00C3CDB
SHA-512:	F752422F8DE3B430832E43758F4C117D0D1FFB863CEDB95AA354635CC82DCC73F1371DA51626FFD76345D600970338DA4A2CD8F10739445C0123D990BD732CD5
Malicious:	false
URL:	https://discord.com/assets/94ec0c2b39908933eed3.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]&&arguments[2];r.Z.dispatch({type:"GIFT_CODE_RESOLVE",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.jr)(i.sku_id)}catch(e){}return r.Z.dispatch({type:"GIFT_CODE_RESOLVE_SUCCESS",giftCode:i}),{giftCode:i}}catch(t){throw r.Z.dispatch({type:"GIFT_CODE_RESOLVE_FAILURE",code:e,error:t}),t}}i=n(775644).Z,t.Z={resolveGiftCode:E,async fetchUserGiftCodesForSKU(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;r.Z.dispatch

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	7.8048030316845365
Encrypted:	false
SSDEEP:	24:w0Hm4yTnGeVfIFHU9HFbYMdL36oSMkKwzSwgvyQfpbfzu:w0Hm4AxWFHYeMZ36oSMS2wgpnu
MD5:	BD7895F71FAD6D9263981408ECCB3EF2
SHA1:	0DECC92425C58B121B6117B90EBFC89DE7397B8C
SHA-256:	927248AC3A7C831DC3DB7E45CEA4A7112F5BA02309227DDE46454F07CF773DB8
SHA-512:	CE7EBDA208426FBFC7E1A3F00ADD50A3944543385D6D2F0F29C1ABFB1653A1C8539D32C8C41FCA0BA6D71F9C65E09D21C6ADE661CD3719D5E7FF4A372FF0A32F
Malicious:	false
Preview:	RIFF"...WEBPVP8 .........@.@.>m..F$"..0......l....z..0?K.w....y.s..............S.?......h.....2>......j..{+....`...D. .........&...!..5w.8.S..VH.:b...-l..A_.......NVl0e..t..Q4hl..tCv...cB.&H......0`.>.]..(.n<6L]u.....M...%WN...>.......".../a .7FT.X..-.:....?.6Z[oO=^.==.).............y...Cn.}..0.fh.3.a....=k....O.^J4'..W."W....'...0.3.~.H..=....CT..W.kTVm.1.D.Rx6@.J..<.]~{4..h....u.42P........6vk.S...eF..fL..!..t0zO..h..Z....B....t.e..w:.......)...._.`E..-r..'"O.D..N.e.u..vp@...dd.............H.$.C.........c...ay.....I,c.2i..a.s.H...&..<:.3..!../..............?...rb"..9..r.q..g.{..E.A.].Rk.y..p[%..m.E]._m.........\....."<S.?......^........qU...L......4LE.q...?......E.n.p%5.54...f....5...g]...'...O....S.>+..DM4o.=.=.....[..5b..9...?y..cF.b...1..+.y...o.}.......>T=..........I....uc........^.....yT0...=#..i{....i..M1;...i.....g...3...g.~.].;.....0.Na......0.F....G.....&.[.+..>\|...9=..P......I.A.R.bT....8...C^q.N.....e;[..bm.{}.[P.y...

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	139
Entropy (8bit):	4.710597482771287
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvdnmFFSDDmJS4RKb5KGMXf/FGc8qQAGrqLW:t6Abli/m03mc4sldMX9QAw
MD5:	72A8B168AD2C7EEA7B2559B5690C7695
SHA1:	85E4F43154EA713C832BA27128A33EB7B2A7CF7A
SHA-256:	1F988D1AD4AB163D61A584254C07D75F3241EB6380BF48BF7D8F981E13C092CD
SHA-512:	11BCB1A3623B97C9DD2F22D0389B3CA05AB4F99596DE5D07C50C1FC83F7532D8C20B58379C54C38F503D86D8C2CAF52AF3B35FFCCDC4750089ABAF86C1C5294E
Malicious:	false
URL:	https://discord.com/assets/2597d11c1e039607373e.svg
Preview:	<svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>.

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	180
Entropy (8bit):	4.921485085907038
Encrypted:	false
SSDEEP:	3:t6WH7W+ZacvTnARcLnkDmJS4RKb5KVErcHYWNTWi7eLFOyTIXGUNfHFQJJqGrqL0:t6AbZ/Ikn4mc4slmYWBWzLRI2ylQJAe
MD5:	B1D4C5E276E3AAA8EC41E6014DD572B2
SHA1:	B5B63A8B35223277D75C79B2AABD8221FDA383EB
SHA-256:	7CF5996F7AB483BD985B3DE5BFBCF50A2B22A7B473E8011E5C993D9830AF9D12
SHA-512:	8E4C954D96FBDA407E87FA65859FE758FC83F2DA0C6D7C07824926BFB0BCDF4F40DE057C5DD1D7EE0890C5287D2ED2EC8FDEFBDF317B46FE222339894E0A559B
Malicious:	false
URL:	https://discord.com/assets/5430e9964fe8364e084d.svg
Preview:	<svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.7861988241054
Encrypted:	false
SSDEEP:	3:t6WH7W+IjSKcvUVYEo0LvDmJS4RKb5KVErcHNDPqdcJqGrqL0:t6AbzUOC3mc4slmNDiiAe
MD5:	7D883BA72B5DBC0229F5D1980205EE34
SHA1:	678BDA23DF97E8B9C3B15E71C41E7B215D043F22
SHA-256:	53A0F1F10860A6E4CF9BD3B4949C5DDE68888DBC96BA0DA1020C5958EFC214A5
SHA-512:	E040F62517C951A0AB2ABC5038F22456E5862166E2A2346345464B9C4B63271CFBD1220BB14D2C39D7FACFD008848ACE682420F1EFE9F4F29265D7177A3C7E16
Malicious:	false
URL:	https://discord.com/assets/ab03f7053698d417194c.svg
Preview:	<svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2058
Entropy (8bit):	4.614306214221163
Encrypted:	false
SSDEEP:	48:CVHe7HtOty0VulV1/8CXP0Cjek7aj4clug9ai:iANEyxx8UPTXaj4cogIi
MD5:	E1349377226366F95F85AB9EAC4586D3
SHA1:	9A3A00B6E6AB0A240363F4E4DB2F5288227FF76B
SHA-256:	2CA673A9914A35A230469A8A0FD6B4DB293B236DEA391633B53339AFE577A92E
SHA-512:	7C16967D1960CDE4914F71B6FE347A7764AAED42366A87920597D225F3874B5B34A00C5089564BEBF0A919C419049DB99B27128CC81BC28A1492460FD199F9E7
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve">. <defs>. <clipPath id="a" clipPathUnits="userSpaceOnUse">. <path d="M0 36h36V0H0v36Z"/>. </clipPath>. <mask id="b">. <g>. <rect x="0" y="0" width="100" height="100" fill="white" />. <path d="M11.708 29.849a1.296 1.296 0 1 0-2.591-.001 1.296 1.296 0 0 0 2.591 0" fill="black"/>. </g>. </mask>. </defs>. <g>. <g>. <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)">. <g>. <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.504 31.474 6 26.459 6h-15.71C6.607 6 3.727 13.224 6.75 17.438c0 0 4.5 3.5 6 .812" fill="white"/>. </g>. <g>. <path d="M13.008 17.864C8.02 10.927 6.968 6 10.75 6c-4.142 0-6.577 6.187-4.468 11.031.463 1.064 1.758 2.492 1.758 2.492l4.18.008c.162-.32.598-1.366.79-1.667" fill="white"/>. </g>. <g>. <path d

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17413)
Category:	dropped
Size (bytes):	17462
Entropy (8bit):	5.594711522541062
Encrypted:	false
SSDEEP:	384:iwLnWOUnUuyMNps0HHHsglNzUxBAAdTRIZWiv/XB2kZYP:BLQne0P5UxMXB2kSP
MD5:	3B98C1EF9293D482A5099FDB6984946F
SHA1:	6FEFA9D8FF6B2DB16B5EC2ED5922DA0AE6187448
SHA-256:	A76F75BF6294EEA278F82522810ACBC3BCFA9290006F57746AD79BCA3615AD66
SHA-512:	CE9915807ADC42ECAF18D254091B31BD65CE9A29AF38820ACCC2A5D38BC8AA329471AE1E7F404B6F8D0F85CC643B3616863A70D0E3EA1B8C569AC64A5E889C54
Malicious:	false
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,oneOfType:e,shape:e,exact:e,checkPropTypes:i,resetWarningCache:n};return r.PropTypes=r,r}},639519:function(t,e,r){t.exports=r(884835)()},311596:function(t){"use strict";t.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},58615:function(t,e,r){var o=r(338091);function n(t){this.mode=o.MODE_8BIT_BYTE,this.data=t}n.prototype={getLength:fu

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 179380, version 2.459
Category:	downloaded
Size (bytes):	179380
Entropy (8bit):	7.998791638207558
Encrypted:	true
SSDEEP:	3072:IkairG/VFWmVX/55KB+fV6ZNTJuvdeDsYaZQ9aFftKn/zfRoJC1NTuGo5m5Ss9fY:5aD/VEIXs+fVSNTJ8deoYabFftK/VosY
MD5:	7CF1BE7696BF689B97230262EADE8AD8
SHA1:	8EB128F9E3CF364C2FD380EEFAA6397F245A1C82
SHA-256:	A981989AEE5D4479FFADF550D9ECFF24A4AC829483E3E55C07DA3491F84B12BA
SHA-512:	7D7C7DC08001079D93EF447122DEE49ABD2B7A84D1619A055FF3E7EC0009261AB6ADD018560BFD82ED22B29C1915BFD059F02CD83FED2E15E9AF05A5D0654E06
Malicious:	false
URL:	https://discord.com/assets/48a594e29497835802fe.woff2
Preview:	wOF2...............L...Q..............................F...v.`..:.....$....6.$...@...D.. ..Z...\..[lI..<....rs.J.....H.H.G..Lc6.X.......2....1...B...d5.a..1......_(.D..&v.......[...Q=..................K........w'.,yl.`.1x0.Ya..B..Ph..6m.D....kE.B`.zG4...%+..!.J......j.z.......Z.F....~....V.m5...\|Xc.eG.x}C.....[U2..:oZ..b..0j.B......9.w.....Z.:..e.t...7...6\O...5e.KUNU9.P....-W./......A.y..E.#N.........ui@.'.m..~.d.Q..vpBv.+p..9.l...Sb..s%...^2.....Z].\|......=,.....@....^...5..w.6.a.2...$...[v..A..sG.t....T..L..~....H4..&#....]...W..].V.....Pt....o.Y.....T../..qS....c.O(<..-'P.9s.../.t..G .........o..b....83.^"K......J+..z^2x.L.../=Ts.....]E.....s)Y...y...g...$....da.......lA...y..<-KoEP>..I.....T.\I...d75.M...0..q.F.....&......<~..k7.(.}Q.%.q.<...{..9..0>d.VV..ze...I.<..4M.s.$....k....L ..H.B....2e".3..+..]<..m..4...J.......7r....e...KT..7{:.A2..\|...l..m.bS...S+.B..CQ/.d-..;r.>.....=B.o.....!).[..2......a6.q4ak.^..kyk\|.L....{.~..f1..L1..

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7679)
Category:	downloaded
Size (bytes):	7728
Entropy (8bit):	5.087323529198084
Encrypted:	false
SSDEEP:	96:wgSRVk6Wg8lh4Nrviiv1aWPRkDhTt9qwqSBtxCMNMRV0IBSAMD9C+m+rmxARJx3t:RSRVmriLDPRkxtRJxNMRV0IZdSL9ilfA
MD5:	1C6B9D0AD743762986197AE0E81874C1
SHA1:	EABACE4131BA74B108FC891EA843B4F85B218808
SHA-256:	2D739091F602476FCF261435B48A1FAFCE2533564FFF0549D27B47E341B4DCBF
SHA-512:	74FDE9F8997087BB107ED5DDC3A4A37BD24793CAAD605FBDCDD54E9D18AF8F44D0C0E92FB2259AA936BD1B20D5537441EF39D9A7F066323911436184B0138111
Malicious:	false
URL:	https://discord.com/assets/d67c5e680608266a1f63.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}return function(){function e(){this.__entries__=[]}return Object.defineProperty(e.prototype,"size",{get:function(){return this.__entries__.length},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototype.delete=function(e){var n=this.__entries__,r=t(n,e);~r&&n.splice(r,1)},e.prototype.has=function(e){return!!~t(this.__entries__,e)},e.prototype.clear=function(){this.__entries__.splice(0)},e.prototype.forEach=function(t,e){void 0===e&&(e=null);for(var n=0,r=this.__entries__;n<r.length;n++){var i=r[n];t.call(e,i[1],i[0])}},e}()}(),i="undefined"!

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1131565
Entropy (8bit):	5.877306362220961
Encrypted:	false
SSDEEP:	12288:BMrA+2Uf/GNe5hxEhraL6OFn7RcYxUgRHp09/V+KtlzJ/871zWUjEG6T7b:BMrZ5fyXvOFn7RfdHp0FV+vzWUoG2
MD5:	4F8F7AC8F509D88D00832626B0034B06
SHA1:	1EB4AA922A3585CF75D1D327456BE75C2D5B7691
SHA-256:	75121705F4F16884C3A4B4E8823088807C10D215EEFB26A8188B8421D8A13D91
SHA-512:	62F992FC3F9C3B1FFA50ECC096C8A117E9B855C4856A9D5413BB9B2EE93A44038D67D097E14CDECABF6E07538A1E1156A78718645272E9496F75B005A4B2A009
Malicious:	false
URL:	https://discord.com/assets/sentry.d30fc24f50e5e3e76b3e.js
Preview:	(()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(e)}function o(e,t){this.value=e,this.sign=t,this.isSmall=!1}function E(e){this.value=e,this.sign=e<0,this.isSmall=!0}function i(e){this.value=e}function c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return e[0];case 2:return e[0]+1e7e[1];default:return e[0]+(e[1]+1e7e[2])*1e7}return e}function u(e){for(var t=e.length;0===e[--t];);e.length=t+1}function I(e){for(var t=Array(e),r=-1;++r<e;)t[r]=0;return t}function R(e){return e>0?Math.floor(e):Math.ceil(e)}function N(e,t){var r,n,a=e.length,_=t.length,o=Array(a),E=0;for(n=0;n<_;n++)E=(r=

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	14624305
Entropy (8bit):	5.854943527266922
Encrypted:	false
SSDEEP:	196608:r6lXgFXaYzjupIEtYW4sZoymJBkD/skskv:rXXaYzjupIEtYW4sZ9mJBkDks
MD5:	216CB783D60A3E7C57C9D9FFEA99DC3F
SHA1:	C645D044161C447B84CBA1E62FCB018B5A7D6066
SHA-256:	48D0B669FD29BF3D5A6552EBD89B2048FBB6D58F824E8DD1F92772AC5821D716
SHA-512:	54F12CC52FBCAE1DF1575969CD269E75795B6D469B2C5CB0854D5A242A9A460CFBC8A9C9DCBDF4A7B7CEBC9EEC2EFC54A714C9CB6DB68974173DA2AC4E01E84B
Malicious:	false
URL:	https://discord.com/assets/webMinimal.183cbc8427e6b143ce21.js
Preview:	(()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["403530","29924"],"./cs.jsona":["753771","87233"],"./fi.jsona":["554545","7402"],"./es-419.jsona":["39227","59729"],"./ja.jsona":["516722","7728"],"./pt-BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"./lt.jsona":["877749","44754"],"./pl.jsona":["477384","60878"],"./hu.jsona":["107425","98570"],"./nl.jsona":["432763","41588"],"./th.jsona":["182260","49827"],"./bg.jsona":["251927","20575"],"./fr.jsona":["570173","99450"],"./zh-TW.jsona":["592369","30684"],"./hi.jsona":["629869","22732"],"./en-GB.jsona":["569249","99339"],"./ko.jsona":[

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	24
Entropy (8bit):	4.022055208874201
Encrypted:	false
SSDEEP:	3:PaniAKp18n:SnT
MD5:	5DFB17ADA137F27939246A24FD5F7CE1
SHA1:	6748CBADBAAA9216F6FC0C3C3B5F7CA786F3C8BA
SHA-256:	E7E1364442A162805292D9693D57C84E66D37E27849E1EDC4C31A3436DEDF238
SHA-512:	70A38493813CA097B394743E6ED33B2574079F500E5D9C911A8EC251E39C5BA47EC41214EE47B21BEF4D4392B2F3D507717282C2AE073A05FEC74542A2460F5D
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAnjkqJiyOoN-BIFDfwdehA=?alt=proto
Preview:	Cg4KDA38HXoQGgUIoAEYAg==

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	395
Entropy (8bit):	4.646873794844198
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4slvIl4slvUldboLYPsd9IZI0OuFxMdIr0a/NdpVo4a38n:trVzNtuCHvOdELYPsuI09z9LdYr38n
MD5:	E843C51C0EEC3801B70CAE5C45AD343F
SHA1:	AD735360ECFA829DB9D6C48F1A671A99BFCE1D2A
SHA-256:	F860149A77A53D43396F3AEC9377B9A0DD6C5D84459079C5D393F6343EC253FB
SHA-512:	2AF4816580FD02A2AE107914D967AF966CA97E137434E2668C7A430D34168E150F668AE3A3B005BFF7070D50A0FD89BD0B5A351F5E3DB6F6B167998378308F71
Malicious:	false
URL:	https://discord.com/assets/410a2166a48c9e482e2a.svg
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.31127 9.31127 12 5.99456 12C2.80018 12 0.188323 9.50595 0 6.35889C0.795708 7.06704 1.84421 7.49727 2.9932 7.49727Z" fill="#FFFFFF"/>.</svg>.

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9319)
Category:	dropped
Size (bytes):	9368
Entropy (8bit):	5.515903871543996
Encrypted:	false
SSDEEP:	96:i5FOdCCCb5Ui4C5wOjggHurX0W89VSIFIUpSpWgAUcnNyeVjAZ2dQTK0ne+6ACub:iSbuIAr3gKYa48OwaUDhQDFRtQS
MD5:	484B9F4BDA963A4ADE71A4EB95D2538F
SHA1:	C381C9D9C91D4256D92E2480CB9DF1A0F090F7D6
SHA-256:	EA87CB393653DF89EF7B31DD35BC78C5DBA14B5F5BEC401153A3C51CD566C923
SHA-512:	D18D67D5B5FC1FDBE61C6728B7104A5589837A32D6D20BF59B0405DB4093FBAF3FBF961DBC24158B5C21147945941D75ECBADF264857EAB722C9511F70D0988B
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(135200);t.Z={resetSuggestions:()=>a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"}),async fetchSuggestionsRegistration(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?void 0:n.username)!=null)return a.Z.dispatch({type:"POMELO_REGISTRATION_SUGGESTIONS_SUCCESS",suggestion:i.body,source:e})}catch(e){return}}},async fetchSuggestions(e){if(!!(0,g.P)())try{var t;a.Z.dispatch({type:"POMELO_SUGGESTIONS_FETCH",usernameSuggestionLoading:!0});let n=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS,timeout:e});if(

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.646873794844198
Encrypted:	false
SSDEEP:	6:tnrVzUOtumc4slvIl4slvUldboLYPsd9IZI0OuFxMdIr0a/NdpVo4a38n:trVzNtuCHvOdELYPsuI09z9LdYr38n
MD5:	E843C51C0EEC3801B70CAE5C45AD343F
SHA1:	AD735360ECFA829DB9D6C48F1A671A99BFCE1D2A
SHA-256:	F860149A77A53D43396F3AEC9377B9A0DD6C5D84459079C5D393F6343EC253FB
SHA-512:	2AF4816580FD02A2AE107914D967AF966CA97E137434E2668C7A430D34168E150F668AE3A3B005BFF7070D50A0FD89BD0B5A351F5E3DB6F6B167998378308F71
Malicious:	false
Preview:	<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.31127 9.31127 12 5.99456 12C2.80018 12 0.188323 9.50595 0 6.35889C0.795708 7.06704 1.84421 7.49727 2.9932 7.49727Z" fill="#FFFFFF"/>.</svg>.

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9310)
Category:	dropped
Size (bytes):	9359
Entropy (8bit):	5.630050363226493
Encrypted:	false
SSDEEP:	192:fcLtSa9QY4Cg9OcfTp1tOxyoZA0ab0KPqO2Lk2mMATw2DxnE7LoT:6WCQdfTLteyoZA0ab0KPqO2Lp+w2DxEo
MD5:	52287A03A33104E4E3508B67501DB130
SHA1:	B131FDFAA0259B1226B6EDF3BF5820C60A25FCAB
SHA-256:	A690D620CF44F9CAEF92F4943B977D45EF082F2280D16B7D6EE3B76157812310
SHA-512:	F4C83E10C7FB93CAA7F0B183D49DEFC53D21B8CC7CABAAD79ED36974F53DF01F87D45CF3452F7F3C2BF86168D3DC488296C6EA57279B4A2CDC083A2747AD97BE
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signup:(t,e)=>u.Z.post({url:o.ANM.HUB_WAITLIST_SIGNUP,body:{email:t,school:e},trackedActionData:{event:r.NetworkActionNames.HUB_WAITLIST_SIGNUP,properties:t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SEND,body:{email:t,guild_id:n,allow_multiple_guilds:e,use_verification_code:!0},trackedActionData:{event:r.NetworkActionNames.HUB_EMAIL_VERIFY_SEND,properties:t=>{var e;let n=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.has_matching_guild;return(0,i.iG)({has_matching_guild:n})}}})).body,async verify(t){if(null!=t)try{var e;let n=awa

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18134)
Category:	dropped
Size (bytes):	18183
Entropy (8bit):	5.745446950417671
Encrypted:	false
SSDEEP:	384:M7+ek/HNfVFGOSH4vgk+l/HyHOC7CmA5h4m4C2xYtL5c299H0KkBijYpthjDh2P1:g+ek/7VwEgkK/SuC7Cx5G1C2xYtL5c2R
MD5:	CB2E31554EC3CE69856DD70C281A6DB7
SHA1:	53524C140D3B966DFA9ADAF06A1AD062CC5FB9E1
SHA-256:	A4E79A1E245BDE12C9A8FE50342E450213CB0F3002D0453DE8FDEDE75630F2D2
SHA-512:	FB5D9629793FA3A432D955AE2193504445464719C92B7281612DC83912FCF1150A07F2BEDEDADFB102D8FC0D54980B769C933D4D99DEDAD0AFC14E3065ABE6FC
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/assets/4676f063fb9f129e9fdb.svg"},561030:function(e){e.exports="/assets/75c80c4160a66983ae66.svg"},419185:function(e){e.exports="/assets/47e72e6360ce185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027f11792ba8c0e7f.svg"},526916:function(e){e.exports="/assets/f38b6aefa24dc9a54765.svg"},29654:function(e){e.exports="/assets/dde11474b0623b723861.svg"},820160:function(e,s,a){a.d(s,{Z:function(){return L}});var E=a(200651);a(192379);var _=a(481060),t=a(813197),n=a(689938),r=a(510186);function L(e){let{icon:s,onChange:a}=e;return(0,E.jsx)(_.Fo

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8059), with no line terminators
Category:	dropped
Size (bytes):	8059
Entropy (8bit):	5.760157514178045
Encrypted:	false
SSDEEP:	192:Lef79w8ekobYwgrg/y/CKAY2td7kjR/2/tc:axw8ekobYwgruIgtd7kjY1c
MD5:	12F8831A9DD77D3446EBFD38D4D71DF5
SHA1:	704276EEF489BAADCB9975E9A492F95B9FA0008A
SHA-256:	65195CF3F467B67B8C661763E217EF8040CA0DB7C6B6FF4ECF1DDA8208CD58CD
SHA-512:	26361347A952F79B5F588E83E1EADD13521F0B61DCF07AC4C42DBEEB4C212D26197096D3C8B9D2C802C0B6697C6987F07B3715FEA602729205DF253BC6AC8473
Malicious:	false
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,h,i,n,o,y,z,B){V=b,function(c,d,U,e,f){for(U=b,e=c();!![];)try{if(f=-parseInt(U(310))/1(-parseInt(U(325))/2)+-parseInt(U(291))/3+-parseInt(U(303))/4+-parseInt(U(305))/5+parseInt(U(259))/6(-parseInt(U(242))/7)+parseInt(U(254))/8+parseInt(U(224))/9*(parseInt(U(312))/10),f===d)break;else e.push(e.shift())}catch(D){e.push(e.shift())}}(a,519984),h=this\|\|self,i=h[V(255)],n={},n[V(306)]='o',n[V(283)]='s',n[V(327)]='u',n[V(318)]='z',n[V(260)]='n',n[V(281)]='I',n[V(258)]='b',o=n,h[V(293)]=function(D,E,F,G,a4,I,J,K,L,M,N){if(a4=V,E===null\|\|E===void 0)return G;for(I=x(E),D[a4(251)][a4(266)]&&(I=I[a4(238)](D[a4(251)][a4(266)](E))),I=D[a4(219)][a4(323)]&&D[a4(315)]?D[a4(219)][a4(323)](new D[(a4(315))](I)):function(O,a5,P){for(a5=a4,O[a5(246)](),P=0;P<O[a5(253)];O[P+1]===O[P]?O[a5(276)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a4(225)][a4(300)](J),K=0;K<I[a4(253)];L=I[K],M=v(D,E,L),J(M)?(N=M==='s'&&!D[a4(277)](E[L]),a4(316)===F+L?H(F+L,M):N\|\|H

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13325)
Category:	downloaded
Size (bytes):	13374
Entropy (8bit):	5.33229367944175
Encrypted:	false
SSDEEP:	192:c9jPMDYeG0dPbPDjzw4WDhiElYrskCLdHWQBC7dr1m+8LBpDtOnyUotvLfQE2u:c9jPMRLjZ0usbxwdr1QBpDtOy3JT
MD5:	D0C788B157FF96A2DD902C97BFC889F6
SHA1:	6CDE0BD611B34B15CA15437CA5AC4F77DE01ADA8
SHA-256:	05A00FBAFFC4A7254C9B631FF0E81BE546DC275BE1D6F992C36849222D0B73F7
SHA-512:	170615E3DE829D517662BE32C762B76B013163FA040C2EEDF89C865A9CEE1CEEDA7EE305BE27CD3A724832571A94B5A26FB3BB9D9A1D1C5386081F206A1E1436
Malicious:	false
URL:	https://discord.com/assets/5067a2ec1b24a6de868c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){var e=r(622281),o=String,i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not an object")}},953326:function(t,n,r){var e=r(299623),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},332916:function(t,n,r){var e=r(581031),o=e({}.toString),i=e("".slice);t.exports=function(t){return i(o(t),8,-1)}},381740:function(t,n,r){var e=r(740362),o=r(666061),i=r(347722),u=r(97131);t.exports=function(t,n,r){for(var c=o(n),f=u.f,a=i.f,s=0;s<c.length;s++){var p=c[s];!e(t,p)&&!(r&&e(r,p))&&f(t,p,a(n,p))}}},251069:function(t,n,r){var e=r

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1189139
Entropy (8bit):	5.20676221692586
Encrypted:	false
SSDEEP:	24576:xAexVV4zeUuKevkJHfJytZemXpvyZTQ02JKdmtWCt3nCxhZyUXQ32N4XhKOXAWbF:xAenVOuKevkJHfJytZemXpvyZTQ02JKw
MD5:	7B173AF12AA2176B69D5656709649AB1
SHA1:	C04DB8B7D3EAE3F4EB8CCCF59F71ED924B87E029
SHA-256:	D92469EE3632C38B4562C947419B685A7A13EFF0E3861DCC383A255C389A5F40
SHA-512:	945BE17823D84E2A6E5BB0852B73FD77B0A292EAF13718F94D3AA8008F33B10A9C6007E2ACFFFE970CC10E9A04227C57BADD5B0C3BF0F46F4EAB98E248455561
Malicious:	false
URL:	https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css
Preview:	@keyframes spinner-wandering-cubes_b6db20{25%{transform:translatex(22px)rotate(-90deg)scale(.5)}50%{transform:translatex(22px)translatey(22px)rotate(-180deg)}75%{transform:translatex(0)translatey(22px)rotate(-270deg)scale(.5)}to{transform:rotate(-360deg)}}@keyframes spinner-chasing-dots-rotate_b6db20{to{transform:rotate(360deg)}}@keyframes spinner-chasing-dots-bounce_b6db20{0%,to{transform:scale(0)}50%{transform:scale(1)}}@keyframes spinner-pulsing-ellipsis_b6db20{0%{transform:scale(1);opacity:1}50%{transform:scale(.8);opacity:.3}to{transform:scale(1);opacity:1}}@keyframes spinner-low-motion_b6db20{0%{opacity:1}50%{opacity:.6}to{opacity:1}}@keyframes spinner-spinning-circle-rotate_b6db20{to{transform:rotate(360deg)}}@keyframes spinner-spinning-circle-dash_b6db20{0%{stroke-dasharray:1,200;stroke-dashoffset:0}50%{stroke-dasharray:130,200}to{stroke-dasharray:130,200;stroke-dashoffset:-124}}.spinner_b6db20{display:flex;justify-content:center;align-items:center}.inner_b6db20{position:relati

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	87973
Entropy (8bit):	5.125806607183933
Encrypted:	false
SSDEEP:	1536:f0kGwo/3g1MGEN6UCSQyYHhU58xxfrDX/5CF+gD58G3LpV9H5B7va:f0kGDZc
MD5:	E05640582E20F17E0F1797160B67DCD4
SHA1:	DCB27383F5836437E5433C7CCB5981E94826EE00
SHA-256:	E9DEEBCC271633C282AB3FE440CE81A196ECE4F402804FE8940030F98C563475
SHA-512:	60CDDA59E85FDED81B351614DAF3D40B30F939F7F8D9B586F516165699822E8F07F344CDD3709DCF6ADA350C725330DF26B6947322F154AB54D02C5AF3AAD71B
Malicious:	false
Preview:	<svg width="1440" height="900" viewBox="0 0 1440 900" preserveAspectRatio="xMinYMin slice" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)"><path d="M1440 0H0v900h1440V0Z" fill="url(#c)"/><path d="M1440 0H435.551v620.81H1440V0Z" fill="url(#d)"/><path d="M1440 341.601H484.351v558.38H1440v-558.38Z" fill="url(#e)"/><path d="M1440 0H427.5v690.995H1440V0Z" fill="url(#f)"/><path d="M787.663 810.02c330.987-141.179 530.547-416.834 445.727-615.692C1148.57-4.53 811.492-51.288 480.502 89.891 149.512 231.07-50.048 506.725 34.772 705.583c84.821 198.858 421.901 245.616 752.891 104.437Z" fill="url(#g)"/><path d="M1024.18 825.565c290.6-123.952 456.96-386.723 371.57-586.916-85.39-200.193-390.19-261.999-680.792-138.047-290.602 123.952-456.959 386.724-371.569 586.917 85.389 200.193 390.19 261.998 680.791 138.046Z" fill="url(#h)"/><path d="M673.907 771.815c264.238-112.707 429.363-319.136 368.823-461.073-60.538-141.936-323.823-165.631-588.061-52.924C190.431 370.5

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	4.484082045212369
Encrypted:	false
SSDEEP:	48:C4LO/K7oWBkomgBkRzd0kJBJkI8JkINGD/dYk2kahkzd/FnLgkpmZ5ZOE83VCn:RO/IS53JBJbKbN4WQbMRZmEAI
MD5:	81084FF5A27B6E6FF487E479C37D1660
SHA1:	81A274F69A1358F85715A0FEA227730D795CB353
SHA-256:	075DE1D6EA4FB470197A88BA371F60F70B819B250CB5AF8BD6A4794B1A9CA4A1
SHA-512:	CCCD00A5C013B130BE0A8466F903F7EEE9306518DFAA8758849027EBC1829EA2A6B7516E4D2070B110A12EC7EB559E3B75D256AD1B07BE3FD8595C0E430DC0D5
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19">. <defs>. <style>. .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225}. </style>. </defs>. <g id=".._2" data-name=".. 2">. <g id="Layer_1" data-name="Layer 1">. <path class="cls-1" d="M89.59 19.89 84.93 8.38a5.51 5.51 0 0 0-7.19-3l-5.67 2.25A12.42 12.42 0 0 0 56 .91L45.48 5.16c-1.84 4.11-5.48 9.72-11.59 9.52a8.55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3.04-7.19ZM11.65 52.94a2.76 2.76 0 0 1-3.59-1.52l-3.63-9A2.76 2.76 0 0 1 6 38.87l4-1.65 5.69 14.07ZM22.33 39.6a3.72 3.72 0 1 1 2.06-4.85 3.71 3.71 0 0 1-2.06 4.85Zm33.36-1.55-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21762)
Category:	downloaded
Size (bytes):	21811
Entropy (8bit):	5.462655463719556
Encrypted:	false
SSDEEP:	384:f1bjtqrVapZjquHCWnJcJhcby8XziQBy6HUKVMov5hHKs80K:JjtOVaJDnJcPc+EWQ8EM65RR8l
MD5:	0FBB77D1B69F18DF0FDCF836DE1C4106
SHA1:	E8CE4037B97732809F1E1BF24992959C678F2118
SHA-256:	279E49A00A41A18545CF319B5A8B571FD48CFCC4B78A361BBE75A33CE7A4F71A
SHA-512:	F73E3B25561D0D3307C7DD9D505F84101897CFA70737D757AED8D95BDC6A2CE116FD114674DD0BBE666AABE2176B0EEF150A5D4EE2C7C3CCE815A5CA73215D03
Malicious:	false
URL:	https://discord.com/assets/a6f6204cd40c3c5f5c14.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r,n){var e=n(838957),o=TypeError;t.exports=function(t,r){if(e(r,t))return t;throw o("Incorrect invocation")}},212036:function(t){t.exports="undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(276321),x=n(641236),b=n(457507),T=n(644659),E=T.enforce,I=T.get,R=a.Int8Array,m=R&&R.prototype,O=a.Uint8ClampedArray,M=O&&O.prototype,F=R&&A(R),U=m&&A(m),_=Object.prototype,L=a.TypeError,B=x("toStringTag"),C=b("TYPED_ARRAY_TAG"),S="TypedArrayConstructor",P=u&&!!w&&"Opera"!==p(a.opera),V=!1,N={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,U

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 38156, version 2.66
Category:	downloaded
Size (bytes):	38156
Entropy (8bit):	7.992862818603593
Encrypted:	true
SSDEEP:	768:YLYEgWfC/zlP948Q4NxhBiMwYatzdYZyXSihSZ9ia6UBJlly12m9U:YLYEszTFQyxfiMwYmxYZ1p9ia6U7r4U
MD5:	3D6549BF2F38372C054EAFB93FA358A9
SHA1:	E7A50F91C7EC5D5D896B55FA964F57EE47E11A1B
SHA-256:	8E401B056DC1EB48D44A01407CEB54372BBC44797D3259069CE96A96DFD8C104
SHA-512:	4BDE638A4111B0D056464CE4FD45861208D1669C117E2632768ACD620FCD924AB6384B3133E4BAF7D537872166EB50CA48899B3909D9DBF2A111A7713322FAD4
Malicious:	false
URL:	https://discord.com/assets/c1b53be672aac192a996.woff2
Preview:	wOF2..............\|T.......B............................. .`..P..<..W.....8..}.6.$..`..r.. ..n..F..v[.Vq...Q.r......9.../h....r~..y...)Jv.._@....Z...cm.z.(...u..#EMKK..e.mm..2,.FK...Y..mk].{...[.^UR......8p.jD.n.t..k.....b!.C...&8...._.-n69(...N....o..w..1...\|.i....!..\...n.^.Kq..../]x.........x..N...=.^".ZF.L.6lD...X..[u.-.............y....\...%.q.....u~.y.K..>.d{...P..BU..2..p.nO.z....y~.....#DT...S.(d-~E.m...][..s...\..+.t..\!H.......'V...@.w..r['bc:V...X.d.86..c.......Xd<..p..N".9...X6..(\|.C..t....0x.E.....8_.....Xs..8(...4I.X2J,Y[[....U..^I.y.#...w.R.....).o..i.....a......t+...Pz.%..FB..&.$.dS.!$...iM;....K....;M....z`iw..j;.Su.I...O.Z9.....d....-2.Y2k.5....M.g..1u.$....T../.K.R1... ..?....C.&.wk..N.X....h.B.......};K@S...@'..4.;...\|x.I.R....zj..Ph....\7...<.m~U ......Hu.(\|SV<...?$.....MO.9.....H..z~R..9rD..y..H........N..i....}.."23.+........\|i.[..\|w..=.a-..E4...f..[....O9..g....x.0.c.f4..p[m.e/...)P......5.M......../..6.&..5.Rw

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11118)
Category:	downloaded
Size (bytes):	11167
Entropy (8bit):	5.535074023387345
Encrypted:	false
SSDEEP:	192:YVQA29dyFDfqMgeYTllT06FJLviKriLZErOWD8yLg6T06oGL3rOhzus:QazsqP116In4zn
MD5:	8AAA605C48DC545F185CA77C921139D3
SHA1:	D2481F19DC4D8F4B161D3DD0B35B446FDC505446
SHA-256:	9ADEBA0225F0D293B735E83C05D1BB063F750C439CE8BCD7ED362D795CFD39B1
SHA-512:	469573F4D8F912DC151474F9ACA815F2A686C590408B20733E58C1C21F8DC71A26B2569B8052A8B67331D2DD2FA4E54AD7B4D953FEBC2DCA0676827AC0EFD377
Malicious:	false
URL:	https://discord.com/assets/6df906184440a6461f5c.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messages.MFA_V2_TOTP_NAME},get sms(){return n.Z.Messages.MFA_V2_SMS_NAME},get password(){return n.Z.Messages.MFA_V2_PASSWORD_NAME},get backup(){return n.Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);function f(e){var t,s;let{mfaChallenge:h,mfaFinish:f,onEarlyClose:m,onClose:S,width:_=440}=e,[g,x]=l.useState(null!==(s=null===(t=h.methods[0])\|\|void 0===t?void 0:t.type)&&void 0!==s?s:"select"),[E,C]=l.useState(g),p=async e=>{let{mfaType:t,data:s}=e;await f({mfaType:t,data:s,ticket:h.ticket}),null!=S&&S()},v={mfaChallenge:h,finish:p,setSli

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9319)
Category:	downloaded
Size (bytes):	9368
Entropy (8bit):	5.515903871543996
Encrypted:	false
SSDEEP:	96:i5FOdCCCb5Ui4C5wOjggHurX0W89VSIFIUpSpWgAUcnNyeVjAZ2dQTK0ne+6ACub:iSbuIAr3gKYa48OwaUDhQDFRtQS
MD5:	484B9F4BDA963A4ADE71A4EB95D2538F
SHA1:	C381C9D9C91D4256D92E2480CB9DF1A0F090F7D6
SHA-256:	EA87CB393653DF89EF7B31DD35BC78C5DBA14B5F5BEC401153A3C51CD566C923
SHA-512:	D18D67D5B5FC1FDBE61C6728B7104A5589837A32D6D20BF59B0405DB4093FBAF3FBF961DBC24158B5C21147945941D75ECBADF264857EAB722C9511F70D0988B
Malicious:	false
URL:	https://discord.com/assets/6674c18c2e4160ceca2d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(135200);t.Z={resetSuggestions:()=>a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"}),async fetchSuggestionsRegistration(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===n?void 0:n.username)!=null)return a.Z.dispatch({type:"POMELO_REGISTRATION_SUGGESTIONS_SUCCESS",suggestion:i.body,source:e})}catch(e){return}}},async fetchSuggestions(e){if(!!(0,g.P)())try{var t;a.Z.dispatch({type:"POMELO_SUGGESTIONS_FETCH",usernameSuggestionLoading:!0});let n=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS,timeout:e});if(

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11498)
Category:	dropped
Size (bytes):	11547
Entropy (8bit):	5.654551838352384
Encrypted:	false
SSDEEP:	192:632FaInJkXD9sQex9Wlp4JG+xyhyTBwFRAD0C+eN1Z0:632UK2XD9sQex9Wj4JG+xS0yba0
MD5:	AC6CE4E7FF5F746693AB549F03BE7ADE
SHA1:	2A3F2AFB8955C4218FDE52112D6F2E0E96CBD666
SHA-256:	233B97D0C0F688815243BCED54A8E2B633F60622B8704676F1E7C8F3051E19A1
SHA-512:	6F9EFF5DBC54D96955A801E0BB5A15E08989A8569018C223E0A079BFA03CAB090ADB545A5145EE934B848D2DF677493EF90E8A42D801817A4EA9BCBFC16F5DCD
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/assets/17a91e9b4e7eb3921ed5.svg"},73117:function(e,s,n){e.exports=n.p+"39b91170d9f2309e4c5e.mov"},988868:function(e,s,n){e.exports=n.p+"15aad6b83736f221e23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e246db4b38a.mp4"},470794:function(e){e.exports="/assets/7df11a68a272724be266.png"},886777:function(e,s,n){e.exports=n.p+"b235c36699192662a3fe.webm"},588705:function(e,s,n){n.d(s,{R:function(){return f}}),n(411104);var t=n(200651),a=n(192379),l=n(442837),r=n(481060),i=n(388905),u=n(686546),o=n(925329),c=n(372769),m=n(726745),d=n(973616),I=

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1232)
Category:	downloaded
Size (bytes):	11667
Entropy (8bit):	5.447592966322727
Encrypted:	false
SSDEEP:	96:oTwUTwJTwcUqMJ5DdEQwS1lN/N8N9OfRr8LCzCNjRe5mvtgCsXe5oEMRNGNk5N9G:vz6cCrDYwhyARr80CKoVN8IQbnx/0
MD5:	B341E64510AF9568A3999AF33DB78DC5
SHA1:	D706C8DCB1FFD69FA7D8E4E572620649569C30C5
SHA-256:	E387FE2AD2587F5B4C481EF6C91BC29F71D190F991E9EF6018922AAD5421952A
SHA-512:	BBD7BA87BD47BB6B30A884E36BC595F795A63D61F3C23B8288D02C78ACEE427CDB52B7B6060EB7FC0A01DAA5C698C177CB9307D1FC651EEF3CB90F47EA1A1735
Malicious:	false
URL:	https://discord.com/invite/privatecommunity
Preview:	<!DOCTYPE html>.<html>.<head> <meta charset="utf-8">. <meta content="width=device-width,initial-scale=1,maximum-scale=3" name="viewport">.<meta name="description" content="Check out the .............. .......... .. community on Discord - hang out with 2638 other members and enjoy free voice and text chat." />.<meta name="twitter:card" content="summary_large_image" />.<meta name="twitter:site" content="@discord" />.<meta name="twitter:title" content="Join the .............. .......... .. Discord Server!" />.<meta name="twitter:description" content="Check out the .............. .......... .. community on Discord - hang out with 2638 other members and enjoy free voice and text chat." />.<meta property="og:title" content="Join the .............. .......... .. Discord Server!" />.<meta property="og:url" content="https://discord.com/invite/privatecommunity" />.<meta property="og:desc

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4246
Entropy (8bit):	4.103696787604314
Encrypted:	false
SSDEEP:	96:K9F4GfkbfNyN48/E8jfsrKk1Z/eO4oSgT3I/VcbQokvBD:KnqbfQ48/BfsrKYZ/eOBe9FJD
MD5:	DDA77F765068E4450D3545A40B777663
SHA1:	63AE45EF489734D09D3AEA98E016C0DD1BC733F9
SHA-256:	A644A9364BE96AD0A72F8E24397322B4D0646563A11E8FF76191A9239A561AC9
SHA-512:	D88521109D4AC8EA200F644973A7A554C1A6B8E0AE4658C7F0E3FAFBEE40A1CB8A6A75BECB2A49AE3B8D226BEE36CD8CA63B492FABC2BF034D6A295349567946
Malicious:	false
Preview:	<svg width="124" height="24" viewBox="0 0 124 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)" fill="#fff"><path d="M26.242 2.01A25.218 25.218 0 0 0 19.851 0a18.718 18.718 0 0 0-.819 1.701 23.45 23.45 0 0 0-7.083 0A18.2 18.2 0 0 0 11.121 0a25.13 25.13 0 0 0-6.396 2.015C.68 8.132-.417 14.097.132 19.978c2.682 2.005 5.282 3.223 7.838 4.02A19.514 19.514 0 0 0 9.65 21.23a16.507 16.507 0 0 1-2.644-1.287c.222-.165.439-.337.648-.513 5.098 2.386 10.636 2.386 15.673 0 .211.177.428.348.648.513-.839.505-1.726.939-2.649 1.29A19.432 19.432 0 0 0 23.004 24c2.558-.797 5.16-2.015 7.843-4.022.643-6.817-1.099-12.728-4.605-17.968ZM10.343 16.361c-1.53 0-2.785-1.43-2.785-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174.003 1.74-1.228 3.17-2.785 3.17Zm10.293 0c-1.53 0-2.786-1.43-2.786-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174 0 1.74-1.228 3.17-2.785 3.17ZM41.629 6.122h6.652c1.603 0 2.958.257 4.069.767 1.109.51 1.94 1

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7029)
Category:	downloaded
Size (bytes):	7078
Entropy (8bit):	5.693672087902241
Encrypted:	false
SSDEEP:	192:EDHGzBioMyirXyf70li//fZc8Twtv1T5aLdMu951f54aH8L:EDmlioLirXyfYlw/xHWOyuB+acL
MD5:	45A3EE5FF96BDB2DD7FBB2846B5EA494
SHA1:	795E2BB4E00AB75A91BDBA9A4C7D9E2B2E0CD905
SHA-256:	08F280458FAB95C2E5754187C406458A8FE69A1C12329C8EF6CB801067E00BB6
SHA-512:	D545E8F9FE857A5A3AC908E1CCDA13ADCD19EFA78AE34143BCB36080C228090B8C5AE446EFE51C4A87A22BD9403B6E851219B331274D8929EB20AF81E9B159F8
Malicious:	false
URL:	https://discord.com/assets/1bab9b095996b8d024ce.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype")}},442975:function(r,t,o){var e=o(936940);r.exports=!e(function(){function r(){}return r.prototype.constructor=null,Object.getPrototypeOf(new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},InvalidCharacterError:{s:"INVALID_CHARACTER_ERR",c:5,m:1},NoDataAllowedError:{s:"NO_DATA_ALLOWED_ERR",c:6,m:0},NoModificationAllowedError:{s:"NO_MODIFICATION_ALLOWED_ERR",c:7,m:1},NotFoundError:{s:"NOT_FOUND_ERR",c:8,m:1},NotSupportedError:{s:"NOT_SUPPORTED_ERR",c:9,m:1},InUseAttributeError:{s:"INUSE_ATTRIBUTE_ERR",c:10,m:1},InvalidStateError:{

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43364, version 3.131
Category:	downloaded
Size (bytes):	43364
Entropy (8bit):	7.995499053027601
Encrypted:	true
SSDEEP:	768:fQelRMAMlg6keZjHGyL9BFjYBuukYbpX4Qb0NJ4rLU7KoYVZ:fQeTWlg6kON8cubbpIb+ggf
MD5:	281BBA49537CF936D1A0DF10FB719F63
SHA1:	4085AD185C5902AFD273E3E92296A4DE3DC19EDD
SHA-256:	B78FB569265B01789E7EDD88CFE02ECB2C3FEE5E1999678255F9B78A3B2CC4E8
SHA-512:	AF988371DB77831F76EDF95A50B9DDF1E957F0230404C8307914F11211E01CC95C61E0768D55AA4347F24E856D226F7E07AC21C09880E49DBD6346D1760B8BFF
Malicious:	false
URL:	https://discord.com/assets/8234e0a75aa9afb205bd.woff2
Preview:	wOF2.......d.......8..............................x...@..\.`..X..>...........".6.$........ .....K...[.q...c...5.nC...U....?...q.zn.<..-...a..C..J;..8.....s......M.@5.u.F....).'.N..9{U.'..u...\|.;W....gz;m.o..&A.....o.........Vm/....a.VNF......T/$..iM......".J(...:.F1.x.}.F....%..Xb.3d%....)Yv..'.th..}..&......k.f..%'..i=@..p..wr.<.i.;...c...13..........i....{.F...&{.....A.]....-...?.....<.....J?.9B.&.f.d.).T...S.. n...g7N...w.=...\|.!......b..s.........qI<F:...p...y...2.h.+1L.,.mG\..4.E%+r...........o#7F..H.-.h..R..EXdHY.......(....-J....Mg..%m.5I....]rQo.$M..m..m...dL.m.n.~....clT.m..=.(..3....Cz..p........k...dF?......s...rQ.)}....LS....}._.5......z.....P.B$.T.D..OX.r.5..-1.H..pD..L../.........'....&'\.T.N...........-.}J..Z....y.d!t..#....@.].!P5..S.`.A.`....E.y...k..*d.......p..O.H.7...P...q......4.....U.Y2.w4..E. Y]$Y.R...x.=..+...T7.-O..yH.0/.&....E.q1[.uOO[..=\Q"...,..W\q1\a..).......`acasaacc4s...XXX....e..v.-N.oh)...E%..D......#..CL

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	dropped
Size (bytes):	5601
Entropy (8bit):	5.7655360019382895
Encrypted:	false
SSDEEP:	96:2XobeWK+r3kiJfaaLUmbybQSfuaVRbm0HMgFfgWuAyEdVAmefr4/8VZPUGky:qobvfaa9DSfXDbXMaYPAyEdLefr4/YMe
MD5:	13FF42A071C43FA5521C11EB2F2EA914
SHA1:	B97D6318B384D57DEFD41EC4DEBF9D7DE198537C
SHA-256:	6B8776086567649C2432023184979BB8244A268C081FC1D478D834BF50A169F9
SHA-512:	F38C1D3760B23A65EACDB8214424227BDFE638C4A86E6DB89D8D86E29A820060165583FB7794E77935E52B62A6FE09567FC71FB44986D0FBD473F54DEBC56202
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}let s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null};class d extends(i=a.ZP.PersistedStore){initialize(e){null!=e&&(s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){return s.wowMomentWumpusMediaUrl}}o(d,"displayName","PurchasedItemsFestivityStore"),o(d,"persistKey","PurchasedItemsFestivityStore"),o(d,"migrations",[e=>({...e})]),t.Z=new d(c.Z,{LOGOUT:function(){s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null}},PURCHASED_ITEMS_FESTIVITY_SET_CAN_PLAY_WOW_MOMENT:functi

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28800)
Category:	dropped
Size (bytes):	28801
Entropy (8bit):	4.499298982951945
Encrypted:	false
SSDEEP:	384:h76Zul81CcPtMjBuvLTBrqDoiba+h3pjeuOXPRTpCLhuYNWGLk:h183ku3UDbzU9JYcOLk
MD5:	407D7D26D8FD716F400ECE5B46C3C2E7
SHA1:	7AD81F40D6895267C86905EE7E5E422D4BCD9C48
SHA-256:	B3C3F01A35C41D971347611B78E0652468367B120799D3B35724847AECF25B77
SHA-512:	610B5936B0046FB24E66563962E8FAC2C2574D4B860012A1FFD7FB8922E072E2A453D258C1D5613733757A4D8312A26D682756F0C02128180EBF154118610A29
Malicious:	false
Preview:	{"fingerprint":"1298907937510785088.5-G4GEYS2sOUMe00NM2RIBN_JDo","assignments":[[2810205487,1,1,-1,3,9634,0,0],[2617218444,4,1,-1,2,3374,0,0],[3035674767,0,1,-1,0,8770,0,0],[1609782151,0,1,-1,2,4276,0,0],[3643362751,0,1,-1,0,3704,0,0],[3753034466,1,2,-1,0,1089,0,0],[1913882179,0,1,-1,2,1078,0,0],[1567199723,0,1,-1,1,1483,0,0],[454783470,4,1,-1,0,4415,0,0],[3450899088,1,1,-1,0,7087,0,0],[3656796460,3,1,-1,3,3879,0,0],[1814483290,0,1,-1,0,3022,0,0],[4221006726,0,1,-1,0,5760,0,0],[1398673921,1,1,-1,0,7392,0,0],[2532700533,0,1,-1,0,4385,0,0],[3557480712,0,1,-1,0,3115,0,0],[853403133,4,1,-1,0,1552,0,0],[2491005019,4,1,-1,0,1286,0,0],[3889077804,2,1,-1,0,8778,0,0],[4079214319,2,1,-1,0,5077,0,0],[1034661306,0,1,-1,0,9955,0,0],[828251710,2,1,-1,1,7766,0,0],[3124003316,1,1,-1,0,1546,0,0],[2676348506,0,1,-1,0,5701,0,0],[4136574802,0,1,-1,1,5636,0,0],[4049571159,0,1,-1,0,4117,0,0],[3182051840,0,1,-1,0,4183,0,0],[2539540256,0,1,-1,3,2592,0,0],[3991298449,2,1,-1,2,7997,0,0],[472975400,6,1,-1,0,5432

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 45868, version 3.131
Category:	downloaded
Size (bytes):	45868
Entropy (8bit):	7.995149406203617
Encrypted:	true
SSDEEP:	768:7T3lyZzszaXGZG8vNh620Ph+EdGcNo3ITx62hw4oZkha6UK5+Ubp7tSSC5Zn/pf8:7TVyZwzQZ8vNd0Ph9/Nuo6GPUK5+UbJz
MD5:	D295C40AF6FCA08F8E0EB5425351F431
SHA1:	1D246A1E54B3A1F2428883D8C911AF73EDDFFCA6
SHA-256:	5D225B25D66B30563A00F395476ED701130D3F749620A63531CEA09FC537164E
SHA-512:	9C9F23CB775244EB10F83F964B36224AD2CD5152CFA5AB82928F68ED1CB49BE4156F887CC40A857B72EFD0833014E4366BF136689A717DD58828A1B195ED486E
Malicious:	false
URL:	https://discord.com/assets/8bd8143eff37936894aa.woff2
Preview:	wOF2.......,......................................x......\.`..X..@........T..@.6.$........ ..a..K..x[T...5...(..V.M..m...{.9....s49..ybj.......>}.m......O&r.%.T..Q....5.43.yD..u.%.S.w^.B....1p\|b2..g...Wuq.B...2.e~.3..>.I..TLP..c.....c$8..Tle.......U:6Wl.=.....U..V............W .iH8..7...r..~.eo.A......8..T.`.o........&.L".o.E..v....+B...N"].p...d [ ..Z_.w....s....L......,.E..=+.y3l...-......K..5..6....~.r.f..5D..U\|W.$...n.f.(6..j.\|....B...]..-....]"..5..[g.B..[s..% .[/.D..m.../...U}d....T.<....b......\|..Fc..K..2Y..pb}m\..p.....:.hn.6$F..F..1"E*.h+......&5r..(...\|\|g.N\T.....I.4KD[U.^V..y.{.n%j3.k.....E%...@...<(j.......O....K...0 L...QD.......Q.xzQ...[Y..".1F..1j0F...C.."e.i.wN/<.(...k.".++....`........UW.K3.......}...u+I%........y.o.v.ym....D\|f2.cWr@...l;.L.Y..~.&..g.... b[......j..I.i.H.{4n....s.y.`_v7..,...Z...".S.t.J3.[...t+.'b..F.6...Q`.!..B...N.0L.,<.:>......:@.SP..9@2.....rvr0.oJ,.5..p'..V.Js@.....L..%[.%#=.y3.\|..V.fa.m;).....G....._

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	downloaded
Size (bytes):	2750
Entropy (8bit):	5.460366645013334
Encrypted:	false
SSDEEP:	48:F0fzk02vWrc1AKTMSTEcr9rTOLBsmPBo/6XgpdgwrIsi5dEk+MQwq2kWkGRv6hvr:ek02hfMXcKs+lXyisi5CkiPrWk+Ch/Ew
MD5:	390A7AB1F964AA8CB1B87DD13732C3BC
SHA1:	CEA52AC6FA0CDF49A18D51C8CD8A5C4FB52DEAC9
SHA-256:	BEDD382930BA4E10DFA902BF833195911F82E754223441446E9D7CC45B01110F
SHA-512:	4B799488E35C5B933E9B1BA6AB335E2EAD6D625D3DC1FEC19DD80F48B9B7996171BEC24513095F3F1BAA9C8B7675FA4E527B763AEED26B69273BF2DCED014D3F
Malicious:	false
URL:	https://discord.com/assets/29a63f12209c956d9204.js
Preview:	(()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VERY_HARDCORE=5]="VERY_HARDCORE";let u={0:"NONE",4:"NONE",1:"CASUAL",2:"CASUAL",3:"COMPETITIVE",5:"COMPETITIVE"}},945124:function(t,r,n){n.d(r,{y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2Array.from(r.traits).filter(r=>t.traits.includes(r)).length),n}},866762:function(t,r,n){n(312677);var e=n(945124);self.addEventListener("message",t=>{var r,n;let{data:{unsortedClans:i,id:u,criteria:o}}=t;let a=(r=i,n=o,r.map(t=>({...t,affinity:(0,e.y)(t,n)})).sort((t,r)=>{var i,u;let o=null!==(i=r.affinity)&&void 0!==i?i:(0,e.y)(r,n);return o-

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	168789
Entropy (8bit):	5.612789333447181
Encrypted:	false
SSDEEP:	1536:lvVvKVPI1oqgO/usjA1vkY0JCxf7UG/9rHUQNbsbkb5a05VGOEc2+hzuy6fvxO7a:uVPIgPvEc7N/9rNhbYy6w7XvXcZ
MD5:	3B74671903D935A08DC04ACEF440C188
SHA1:	7B2C8D8AE72E5E2DA1BA4440722810565E11084C
SHA-256:	4AC4D0F31456B9D1741A52E5C54089952219E0C2287D83B81F12C94468DB3B03
SHA-512:	7F465558B1D640EEC9639921A70C0C0A9AE8BD7F95D0EE098B0553A7B84C5B983A9140FA48C45453FD8E39FAB7188000A2A0628300C4CEF9FE3F2742C20F1C62
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.svg"},806848:function(e){e.exports="/assets/6183fdc13d8046fd5bda.svg"},512266:function(e){e.exports="/assets/a2d51a24d014f52f83a6.png"},105020:function(e){e.exports="/assets/89ea0e62d0f8ffa67a17.svg"},211095:function(e){e.exports="/assets/86755fd1deda5cb45518.svg"},640356:function(e){e.exports="/assets/3880dc73d6be9d91ef36.svg"},515695:function(e){e.exports="/assets/450a761db3bfe89ca9b9.png"},892235:function(e){e.exports="/assets/48f03d965f1e82275006.svg"},375673:function(e){e.exports="/assets/3cf7f333e815240d3294.svg"},73962:function(e){e.exports="/assets/ed7318a94c14ce41d11d.svg"},689411:function(e){e.exports="/assets/831c999494cb5e095eae.svg"},2984:function(e){e.exports="/assets/0e5029fd9cd4812b6712.svg"},575703:function(e){e.exports=

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	24565
Entropy (8bit):	6.000976601202208
Encrypted:	false
SSDEEP:	384:xakxHbO0x9ipfSEuH44B445H44Q544Aq44Q4P44ZF944Q4Q4424Qb444nxWl444p:xZxH5ripqEuH44B445H44Q544Aq44Q4+
MD5:	EC2C34CADD4B5F4594415127380A85E6
SHA1:	E7E129270DA0153510EF04A148D08702B980B679
SHA-256:	128E20B3B15C65DD470CB9D0DC8FE10E2FF9F72FAC99EE621B01A391EF6B81C7
SHA-512:	C1997779FF5D0F74A7FBB359606DAB83439C143FBDB52025495BDC3A7CB87188085EAF12CC434CBF63B3F8DA5417C8A03F2E64F751C0A63508E4412EA4E7425C
Malicious:	false
URL:	https://discord.com/assets/favicon.ico
Preview:	............ .h...F... .... .........00.... ..%..V......... ..$...:..(....... ..... ..........................................dX2.dX..dW..dW..dX..dX..dX..dX2.........................dW..dW..dX..eX..eX..eX..eX..eX..eX..dW..dW..dW..............dW..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........dW..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW......dX2.dW..eX..eX..\|q......eX..eX..eX..eX......\|q..eX..eX..eX..eX2.dW..eX..eX..........................................eX..eX..eW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..............eX..........eX..............eX..eX..dW..dW..eX..eX..........................................eX..eX..dW..dW..eX..eX..~s..................................~s..eX..eX..dW..dW..eX..eX..eX..................................eX..eX..eX..dW..dX2.eX..eX..eX..h[..........{p..{p..........h[..eX..eX..dW..eW2.....dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..........eX..dX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eX..eW..e

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8712)
Category:	downloaded
Size (bytes):	8761
Entropy (8bit):	5.595354119822134
Encrypted:	false
SSDEEP:	96:7YoXmoXiURhBU9QCy4WqAVMF+FW91nuFua4MDeTVPpz6jid6ftysD9g9u6EPaLil:7YoXmoXE9xUFEuTKt2lyLkTp/os
MD5:	102FE4FDEC4447C9891C9F3FAEAE0474
SHA1:	3FA3BAF1DCED3A39DF8599BEEFA5180B436A782C
SHA-256:	E45508538EE1AB34F520303F7D1A9A7F5CB5D99FF34CE7E5EB64EB32EF6F19F9
SHA-512:	97942EEC44A5F613A45A514E355F26EC3B2458BA497009D4D70D88FF3562C94212DFB424AF0CE37BE880F3528446B28BBAB6F77C2717F0C16BF1317AFBC030D4
Malicious:	false
URL:	https://discord.com/assets/d86788be99e870993214.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverrides:!1,mustConfirmExternalLink:!0}).react},i={...s.Z.guildEventRules.channelMention,react:(0,a.Z)({enableBuildOverrides:!1,shouldCloseDefaultModals:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r.ZP.getUserCount(t,n));return(0,s.useEffect)(()=>{null!=e&&null!=t&&l.Z.getGuildEventUserCounts(e,t,null!=n?[n]:[])},[t,e,n]),i}},405613:function(e,t,n){n.d(t,{Z:function(){return l}});var s=n(134432),a=n(981631);function l(e,t){let n;if(null==e.image)return null;null==t&&(t=window.screen.width*(0,s.x_)()),t=(0,s.oO)(t);let l=window.

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7679)
Category:	dropped
Size (bytes):	7728
Entropy (8bit):	5.087323529198084
Encrypted:	false
SSDEEP:	96:wgSRVk6Wg8lh4Nrviiv1aWPRkDhTt9qwqSBtxCMNMRV0IBSAMD9C+m+rmxARJx3t:RSRVmriLDPRkxtRJxNMRV0IZdSL9ilfA
MD5:	1C6B9D0AD743762986197AE0E81874C1
SHA1:	EABACE4131BA74B108FC891EA843B4F85B218808
SHA-256:	2D739091F602476FCF261435B48A1FAFCE2533564FFF0549D27B47E341B4DCBF
SHA-512:	74FDE9F8997087BB107ED5DDC3A4A37BD24793CAAD605FBDCDD54E9D18AF8F44D0C0E92FB2259AA936BD1B20D5537441EF39D9A7F066323911436184B0138111
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}return function(){function e(){this.__entries__=[]}return Object.defineProperty(e.prototype,"size",{get:function(){return this.__entries__.length},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototype.delete=function(e){var n=this.__entries__,r=t(n,e);~r&&n.splice(r,1)},e.prototype.has=function(e){return!!~t(this.__entries__,e)},e.prototype.clear=function(){this.__entries__.splice(0)},e.prototype.forEach=function(t,e){void 0===e&&(e=null);for(var n=0,r=this.__entries__;n<r.length;n++){var i=r[n];t.call(e,i[1],i[0])}},e}()}(),i="undefined"!

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39724, version 2.66
Category:	downloaded
Size (bytes):	39724
Entropy (8bit):	7.994965715436545
Encrypted:	true
SSDEEP:	768:w35mZVsqT7RAo+6tbgLdolT9YSswcTWa+O/dm8ae41u37qt+:1xTO3kb0dolT998WhO/Hae4jt+
MD5:	FF5ECCDE83F118CEA0224EBBB9DC3179
SHA1:	0AD305614C46BDB6B7BB3445C2430E12AECEE879
SHA-256:	13DA02CE62B1A388A7C8D6F3BD286FE774EE2B91AC63D281523E80B2A8A063BC
SHA-512:	03DC88F429DD72D9433605C7C0F5659AD8D72F222DA0BB6BF03B46F4A509B17EC2181AF5DB180C2F6D11C02F39A871C651BE82E28FB5859037E1BBF6A7A20F6B
Malicious:	false
URL:	https://discord.com/assets/b21c5111a12372139409.woff2
Preview:	wOF2.......,......\|P.......B............................. .`..P..@..W........<.6.$..`..r.. ..<..F..`[pVq..w.SI..+.S.f;dS.i.. C.bj.6..w;./......OM&..[.mo-......4F`...SeR.XzP.g..j..L.....S.T(a..y.D...od./).....\|l...zn...T..OpZP....c\....%.H..y..g.!..!..\|._........O._.[.nJS..]..H....rd..#.?.n#.B.w.w...":.u...\|.a..#.#N...q.z.Z.....".5...X...3\|O...8>......(...H....M\|.w.o.%.%..\|5.'L.a.N.) ..G`.(1.je.#.~_.......!...7.e.......s.\.`G.^...h.B....tR.N..+"xU....3.F}0....z...@^..iB^....u&....._{.$]..........8k....?.c...^.~...A2...T.$.i.....Ycx!b~.x...3:g.[.!.X...fgt.duf.....uZW!....y..(].$.If_....g69.Ef.'{.ndC..Yt6...;..\..M......E'.^I....rFJ..)1\|...q......!.m~......../M.........7!I.E...U..!"....:...T9{!=.+... ..es2.2.%.Ll.t.j.D .p..<...$.....%...IB"'..#H.D............;OWk..G.Y.V....\&.U{.V....N.h....S[Yg(......f..Uu......z2.(.r..3...,-...G....c.9^"..:..>.......Q....S......]D'.,.@4..w./S.ep`...].sGR....Vc.j...-.\|..}_...&.eg.G..e.u...(./S..+H.'.9\.k%..

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	14624305
Entropy (8bit):	5.854943527266922
Encrypted:	false
SSDEEP:	196608:r6lXgFXaYzjupIEtYW4sZoymJBkD/skskv:rXXaYzjupIEtYW4sZ9mJBkDks
MD5:	216CB783D60A3E7C57C9D9FFEA99DC3F
SHA1:	C645D044161C447B84CBA1E62FCB018B5A7D6066
SHA-256:	48D0B669FD29BF3D5A6552EBD89B2048FBB6D58F824E8DD1F92772AC5821D716
SHA-512:	54F12CC52FBCAE1DF1575969CD269E75795B6D469B2C5CB0854D5A242A9A460CFBC8A9C9DCBDF4A7B7CEBC9EEC2EFC54A714C9CB6DB68974173DA2AC4E01E84B
Malicious:	false
Preview:	(()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["403530","29924"],"./cs.jsona":["753771","87233"],"./fi.jsona":["554545","7402"],"./es-419.jsona":["39227","59729"],"./ja.jsona":["516722","7728"],"./pt-BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"./lt.jsona":["877749","44754"],"./pl.jsona":["477384","60878"],"./hu.jsona":["107425","98570"],"./nl.jsona":["432763","41588"],"./th.jsona":["182260","49827"],"./bg.jsona":["251927","20575"],"./fr.jsona":["570173","99450"],"./zh-TW.jsona":["592369","30684"],"./hi.jsona":["629869","22732"],"./en-GB.jsona":["569249","99339"],"./ko.jsona":[

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 137140, version 2.459
Category:	downloaded
Size (bytes):	137140
Entropy (8bit):	7.998481140044296
Encrypted:	true
SSDEEP:	3072:kX89D4n2tV29WN9z2uXw/hqzr7IbI1O1KfB9Bk8WnRSqv2WDc+FC5:kn2tS/IzXIbIo1KZWUqv2W8
MD5:	F9BF0F65660D23C6F359D22720FC55AE
SHA1:	9FA19AB7EA56165E2138C443816C278D5752DD08
SHA-256:	426AE06CD942849AB48B84C287C760F3701B603EBCC5C9AAA4A89923EF5F058E
SHA-512:	436019A96E47848533684A34E3C360F516C29B2AA2473D0A05D50C0FD3AD19EAC39DF2DE12B6EC1C6760493EFB5ABF58E6A54D32080226FA1765983435634D88
Malicious:	false
URL:	https://discord.com/assets/f5b8aa3411dfc24ff2e6.woff2
Preview:	wOF2..............0....U..........................f........`........$..U.6.$..T..X.. ......[..[.;......w.N....ZjU...]".u..$.k..<..1...3@i...6.I.X......@ydf.h#..................{I~<:..I..C_........#.]7i..q[.+PF.U...x.......1..b..31Va....aB......n.V..&.Q.3cc.L...1f6.-:x.G..`EE.....r ......6..r..F.u..<\|..aEX.V......c.L.,....RX....V....FQ.u..q.^.{q.]#.y..I.....19c$..j...k...W.......+.....H.dy....-.c.....X<<.....@.Q=.........:....+....F..z.K..Y..{t..{..p..".I......M.X\|t........}......nk42...S\.....$H...0...m......#f>EU..-z.k\|.. ..Y.'..;<?.......S.C...............weU"...ES.2.>.%...O..q.@....F...0.aR.F\|[a..Vq...z\|HQ_m-j.3x1.XX.p...T./...z.p\|..<-...%;Fx.....8CG&d..FQ.{.'..1...1#7..a?.;.G.....~U..4.F.....Q.f...3..t:.~..o};"+...O....>D.x)%.. .O:.x.`N..]..uG.....C.!......%z..g...ZT.p.........5.......@!.S#/6$.k%..]...b=. $0gOC.]G\..lU....DH...(..;.e.B.!GH.5.eY.eY...-.m.....\..&.KYF3...-..........-......d..V.&w..... ..{..C.SZ...p)...d.w,...<....}.@

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18413)
Category:	dropped
Size (bytes):	18462
Entropy (8bit):	5.313916053766187
Encrypted:	false
SSDEEP:	384:r0Q0mLG04pG+rx1GoKoLItuPVMWpUdq3FYbNbeka5xeWoY/La0WMTUbbbutFY/GU:r0PmLGTGGDGoRstuKFNCQ/ORQL
MD5:	DC15D17D50A8A78E8C593E27FA1EAF57
SHA1:	42BD0149308EEBA00FF841AC13E5AB6DC7659513
SHA-256:	FFE3FB22E7E5528DA94902D66D2C834C448E7AC03896B63886E08CECCFC26A35
SHA-512:	4FF0AF46A6E692365F6037AD1778652A05401DBF3C2C042BF75B3AED44F37D642D63967FE65720176B3513E2791DC1DF9C784D0C9A3C2BF380832B4216569A5E
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/assets/e1ce6b38901837435ec5.png"},877604:function(t,i,e){e(411104);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(111543);function o(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureComponent){componentDidUpdate(t){t.src!==this.props.src&&this.setState({loaded:!1},()=>this.initialize())}initialize(){d(this.props.src).then(()=>{!this.unmounting&&this.setState({loaded:!0})})}componentWillUnmount(){this.unmounting=!0}render(){let{className:t,src:i,alt:e,width:s,height:h,onLoad:a,style:o,imageClassName:d}=this.props,{lo

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18413)
Category:	downloaded
Size (bytes):	18462
Entropy (8bit):	5.313916053766187
Encrypted:	false
SSDEEP:	384:r0Q0mLG04pG+rx1GoKoLItuPVMWpUdq3FYbNbeka5xeWoY/La0WMTUbbbutFY/GU:r0PmLGTGGDGoRstuKFNCQ/ORQL
MD5:	DC15D17D50A8A78E8C593E27FA1EAF57
SHA1:	42BD0149308EEBA00FF841AC13E5AB6DC7659513
SHA-256:	FFE3FB22E7E5528DA94902D66D2C834C448E7AC03896B63886E08CECCFC26A35
SHA-512:	4FF0AF46A6E692365F6037AD1778652A05401DBF3C2C042BF75B3AED44F37D642D63967FE65720176B3513E2791DC1DF9C784D0C9A3C2BF380832B4216569A5E
Malicious:	false
URL:	https://discord.com/assets/89b7ddebcacbe8dfbd3a.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/assets/e1ce6b38901837435ec5.png"},877604:function(t,i,e){e(411104);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(111543);function o(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}let d=t=>new Promise((i,e)=>{null==t&&e(Error("No image src passed"));let s=new Image;s.src=t,s.onload=()=>i(s),s.onerror=t=>e(t)});class u extends(s=h.PureComponent){componentDidUpdate(t){t.src!==this.props.src&&this.setState({loaded:!1},()=>this.initialize())}initialize(){d(this.props.src).then(()=>{!this.unmounting&&this.setState({loaded:!0})})}componentWillUnmount(){this.unmounting=!0}render(){let{className:t,src:i,alt:e,width:s,height:h,onLoad:a,style:o,imageClassName:d}=this.props,{lo

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.359578028959659
Encrypted:	false
SSDEEP:	24:Y74WU4bejvfkjyDEfXgAh/4ACjsY384W9iiex4grjh:Y741gerKyDEfbftY384Swx4UN
MD5:	E2CD13D6C4B1EF7E464FD22FBC18BA56
SHA1:	478AC70BFFF328092BC4A88898AD5ECB7232AB23
SHA-256:	B48B77DEC8C7D5A0953A7F8F06E363884387239A5A3BF9B9BD63945B68FE3A2B
SHA-512:	53F927063C760D199A8A11733AF3CB821C53BEF30EFAF4D113970CDE2AA6791E1FBED06EB947A707CC4316CAFA799CAE1B88A00280C05C6AE89BBF48C3B84A4C
Malicious:	false
Preview:	{"type":0,"code":"privatecommunity","expires_at":null,"guild":{"id":"1230227842877620359","name":"\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\udc15\ud835\udc00\ud835\udc13\ud835\udc04 \ud835\udc12\ud835\udc13\ud835\udc0e\ud835\udc11\ud835\udc04 \ud83d\udd10","splash":"04b58b5d8c863962ccdac305e5ee1269","banner":"0ada4913f44d405e7a85ad7d492c34fd","description":null,"icon":"a_75aa56a5faded73ac41ce0fac1e7d74c","features":["BANNER","PRIVATE_THREADS","ROLE_ICONS","THREE_DAY_THREAD_ARCHIVE","MEMBER_PROFILES","ENABLED_MODERATION_EXPERIENCE_FOR_NON_COMMUNITY","ANIMATED_BANNER","SOUNDBOARD","COMMUNITY","ANIMATED_ICON","NEWS","INVITE_SPLASH","VANITY_URL","SEVEN_DAY_THREAD_ARCHIVE"],"verification_level":4,"vanity_url_code":"privatecommunity","nsfw_level":0,"nsfw":false,"premium_subscription_count":56},"guild_id":"1230227842877620359","channel":{"id":"1230229306408697856","type":0,"name":"\ud83c\udf10\u30fb\ud835\udc12\ud835\udc08\ud835\udc13\ud835\udc04-\ud835\udc0f\ud835\udc11\ud835\udc08\ud835\ud

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7029)
Category:	dropped
Size (bytes):	7078
Entropy (8bit):	5.693672087902241
Encrypted:	false
SSDEEP:	192:EDHGzBioMyirXyf70li//fZc8Twtv1T5aLdMu951f54aH8L:EDmlioLirXyfYlw/xHWOyuB+acL
MD5:	45A3EE5FF96BDB2DD7FBB2846B5EA494
SHA1:	795E2BB4E00AB75A91BDBA9A4C7D9E2B2E0CD905
SHA-256:	08F280458FAB95C2E5754187C406458A8FE69A1C12329C8EF6CB801067E00BB6
SHA-512:	D545E8F9FE857A5A3AC908E1CCDA13ADCD19EFA78AE34143BCB36080C228090B8C5AE446EFE51C4A87A22BD9403B6E851219B331274D8929EB20AF81E9B159F8
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype")}},442975:function(r,t,o){var e=o(936940);r.exports=!e(function(){function r(){}return r.prototype.constructor=null,Object.getPrototypeOf(new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1},InvalidCharacterError:{s:"INVALID_CHARACTER_ERR",c:5,m:1},NoDataAllowedError:{s:"NO_DATA_ALLOWED_ERR",c:6,m:0},NoModificationAllowedError:{s:"NO_MODIFICATION_ALLOWED_ERR",c:7,m:1},NotFoundError:{s:"NOT_FOUND_ERR",c:8,m:1},NotSupportedError:{s:"NOT_SUPPORTED_ERR",c:9,m:1},InUseAttributeError:{s:"INUSE_ATTRIBUTE_ERR",c:10,m:1},InvalidStateError:{

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35271)
Category:	downloaded
Size (bytes):	35272
Entropy (8bit):	4.433207554415598
Encrypted:	false
SSDEEP:	384:LrRuL6Xw/c9dvGFG1CcPtMjBupLTBr3DozAbb2S+h3pjeuOzPRTfZoDpavLhuYp0:/ALr/uN3ku1BVbbqUNJgacuLk
MD5:	BD438ABD366DBE56EE2B4358C3C0F935
SHA1:	85BD89E9CBC72A88A8C637610970A2240C3B63E1
SHA-256:	D9084399BBFBFF959CB010192BB3F08E9E5E28F2E27B177D4856AF4AD28CA578
SHA-512:	35974AADAEFA9C9713A4005F7F71E9BA11CE6D106283121A69657B657D01B84AF9FDE256BAD65ADAC7508D653D11F7345B2B8A6E46301DB2CB0C80EAC4119CA1
Malicious:	false
URL:	https://discord.com/api/v9/experiments?with_guild_experiments=true
Preview:	{"fingerprint":"1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-Vlk","assignments":[[2810205487,1,1,-1,3,8503,0,0],[2617218444,4,1,-1,2,2731,0,0],[3035674767,0,1,-1,0,3216,0,0],[1609782151,0,1,-1,2,1231,0,0],[3643362751,0,1,-1,0,7596,0,0],[3753034466,1,2,-1,0,8638,0,0],[1913882179,0,1,-1,2,9398,0,0],[1567199723,0,1,-1,1,4943,0,0],[3091068323,0,2,-1,10,2840,0,0],[454783470,4,1,-1,0,3250,0,0],[3450899088,1,1,-1,0,3933,0,0],[3656796460,3,3,-1,3,4365,0,0],[2519288568,0,1,-1,4,4999,0,0],[1814483290,0,1,-1,0,4507,0,0],[4221006726,0,1,-1,0,1793,0,0],[1398673921,1,1,-1,0,9977,0,0],[2532700533,0,1,-1,0,924,0,0],[3557480712,0,1,-1,0,8150,0,0],[853403133,4,1,-1,0,2888,0,0],[2491005019,4,1,-1,0,4138,0,0],[3889077804,2,1,-1,0,9675,0,0],[4079214319,2,1,-1,0,1755,0,0],[1532280548,16,1,-1,5,74,0,0],[1095779154,0,1,-1,4,8431,0,0],[1398007839,0,1,-1,2,6446,0,0],[1034661306,0,1,-1,0,1683,0,0],[1944696695,0,1,-1,0,4681,0,0],[828251710,2,1,-1,1,2024,0,0],[3124003316,1,1,-1,0,8369,0,0],[2676348506,0,1,-1,0,2561

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3481)
Category:	dropped
Size (bytes):	3530
Entropy (8bit):	5.525597791927395
Encrypted:	false
SSDEEP:	48:4SloopsVL5u5CfGRxnDFzmThAlvnPE17cXfXTrI1iQhTTrUE7qp6upMNqsykTHuV:CokFVfMD04DvEbrOp6udE6ezfkjj
MD5:	BE6064FF8C1D480AFB80FE48762A06C1
SHA1:	F832A784FAEDB0BCFEE78661031D3C23C622501A
SHA-256:	3666E614B6564F13247BF5E53B0DD5C57F27ED75F397AA839F4B75BF55177203
SHA-512:	78E847E48E1A509B9E01550B10A94EA77D4D6BD9208131DD52FFAA379150660A2B7BA11750CA87173FDE4EB75A99512BC98ABDD6593D47DC1A0B8886905DF08E
Malicious:	false
Preview:	(()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(r){let{detail:t=1,pop:e=1}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},{PI:o,min:f,max:i,cos:u,round:a}=Math,c=r[0]\|r[1]<<8\|r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>>((1&w++)<<2)&15)/7.5-1)n);return o},j=x(b,g,(c>>18&31)/31/2),k=x(3,3,(l>>3&63)/63e),P=x(3,3,(l>>9&63)/63e),_=v?x(5,5,O):[],A=(0,n.UN)(r),C=a(A>1?32:32A),F=a(A>1?32/A:32),M=new Uint8Array(CF4),U=[],T=[];for(let r=0,e=0;r<F;r++)for(let n=0;n<C;n++,e+=4){let a=s,c=p,l=d,h=y;for(let r=0,t=i(b,v?5:3);r<t;r++)U[r]=u(o/C(n+.5)r);for(l

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	688
Entropy (8bit):	4.422809447424027
Encrypted:	false
SSDEEP:	12:t6AbzVKIh4zXvVg/jzDJU0uE2pLAZTX9D1jPb1qcNRxU7EK53TQke:tDbzVKwkXveLPC0uWZjR1LhFFkxhe
MD5:	C6CE0010471B65C0FAEDA6C53AB297BD
SHA1:	8735052DE92D694B4EA91CECCAB0E7E8F75A3CC7
SHA-256:	862046FEE1B4F3744F000347CC0B337871967B2BD9471BCB6DDED2A49A61C527
SHA-512:	7A054A7E19F80F7735CCDBC13E9CAFA13A779764C1725161B4EC7D3C793CFFB2E56C61109AA5F09A21E9DE3FD46B2E2EC756A6B03E46F4760125D282C14273C4
Malicious:	false
Preview:	<svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.09196.5369 1.65243l-1.9151 1.86674c-.2283.22257-.33252.54323-.2786.8575l.4521 2.63587c.1357.7914-.69496 1.3949-1.40567 1.0213l-2.36717-1.2445c-.28223-.1484-.6194-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" fill="#fff"/></svg>

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	137
Entropy (8bit):	4.832107377824175
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvcmJDmJS4RKb5KVErcHrFvR8hiJqGrqL0:t6Abli/c8mc4slmrFv2hiAe
MD5:	70275FE3104CF1D3388586AD8FFD478E
SHA1:	473EA46F5B22B5C7D14C39EE9C0C82811593883B
SHA-256:	3269CF3FDA7681388472225BAD39B6BB3B26088A0A03B6CD5796195F0114CE13
SHA-512:	044C0F8F1583FAEBA3A23FF2DF821A5A0E79C548DB3A6474614894DA2CB125476227407F865CF20D32DC7E4D9ADE09EBA6317EFB787EEED2570C0EBDFC401D2A
Malicious:	false
URL:	https://discord.com/assets/af5116b1db004acbdb8b.svg
Preview:	<svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	109613
Entropy (8bit):	5.4029332021931715
Encrypted:	false
SSDEEP:	1536:fCBKa1oPP8sGolumyOSsN5VYpLUBDL2QPidmHTRWisxpLAkF+d10J:qB9C81a5YpL5kl9sxpTa10J
MD5:	80F500D4D0495E5C74E9B92CBC26F088
SHA1:	A2C3F68D87AD8F793935FA7B8D05A0A2D635C4E0
SHA-256:	407002AD3FD8CF26EF02A802DD0D4DB7BFF395D8C22F5F8580CA6CE65A797238
SHA-512:	500C40BF257E7F4098B3B64CEDD49D8612FAF8B254CF496019C5B579C784A416F466C6BAC174B5317A663071E736C2DF82D22E6A7F88AF664BC421A974ABDF59
Malicious:	false
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|(255&e.charCodeAt(++r))<<24))1540483477+(((t>>>16)1540483477&65535)<<16),t^=t>>>24,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)^(t=(65535&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16),((o^=o>>>15)>>>0).toString(36)}},230371:function(e,t){"use strict";t.Z=function(e){var t={};return function(n){return void 0===t[n]&&(t[n]=e(n)),t[n]}}},184826:function(e,t){"use strict";t.Z=function(e){function t(e,t,o){var r=t.trim().split(h);t=r;var i=r.length,a=e.length;switch(a){case

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (905)
Category:	downloaded
Size (bytes):	957
Entropy (8bit):	5.034768569958886
Encrypted:	false
SSDEEP:	12:Bw1JU1t21f1C1bA19RAHxrV1e7Co1RSg341Nzg5mBU9K9K/sSelw1NeVE:BgJ0t2DKeAtG1Es4Fg57Xeis+
MD5:	20DDAA519E404695D0657D3868D2701F
SHA1:	0BDF7AD9C1F272B72FD83741504A39D5E8097901
SHA-256:	808A1D58F797547FE5A8ACDC841C6CA36E7440E1DCFFF9CB40497CAE9ED11143
SHA-512:	3D556D1EA31E803BB1E4EE11F68DAFC2FD0121E1A0E7EBE0BEDD1AFDFD646B05357842C825FFA0909492BA7FA00530C8B79BCD7A3778CF5B663194DF6D3BC227
Malicious:	false
URL:	https://discord.com/assets/2917679ca8a08c390036.css
Preview:	.wrapper_cd22e7,.activeWrapper_cd22e7{height:100%;left:0;position:absolute;top:0;width:100%;z-index:1002}.wrapper_cd22e7{pointer-events:none}.videoWrapper_cd22e7{position:absolute;transform:translate(-50%,-50%);top:50%;left:50%;z-index:200;pointer-events:none;width:auto;height:100%}@media(min-aspect-ratio:2880/2048){.videoWrapper_cd22e7{width:100%;height:auto}}.videoWrapperForHelper_cd22e7{position:absolute;pointer-events:none;z-index:200;top:0;left:0;width:100%;height:100%}.gadientHighlight_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none;background-image:linear-gradient(90deg,var(--premium-tier-2-purple-for-gradients)0%,var(--premium-tier-2-purple-for-gradients-2)50%,var(--premium-tier-2-pink-for-gradients)100%)}.swipeWrapper_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none}.swipe_cd22e7{position:absolute;height:100%;opacity:.1;width:auto;right:0;top:0}./# sourceMappingURL=2917679ca8a08c390036.css.map/

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3481)
Category:	downloaded
Size (bytes):	3530
Entropy (8bit):	5.525597791927395
Encrypted:	false
SSDEEP:	48:4SloopsVL5u5CfGRxnDFzmThAlvnPE17cXfXTrI1iQhTTrUE7qp6upMNqsykTHuV:CokFVfMD04DvEbrOp6udE6ezfkjj
MD5:	BE6064FF8C1D480AFB80FE48762A06C1
SHA1:	F832A784FAEDB0BCFEE78661031D3C23C622501A
SHA-256:	3666E614B6564F13247BF5E53B0DD5C57F27ED75F397AA839F4B75BF55177203
SHA-512:	78E847E48E1A509B9E01550B10A94EA77D4D6BD9208131DD52FFAA379150660A2B7BA11750CA87173FDE4EB75A99512BC98ABDD6593D47DC1A0B8886905DF08E
Malicious:	false
URL:	https://discord.com/assets/ac625b77a0bab0ee72df.js
Preview:	(()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(r){let{detail:t=1,pop:e=1}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},{PI:o,min:f,max:i,cos:u,round:a}=Math,c=r[0]\|r[1]<<8\|r[2]<<16,l=r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>>((1&w++)<<2)&15)/7.5-1)n);return o},j=x(b,g,(c>>18&31)/31/2),k=x(3,3,(l>>3&63)/63e),P=x(3,3,(l>>9&63)/63e),_=v?x(5,5,O):[],A=(0,n.UN)(r),C=a(A>1?32:32A),F=a(A>1?32/A:32),M=new Uint8Array(CF4),U=[],T=[];for(let r=0,e=0;r<F;r++)for(let n=0;n<C;n++,e+=4){let a=s,c=p,l=d,h=y;for(let r=0,t=i(b,v?5:3);r<t;r++)U[r]=u(o/C(n+.5)r);for(l

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17413)
Category:	downloaded
Size (bytes):	17462
Entropy (8bit):	5.594711522541062
Encrypted:	false
SSDEEP:	384:iwLnWOUnUuyMNps0HHHsglNzUxBAAdTRIZWiv/XB2kZYP:BLQne0P5UxMXB2kSP
MD5:	3B98C1EF9293D482A5099FDB6984946F
SHA1:	6FEFA9D8FF6B2DB16B5EC2ED5922DA0AE6187448
SHA-256:	A76F75BF6294EEA278F82522810ACBC3BCFA9290006F57746AD79BCA3615AD66
SHA-512:	CE9915807ADC42ECAF18D254091B31BD65CE9A29AF38820ACCC2A5D38BC8AA329471AE1E7F404B6F8D0F85CC643B3616863A70D0E3EA1B8C569AC64A5E889C54
Malicious:	false
URL:	https://discord.com/assets/1f7f046253c197b5a419.js
Preview:	(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function e(){return t}t.isRequired=t;var r={array:t,bigint:t,bool:t,func:t,number:t,object:t,string:t,symbol:t,any:t,arrayOf:e,element:t,elementType:t,instanceOf:e,node:t,objectOf:e,oneOf:e,oneOfType:e,shape:e,exact:e,checkPropTypes:i,resetWarningCache:n};return r.PropTypes=r,r}},639519:function(t,e,r){t.exports=r(884835)()},311596:function(t){"use strict";t.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},58615:function(t,e,r){var o=r(338091);function n(t){this.mode=o.MODE_8BIT_BYTE,this.data=t}n.prototype={getLength:fu

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18134)
Category:	downloaded
Size (bytes):	18183
Entropy (8bit):	5.745446950417671
Encrypted:	false
SSDEEP:	384:M7+ek/HNfVFGOSH4vgk+l/HyHOC7CmA5h4m4C2xYtL5c299H0KkBijYpthjDh2P1:g+ek/7VwEgkK/SuC7Cx5G1C2xYtL5c2R
MD5:	CB2E31554EC3CE69856DD70C281A6DB7
SHA1:	53524C140D3B966DFA9ADAF06A1AD062CC5FB9E1
SHA-256:	A4E79A1E245BDE12C9A8FE50342E450213CB0F3002D0453DE8FDEDE75630F2D2
SHA-512:	FB5D9629793FA3A432D955AE2193504445464719C92B7281612DC83912FCF1150A07F2BEDEDADFB102D8FC0D54980B769C933D4D99DEDAD0AFC14E3065ABE6FC
Malicious:	false
URL:	https://discord.com/assets/36e086bbcea2eace814d.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/assets/4676f063fb9f129e9fdb.svg"},561030:function(e){e.exports="/assets/75c80c4160a66983ae66.svg"},419185:function(e){e.exports="/assets/47e72e6360ce185adab6.svg"},826806:function(e){e.exports="/assets/fb418059f41b569abca4.svg"},123013:function(e){e.exports="/assets/98cacc492d985565ed4f.png"},540909:function(e){e.exports="/assets/2a5176cf2bd0ccdf0e7b.svg"},232454:function(e){e.exports="/assets/ad2027f11792ba8c0e7f.svg"},526916:function(e){e.exports="/assets/f38b6aefa24dc9a54765.svg"},29654:function(e){e.exports="/assets/dde11474b0623b723861.svg"},820160:function(e,s,a){a.d(s,{Z:function(){return L}});var E=a(200651);a(192379);var _=a(481060),t=a(813197),n=a(689938),r=a(510186);function L(e){let{icon:s,onChange:a}=e;return(0,E.jsx)(_.Fo

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	688
Entropy (8bit):	4.422809447424027
Encrypted:	false
SSDEEP:	12:t6AbzVKIh4zXvVg/jzDJU0uE2pLAZTX9D1jPb1qcNRxU7EK53TQke:tDbzVKwkXveLPC0uWZjR1LhFFkxhe
MD5:	C6CE0010471B65C0FAEDA6C53AB297BD
SHA1:	8735052DE92D694B4EA91CECCAB0E7E8F75A3CC7
SHA-256:	862046FEE1B4F3744F000347CC0B337871967B2BD9471BCB6DDED2A49A61C527
SHA-512:	7A054A7E19F80F7735CCDBC13E9CAFA13A779764C1725161B4EC7D3C793CFFB2E56C61109AA5F09A21E9DE3FD46B2E2EC756A6B03E46F4760125D282C14273C4
Malicious:	false
URL:	https://discord.com/assets/9017b7062734e72bb476.svg
Preview:	<svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.09196.5369 1.65243l-1.9151 1.86674c-.2283.22257-.33252.54323-.2786.8575l.4521 2.63587c.1357.7914-.69496 1.3949-1.40567 1.0213l-2.36717-1.2445c-.28223-.1484-.6194-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" fill="#fff"/></svg>

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 139388, version 2.459
Category:	downloaded
Size (bytes):	139388
Entropy (8bit):	7.99804629870967
Encrypted:	true
SSDEEP:	3072:Q69dyqPSD49z56qcFxDiYZHYj3pU5qJvdzqC3dZIwv82phTFsZ:yUSD49d6TDiYZ8pU4Jvlnd42vmZ
MD5:	DB985AAA3C64F10506D96D876E350D47
SHA1:	AAD4A93575E59643FED7617E2FEB893DD763D801
SHA-256:	234FEB9A8A2C759D00A4959506A3B9CB94C772186A2D117AED973347C7EF1891
SHA-512:	300D0D35EBB9E27D66489FFB3E5502A4DCD3AF032FB0F672D4F004E3846FB795772B6938C99DAFED6FAD0C25DA8412D6F6A7B0221EB2540E84527703DB5B7073
Malicious:	false
URL:	https://discord.com/assets/452d7be36bf4b23241bd.woff2
Preview:	wOF2...... \|......9... ...........................f...v....`...........e.6.$..T..X.. ..\|...[..[.B...c.{....:.w..T.l...C.T+...G.......F.\s...m..J.n`....y..6.<.................c......#............m..n...u..#$H..+....1).oq.l.@...U...#TpP...C..Xk.`.k.....(!...1k0....2f.W^.&hw.hF&h...v.[dA..Y./.6....zC..3._d.....r@...n.$...,.F.6X......SG....x...N.+..6.a%.].V}.u.(P..w.pK..%?.o......b.So1.....M.5.2........).`.N...D.fwTz..a.A. ...).=.\Y..Z.')+.../....0{..8..26u.;<a.......<...=.....eq;kD....Y..I^..`.R..n...T=.R..T.Jl.W..p..].....5.(y#....P.G.N........$Iv.....~....ns...J....TuY!o..jz...P5\|@..H.Tu.P.b!T..r7..,<.u.O....?......J.9...........r....~..f..U`...Y..\|....;..K>cl.....`_.+..l....f>.s.#w...36...[...9rI..t@.....b7.s..F....<..x.zT.t.5...8..?..j9k.'-.)u.[..w..>1I.....2.w.;..3.\?.,...b!.B$Qh.......A....?#...O.....5~W.h..HD.....V..d.O..\x1.rLV..U.4~...k.m.U...{6mg...q.ldfc...d..>[.i............<.".w^....4...XJ.n.xm..D.......M....XE.@.....GL...

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23014)
Category:	downloaded
Size (bytes):	41018
Entropy (8bit):	5.288611763514835
Encrypted:	false
SSDEEP:	768:AwNvVNMV9ptcE+wCFgFLWcE+wCFgFLjONOT/cEA6KAOD54Dow93Tz:bAVeE++E+GONOzcEsYnjz
MD5:	FBEC530F567CB32C81348642102C8348
SHA1:	8D1BD68302D72651A78FD252EE52552D4B7E3364
SHA-256:	24055C6A77C3CDB43FCBB15A9F48F622042F3E8052F177916E3325BCDC85D1F3
SHA-512:	CEF10273CCDECDC4A389724FD4499371595F79601B51AD8CFE14D333E393E5E67373A97D3EDAE722868A7E68A70A6A22FF764AEE40D3CAC21F8CFFC1A231A11F
Malicious:	false
URL:	https://discord.com/assets/591980d24607547de30a.css
Preview:	.discordLogo_b83a05{height:36px;width:112px;background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;display:none;flex-shrink:0;margin-bottom:16px}.authBox_b83a05{width:480px;padding:var(--custom-auth-box-auth-box-padding);font-size:18px;box-shadow:var(--legacy-elevation-high);border-radius:5px;box-sizing:border-box;color:var(--text-muted)}.authBox_b83a05 a{color:var(--text-link)}.authBox_b83a05 a:hover{-webkit-text-decoration:underline;text-decoration:underline}.authBoxExpanded_b83a05{width:784px}.centeringWrapper_b83a05{width:100%;text-align:center}.avatar_b83a05{margin-bottom:24px}@media(max-width:485px){.authBox_b83a05{position:absolute;top:0;right:0;bottom:0;left:0;padding:20px 16px;width:100%;height:100%;display:flex;align-items:center;flex-direction:column;background:linear-gradient(to left bottom,#3d4046,#1e1e23);border-radius:0;overflow:scroll}.authBox_b83a05 .discordLogo_b83a05{display:block}@media(max-width:830px){.authBox_b83a05.authBoxExpanded_b83a05{max-width:none}}.auth

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4246
Entropy (8bit):	4.103696787604314
Encrypted:	false
SSDEEP:	96:K9F4GfkbfNyN48/E8jfsrKk1Z/eO4oSgT3I/VcbQokvBD:KnqbfQ48/BfsrKYZ/eOBe9FJD
MD5:	DDA77F765068E4450D3545A40B777663
SHA1:	63AE45EF489734D09D3AEA98E016C0DD1BC733F9
SHA-256:	A644A9364BE96AD0A72F8E24397322B4D0646563A11E8FF76191A9239A561AC9
SHA-512:	D88521109D4AC8EA200F644973A7A554C1A6B8E0AE4658C7F0E3FAFBEE40A1CB8A6A75BECB2A49AE3B8D226BEE36CD8CA63B492FABC2BF034D6A295349567946
Malicious:	false
URL:	https://discord.com/assets/0e5029fd9cd4812b6712.svg
Preview:	<svg width="124" height="24" viewBox="0 0 124 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)"><g clip-path="url(#b)" fill="#fff"><path d="M26.242 2.01A25.218 25.218 0 0 0 19.851 0a18.718 18.718 0 0 0-.819 1.701 23.45 23.45 0 0 0-7.083 0A18.2 18.2 0 0 0 11.121 0a25.13 25.13 0 0 0-6.396 2.015C.68 8.132-.417 14.097.132 19.978c2.682 2.005 5.282 3.223 7.838 4.02A19.514 19.514 0 0 0 9.65 21.23a16.507 16.507 0 0 1-2.644-1.287c.222-.165.439-.337.648-.513 5.098 2.386 10.636 2.386 15.673 0 .211.177.428.348.648.513-.839.505-1.726.939-2.649 1.29A19.432 19.432 0 0 0 23.004 24c2.558-.797 5.16-2.015 7.843-4.022.643-6.817-1.099-12.728-4.605-17.968ZM10.343 16.361c-1.53 0-2.785-1.43-2.785-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174.003 1.74-1.228 3.17-2.785 3.17Zm10.293 0c-1.53 0-2.786-1.43-2.786-3.17 0-1.741 1.228-3.174 2.785-3.174 1.557 0 2.812 1.43 2.785 3.174 0 1.74-1.228 3.17-2.785 3.17ZM41.629 6.122h6.652c1.603 0 2.958.257 4.069.767 1.109.51 1.94 1

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17745)
Category:	downloaded
Size (bytes):	17794
Entropy (8bit):	5.473881721264957
Encrypted:	false
SSDEEP:	384:ynp0/xKyAhCrap7NrDNZAQJhGzsqX1VXn0Fmc1YNsEPoVUA7:ynpGyfplzJisajM
MD5:	8F5BEB794777EAC4C63978CD0EF850F4
SHA1:	1E1FC58F2A253F63B96801836B6E626898319D4C
SHA-256:	81614ED290684BA635701BA13C3D61377AE1D96E0A8F32FD424879AF56010044
SHA-512:	318626E5ECD021D3B8CC096AE0EA866D62A1CCA883643BD7813490AE7C87CD7D55114CE2FFD6D46F7688DC467A4A4BDB389EE9AF6688EFE0FD1A5FC205613E14
Malicious:	false
URL:	https://discord.com/assets/ea8b2ed5e609f40e7f7b.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143);var n,r=s(200651),i=s(192379),a=s(120356),o=s.n(a),l=s(593473),c=s(873546),u=s(442837),d=s(570140),h=s(893776),p=s(129293),m=s(388905),f=s(17894),C=s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent){componentDidMount(){(0,g.e)("reset_password")}renderPasswordReset(){let{password:e,error:t,hasCancel:n}=this.state,i=this.isSubmitting(),a=null!=t?t:this.renderError("password");return(0,r.jsxs)(m.ZP,{onSubmit:this.handleSubmit,tag:"form",children:[(0,r.jsx)("img",{alt:"",src:null==a?s(26230):s(935227),className:S.marginBottom20}),(0,r.jsx

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.921485085907038
Encrypted:	false
SSDEEP:	3:t6WH7W+ZacvTnARcLnkDmJS4RKb5KVErcHYWNTWi7eLFOyTIXGUNfHFQJJqGrqL0:t6AbZ/Ikn4mc4slmYWBWzLRI2ylQJAe
MD5:	B1D4C5E276E3AAA8EC41E6014DD572B2
SHA1:	B5B63A8B35223277D75C79B2AABD8221FDA383EB
SHA-256:	7CF5996F7AB483BD985B3DE5BFBCF50A2B22A7B473E8011E5C993D9830AF9D12
SHA-512:	8E4C954D96FBDA407E87FA65859FE758FC83F2DA0C6D7C07824926BFB0BCDF4F40DE057C5DD1D7EE0890C5287D2ED2EC8FDEFBDF317B46FE222339894E0A559B
Malicious:	false
Preview:	<svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8063), with no line terminators
Category:	downloaded
Size (bytes):	8063
Entropy (8bit):	5.762836560933041
Encrypted:	false
SSDEEP:	96:hcw3NY9Jxg6Zo7SH4QGJJ0G26Dc2U4b2N3gkLznc3GgKz++CR607ILy:Hy9Jxg6+7SYQGJJcIU4bq3NncthxD7wy
MD5:	EE203C67D1E5003BB23EF7B302698C0C
SHA1:	123CC98C2173A7A47CE7324594914322568E586A
SHA-256:	2343B92392E8365BF9530782C75A5922ADB0F2EA209F5CFC05CCDA8526030EFC
SHA-512:	1A0EF843BDBAFB918DE048B1B1C000D003D9628126756CF1789C9B950E09D1E49509DCC20116DC6C03025EF381B8EEAF2319CAA87AD5FEA298FEC661B53C62EC
Malicious:	false
URL:	https://discord.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
Preview:	window._cf_chl_opt={cFPWv:'g'};~function(V,h,i,n,o,s,z,A){V=b,function(c,d,U,e,f){for(U=b,e=c();!![];)try{if(f=-parseInt(U(443))/1+-parseInt(U(516))/2(-parseInt(U(531))/3)+parseInt(U(459))/4(-parseInt(U(475))/5)+parseInt(U(522))/6+-parseInt(U(478))/7+-parseInt(U(479))/8+-parseInt(U(466))/9*(-parseInt(U(501))/10),d===f)break;else e.push(e.shift())}catch(D){e.push(e.shift())}}(a,378800),h=this\|\|self,i=h[V(476)],n=function(a0,d,e,f){return a0=V,d=String[a0(454)],e={'h':function(D){return null==D?'':e.g(D,6,function(E,a1){return a1=b,a1(465)[a1(463)](E)})},'g':function(D,E,F,a2,G,H,I,J,K,L,M,N,O,P,Q,R,S,T){if(a2=a0,D==null)return'';for(H={},I={},J='',K=2,L=3,M=2,N=[],O=0,P=0,Q=0;Q<D[a2(535)];Q+=1)if(R=D[a2(463)](Q),Object[a2(487)][a2(432)][a2(458)](H,R)\|\|(H[R]=L++,I[R]=!0),S=J+R,Object[a2(487)][a2(432)][a2(458)](H,S))J=S;else{if(Object[a2(487)][a2(432)][a2(458)](I,J)){if(256>J[a2(467)](0)){for(G=0;G<M;O<<=1,E-1==P?(P=0,N[a2(442)](F(O)),O=0):P++,G++);for(T=J[a2(467)](0),G=0;8>G;O=O<<1\|1.8

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 960x540, components 3
Category:	dropped
Size (bytes):	33094
Entropy (8bit):	7.662961138741444
Encrypted:	false
SSDEEP:	384:lgO9OMfES6EqMU9mmYJIbvXWQGA7DC5QC1QP9HfPt6r5esdEiExCbli1zqlYlBaJ:lJU5zGQswlE1TEx8kzqloBYA8R
MD5:	7E3C950F6514CEAEC263944BB6149A6B
SHA1:	D60A06B2724156F2C808648E8B5D8D543D93B084
SHA-256:	2CFA6F333D5A195FDFC244B2F3FBEDBAC858071EEC196BCA300808BAC20BF273
SHA-512:	AF8A05BDB2900D7D06D782309340941C4A0C6623F60F672AD4342A474F17CC76A987584D7EEB8D64D8960D6126A7A9FDB3E847D70DE8BD06C6BBAC24F6851D77
Malicious:	false
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Z(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U..........(...(..o.~....O...(...(...(..^....^......(...(...#.....~....(...(...._.-!.ZZ.(...(...F...KH.t.)h...(...(..^....^......(...(...#.....~....(...(...._.-!.Z.Z(...(...F...KH.t.(.h...(...(...E...ZE...Z.(...(...O.?AKI.G.)h...(...(..U..........(...(..o.~....O...(...(...E...ZE....Z(...(...O.?AKI.G.(.h...(...).U.........

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.710597482771287
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvdnmFFSDDmJS4RKb5KGMXf/FGc8qQAGrqLW:t6Abli/m03mc4sldMX9QAw
MD5:	72A8B168AD2C7EEA7B2559B5690C7695
SHA1:	85E4F43154EA713C832BA27128A33EB7B2A7CF7A
SHA-256:	1F988D1AD4AB163D61A584254C07D75F3241EB6380BF48BF7D8F981E13C092CD
SHA-512:	11BCB1A3623B97C9DD2F22D0389B3CA05AB4F99596DE5D07C50C1FC83F7532D8C20B58379C54C38F503D86D8C2CAF52AF3B35FFCCDC4750089ABAF86C1C5294E
Malicious:	false
Preview:	<svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>.

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4804
Entropy (8bit):	3.9838661314243433
Encrypted:	false
SSDEEP:	96:Ez1Y5tmUKv0bhb9lsqYnlV4XdUo4e7JR0Tn515GGNj1j:eWtRK8Z4qYnlV4Xdt6RGaj1j
MD5:	22FD790491653D837422D80E3500CF92
SHA1:	E0618307DDC1E06D85729819B115D0652ABB148C
SHA-256:	641B1091276BA75578C3D93F367F0D70BCBBA7C62A7F159C4307ACF0ED6C5CBE
SHA-512:	AD2100B9391969B160D3DE80C7310CF5706B89CD097D8B48D6DF0D96E9CFB73C15DDD487DF7773C28094A152EC9D4F8F6E6B718C96FAF734708018C65511266E
Malicious:	false
Preview:	<svg fill="none" height="36" viewBox="0 0 130 36" width="130" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m27.5247 8.06243c-2.1034-.96349-4.3524-1.66374-6.7036-2.06243-.2888.51114-.6261 1.19861-.8587 1.74553-2.4995-.36802-4.9759-.36802-7.4293 0-.2326-.54692-.5777-1.23439-.869-1.74553-2.35376.39869-4.60533 1.1015-6.70864 2.06754-4.242451 6.27676-5.392506 12.39766-4.817478 18.43156 2.813808 2.0574 5.540698 3.3071 8.221628 4.1249.6619-.892 1.25228-1.8401 1.76089-2.8394-.96862-.3603-1.89634-.805-2.77294-1.3213.23259-.1686.46001-.345.67979-.5265 5.34655 2.4484 11.15555 2.4484 16.43815 0 .2224.1815.4498.3579.6798.5265-.8791.5188-1.8094.9635-2.778 1.3239.5086.9967 1.0964 1.9474 1.7609 2.8393 2.6834-.8178 5.4129-2.0675 8.2267-4.1274.6747-6.9949-1.1526-13.0595-4.8302-18.43667zm-16.6759 14.72587c-1.6049 0-2.92111-1.467-2.92111-3.2534s1.28807-3.2559 2.92111-3.2559c1.6331 0 2.9493 1.4669 2.9212 3.2559.0025 1.7864-1.2881 3.2534-2.9212 3.2534zm10.7952 0c-1.6049 0-2.9211-1.467-2.9211-3

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (970)
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.481455450518707
Encrypted:	false
SSDEEP:	24:wkU14HIuIuISm+mm7VOhR1RYIbTOZF7B7v/SlCxKqWeeUu5m:wkTH/bIm7VObfqZFN7vqYxKfv5m
MD5:	5489024A0568CEB2CCC181B8BA420A0F
SHA1:	121F6E3A6DE26A8DCF7A967C442A8509BC196CDC
SHA-256:	34048A4F2D6B0861798B4D37954DAC09E8071EBB63C8E9B6D8ADF20BE95BFF82
SHA-512:	1C9B0EEF72C329B62D8DBAD87C9BCD78E65C11EFC5075C8EE8120A62F803E0F97B78E9E481373DC88908B00B8D9A9675CA81038EFE05E65BF9E9F3247A8F8D15
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(981631);let c="linux";function r(n){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],i=arguments.length>2?arguments[2]:void 0;return"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win":-1!==t.indexOf("Ubuntu")\|\|-1!==t.indexOf("Debian")\|\|-1!==t.indexOf("Fedora")\|\|-1!==t.indexOf("Red Hat")\|\|-1!==t.indexOf("SuSE")\|\|-1!==t.indexOf("Linux")?c:-1!==t.indexOf("OS X")?"osx":"win"}function d(n){return({win:"Windows",osx:"Mac",[c]:"Linux"})[a(n)]}function f(){let n=a();return r(n,!1,n===c?"tar.gz":null)}}}]);.//# sourceMappingURL=b8160243

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8712)
Category:	dropped
Size (bytes):	8761
Entropy (8bit):	5.595354119822134
Encrypted:	false
SSDEEP:	96:7YoXmoXiURhBU9QCy4WqAVMF+FW91nuFua4MDeTVPpz6jid6ftysD9g9u6EPaLil:7YoXmoXE9xUFEuTKt2lyLkTp/os
MD5:	102FE4FDEC4447C9891C9F3FAEAE0474
SHA1:	3FA3BAF1DCED3A39DF8599BEEFA5180B436A782C
SHA-256:	E45508538EE1AB34F520303F7D1A9A7F5CB5D99FF34CE7E5EB64EB32EF6F19F9
SHA-512:	97942EEC44A5F613A45A514E355F26EC3B2458BA497009D4D70D88FF3562C94212DFB424AF0CE37BE880F3528446B28BBAB6F77C2717F0C16BF1317AFBC030D4
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverrides:!1,mustConfirmExternalLink:!0}).react},i={...s.Z.guildEventRules.channelMention,react:(0,a.Z)({enableBuildOverrides:!1,shouldCloseDefaultModals:!0,shouldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r.ZP.getUserCount(t,n));return(0,s.useEffect)(()=>{null!=e&&null!=t&&l.Z.getGuildEventUserCounts(e,t,null!=n?[n]:[])},[t,e,n]),i}},405613:function(e,t,n){n.d(t,{Z:function(){return l}});var s=n(134432),a=n(981631);function l(e,t){let n;if(null==e.image)return null;null==t&&(t=window.screen.width*(0,s.x_)()),t=(0,s.oO)(t);let l=window.

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17745)
Category:	dropped
Size (bytes):	17794
Entropy (8bit):	5.473881721264957
Encrypted:	false
SSDEEP:	384:ynp0/xKyAhCrap7NrDNZAQJhGzsqX1VXn0Fmc1YNsEPoVUA7:ynpGyfplzJisajM
MD5:	8F5BEB794777EAC4C63978CD0EF850F4
SHA1:	1E1FC58F2A253F63B96801836B6E626898319D4C
SHA-256:	81614ED290684BA635701BA13C3D61377AE1D96E0A8F32FD424879AF56010044
SHA-512:	318626E5ECD021D3B8CC096AE0EA866D62A1CCA883643BD7813490AE7C87CD7D55114CE2FFD6D46F7688DC467A4A4BDB389EE9AF6688EFE0FD1A5FC205613E14
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143);var n,r=s(200651),i=s(192379),a=s(120356),o=s.n(a),l=s(593473),c=s(873546),u=s(442837),d=s(570140),h=s(893776),p=s(129293),m=s(388905),f=s(17894),C=s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent){componentDidMount(){(0,g.e)("reset_password")}renderPasswordReset(){let{password:e,error:t,hasCancel:n}=this.state,i=this.isSubmitting(),a=null!=t?t:this.renderError("password");return(0,r.jsxs)(m.ZP,{onSubmit:this.handleSubmit,tag:"form",children:[(0,r.jsx)("img",{alt:"",src:null==a?s(26230):s(935227),className:S.marginBottom20}),(0,r.jsx

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 39764, version 2.66
Category:	downloaded
Size (bytes):	39764
Entropy (8bit):	7.993646621116526
Encrypted:	true
SSDEEP:	768:90TMDBOLlFMKbQDweRs+mkq4oY+VT6p+0t5LMXTkfm7s/U2Uq:6TppGKMDwtN4orTAHjMDja
MD5:	71D3E9DC2BCB8E91225BA9FAB588C8F2
SHA1:	D7E38EE4C245F64B78EB18E6ECD7B9F53B3254A8
SHA-256:	AE99AAEDE2F373187A4FE442A2CB0AB9C2945EFBAB01CF33E01BE517C0C4F813
SHA-512:	DEDA05EBD575D413AA2277876991ECC2EA238907390753485BA1B487EDE2F432363C46DAAD5F3F240EAAF8D3258150829A3AE3D2D9C420EA59567CFD440361A6
Malicious:	false
URL:	https://discord.com/assets/1222195a37d6dd10994e.woff2
Preview:	wOF2.......T......}........B..........................z.. .`..P..D..W........S.6.$..`..r.. .....F..=[.W..ir.h......,......j..In.X....Uj..3...`K\t........".%.]..p..E........G..9&r...S.+.r.5....~`.....S'..1~.a..H...S.........N.tX2G7.u..m.z.!.......).w....V....:.6..W.\.+..j.K...[\|.n..dg.....Kx:;....7?2.j..\...0..=zd.(...{.c.....}._..Q.....dUx....b.\Y,.........W.b.zkAX.,..X..jO..w..% .[..DD.X..G\..?.9..\.G...#...T ..".$.Z.P...W..5.b.._......}at.....@2.A.....m...5Oy....e.a...D...'.s.$...Q.......[.....A.....r..&....8.Q.KZ.#G...#_.~...yh1$.b~.0S[..6..+...../...jdlcC_0S..J.J!e.'...)3.O..}.C.)...v.qn.......5}.7{.m.b.&:.S..h>.hz..."N.G8..A..&.....s...3<...C... _.F$.`.J.....UuKv.ik.H.'....e..b-k..kt..!....Q.l.R)ai&....Dp..\T).O...'6.<....u..WiM.s....I@.....+.....=...&.6.N..n.....\..k...8.....P6.f..k{...3....5....C..T.iG.5....s...$W..=^...3..V.._\..J..2`.........z........1....l.F... .zVb...0.Z..=........[2?.V.....J.....!4B.U..*.....>.Ta`0...

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	downloaded
Size (bytes):	5601
Entropy (8bit):	5.7655360019382895
Encrypted:	false
SSDEEP:	96:2XobeWK+r3kiJfaaLUmbybQSfuaVRbm0HMgFfgWuAyEdVAmefr4/8VZPUGky:qobvfaa9DSfXDbXMaYPAyEdLefr4/YMe
MD5:	13FF42A071C43FA5521C11EB2F2EA914
SHA1:	B97D6318B384D57DEFD41EC4DEBF9D7DE198537C
SHA-256:	6B8776086567649C2432023184979BB8244A268C081FC1D478D834BF50A169F9
SHA-512:	F38C1D3760B23A65EACDB8214424227BDFE638C4A86E6DB89D8D86E29A820060165583FB7794E77935E52B62A6FE09567FC71FB44986D0FBD473F54DEBC56202
Malicious:	false
URL:	https://discord.com/assets/05bd1eb5dea5ee3387f4.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}let s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null};class d extends(i=a.ZP.PersistedStore){initialize(e){null!=e&&(s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){return s.wowMomentWumpusMediaUrl}}o(d,"displayName","PurchasedItemsFestivityStore"),o(d,"persistKey","PurchasedItemsFestivityStore"),o(d,"migrations",[e=>({...e})]),t.Z=new d(c.Z,{LOGOUT:function(){s={canPlayWowMoment:!1,isFetchingWowMomentMedia:!1,wowMomentWumpusMediaUrl:null}},PURCHASED_ITEMS_FESTIVITY_SET_CAN_PLAY_WOW_MOMENT:functi

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (970)
Category:	downloaded
Size (bytes):	1019
Entropy (8bit):	5.481455450518707
Encrypted:	false
SSDEEP:	24:wkU14HIuIuISm+mm7VOhR1RYIbTOZF7B7v/SlCxKqWeeUu5m:wkTH/bIm7VObfqZFN7vqYxKfv5m
MD5:	5489024A0568CEB2CCC181B8BA420A0F
SHA1:	121F6E3A6DE26A8DCF7A967C442A8509BC196CDC
SHA-256:	34048A4F2D6B0861798B4D37954DAC09E8071EBB63C8E9B6D8ADF20BE95BFF82
SHA-512:	1C9B0EEF72C329B62D8DBAD87C9BCD78E65C11EFC5075C8EE8120A62F803E0F97B78E9E481373DC88908B00B8D9A9675CA81038EFE05E65BF9E9F3247A8F8D15
Malicious:	false
URL:	https://discord.com/assets/b8160243347055e1f278.js
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(981631);let c="linux";function r(n){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],i=arguments.length>2?arguments[2]:void 0;return"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win":-1!==t.indexOf("Ubuntu")\|\|-1!==t.indexOf("Debian")\|\|-1!==t.indexOf("Fedora")\|\|-1!==t.indexOf("Red Hat")\|\|-1!==t.indexOf("SuSE")\|\|-1!==t.indexOf("Linux")?c:-1!==t.indexOf("OS X")?"osx":"win"}function d(n){return({win:"Windows",osx:"Mac",[c]:"Linux"})[a(n)]}function f(){let n=a();return r(n,!1,n===c?"tar.gz":null)}}}]);.//# sourceMappingURL=b8160243

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4804
Entropy (8bit):	3.9838661314243433
Encrypted:	false
SSDEEP:	96:Ez1Y5tmUKv0bhb9lsqYnlV4XdUo4e7JR0Tn515GGNj1j:eWtRK8Z4qYnlV4Xdt6RGaj1j
MD5:	22FD790491653D837422D80E3500CF92
SHA1:	E0618307DDC1E06D85729819B115D0652ABB148C
SHA-256:	641B1091276BA75578C3D93F367F0D70BCBBA7C62A7F159C4307ACF0ED6C5CBE
SHA-512:	AD2100B9391969B160D3DE80C7310CF5706B89CD097D8B48D6DF0D96E9CFB73C15DDD487DF7773C28094A152EC9D4F8F6E6B718C96FAF734708018C65511266E
Malicious:	false
URL:	https://discord.com/assets/23a7a3fd6624342117bf.svg
Preview:	<svg fill="none" height="36" viewBox="0 0 130 36" width="130" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m27.5247 8.06243c-2.1034-.96349-4.3524-1.66374-6.7036-2.06243-.2888.51114-.6261 1.19861-.8587 1.74553-2.4995-.36802-4.9759-.36802-7.4293 0-.2326-.54692-.5777-1.23439-.869-1.74553-2.35376.39869-4.60533 1.1015-6.70864 2.06754-4.242451 6.27676-5.392506 12.39766-4.817478 18.43156 2.813808 2.0574 5.540698 3.3071 8.221628 4.1249.6619-.892 1.25228-1.8401 1.76089-2.8394-.96862-.3603-1.89634-.805-2.77294-1.3213.23259-.1686.46001-.345.67979-.5265 5.34655 2.4484 11.15555 2.4484 16.43815 0 .2224.1815.4498.3579.6798.5265-.8791.5188-1.8094.9635-2.778 1.3239.5086.9967 1.0964 1.9474 1.7609 2.8393 2.6834-.8178 5.4129-2.0675 8.2267-4.1274.6747-6.9949-1.1526-13.0595-4.8302-18.43667zm-16.6759 14.72587c-1.6049 0-2.92111-1.467-2.92111-3.2534s1.28807-3.2559 2.92111-3.2559c1.6331 0 2.9493 1.4669 2.9212 3.2559.0025 1.7864-1.2881 3.2534-2.9212 3.2534zm10.7952 0c-1.6049 0-2.9211-1.467-2.9211-3

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.832107377824175
Encrypted:	false
SSDEEP:	3:t6WH7W+lFAATcvcmJDmJS4RKb5KVErcHrFvR8hiJqGrqL0:t6Abli/c8mc4slmrFv2hiAe
MD5:	70275FE3104CF1D3388586AD8FFD478E
SHA1:	473EA46F5B22B5C7D14C39EE9C0C82811593883B
SHA-256:	3269CF3FDA7681388472225BAD39B6BB3B26088A0A03B6CD5796195F0114CE13
SHA-512:	044C0F8F1583FAEBA3A23FF2DF821A5A0E79C548DB3A6474614894DA2CB125476227407F865CF20D32DC7E4D9ADE09EBA6317EFB787EEED2570C0EBDFC401D2A
Malicious:	false
Preview:	<svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11118)
Category:	dropped
Size (bytes):	11167
Entropy (8bit):	5.535074023387345
Encrypted:	false
SSDEEP:	192:YVQA29dyFDfqMgeYTllT06FJLviKriLZErOWD8yLg6T06oGL3rOhzus:QazsqP116In4zn
MD5:	8AAA605C48DC545F185CA77C921139D3
SHA1:	D2481F19DC4D8F4B161D3DD0B35B446FDC505446
SHA-256:	9ADEBA0225F0D293B735E83C05D1BB063F750C439CE8BCD7ED362D795CFD39B1
SHA-512:	469573F4D8F912DC151474F9ACA815F2A686C590408B20733E58C1C21F8DC71A26B2569B8052A8B67331D2DD2FA4E54AD7B4D953FEBC2DCA0676827AC0EFD377
Malicious:	false
Preview:	"use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messages.MFA_V2_TOTP_NAME},get sms(){return n.Z.Messages.MFA_V2_SMS_NAME},get password(){return n.Z.Messages.MFA_V2_PASSWORD_NAME},get backup(){return n.Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);function f(e){var t,s;let{mfaChallenge:h,mfaFinish:f,onEarlyClose:m,onClose:S,width:_=440}=e,[g,x]=l.useState(null!==(s=null===(t=h.methods[0])\|\|void 0===t?void 0:t.type)&&void 0!==s?s:"select"),[E,C]=l.useState(g),p=async e=>{let{mfaType:t,data:s}=e;await f({mfaType:t,data:s,ticket:h.ticket}),null!=S&&S()},v={mfaChallenge:h,finish:p,setSli

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.003997527334849
Encrypted:	false
SSDEEP:	3:HnRthLK5a6eCMABe:HRoJPO
MD5:	DF5DC1ABC0D52F3C9E931E26A7C0065C
SHA1:	EE84123D3B3BC440C63DFE65FF5616BE2B0904D5
SHA-256:	F7167A2FACDE50428D8D2697A1CDFF075DE809323DD16D62B65CDD103B2A9A6D
SHA-512:	9B2253CE41880D22A2DDF4F886BB6CB22FF0C981400CD9D03A1FCA81DE5FAEB86C26B85B66ECEC960816D7BBE9740843890F2FCCD334B6D274295A32A8E6A4E9
Malicious:	false
Preview:	The system cannot find the file specified...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.423569838871576
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LDlanZur0i.exe
File size:	506'368 bytes
MD5:	3b58529670cc2c98fb964a9a2c36fa9f
SHA1:	8575d737bb6bf1ff5c1b603c48a63f9abd0ac5ea
SHA256:	60477891a177629200ba4f8039b5b42351dccdfd9bc404c0a004a8a387a4de82
SHA512:	7aaa635a04e4876d716831e001d307abee0e4893c2c3b6b46463a30e22e10e4f756c923d52f9530086a690be41c53503775cea14ae535b4d9a506572a612989b
SSDEEP:	6144:u6n2e5fa+vd7kXZht5nBPf34ox70+TMEW+rdOzxntBtpe/ry05xIKKdH4f/c6:u62xIMDBPf3/70cWWOz1/twGSCH4F
TLSH:	FAB47D97A7A807E9D1A7D03CC547C603E7B6B49913109BDB43A4CA791F637E12E3A720
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........V...V...V..._.+.B...PHE.^...PH..v...PH..\...PH..R...PH..P.......A...V...s.......?...9H..T...9H..W...9HG.W...9H..W...RichV..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14005fa08
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6716ABFB [Mon Oct 21 19:31:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3dd1b7e6418973ac2798d88d33677d96

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8B51206988h
dec eax
add esp, 28h
jmp 00007F8B51206277h
int3
int3
jmp 00007F8B51206C38h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0000175Bh]
dec eax
mov ecx, ebx
call dword ptr [000016C2h]
call dword ptr [00001744h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001740h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00001734h]
test eax, eax
je 00007F8B51206409h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00018DE2h]
call 00007F8B512065CEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00018EC9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00018E59h], eax
dec eax
mov eax, dword ptr [00018EB2h]
dec eax
mov dword ptr [00018D23h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00018E27h], eax
mov dword ptr [00018CFDh], C0000409h
mov dword ptr [00018CF7h], 00000001h
mov dword ptr [00000001h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x760f0	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x79000	0x3f84	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x4e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6ffd0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x70080	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6fe90	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61000	0x818	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdd8	0x5fe00	f3300104a0b3551b952d7aab7c9e67a8	False	0.53282879726206	data	6.336874548753545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x61000	0x16b92	0x16c00	2490934f9d1e87d270cb2d1c3401e96d	False	0.37956086881868134	data	5.580144875201336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x78000	0xdf8	0x400	655e9f7c7fb6b8a45e906f7f275d46f8	False	0.212890625	mumps blt global (V6) - 596 byte blocks - P/D format	2.441361154031489	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x79000	0x3f84	0x4000	6958d7a482fdbe14be61350635b2382f	False	0.48187255859375	data	5.77717054413388	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x1e8	0x200	7d03a0f9d3c3a10dec18b513161e66d8	False	0.54296875	data	4.772037401703051	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7e000	0x4e4	0x600	0fffa779ce3f96440fc92f1aa0c636a8	False	0.5123697916666666	data	4.824092949506385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7d060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	WideCharToMultiByte, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, GetTickCount, QueryPerformanceCounter, VerifyVersionInfoA, LoadLibraryA, GetProcAddress, GetModuleHandleA, FreeLibrary, GetSystemDirectoryA, CreateFileA, VerSetConditionMask, SleepEx, LeaveCriticalSection, EnterCriticalSection, FormatMessageA, SetLastError, CloseHandle, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, GetCurrentProcessId, GetCurrentThreadId, GetFileSizeEx, WaitForMultipleObjects, PeekNamedPipe, ReadFile, GetFileType, GetEnvironmentVariableA, MultiByteToWideChar, WaitForSingleObjectEx, QueryPerformanceFrequency, GetSystemTimeAsFileTime, MoveFileExA, DeleteCriticalSection, GetLastError, InitializeCriticalSectionEx, OutputDebugStringW, InitializeSListHead, GetConsoleWindow, SetConsoleTitleA, SetConsoleTextAttribute, Sleep, GetStdHandle
USER32.dll	GetWindowLongPtrA, SetWindowLongPtrA, MessageBoxA, SetLayeredWindowAttributes
ADVAPI32.dll	CryptAcquireContextA, CryptReleaseContext, CryptGetHashParam, CryptGenRandom, CryptCreateHash, CryptHashData, CryptDestroyHash, CryptDestroyKey, CryptImportKey, CryptEncrypt
SHELL32.dll	ShellExecuteA
MSVCP140.dll	?_Xlength_error@std@@YAXPEBD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z, ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?_Xbad_function_call@std@@YAXXZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
urlmon.dll	URLDownloadToFileA
Normaliz.dll	IdnToAscii
WLDAP32.dll
CRYPT32.dll	CertGetCertificateChain, CertFreeCertificateChainEngine, CertCreateCertificateChainEngine, CryptQueryObject, CertGetNameStringA, CertFindExtension, CertAddCertificateContextToStore, CertFreeCertificateChain, PFXImportCertStore, CryptStringToBinaryA, CertFreeCertificateContext, CertFindCertificateInStore, CertEnumCertificatesInStore, CertCloseStore, CertOpenStore, CryptDecodeObjectEx
WS2_32.dll	gethostname, sendto, recvfrom, freeaddrinfo, getaddrinfo, select, ioctlsocket, listen, htonl, accept, WSACleanup, WSAStartup, WSAIoctl, WSASetLastError, socket, setsockopt, ntohs, htons, getsockopt, getsockname, getpeername, connect, bind, WSAGetLastError, send, recv, closesocket, ntohl, __WSAFDIsSet
VCRUNTIME140.dll	__std_exception_copy, __std_exception_destroy, _CxxThrowException, memcpy, memset, __std_terminate, __C_specific_handler, __current_exception_context, __current_exception, memchr, memcmp, strchr, strstr, memmove, strrchr
VCRUNTIME140_1.dll	__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn, _beginthreadex, _errno, __sys_nerr, _getpid, exit, system, terminate, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _cexit, _seh_filter_exe, _set_app_type, strerror, _c_exit, _initterm, _initterm_e, _exit, __p___argv, __p___argc, _get_initial_narrow_environment
api-ms-win-crt-heap-l1-1-0.dll	realloc, _callnewh, free, calloc, _set_new_mode, malloc
api-ms-win-crt-utility-l1-1-0.dll	rand, qsort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vfprintf, fseek, feof, __p__commode, __acrt_iob_func, ftell, fputc, _lseeki64, _read, _write, _close, _open, fflush, __stdio_common_vsscanf, __stdio_common_vsprintf, fread, fputs, fopen, fwrite, fgets, fclose, _set_fmode
api-ms-win-crt-convert-l1-1-0.dll	strtod, atoi, strtoul, strtoull, strtol, strtoll
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale, localeconv
api-ms-win-crt-time-l1-1-0.dll	_time64, _gmtime64
api-ms-win-crt-string-l1-1-0.dll	strcmp, strncmp, isupper, strcspn, strspn, _strdup, strncpy, tolower, strpbrk
api-ms-win-crt-filesystem-l1-1-0.dll	_stat64, _unlink, _access, _fstat64
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr, _dclass

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 09:16:03.842767000 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 24, 2024 09:16:04.154527903 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 24, 2024 09:16:04.763947964 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 24, 2024 09:16:04.920151949 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 24, 2024 09:16:05.966981888 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 24, 2024 09:16:06.842001915 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 24, 2024 09:16:06.842060089 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 24, 2024 09:16:08.373214960 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 24, 2024 09:16:08.777576923 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:08.777606010 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:08.777688026 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:08.778069973 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:08.778085947 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.534493923 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.534598112 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.538660049 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.538672924 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.539033890 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.550328016 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.595330000 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.772892952 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.772922039 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.772937059 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.772999048 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.773009062 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.773027897 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.773118019 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.798823118 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.798906088 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.798922062 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.798930883 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.799068928 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.891663074 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.891689062 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.891798019 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.891813040 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.892666101 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.917459965 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.917499065 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.917841911 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.917841911 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.917869091 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.918015003 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.919929981 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.919955969 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.920005083 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.920027018 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.920334101 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.920334101 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.921818018 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.921838045 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.922107935 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:09.922117949 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:09.922745943 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.010504961 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.010551929 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.010668993 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.010713100 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.012622118 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.035655022 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.035682917 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.035793066 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.035808086 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.036487103 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.038220882 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.038244963 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.038306952 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.038322926 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.038340092 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.040076017 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.040107965 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.040271997 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.040271997 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.040285110 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.040497065 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.042517900 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.042550087 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.042681932 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.042681932 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.042694092 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.043631077 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.045021057 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.045053959 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.045147896 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.045147896 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.045156956 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.046698093 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.128607035 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.128643036 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.128700972 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.128753901 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.128753901 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.128753901 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.128771067 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.128784895 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.128894091 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.128912926 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.143063068 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.143064022 CEST	49700	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.143084049 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.143093109 CEST	443	49700	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.302686930 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.302740097 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.302859068 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.303646088 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.303683996 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.303776979 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.304588079 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.304599047 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.304660082 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.305403948 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.305440903 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.305898905 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.306260109 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.306277037 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.306458950 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.306476116 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.307117939 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.307151079 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.307353020 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.307456017 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.307471991 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.307529926 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.307543039 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:10.307754040 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:10.307769060 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.033107996 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.041527987 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.041955948 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.041974068 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.042690039 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.042918921 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.042924881 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.043833017 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.043860912 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.044683933 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.044691086 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.045516968 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.045542955 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.046129942 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.046135902 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.053714037 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.054120064 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.054127932 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.054599047 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.054605007 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.063817978 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.064234018 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.064245939 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.064601898 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.064609051 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.167901993 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.168091059 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.168155909 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.168358088 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.168391943 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.168437004 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.168450117 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.171565056 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.171870947 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.171941996 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.172523975 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.172544956 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.172558069 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.172564030 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.173707008 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.173769951 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.173830032 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.173852921 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.173892975 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.173899889 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.173969030 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.174015045 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.184820890 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.184840918 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.184906960 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.184914112 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.184954882 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.187284946 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.187310934 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.187333107 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.187339067 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.196569920 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.196599007 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.196654081 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.196659088 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.196703911 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.210120916 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.210175991 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.210243940 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.210305929 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.210313082 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.210329056 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.210333109 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.212969065 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.212969065 CEST	49702	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.212990999 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.213002920 CEST	443	49702	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.217086077 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.217123985 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.247169971 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.247195005 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.247263908 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.261085987 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.261126995 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.261181116 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.261599064 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.261612892 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.264048100 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.264081955 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.264142036 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.264262915 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.264276981 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.268543959 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.268554926 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.268611908 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.269078970 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.269092083 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.269792080 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:11.269817114 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:11.500984907 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:11.501019001 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:11.501126051 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:11.543653011 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:11.543684006 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.170583963 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.171096087 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.171109915 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.171279907 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.171435118 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.171595097 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.171601057 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.171710968 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.171741962 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.172019005 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.172022104 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.172040939 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.172066927 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.172072887 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.172317982 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.172332048 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.172652960 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.172657967 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.172785997 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.172791004 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.173985004 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.174338102 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.174351931 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.174669027 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.174674034 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.180818081 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.180891991 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:12.183907986 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:12.183913946 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.184318066 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.187333107 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:12.235335112 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.301280975 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.301450014 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.301548958 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.301614046 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.301631927 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.301645041 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.301651955 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302063942 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302201986 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302222013 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302294016 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302301884 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.302541018 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.302695036 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.302715063 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302726030 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.302733898 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302808046 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.302813053 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.302841902 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.302845001 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.303751945 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.303807974 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.303986073 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.304680109 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.304693937 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.304702997 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.304708004 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.304927111 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.304986954 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.305912971 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.305933952 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.305975914 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306008101 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306046009 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306061029 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.306093931 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306099892 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.306293011 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306293964 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306304932 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.306308985 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.306369066 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306932926 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.306941986 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.307202101 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308192968 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308202028 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.308475018 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308480978 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308497906 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.308559895 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308634996 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308645964 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.308713913 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308726072 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.308764935 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308777094 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.308868885 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:12.308886051 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:12.338015079 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.338187933 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:12.338392019 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:12.346189976 CEST	49715	443	192.168.2.10	104.26.0.5
Oct 24, 2024 09:16:12.346211910 CEST	443	49715	104.26.0.5	192.168.2.10
Oct 24, 2024 09:16:13.038158894 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.038935900 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.038954020 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.039436102 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.039443970 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.043858051 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.046847105 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.047025919 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.047039986 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.047460079 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.047507048 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.047511101 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.047996044 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.048024893 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.048403025 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.048409939 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.049088001 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.049108028 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.049638033 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.049653053 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.051527977 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.051853895 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.051876068 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.052474976 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.052480936 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.168838024 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.169316053 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.169393063 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.171631098 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.171653986 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.171665907 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.171672106 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.174597025 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.174643993 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.174679995 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.174691916 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.174736977 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.174762011 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.174909115 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.174921989 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.174947977 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.174947977 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.174956083 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.174963951 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.177016020 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.177047968 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.177124977 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.177220106 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.177233934 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.179363012 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.179467916 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.179563046 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.179601908 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.179617882 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.179655075 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.179660082 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.180651903 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.180752993 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.180856943 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.180896997 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.180903912 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.180918932 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.180924892 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.181973934 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.182001114 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.182089090 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.182297945 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.182313919 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.182894945 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.182925940 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.183003902 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.183128119 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.183141947 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.185400009 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.185472012 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.185570955 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.185599089 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.185602903 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.185611963 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.185617924 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.185705900 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 24, 2024 09:16:13.187654018 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.187673092 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.187758923 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.187922001 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.187933922 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.906769991 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.908286095 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.909090996 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.916121006 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.916136026 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.916349888 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.916354895 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.920989990 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.921009064 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.921396971 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.921402931 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.921628952 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.921644926 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.921981096 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.921987057 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.923878908 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.924791098 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.924802065 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.925184011 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.925189972 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.925328970 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.928791046 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.928807974 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:13.929183960 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:13.929189920 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.045660973 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.045726061 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.045816898 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.046669006 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.046943903 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.047013044 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.047301054 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.047900915 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.047966003 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.054560900 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.054703951 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.054759026 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.056580067 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.057064056 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.057188988 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.075597048 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.075597048 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.075618029 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.075628996 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.088475943 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.088475943 CEST	49725	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.088500977 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.088515043 CEST	443	49725	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.105412006 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.105436087 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.121269941 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.121285915 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.121301889 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.121308088 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.121836901 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.121855021 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.121862888 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.121869087 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.154117107 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.154144049 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.154221058 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.162055969 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.162098885 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.162229061 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.163171053 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.163198948 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.163297892 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.167347908 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.167370081 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.178940058 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.178958893 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.179032087 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.179202080 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.179219007 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.180286884 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.180325031 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.180425882 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.180425882 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.180442095 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.184148073 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.184170008 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.184855938 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.184869051 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.529488087 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 24, 2024 09:16:14.917251110 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.918478966 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.918739080 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.931133032 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.945051908 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.966960907 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.966986895 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.967031002 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.971112967 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.971124887 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.971581936 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.971587896 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.971797943 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.971805096 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.972256899 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.972261906 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.973006010 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.973016024 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.973030090 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.973033905 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.973434925 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.973439932 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.973473072 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:14.973480940 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:14.982578039 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.015877008 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.015888929 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.016288042 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.016294003 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.096571922 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.096631050 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.096689939 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.096693039 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.096781969 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.096832991 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.099152088 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.099379063 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.099446058 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.101397991 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.101881027 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.101927042 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.146440983 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.146773100 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.147053957 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.151340008 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.151381016 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.151396990 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.151406050 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.152935028 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.152935028 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.152954102 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.152965069 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.153157949 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.153157949 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.153167009 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.153176069 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.153948069 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.153954029 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.153991938 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.153999090 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.154254913 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.154254913 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.154287100 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.154301882 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.539669991 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:15.539706945 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:15.539782047 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:15.544127941 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:15.544148922 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:15.576422930 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.576468945 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.576543093 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.721581936 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.721620083 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.722022057 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.724745989 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.724769115 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.730974913 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.731004953 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.731228113 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.731339931 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.731348991 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.732368946 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.732383966 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.734060049 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.734096050 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.734185934 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.734383106 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.734397888 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.735354900 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.735382080 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:15.735495090 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.739335060 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:15.739348888 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.164194107 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.164657116 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.164669037 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.166316032 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.166445971 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.168524027 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.168613911 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.172343969 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.172352076 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.217037916 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.312104940 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.312186956 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.312477112 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.443339109 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 24, 2024 09:16:16.443340063 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 24, 2024 09:16:16.449273109 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.463670969 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.470269918 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.481666088 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.491736889 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.494014978 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.505839109 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.521419048 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.537069082 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.537070990 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.667026043 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.667032003 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.667610884 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.667617083 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.668065071 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.668073893 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.668426991 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.668431044 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.669146061 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.669157028 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.669900894 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.669907093 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.669990063 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.669995070 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.670511007 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.670516014 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.671061993 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.671080112 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.671554089 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.671560049 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.673115969 CEST	49731	443	192.168.2.10	162.159.136.234
Oct 24, 2024 09:16:16.673135996 CEST	443	49731	162.159.136.234	192.168.2.10
Oct 24, 2024 09:16:16.685816050 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:16.685849905 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:16.686079979 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:16.686295033 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:16.686302900 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:16.792738914 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.792819023 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.792877913 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.793065071 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.793087959 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.793118000 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.793127060 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.794140100 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.794300079 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.794507980 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.795396090 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.795396090 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.795406103 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.795413017 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.796195030 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.796264887 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.796353102 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.796694994 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.796714067 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.796775103 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.797230005 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.797300100 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.797648907 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.797663927 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.797713995 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.797844887 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.797914028 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.799572945 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.799586058 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.799597025 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.799602985 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.799848080 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.799880981 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.800052881 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.800081968 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.800091028 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.800153971 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.800950050 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.800965071 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.801143885 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801249981 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801264048 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.801311970 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801326990 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.801387072 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801403046 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801418066 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.801521063 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801533937 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.801692009 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.801707029 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.802838087 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.802845955 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:16.802901983 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.803005934 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:16.803019047 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.305344105 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.305603981 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.305632114 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.307274103 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.307351112 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.308348894 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.308443069 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.308566093 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.308583975 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.359752893 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.546802044 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547338009 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547350883 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547393084 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547419071 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.547427893 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547457933 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547496080 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.547523022 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.547637939 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.547656059 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.557528019 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.557566881 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.558753014 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.558962107 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.584296942 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.593672991 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.593739033 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.594310045 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.594326973 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.596566916 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.596594095 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.597027063 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.597032070 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.597413063 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.597435951 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.597515106 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.597534895 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.600229025 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.600235939 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.600600958 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.600635052 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.600986958 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.601000071 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.601192951 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.601207972 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.601619005 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.601624966 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.613715887 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.613807917 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.613821030 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.613852978 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.613912106 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.613943100 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.614170074 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.614428997 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.614483118 CEST	49742	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.614521980 CEST	443	49742	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.622993946 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.623032093 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.623126984 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.623414993 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.623467922 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.623531103 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.623769999 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.623778105 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.623825073 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.623996019 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.624008894 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.624145985 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.624169111 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.624258995 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:17.624269962 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:17.872205973 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872215986 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872288942 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872291088 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872312069 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872337103 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872354031 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.872369051 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872378111 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.872407913 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.872519970 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872565031 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.872569084 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872653961 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.872673988 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872684956 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.872689962 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872769117 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.872833967 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.873924017 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.873963118 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.874772072 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.874783993 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.874799013 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.874804974 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.875811100 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.875825882 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.876529932 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.876534939 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.876568079 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.876571894 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.895077944 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.895148993 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.895229101 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.902204037 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.902240992 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.902345896 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.903790951 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.903810978 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.904046059 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.912900925 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.912925005 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.913829088 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.913844109 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.913968086 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.914661884 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.914684057 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.916065931 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.916075945 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.917433023 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.917484045 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.917541981 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.917694092 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.917711020 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:17.918072939 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:17.918101072 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.228347063 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.229039907 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.229053974 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.229660034 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.230138063 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.230293036 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.230304003 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.230320930 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.234462976 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.235399008 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.235850096 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.235858917 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.236013889 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.236038923 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.236926079 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.236994028 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.237157106 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.237409115 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.237489939 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.237747908 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.237876892 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.238086939 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.238095999 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.238146067 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.279336929 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.281884909 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.281975031 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.378596067 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.378727913 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.378820896 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.378871918 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.378886938 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.378930092 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.378936052 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.379054070 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.379096985 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.379105091 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.379230022 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.379281998 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.379288912 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386226892 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386296988 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386333942 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386359930 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386363983 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.386409998 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386447906 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.386470079 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386509895 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386558056 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386584044 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.386605978 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.386631012 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.388312101 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388372898 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388403893 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388425112 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.388433933 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388472080 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388504028 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388514042 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.388521910 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388621092 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.388870955 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388905048 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388912916 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.388921022 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.388967037 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.391639948 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.391712904 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.391727924 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.427154064 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.427170992 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.437110901 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.480623007 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.494147062 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494378090 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494436979 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.494448900 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494538069 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494587898 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.494596004 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494702101 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494787931 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494858980 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.494867086 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.494913101 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.495501041 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.495641947 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.495699883 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.495712996 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.495946884 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.495997906 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.496005058 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.496098995 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.496150970 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.496159077 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.496249914 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.496359110 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.496366024 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.497147083 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.497204065 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.497210979 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.497294903 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.497447968 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.497456074 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.503698111 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.503766060 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.503801107 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.503858089 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.503915071 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.503978014 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.504138947 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504193068 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504251957 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.504266024 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504838943 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504872084 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504899979 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.504903078 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504914045 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.504951000 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.504966021 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.505031109 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.505044937 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506414890 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506448984 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506452084 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506485939 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506491899 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.506500959 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506508112 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506536961 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506536961 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.506570101 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.506581068 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506824017 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.506875992 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506937981 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.506963968 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.507011890 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.507019997 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.507060051 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.507416010 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.507885933 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.507919073 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.507945061 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.507955074 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.507989883 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.508002996 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.508012056 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.508049965 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.508055925 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.508315086 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.508367062 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.508373976 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.508399010 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.508451939 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.508460045 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.509330988 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.509401083 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.509408951 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.549029112 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.549066067 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.549160957 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.549226999 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.549232960 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.549266100 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.597759008 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.609006882 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609206915 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609281063 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.609299898 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609385967 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609469891 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.609478951 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609508038 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609560013 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.609603882 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609884977 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.609971046 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610033035 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.610042095 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610099077 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.610105038 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610482931 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610569000 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.610575914 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610629082 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610630035 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.610657930 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.610692978 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.611440897 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.611522913 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.611524105 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.611550093 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.611589909 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.611975908 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.612070084 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.612102032 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.612128973 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.612158060 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.612936974 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.612993956 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.613002062 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.613034010 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.613064051 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.613070965 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.613099098 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.613902092 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.613970041 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.613977909 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.614016056 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.614027023 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.614047050 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.614073038 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.620461941 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.620527983 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.620564938 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.620583057 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.620615959 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.620676994 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.620711088 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.620992899 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.621032953 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.621040106 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.621104002 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.621121883 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.621145010 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.621151924 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.621310949 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.621974945 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.622617960 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.622664928 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.622672081 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.622684002 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.622719049 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.622734070 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.622741938 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.622797966 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.623589993 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.623656034 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.624659061 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.624708891 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625086069 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625088930 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625148058 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625164032 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625179052 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625207901 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625220060 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625256062 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625257969 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625271082 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625272036 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625323057 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625324965 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625355005 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625384092 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625384092 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625396967 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.625399113 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.625439882 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.626478910 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.626534939 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.626564980 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.626611948 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.626657009 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.626667023 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.626786947 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.627043009 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.627109051 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.627238035 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.627291918 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.627300024 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.627342939 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.628072977 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.628139973 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.628432035 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.628462076 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.628483057 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.628492117 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.628504038 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.629081964 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.629149914 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.629158020 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.629170895 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.629201889 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.629209042 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.629241943 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.630613089 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.630671978 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.630681038 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.630748987 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.631284952 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.631326914 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.631350040 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.631357908 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.631377935 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.631392002 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.654817104 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.655378103 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.655395031 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.656100035 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.656105042 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.657835960 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.658416033 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.661595106 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.661638021 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.662169933 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.662180901 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.666172981 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.666255951 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.666287899 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.666347980 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.677124023 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.677840948 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.677895069 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.678289890 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.678301096 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.724596024 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.724704027 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.724735022 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.724797964 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.724842072 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.724899054 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.724942923 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.725003958 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.725044012 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.725101948 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.725351095 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.725419998 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.725457907 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.725523949 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.725558996 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.725615978 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.726139069 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.726206064 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.726241112 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.726308107 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.726335049 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.726397991 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.726907015 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.726965904 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.727005959 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.727068901 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.727107048 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.727168083 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.727195978 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.727255106 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.727940083 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.727983952 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.727994919 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728004932 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728028059 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728044033 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728079081 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728084087 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728460073 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728733063 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728791952 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728801966 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728847980 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728857994 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728863955 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728889942 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.728895903 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728948116 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.728955030 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.729660988 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.729718924 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.729726076 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.729830027 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.729862928 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.729876995 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.729883909 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.729918003 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.730650902 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.730710983 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.730717897 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.730725050 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.730770111 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.730866909 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.730905056 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.730921030 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.730926991 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.730957031 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.738260984 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.738329887 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.738349915 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.738392115 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.738409042 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.738449097 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.738512039 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.738560915 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.738614082 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.738663912 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.739164114 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.739234924 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.739552975 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.739610910 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.739742041 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.739795923 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.740215063 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.740252972 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.740277052 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.740283012 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.740308046 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.740318060 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.740369081 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.740375996 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.740421057 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.741255999 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.741306067 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.741312981 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.741368055 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.742106915 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.742140055 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.742162943 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.742171049 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.742188931 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.742222071 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.742223024 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.742233038 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.742276907 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.743427992 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.743513107 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.743807077 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.743834972 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.743880987 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.743880987 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.743916988 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.743932962 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.743942022 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.743958950 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.743980885 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.744003057 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.744116068 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.744172096 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.744486094 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.744535923 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.744545937 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.744555950 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.744586945 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745014906 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745058060 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745079041 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745086908 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745105028 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745126963 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745346069 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745402098 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745409966 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745457888 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745469093 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745517015 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745520115 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745528936 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745560884 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745583057 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745728970 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745765924 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745781898 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745789051 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745835066 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745837927 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745863914 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745870113 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745876074 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745887041 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745907068 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745927095 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.745934010 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.745951891 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746247053 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746300936 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746308088 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746351004 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746432066 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746469021 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746494055 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746503115 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746512890 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746525049 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746550083 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746551037 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.746568918 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.746604919 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749133110 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749169111 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749202013 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749234915 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749250889 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749358892 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749363899 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749373913 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749408007 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749414921 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749423027 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749443054 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749456882 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749511957 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749519110 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749536037 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749593973 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.749602079 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.749646902 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.750339985 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.750493050 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.750535011 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.750554085 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.750560999 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.750616074 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.750621080 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.750631094 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.750667095 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.750823975 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.751214981 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.751631975 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.751676083 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.751701117 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.751708031 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.751719952 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.751720905 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.751777887 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.751786947 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.751823902 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.752418041 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.752454996 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.752476931 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.752482891 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.752517939 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.752537012 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.783257961 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.783325911 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.783335924 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.783385038 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.783580065 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.783634901 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.786818027 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.787297964 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.787374973 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.795336008 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.795336008 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.795348883 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.795357943 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.796582937 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.802459955 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.802521944 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.809287071 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.809499025 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.809566975 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.833592892 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.833616018 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.833631039 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.833637953 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.839409113 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 24, 2024 09:16:18.839416027 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 24, 2024 09:16:18.839968920 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840064049 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.840275049 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840325117 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840353966 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.840363026 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840377092 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.840441942 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840487957 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840501070 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.840528011 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840563059 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.840712070 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840751886 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840770960 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.840785027 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.840814114 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.845477104 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.845515966 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.845544100 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.845555067 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.845597982 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.845690966 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.845731974 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.845766068 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.845774889 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.845793962 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.845822096 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846079111 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846137047 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846158028 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846165895 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846198082 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846460104 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846513033 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846540928 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846550941 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846582890 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846726894 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846765995 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846792936 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846801043 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846821070 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846870899 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846919060 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846936941 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.846946001 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.846977949 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.847536087 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.847577095 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.847604036 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.847611904 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.847646952 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.847770929 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.847815990 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.847829103 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.847843885 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.847873926 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.848699093 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.848737001 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.848762035 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.848772049 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.848814011 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.848881006 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.848927021 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.848938942 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.848958015 CEST	443	49748	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.848994017 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.855207920 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.855292082 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.855542898 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.855585098 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.855611086 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.855622053 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.855637074 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.855674982 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.856134892 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.856156111 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.856199026 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.856205940 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.856239080 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.856261969 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.856549025 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.856583118 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.856621981 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.856628895 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.856662035 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.856684923 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861310959 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861327887 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861390114 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861397028 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861439943 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861463070 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861485004 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861526012 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861532927 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861574888 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861603022 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861711025 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861766100 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861769915 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861792088 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.861826897 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.861865044 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.862250090 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.862265110 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.862309933 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.862317085 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.862343073 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.862353086 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.862560987 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.862593889 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.862633944 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.862642050 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.862673998 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863082886 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863101006 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863143921 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863151073 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863178968 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863195896 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863347054 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863364935 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863409042 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863416910 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863445044 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863801003 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863817930 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863859892 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863876104 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.863894939 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.863923073 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.864109039 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864125013 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864166021 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.864172935 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864201069 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.864212990 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.864430904 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864444017 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864478111 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.864486933 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864512920 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.864960909 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.864976883 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865017891 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865026951 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865051985 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865261078 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865277052 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865310907 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865318060 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865349054 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865367889 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865567923 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865583897 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865619898 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865627050 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.865650892 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865668058 CEST	49748	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.865674973 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866008043 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866019964 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866065979 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866074085 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866103888 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866467953 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866485119 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866523027 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866530895 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866549015 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866738081 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866744041 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866763115 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866821051 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866827011 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.866841078 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.866871119 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.867444992 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.867456913 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.867497921 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.867505074 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.867532015 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.868783951 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868798971 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868841887 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.868850946 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868886948 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.868916035 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868928909 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868967056 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.868973970 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868988037 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.868999958 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.869014025 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.869049072 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.869059086 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.869085073 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.870795965 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.870810032 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.870862007 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.870871067 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.870898008 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.870980978 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.870999098 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.871037960 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.871046066 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.871078014 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.871225119 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.871243954 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.871287107 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.871294022 CEST	443	49750	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.871331930 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.883627892 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.885107994 CEST	49750	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.900302887 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.900321960 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.900393963 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.900405884 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.900435925 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.900458097 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.900780916 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.900799036 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.900856018 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.900862932 CEST	443	49749	162.159.138.232	192.168.2.10
Oct 24, 2024 09:16:18.900929928 CEST	49749	443	192.168.2.10	162.159.138.232
Oct 24, 2024 09:16:18.930633068 CEST	49758	443	192.168.2.10	13.107.246.60

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 09:16:11.467735052 CEST	192.168.2.10	1.1.1.1	0xebaa	Standard query (0)	keyauth.win	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.470089912 CEST	192.168.2.10	1.1.1.1	0x4f7a	Standard query (0)	discord.gg	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.470336914 CEST	192.168.2.10	1.1.1.1	0x99	Standard query (0)	discord.gg	65	IN (0x0001)	false
Oct 24, 2024 09:16:16.676386118 CEST	192.168.2.10	1.1.1.1	0xf00b	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:16.676812887 CEST	192.168.2.10	1.1.1.1	0xa8e5	Standard query (0)	discord.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:19.510741949 CEST	192.168.2.10	1.1.1.1	0x4541	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.515367985 CEST	192.168.2.10	1.1.1.1	0xf414	Standard query (0)	discord.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:19.875550985 CEST	192.168.2.10	1.1.1.1	0xa4a4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.875880003 CEST	192.168.2.10	1.1.1.1	0x7575	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:24.745063066 CEST	192.168.2.10	1.1.1.1	0x165a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:24.748317957 CEST	192.168.2.10	1.1.1.1	0xdff8	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:30.961455107 CEST	192.168.2.10	1.1.1.1	0xd385	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:30.961772919 CEST	192.168.2.10	1.1.1.1	0x3d76	Standard query (0)	cdn.discordapp.com	65	IN (0x0001)	false
Oct 24, 2024 09:16:31.758429050 CEST	192.168.2.10	1.1.1.1	0xa06f	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.758646011 CEST	192.168.2.10	1.1.1.1	0xe2f9	Standard query (0)	cdn.discordapp.com	65	IN (0x0001)	false
Oct 24, 2024 09:17:24.733581066 CEST	192.168.2.10	1.1.1.1	0xdb2	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:17:24.733731985 CEST	192.168.2.10	1.1.1.1	0x7596	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 09:16:11.477446079 CEST	1.1.1.1	192.168.2.10	0xebaa	No error (0)	keyauth.win	104.26.0.5	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:11.477446079 CEST	1.1.1.1	192.168.2.10	0xebaa	No error (0)	keyauth.win	104.26.1.5	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:11.477446079 CEST	1.1.1.1	192.168.2.10	0xebaa	No error (0)	keyauth.win	172.67.72.57	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.477885962 CEST	1.1.1.1	192.168.2.10	0x4f7a	No error (0)	discord.gg	162.159.136.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.477885962 CEST	1.1.1.1	192.168.2.10	0x4f7a	No error (0)	discord.gg	162.159.130.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.477885962 CEST	1.1.1.1	192.168.2.10	0x4f7a	No error (0)	discord.gg	162.159.133.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.477885962 CEST	1.1.1.1	192.168.2.10	0x4f7a	No error (0)	discord.gg	162.159.135.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.477885962 CEST	1.1.1.1	192.168.2.10	0x4f7a	No error (0)	discord.gg	162.159.134.234	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:15.481627941 CEST	1.1.1.1	192.168.2.10	0x99	No error (0)	discord.gg		65	IN (0x0001)	false
Oct 24, 2024 09:16:16.683825970 CEST	1.1.1.1	192.168.2.10	0xf00b	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:16.683825970 CEST	1.1.1.1	192.168.2.10	0xf00b	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:16.683825970 CEST	1.1.1.1	192.168.2.10	0xf00b	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:16.683825970 CEST	1.1.1.1	192.168.2.10	0xf00b	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:16.683825970 CEST	1.1.1.1	192.168.2.10	0xf00b	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:16.684969902 CEST	1.1.1.1	192.168.2.10	0xa8e5	No error (0)	discord.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:19.518599033 CEST	1.1.1.1	192.168.2.10	0x4541	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.518599033 CEST	1.1.1.1	192.168.2.10	0x4541	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.518599033 CEST	1.1.1.1	192.168.2.10	0x4541	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.518599033 CEST	1.1.1.1	192.168.2.10	0x4541	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.518599033 CEST	1.1.1.1	192.168.2.10	0x4541	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.524863958 CEST	1.1.1.1	192.168.2.10	0xf414	No error (0)	discord.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:19.883533955 CEST	1.1.1.1	192.168.2.10	0xa4a4	No error (0)	www.google.com	142.250.185.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:19.883549929 CEST	1.1.1.1	192.168.2.10	0x7575	No error (0)	www.google.com		65	IN (0x0001)	false
Oct 24, 2024 09:16:24.755290031 CEST	1.1.1.1	192.168.2.10	0x165a	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:30.969260931 CEST	1.1.1.1	192.168.2.10	0xd385	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:30.969260931 CEST	1.1.1.1	192.168.2.10	0xd385	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:30.969260931 CEST	1.1.1.1	192.168.2.10	0xd385	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:30.969260931 CEST	1.1.1.1	192.168.2.10	0xd385	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:30.969260931 CEST	1.1.1.1	192.168.2.10	0xd385	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.767199039 CEST	1.1.1.1	192.168.2.10	0xa06f	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.767199039 CEST	1.1.1.1	192.168.2.10	0xa06f	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.767199039 CEST	1.1.1.1	192.168.2.10	0xa06f	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.767199039 CEST	1.1.1.1	192.168.2.10	0xa06f	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.767199039 CEST	1.1.1.1	192.168.2.10	0xa06f	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 09:16:31.767672062 CEST	1.1.1.1	192.168.2.10	0xe2f9	No error (0)	cdn.discordapp.com		65	IN (0x0001)	false
Oct 24, 2024 09:17:24.740900993 CEST	1.1.1.1	192.168.2.10	0xdb2	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.10	49700	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:09 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 21 Oct 2024 13:21:21 GMT ETag: "0x8DCF1D34132B902" x-ms-request-id: 8e5348b2-101e-007a-1be5-24047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071609Z-15b8d89586f8nxpt5xx0pk7du800000004g0000000007uxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:09 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-24 07:16:09 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-24 07:16:09 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-24 07:16:09 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-24 07:16:09 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-24 07:16:09 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-24 07:16:10 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-24 07:16:10 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-24 07:16:10 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-24 07:16:10 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.10	49704	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 52fc638d-b01e-0070-36c5-201cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-16849878b78c2tmb7nhatnd68s00000007b000000000bpkv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.10	49705	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 31a53d7e-801e-00a3-74f7-217cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-16849878b78c2tmb7nhatnd68s00000007b000000000bpkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.10	49701	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 331d1c77-401e-0029-354e-229b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-16849878b78mhkkf6kbvry07q000000007bg000000001geh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.10	49703	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1cf92a68-e01e-000c-57f4-248e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-r197bdfb6b49k6rsrbz098tg8000000004h0000000008wpt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.10	49702	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:11 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:11 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:11 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23ba7a24-801e-0015-5af3-24f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071611Z-r197bdfb6b4lkrtc7na2dkay2800000002pg00000000e840 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:11 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.10	49707	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5ab32e4-501e-00a3-0f09-25c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-r197bdfb6b4rt57kw3q0f43mqg0000000br0000000005q5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.10	49708	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f2ab8105-101e-0065-6df4-244088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-r197bdfb6b4qpk6v9629ad4b5s0000000bw000000000hrwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.10	49709	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 12991b82-401e-00a3-77f3-248b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-15b8d89586f6nn8zquf2vw6t5400000004fg000000009e27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.10	49710	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e5972945-801e-007b-45f3-24e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-15b8d89586flzzks5bs37v2b9000000002vg00000000d4gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.10	49706	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 83a5bbbc-601e-005c-5bad-24f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071612Z-15b8d89586fqckbz0ssbuzzp1n00000001x0000000002e1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49715	104.26.0.5	443	8112	C:\Users\user\Desktop\LDlanZur0i.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:12 UTC	128	OUT	POST /api/1.1/ HTTP/1.1 Host: keyauth.win Accept: / Content-Length: 58 Content-Type: application/x-www-form-urlencoded
2024-10-24 07:16:12 UTC	58	OUT	Data Raw: 74 79 70 65 3d 69 6e 69 74 26 76 65 72 3d 38 2e 33 26 6e 61 6d 65 3d 6c 6f 61 64 65 72 20 70 72 69 6e 63 69 70 61 6c 26 6f 77 6e 65 72 69 64 3d 39 57 49 76 54 56 4a 61 39 6d Data Ascii: type=init&ver=8.3&name=loader principal&ownerid=9WIvTVJa9m
2024-10-24 07:16:12 UTC	1115	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:12 GMT Content-Type: application/json; charset=UTF-8 Content-Length: 121 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yl8%2FlLGecnRjz2I35BX0gHRFMBGAqv3Ccxn20h9Af04%2F%2FLNc6PSM%2BZ1%2BnuLwReD6xU0O7WRYCl1SpCHexrq%2BNgtMeErVkikwhR2qMF1Z7z7wthl7T8ySWOBM3NG7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Acknowledge: Credit to VaultCord.com X-Powered-By: VaultCord.com content-security-policy: upgrade-insecure-requests permissions-policy: accelerometer=(), camera=(), fullscreen=, geolocation=(self), gyroscope=(), microphone=(), payment= referrer-policy: strict-origin-when-cross-origin strict-transport-security: max-age=31536000; includeSubDomains x-content-security-policy: img-src ; media-src data:; x-content-type-options: nosniff x-frame-options: DENY x-xss-protection: 1; mode=block Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8d782e1899e046cc-DFW
2024-10-24 07:16:12 UTC	121	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 66 61 6c 73 65 2c 22 63 6f 64 65 22 3a 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 69 6e 76 61 6c 69 64 76 65 72 22 2c 22 64 6f 77 6e 6c 6f 61 64 22 3a 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 67 67 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 22 2c 22 6f 77 6e 65 72 69 64 22 3a 22 39 57 49 76 54 56 4a 61 39 6d 22 7d Data Ascii: {"success":false,"code":0,"message":"invalidver","download":"https://discord.gg/privatecommunity","ownerid":"9WIvTVJa9m"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.10	49716	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 43877b29-f01e-005d-36f3-2413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-r197bdfb6b4rt57kw3q0f43mqg0000000bpg00000000a84d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.10	49718	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-16849878b787sbpl0sv29sm89s00000007b000000000h0tc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.10	49717	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 13862abc-a01e-0053-5aa2-218603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-16849878b788tnsxzb2smucwdc00000007a000000000eyz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.10	49720	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 7de7ed35-901e-005b-7c14-222005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-16849878b786wvrz321uz1cknn00000007c0000000009khb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.10	49719	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d84539c-601e-00ab-7af2-2466f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-r197bdfb6b4tq6ldv3s2dcykm8000000018000000000479p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.10	49722	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 89a40e36-b01e-00ab-18ad-24dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-15b8d89586fmhkw4gksnr1w3ds0000000dyg00000000c4ft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.10	49723	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4cd68789-d01e-0017-448e-21b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-16849878b787psctgubawhx7k8000000072g00000000k88b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.10	49721	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1ff5e4cc-601e-0001-30ce-25faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-15b8d89586fbt6nf34bm5uw08n00000002mg000000002q63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.10	49724	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 241b467f-801e-0015-2b13-25f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-r197bdfb6b4h2vctng0a0nubg80000000ad000000000eq6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.10	49725	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:13 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: c288f504-201e-0000-75f2-24a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071613Z-r197bdfb6b429k2s6br3k49qn400000004ng000000002se2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.10	49730	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: fc96bee5-501e-00a3-3f0b-22c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071614Z-16849878b78dghrpt8v731n7r4000000079g000000007p5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.10	49726	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1a7ba294-f01e-0071-2df2-24431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-r197bdfb6b4rt57kw3q0f43mqg0000000br0000000005q9q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.10	49729	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b11d926e-c01e-00a2-50f4-242327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-r197bdfb6b4ld6jc5asqwvvz0w00000001bg00000000525g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.10	49728	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:14 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5074b8ce-701e-005c-627a-25bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-15b8d89586f8nxpt5xx0pk7du800000004n00000000012qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.10	49727	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:15 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:15 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 00f7314e-e01e-0052-48ac-21d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071615Z-16849878b78plcdqu15wsb8864000000076g00000000hc51 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	49731	162.159.136.234	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	669	OUT	GET /privatecommunity HTTP/1.1 Host: discord.gg Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:16:16 UTC	849	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 0 Connection: close Location: https://discord.com/invite/privatecommunity Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JT1JjqKX8jBRKspYpHlPrev916dPpJVYjAe98BYCPvOMqgYsSYsDLf9DaXAMnGRSPSouCqUcNspR8K%2F%2FKj85j%2B85ODsyJYiJEwKEekVkCDP1%2FoddLdA7eBcA4pg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d782e317db12e5b-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.10	49737	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9b0fb70e-e01e-0020-42f5-24de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-r197bdfb6b4kkrkjudg185sarw00000001a000000000mrqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.10	49733	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 6ff76e76-001e-002b-21c5-2099f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-16849878b78p6ttkmyustyrk8s000000076g00000000c98m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.10	49734	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0124f848-201e-003f-38ad-246d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-15b8d89586fx2hlt035xdehq580000000e2g00000000a5yu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.10	49735	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 999b7e79-701e-001e-6bf4-24f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-r197bdfb6b4h2vctng0a0nubg80000000afg000000008u9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.10	49736	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:16 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 26284338-e01e-0052-664d-22d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071616Z-16849878b78dghrpt8v731n7r400000007a000000000421p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	49742	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	677	OUT	GET /invite/privatecommunity HTTP/1.1 Host: discord.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:16:17 UTC	497	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 8d782e389ce26b1c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Cache-Control: private Last-Modified: Thu, 24 Oct 2024 03:15:21 GMT Set-Cookie: __dcfduid=dc70f08091d711efb298db8715914584; Expires=Tue, 23 Oct 2029 07:16:17 GMT; Max-Age=157680000; Path=/; Secure; HttpOnly; SameSite=Lax Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-10-24 07:16:17 UTC	5202	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 3b 20 73 63 72 69 70 74 2d 73 72 63 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 6e 6f 6e 63 65 2d 4d 54 67 35 4c 44 45 79 4d 43 77 78 4d 6a 55 73 4d 53 77 32 4d 53 77 78 4e 6a 45 73 4d 54 4d 7a 4c 44 49 31 4e 51 3d 3d 27 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 6e 69 6d 61 74 69 6f 6e 73 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f Data Ascii: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' 'nonce-MTg5LDEyMCwxMjUsMSw2MSwxNjEsMTMzLDI1NQ==' blob: https://cdn.discordapp.com/animations/ https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 32 64 39 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 33 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 68 65 63 6b 20 6f 75 74 20 74 68 65 20 f0 9d 90 8f f0 9d 90 91 f0 9d 90 88 f0 9d 90 95 f0 9d 90 80 f0 9d 90 93 f0 9d 90 84 20 f0 9d 90 92 f0 9d 90 93 f0 9d 90 8e f0 9d 90 91 f0 9d 90 84 20 f0 9f 94 90 20 63 6f Data Ascii: 2d93<!DOCTYPE html><html><head> <meta charset="utf-8"> <meta content="width=device-width,initial-scale=1,maximum-scale=3" name="viewport"><meta name="description" content="Check out the co
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6c 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 74 2d 42 52 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 2d 55 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6c Data Ascii: <meta property="og:locale:alternate" content="el" /><meta property="og:locale:alternate" content="pt-BR" /><meta property="og:locale:alternate" content="tr" /><meta property="og:locale" content="en-US" /><meta property="og:locale:alternate" content="l
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 75 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 63 73 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 73 76 2d 53 45 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6c 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 3a 61 6c 74 65 72 6e 61 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 66 72 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a Data Ascii: ate" content="hu" /><meta property="og:locale:alternate" content="cs" /><meta property="og:locale:alternate" content="sv-SE" /><meta property="og:locale:alternate" content="nl" /><meta property="og:locale:alternate" content="fr" /><meta property="og:
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 6a 61 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 65 73 2d 45 53 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 69 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 69 74 22 20 2f 3e 0a 3c 6d 65 74 61 Data Ascii: d.com/invite/privatecommunity?locale=ja" /><meta rel="alternate" hreflang="es-ES" href="https://discord.com/invite/privatecommunity?locale=es-ES" /><meta rel="alternate" hreflang="it" href="https://discord.com/invite/privatecommunity?locale=it" /><meta
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 74 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 74 68 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 3f 6c 6f 63 61 6c 65 3d 65 6e 2d 47 42 22 20 2f 3e 0a 3c 6d 65 74 61 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 6c 61 6e 67 3d 22 6b 6f 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 Data Ascii: rel="alternate" hreflang="th" href="https://discord.com/invite/privatecommunity?locale=th" /><meta rel="alternate" hreflang="en-GB" href="https://discord.com/invite/privatecommunity?locale=en-GB" /><meta rel="alternate" hreflang="ko" href="https://disc
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 67 3a 69 6d 61 67 65 3a 68 65 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 35 31 32 22 20 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 73 70 6c 61 73 68 65 73 2f 31 32 33 30 32 32 37 38 34 32 38 37 37 36 32 30 33 35 39 2f 30 34 62 35 38 62 35 64 38 63 38 36 33 39 36 32 63 63 64 61 63 33 30 35 65 35 65 65 31 32 36 39 2e 6a 70 67 3f 73 69 7a 65 3d 35 31 32 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 62 69 6e 67 62 6f 74 22 20 63 Data Ascii: g:image:height" content="512" /><meta property="twitter:image" content="https://cdn.discordapp.com/splashes/1230227842877620359/04b58b5d8c863962ccdac305e5ee1269.jpg?size=512" /><meta name="googlebot" content="noindex, nofollow" /><meta name="bingbot" c
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 69 73 63 6f 72 64 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 43 44 4e 5f 48 4f 53 54 3a 20 27 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 41 53 53 45 54 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 27 2c 0a 20 20 20 20 20 20 4d 45 44 49 41 5f 50 52 4f 58 59 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 6d 65 64 69 61 2e 64 69 73 63 6f 72 64 61 70 70 2e 6e 65 74 27 2c 0a 20 20 20 20 20 20 57 49 44 47 45 54 5f 45 4e 44 50 4f 49 4e 54 3a 20 27 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 77 69 64 67 65 74 27 2c 0a 20 20 20 20 20 20 49 4e 56 49 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 63 6f 72 64 2e 67 67 27 2c 0a 20 20 20 20 20 20 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 48 4f 53 54 3a 20 27 64 69 73 Data Ascii: iscord.com', CDN_HOST: 'cdn.discordapp.com', ASSET_ENDPOINT: '//discord.com', MEDIA_PROXY_ENDPOINT: '//media.discordapp.net', WIDGET_ENDPOINT: '//discord.com/widget', INVITE_HOST: 'discord.gg', GUILD_TEMPLATE_HOST: 'dis
2024-10-24 07:16:17 UTC	1369	IN	Data Raw: 49 74 65 6d 28 6e 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6f 3f 6e 75 6c 6c 3a 4a 53 4f 4e 2e 70 61 72 73 65 28 6f 29 7d 63 61 74 63 68 28 6e 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 28 22 74 6f 6b 65 6e 22 29 26 26 21 77 69 6e 64 6f 77 2e 5f 5f 4f 56 45 52 4c 41 59 5f 5f 29 7b 76 61 72 20 6e 3d 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 44 69 73 63 6f 72 64 4e 61 74 69 76 65 7c 7c 6e 75 6c 6c 21 3d 77 69 6e 64 6f 77 2e 72 65 71 75 69 72 65 3f 22 65 74 66 22 3a 22 6a 73 6f 6e 22 2c 6f 3d 77 69 6e 64 6f 77 2e 47 4c 4f 42 41 4c 5f 45 4e 56 2e 47 41 54 45 57 41 59 5f 45 4e 44 50 4f 49 4e 54 2b 22 2f 3f 65 6e 63 6f 64 69 6e 67 3d 22 2b 6e 2b 22 26 76 3d 22 2b 77 69 6e 64 6f 77 2e 47 4c 4f 42 41 4c 5f 45 4e 56 2e 41 50 49 5f 56 45 52 53 49 4f 4e 3b 6e 75 Data Ascii: Item(n);return null==o?null:JSON.parse(o)}catch(n){return null}}("token")&&!window.__OVERLAY__){var n=null!=window.DiscordNative\|\|null!=window.require?"etf":"json",o=window.GLOBAL_ENV.GATEWAY_ENDPOINT+"/?encoding="+n+"&v="+window.GLOBAL_ENV.API_VERSION;nu
2024-10-24 07:16:17 UTC	723	IN	Data Raw: 73 4d 53 77 32 4d 53 77 78 4e 6a 45 73 4d 54 4d 7a 4c 44 49 31 4e 51 3d 3d 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 7d 7d 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 66 72 61 6d 65 27 29 3b 61 2e 68 65 69 67 68 Data Ascii: sMSw2MSwxNjEsMTMzLDI1NQ==';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.heigh

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.10	49747	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: efc778c0-f01e-0052-4de5-219224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-16849878b787c9z7hb8u9yysp000000007kg000000000047 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.10	49743	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 759c8b5d-301e-003f-27f2-24266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-15b8d89586fhl2qtatrz3vfkf000000004e000000000bep9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.10	49744	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5167a131-c01e-0082-697a-25af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-15b8d89586f6nn8zquf2vw6t5400000004gg000000006d6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.10	49745	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: e79f0600-d01e-00ad-4ef2-24e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-15b8d89586f2hk28h0h6zye26c00000001400000000086bm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.10	49746	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:17 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:17 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: af8b8727-001e-00a2-18f5-24d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071617Z-15b8d89586fcvr6p5956n5d0rc00000004a000000000f30d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	49748	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	889	OUT	GET /assets/69646.2af8e3f2e60b2cca1cbf.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:18 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/css Content-Length: 1189139 Connection: close CF-Ray: 8d782e3e5cba478e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7b173af12aa2176b69d5656709649ab1" Last-Modified: Wed, 23 Oct 2024 17:23:22 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8odZueLq7Xo%2BTEoSYJSnJ8mTMNj%2B55JNJaxXx%2FYyHziCgTSzu8TAjmlmsXQyiuUIbuexx2ar2fvHkYH4Xqr82aQaISbwdmAf2V2HxyVEMZIugfHG4J%2FN%2BR6HUnz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:18 UTC	408	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 77 61 6e 64 65 72 69 6e 67 2d 63 75 62 65 73 5f 62 36 64 62 32 30 7b 32 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 39 30 64 65 67 29 73 63 61 6c 65 28 2e 35 29 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 32 32 70 78 29 74 72 61 6e 73 6c 61 74 65 79 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 31 38 30 64 65 67 29 7d 37 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 78 28 30 29 74 72 61 6e 73 6c 61 74 65 79 28 32 32 70 78 29 72 6f 74 61 74 65 28 2d 32 37 30 64 65 67 29 73 63 61 6c 65 28 2e 35 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 33 36 30 64 65 67 29 7d Data Ascii: @keyframes spinner-wandering-cubes_b6db20{25%{transform:translatex(22px)rotate(-90deg)scale(.5)}50%{transform:translatex(22px)translatey(22px)rotate(-180deg)}75%{transform:translatex(0)translatey(22px)rotate(-270deg)scale(.5)}to{transform:rotate(-360deg)}
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 70 75 6c 73 69 6e 67 2d 65 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 35 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 38 29 3b 6f 70 61 63 69 74 79 3a 2e 33 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 6e 65 72 2d 6c 6f 77 2d 6d 6f 74 69 6f 6e 5f 62 36 64 62 32 30 7b 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 35 30 25 7b 6f 70 61 63 69 74 79 3a 2e 36 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e Data Ascii: ansform:scale(1)}}@keyframes spinner-pulsing-ellipsis_b6db20{0%{transform:scale(1);opacity:1}50%{transform:scale(.8);opacity:.3}to{transform:scale(1);opacity:1}}@keyframes spinner-low-motion_b6db20{0%{opacity:1}50%{opacity:.6}to{opacity:1}}@keyframes spin
2024-10-24 07:16:18 UTC	1270	IN	Data Raw: 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 32 38 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 70 75 6c 73 69 6e 67 45 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 20 2e 69 74 65 6d 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 3a 73 70 69 6e 6e 65 72 2d 70 75 6c 73 69 6e 67 2d 65 6c 6c 69 70 73 69 73 5f 62 36 64 62 32 30 20 31 2e 34 73 20 69 6e 66 69 6e 69 74 65 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 77 69 64 74 68 3a 36 70 78 3b 68 65 69 67 68 74 3a 36 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 31 30 30 29 3b 62 6f 72 64 Data Ascii: t:auto;width:28px;display:flex;justify-content:center;position:relative}.pulsingEllipsis_b6db20 .item_b6db20{animation:spinner-pulsing-ellipsis_b6db20 1.4s infinite ease-in-out;width:6px;height:6px;margin-right:2px;background-color:var(--primary-100);bord
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 32 30 20 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 69 6e 66 69 6e 69 74 65 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 2c 32 30 30 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 36 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 72 6f 75 6e 64 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 35 30 30 29 7d 2e 70 61 74 68 32 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 31 35 73 3b 73 74 72 6f 6b 65 3a 76 61 72 28 2d 2d 74 65 78 74 2d 62 72 61 6e 64 29 3b 6f 70 61 63 69 74 79 3a 2e 36 7d 2e 70 61 74 68 33 5f 62 36 64 62 32 30 7b 61 6e 69 6d 61 74 69 6f 6e Data Ascii: 20 2s ease-in-out infinite;stroke-dasharray:1,200;stroke-dashoffset:0;fill:none;stroke-width:6;stroke-miterlimit:10;stroke-linecap:round;stroke:var(--brand-500)}.path2_b6db20{animation-delay:.15s;stroke:var(--text-brand);opacity:.6}.path3_b6db20{animation
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 2e 62 75 74 74 6f 6e 5f 64 64 34 66 38 35 20 2e 63 6f 6e 74 65 6e 74 73 5f 64 64 34 66 38 35 7b 2d 2d 62 75 74 74 6f 6e 2d 2d 75 6e 64 65 72 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 74 6f 70 2c 74 72 61 6e 73 70 61 72 65 6e 74 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 6f 66 66 73 65 74 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 62 75 74 74 6f 6e 2d 6c 69 6e 6b 2d 75 6e 64 65 72 6c 69 6e 65 2d 6f 66 66 73 65 74 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 20 76 61 72 28 2d 2d 63 75 73 74 6f Data Ascii: .button_dd4f85 .contents_dd4f85{--button--underline-color:transparent;background-image:linear-gradient(to top,transparent,transparent var(--custom-button-link-underline-offset),transparent var(--custom-button-link-underline-offset),transparent var(--custo
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 32 30 30 29 7d 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 77 68 69 74 65 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 46 69 6c 6c 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 49 6e 76 65 72 74 65 64 5f 64 64 34 66 38 35 20 2e 73 70 69 6e 6e 65 72 49 74 65 6d 5f 64 64 34 66 38 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 Data Ascii: d-color:var(--brand-200)}.lookFilled_dd4f85.colorBrandInverted_dd4f85:disabled,.lookFilled_dd4f85.colorBrandInverted_dd4f85[aria-disabled=true]{background-color:var(--white-500)}.lookFilled_dd4f85.colorBrandInverted_dd4f85 .spinnerItem_dd4f85{background-c
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 6e 6b 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 42 72 61 6e 64 5f 64 64 34 66 38 35 20 2e 73 70 69 6e 6e 65 72 49 74 65 6d 5f 64 64 34 66 38 35 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 35 30 30 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 50 72 69 6d 61 72 79 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 70 72 69 6d 61 72 79 2d 62 6f 72 64 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 50 72 69 6d 61 72 79 5f 64 64 34 66 38 35 3a Data Ascii: nk_dd4f85.colorBrand_dd4f85 .spinnerItem_dd4f85{background-color:var(--brand-500)}.lookOutlined_dd4f85.colorPrimary_dd4f85{color:var(--button-outline-primary-text);border-color:var(--button-outline-primary-border)}.lookOutlined_dd4f85.colorPrimary_dd4f85:
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 28 76 61 72 28 2d 2d 74 65 78 74 2d 6c 69 6e 6b 2d 68 73 6c 29 2f 2e 31 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 4c 69 6e 6b 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 Data Ascii: .lookOutlined_dd4f85.colorLink_dd4f85{color:var(--text-link);border-color:var(--text-link)}.lookOutlined_dd4f85.colorLink_dd4f85:active{background-color:hsl(var(--text-link-hsl)/.1)}.lookOutlined_dd4f85.colorLink_dd4f85:disabled,.lookOutlined_dd4f85.color
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 3a 61 63 74 69 76 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 28 76 61 72 28 2d 2d 77 68 69 74 65 2d 35 30 30 2d 68 73 6c 29 2f 2e 31 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 3a 64 69 73 61 62 6c 65 64 2c 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 5b 61 72 69 61 2d 64 69 73 61 62 6c 65 64 3d 74 72 75 65 5d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 57 68 69 74 65 5f 64 64 34 66 38 35 20 2e 73 Data Ascii: dd4f85.colorWhite_dd4f85:active{background-color:hsl(var(--white-500-hsl)/.1)}.lookOutlined_dd4f85.colorWhite_dd4f85:disabled,.lookOutlined_dd4f85.colorWhite_dd4f85[aria-disabled=true]{background-color:transparent}.lookOutlined_dd4f85.colorWhite_dd4f85 .s
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 61 6e 67 65 72 2d 62 6f 72 64 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 52 65 64 5f 64 64 34 66 38 35 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 68 6f 76 65 72 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 62 6f 72 64 65 72 2d 68 6f 76 65 72 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 74 74 6f 6e 2d 6f 75 74 6c 69 6e 65 2d 64 61 6e 67 65 72 2d 74 65 78 74 2d 68 6f 76 65 72 29 7d 2e 6c 6f 6f 6b 4f 75 74 6c 69 6e 65 64 5f 64 64 34 66 38 35 2e 63 6f 6c 6f 72 52 65 64 5f 64 64 34 66 Data Ascii: anger-border)}.lookOutlined_dd4f85.colorRed_dd4f85:hover{background-color:var(--button-outline-danger-background-hover);border-color:var(--button-outline-danger-border-hover);color:var(--button-outline-danger-text-hover)}.lookOutlined_dd4f85.colorRed_dd4f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	49750	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	879	OUT	GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:18 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/javascript Content-Length: 14624305 Connection: close CF-Ray: 8d782e3e6d7e475b-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "216cb783d60a3e7c57c9d9ffea99dc3f" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rBsUkxrFwsi6YzjEDE8D7xVmqNCwOY8i0YZLyu8cnSk8X98Tney3SuuOfc0cX%2BiUIiBfEy7898V%2BcnUauOlhnBgmVrAQbxIbIAEoq4o37i4oFk6HRy2jBLCjoFPY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:18 UTC	406	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 33 38 35 30 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 64 65 2e 6a 73 6f 6e 61 22 3a 5b 22 36 34 34 37 35 33 22 2c 22 33 30 32 34 34 22 5d 2c 22 2e 2f 7a 68 2d 43 4e 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 34 30 36 32 22 2c 22 35 36 34 34 36 22 5d 2c 22 2e 2f 64 61 2e 6a 73 6f 6e 61 22 3a 5b 22 34 34 38 36 37 22 2c 22 35 37 33 38 37 22 5d 2c 22 2e 2f 65 6c 2e 6a 73 6f 6e 61 22 3a 5b 22 35 38 31 31 34 34 22 2c 22 35 35 36 30 31 22 5d 2c 22 2e 2f 74 72 2e 6a 73 6f 6e 61 22 3a 5b 22 31 34 36 38 37 38 22 2c 22 38 34 33 38 35 22 5d 2c 22 2e 2f 65 73 2d 45 53 2e 6a 73 6f 6e 61 22 3a 5b 22 38 37 32 35 35 30 22 2c 22 34 35 37 34 37 22 5d 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 61 22 3a 5b 22 Data Ascii: (()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 2d 42 52 2e 6a 73 6f 6e 61 22 3a 5b 22 32 34 36 32 39 37 22 2c 22 33 39 34 22 5d 2c 22 2e 2f 72 6f 2e 6a 73 6f 6e 61 22 3a 5b 22 33 37 31 39 30 22 2c 22 35 33 32 36 39 22 5d 2c 22 2e 2f 73 76 2d 53 45 2e 6a 73 6f 6e 61 22 3a 5b 22 33 33 35 34 31 37 22 2c 22 31 31 31 39 33 22 5d 2c 22 2e 2f 72 75 2e 6a 73 6f 6e 61 22 3a 5b 22 38 30 39 34 36 34 22 2c 22 31 32 36 31 31 22 5d 2c 22 2e 2f 76 69 2e 6a 73 6f 6e 61 22 3a 5b 22 31 33 39 31 30 37 22 2c 22 34 35 35 37 36 22 5d 2c 22 2e 2f 69 64 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 32 32 34 38 22 2c 22 37 37 38 30 30 22 5d 2c 22 2e 2f 69 74 2e 6a 73 6f 6e 61 22 3a 5b 22 35 31 35 36 33 30 22 2c 22 37 38 36 37 30 22 5d 2c 22 2e 2f 75 6b 2e 6a 73 6f 6e 61 22 3a 5b 22 31 36 37 31 31 31 22 2c 22 35 38 35 34 38 22 5d 2c 22 Data Ascii: -BR.jsona":["246297","394"],"./ro.jsona":["37190","53269"],"./sv-SE.jsona":["335417","11193"],"./ru.jsona":["809464","12611"],"./vi.jsona":["139107","45576"],"./id.jsona":["492248","77800"],"./it.jsona":["515630","78670"],"./uk.jsona":["167111","58548"],"
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 72 5f 32 35 30 30 78 31 30 30 30 2e 70 6e 67 22 3a 22 39 32 38 34 30 30 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 48 65 72 6f 5f 4c 65 66 74 5f 31 38 30 78 32 32 30 2e 70 6e 67 22 3a 22 31 34 38 38 32 31 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 48 65 72 6f 5f 52 69 67 68 74 5f 31 38 30 78 32 32 30 2e 70 6e 67 22 3a 22 39 38 32 35 36 33 22 2c 22 2e 2f 73 74 69 63 6b 65 72 73 2d 6c 61 75 6e 63 68 2f 32 30 32 30 5f 50 4d 4d 5f 53 54 49 43 4b 45 52 53 5f 4d 72 6b 74 5f 44 65 73 6b 74 6f 70 5f 43 68 61 6e 67 65 6c 6f 67 5f 36 35 38 58 32 32 Data Ascii: r_2500x1000.png":"928400","./stickers-launch/2020_PMM_STICKERS_Mrkt_DesktopHero_Left_180x220.png":"148821","./stickers-launch/2020_PMM_STICKERS_Mrkt_DesktopHero_Right_180x220.png":"982563","./stickers-launch/2020_PMM_STICKERS_Mrkt_Desktop_Changelog_658X22
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 31 34 38 36 36 30 22 7d 2c 35 37 37 33 39 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 69 6d 67 5f 70 72 65 6d 69 75 6d 5f 65 6d 6f 6a 69 5f 64 61 72 6b 2e 73 76 67 22 3a 22 33 34 31 30 34 38 22 2c 22 2e 2f 69 6d 67 5f 70 72 65 6d 69 75 6d 5f 65 6d 6f 6a 69 5f 6c 69 67 68 74 2e 73 76 67 22 3a 22 35 33 37 33 38 31 22 2c 22 2e 2f 69 6d 67 5f 70 72 65 6d 69 75 6d 5f 65 6d 6f 6a 69 5f 74 75 74 6f 72 69 61 6c 2e Data Ascii: ="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="148660"},577391:function(e,t,n){var r={"./img_premium_emoji_dark.svg":"341048","./img_premium_emoji_light.svg":"537381","./img_premium_emoji_tutorial.
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 37 33 35 38 30 30 22 7d 2c 36 30 34 39 30 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 65 6d 6f 6a 69 2d 33 32 2e 70 6e Data Ascii: ))}function a(e){if(!n.o(r,e)){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="735800"},604901:function(e,t,n){var r={"./spritesheet-emoji-32.pn
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 3a 22 35 37 38 31 34 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 65 66 65 61 6e 2e 6d 70 33 22 3a 22 38 31 39 30 39 38 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 64 69 73 63 6f 6e 6e 65 63 74 2e 6d 70 33 22 3a 22 33 38 32 34 37 32 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 6d 65 73 73 61 67 65 31 2e 6d 70 33 22 3a 22 37 37 32 36 33 37 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 6d 75 74 65 2e 6d 70 33 22 3a 22 35 33 39 37 31 36 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 75 6e 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 32 35 37 31 33 30 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 75 6e 64 65 66 65 61 6e 2e 6d 70 33 22 3a 22 31 30 37 38 34 38 22 2c 22 2e 2f 68 61 6c 6c 6f 77 65 65 6e 5f 75 6e 6d 75 74 65 2e 6d 70 33 22 3a 22 34 33 32 39 31 35 22 2c Data Ascii: :"57814","./halloween_defean.mp3":"819098","./halloween_disconnect.mp3":"382472","./halloween_message1.mp3":"772637","./halloween_mute.mp3":"539716","./halloween_undeafen.mp3":"257130","./halloween_undefean.mp3":"107848","./halloween_unmute.mp3":"432915",
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 29 29 7b 76 61 72 20 74 3d 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 66 69 6e 64 20 6d 6f 64 75 6c 65 20 27 22 2b 65 2b 22 27 22 29 3b 74 68 72 6f 77 20 74 2e 63 6f 64 65 3d 22 4d 4f 44 55 4c 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 74 7d 72 65 74 75 72 6e 20 72 5b 65 5d 7d 69 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 7d 2c 69 2e 72 65 73 6f 6c 76 65 3d 61 2c 65 2e 65 78 70 6f 72 74 73 3d 69 2c 69 2e 69 64 3d 22 34 35 31 33 34 33 22 7d 2c 31 37 34 34 39 38 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 3d 7b 7d 3b 74 2e 69 73 53 61 66 61 72 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 61 76 69 67 61 74 6f 72 3f 2e 76 65 6e 64 6f 72 26 26 6e 61 76 69 67 61 74 6f Data Ascii: )){var t=Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}i.keys=function(){return Object.keys(r)},i.resolve=a,e.exports=i,i.id="451343"},174498:function(e){let t={};t.isSafari=function(){return navigator?.vendor&&navigato
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 7c 68 61 69 65 7c 68 63 69 74 7c 68 64 5c 2d 28 6d 7c 70 7c 74 29 7c 68 65 69 5c 2d 7c 68 69 28 70 74 7c 74 61 29 7c 68 70 28 20 69 7c 69 70 29 7c 68 73 5c 2d 63 7c 68 74 28 63 28 5c 2d 7c 20 7c 5f 7c 61 7c 67 7c 70 7c 73 7c 74 29 7c 74 70 29 7c 68 75 28 61 77 7c 74 63 29 7c 69 5c 2d 28 32 30 7c 67 6f 7c 6d 61 29 7c 69 32 33 30 7c 69 61 63 28 20 7c 5c 2d 7c 5c 2f 29 7c 69 62 72 6f 7c 69 64 65 61 7c 69 67 30 31 7c 69 6b 6f 6d 7c 69 6d 31 6b 7c 69 6e 6e 6f 7c 69 70 61 71 7c 69 72 69 73 7c 6a 61 28 74 7c 76 29 61 7c 6a 62 72 6f 7c 6a 65 6d 75 7c 6a 69 67 73 7c 6b 64 64 69 7c 6b 65 6a 69 7c 6b 67 74 28 20 7c 5c 2f 29 7c 6b 6c 6f 6e 7c 6b 70 74 20 7c 6b 77 63 5c 2d 7c 6b 79 6f 28 63 7c 6b 29 7c 6c 65 28 6e 6f 7c 78 69 29 7c 6c 67 28 20 67 7c 5c 2f 28 6b 7c 6c Data Ascii: \|haie\|hcit\|hd\-(m\|p\|t)\|hei\-\|hi(pt\|ta)\|hp( i\|ip)\|hs\-c\|ht(c(\-\| \|_\|a\|g\|p\|s\|t)\|tp)\|hu(aw\|tc)\|i\-(20\|go\|ma)\|i230\|iac( \|\-\|\/)\|ibro\|idea\|ig01\|ikom\|im1k\|inno\|ipaq\|iris\|ja(t\|v)a\|jbro\|jemu\|jigs\|kddi\|keji\|kgt( \|\/)\|klon\|kpt \|kwc\-\|kyo(c\|k)\|le(no\|xi)\|lg( g\|\/(k\|l
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 69 63 2e 77 6f 66 66 32 22 3a 5b 22 38 35 38 38 35 35 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 36 30 30 2d 73 65 6d 69 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 33 38 31 31 37 36 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 39 30 39 36 37 31 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 2e 77 6f 66 66 32 22 3a 5b 22 35 39 38 33 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 33 39 30 32 38 38 22 5d 2c 22 2e 2f 66 72 61 75 6e 63 65 73 2f 66 72 61 75 6e 63 65 73 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f Data Ascii: ic.woff2":["858855"],"./noto-sans/notosans-600-semibold.woff2":["381176"],"./gg-sans/ggsans-700-bold.woff2":["909671"],"./gg-sans/ggsans-500-medium.woff2":["5983"],"./noto-sans/notosans-500-mediumitalic.woff2":["390288"],"./fraunces/fraunces-400-normal.wo
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 3a 5b 22 31 30 31 31 30 33 22 5d 2c 22 2e 2f 67 67 2d 6d 6f 6e 6f 2f 67 67 6d 6f 6e 6f 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 37 35 37 38 38 33 22 5d 2c 22 2e 2f 63 6f 72 69 6e 74 68 69 61 2f 63 6f 72 69 6e 74 68 69 61 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 36 32 32 38 31 34 22 5d 2c 22 2e 2f 67 67 2d 73 61 6e 73 2f 67 67 73 61 6e 73 2d 36 30 30 2d 73 65 6d 69 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 31 35 31 38 35 39 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 35 30 30 2d 6d 65 64 69 75 6d 2e 77 6f 66 66 32 22 3a 5b 22 32 31 34 39 22 5d 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 69 66 28 21 6e 2e 6f 28 72 2c 65 29 29 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c Data Ascii: :["101103"],"./gg-mono/ggmono-700-bold.woff2":["757883"],"./corinthia/corinthia-400-normal.woff2":["622814"],"./gg-sans/ggsans-600-semibold.woff2":["151859"],"./noto-sans/notosans-500-medium.woff2":["2149"]};function i(e){if(!n.o(r,e))return Promise.resol

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	49749	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	875	OUT	GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:18 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/javascript Content-Length: 1131565 Connection: close CF-Ray: 8d782e3e6be72e6c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "4f8f7ac8f509d88d00832626b0034b06" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vgmSeoJ3SqLXpt%2F%2F0BnhFeHsrZUYW6%2F1fk8pRLak5k7VCqd0b5G2yjREuEBVimEk3h3Oc8U3L3inT1bD4ZQ7a%2BVqIxqLPdPPMEMluGwplOtBh2DzEQbk66QiXZlq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:18 UTC	403	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 35 34 38 36 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 65 3d 72 2e 6e 6d 64 28 65 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 73 28 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 29 2c 72 3d 22 30 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2c 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 42 69 67 49 6e 74 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5f 5b 30 5d 3a 76 6f 69 64 20 30 21 3d 3d 74 3f 31 30 21 3d 2b 74 7c 7c 72 3f 59 28 65 2c 74 2c 72 2c 6e 29 3a 46 28 65 29 3a 46 28 Data Ascii: (()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 63 28 65 29 7b 72 65 74 75 72 6e 20 2d 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 3c 65 26 26 65 3c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 7d 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 72 65 74 75 72 6e 20 65 3c 31 65 37 3f 5b 65 5d 3a 65 3c 31 65 31 34 3f 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 5d 3a 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 31 34 29 5d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 75 28 65 29 3b 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 72 3c 34 26 26 30 3e 67 28 65 2c 74 29 29 73 77 69 74 63 68 28 72 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 30 3b 63 61 73 65 20 31 3a 72 Data Ascii: tion c(e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:r
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 6f 28 54 28 72 2c 4d 61 74 68 2e 61 62 73 28 6e 29 29 2c 74 68 69 73 2e 73 69 67 6e 29 3a 6e 65 77 20 6f 28 41 28 72 2c 6e 29 2c 74 68 69 73 2e 73 69 67 6e 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6c 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 73 75 62 74 72 61 63 74 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 69 66 28 74 2e 69 73 53 6d 61 6c 6c 29 7b Data Ascii: .value,n=t.value;return t.isSmall?new o(T(r,Math.abs(n)),this.sign):new o(A(r,n),this.sign)},o.prototype.plus=o.prototype.add,E.prototype.add=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.subtract(t.negate());var n=t.value;if(t.isSmall){
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 2e 6d 69 6e 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 45 28 72 2d 6e 29 3a 4c 28 6e 2c 4d 61 74 68 2e 61 62 73 28 72 29 2c 72 3e 3d 30 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 69 6e 75 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 Data Ascii: .minus=o.prototype.subtract,E.prototype.subtract=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.add(t.negate());var n=t.value;return t.isSmall?new E(r-n):L(n,Math.abs(r),r>=0)},E.prototype.minus=E.prototype.subtract,i.prototype.subtract=f
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 2e 63 65 69 6c 28 6e 2f 32 29 3b 76 61 72 20 61 3d 74 2e 73 6c 69 63 65 28 6e 29 2c 5f 3d 74 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 6f 3d 72 2e 73 6c 69 63 65 28 6e 29 2c 45 3d 72 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 69 3d 65 28 5f 2c 45 29 2c 63 3d 65 28 61 2c 6f 29 2c 73 3d 65 28 41 28 5f 2c 61 29 2c 41 28 45 2c 6f 29 29 2c 6c 3d 41 28 41 28 69 2c 70 28 64 28 64 28 73 2c 69 29 2c 63 29 2c 6e 29 29 2c 70 28 63 2c 32 2a 6e 29 29 3b 72 65 74 75 72 6e 20 75 28 6c 29 2c 6c 7d 28 45 2c 69 29 2c 63 29 3a 6e 65 77 20 6f 28 66 28 45 2c 69 29 2c 63 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 74 69 6d 65 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 75 6c 74 69 70 6c 79 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 6d 75 6c 74 69 70 6c 79 42 79 53 6d 61 6c 6c 3d 66 75 6e Data Ascii: .ceil(n/2);var a=t.slice(n),_=t.slice(0,n),o=r.slice(n),E=r.slice(0,n),i=e(_,E),c=e(a,o),s=e(A(_,a),A(E,o)),l=A(A(i,p(d(d(s,i),c),n)),p(c,2*n));return u(l),l}(E,i),c):new o(f(E,i),c)},o.prototype.times=o.prototype.multiply,E.prototype._multiplyBySmall=fun
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 29 7b 69 66 28 31 3d 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2c 5f 5b 30 5d 5d 3b 69 66 28 2d 31 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2e 6e 65 67 61 74 65 28 29 2c 5f 5b 30 5d 5d 3b 76 61 72 20 54 3d 4d 61 74 68 2e 61 62 73 28 41 29 3b 69 66 28 54 3c 31 65 37 29 7b 72 3d 6c 28 28 6e 3d 44 28 4e 2c 54 29 29 5b 30 5d 29 3b 76 61 72 20 4c 3d 6e 5b 31 5d 3b 72 65 74 75 72 6e 28 65 2e 73 69 67 6e 26 26 28 4c 3d 2d 4c 29 2c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 72 29 3f 28 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 26 26 28 72 3d 2d 72 29 2c 5b 6e 65 77 20 45 28 72 29 2c 6e 65 77 20 45 28 4c 29 5d 29 3a 5b 6e 65 77 20 6f 28 72 2c 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 29 2c 6e 65 77 20 45 28 4c 29 5d 7d 41 3d 73 28 54 29 7d 76 61 72 20 66 3d 67 Data Ascii: ){if(1===A)return[e,_[0]];if(-1==A)return[e.negate(),_[0]];var T=Math.abs(A);if(T<1e7){r=l((n=D(N,T))[0]);var L=n[1];return(e.sign&&(L=-L),"number"==typeof r)?(e.sign!==c.sign&&(r=-r),[new E(r),new E(L)]):[new o(r,e.sign!==c.sign),new E(L)]}A=s(T)}var f=g
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 74 68 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3e 74 2e 6c 65 6e 67 74 68 3f 31 3a 2d 31 3b 66 6f 72 28 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 72 3e 3d 30 3b 72 2d 2d 29 69 66 28 65 5b 72 5d 21 3d 3d 74 5b 72 5d 29 72 65 74 75 72 6e 20 65 5b 72 5d 3e 74 5b 72 5d 3f 31 3a 2d 31 3b 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 76 61 72 20 74 3d 65 2e 61 62 73 28 29 3b 72 65 74 75 72 6e 21 74 2e 69 73 55 6e 69 74 28 29 26 26 28 21 21 28 74 2e 65 71 75 61 6c 73 28 32 29 7c 7c 74 2e 65 71 75 61 6c 73 28 33 29 7c 7c 74 2e 65 71 75 61 6c 73 28 35 29 29 7c 7c 21 28 74 2e 69 73 45 76 65 6e 28 29 7c 7c 74 2e 69 73 44 69 76 69 73 69 62 6c 65 42 79 28 33 29 7c 7c 74 2e 69 73 44 69 76 69 73 69 Data Ascii: th!==t.length)return e.length>t.length?1:-1;for(var r=e.length-1;r>=0;r--)if(e[r]!==t[r])return e[r]>t[r]?1:-1;return 0}function U(e){var t=e.abs();return!t.isUnit()&&(!!(t.equals(2)\|\|t.equals(3)\|\|t.equals(5))\|\|!(t.isEven()\|\|t.isDivisibleBy(3)\|\|t.isDivisi
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 74 6f 53 74 72 69 6e 67 28 29 2b 22 20 69 73 20 74 6f 6f 20 6c 61 72 67 65 2e 22 29 3b 69 66 28 74 68 69 73 2e 69 73 53 6d 61 6c 6c 26 26 63 28 74 3d 4d 61 74 68 2e 70 6f 77 28 6f 2c 69 29 29 29 72 65 74 75 72 6e 20 6e 65 77 20 45 28 52 28 74 29 29 3b 66 6f 72 28 72 3d 74 68 69 73 2c 6e 3d 5f 5b 31 5d 3b 21 30 26 69 26 26 28 6e 3d 6e 2e 74 69 6d 65 73 28 72 29 2c 2d 2d 69 29 2c 30 21 3d 3d 69 3b 29 7b 3b 69 2f 3d 32 2c 72 3d 72 2e 73 71 75 61 72 65 28 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c Data Ascii: toString()+" is too large.");if(this.isSmall&&c(t=Math.pow(o,i)))return new E(R(t));for(r=this,n=_[1];!0&i&&(n=n.times(r),--i),0!==i;){;i/=2,r=r.square()}return n},E.prototype.pow=o.prototype.pow,i.prototype.pow=function(e){var t=F(e),r=this.value,n=t.val
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 67 6e 3f 74 2e 73 69 67 6e 3f 31 3a 2d 31 3a 74 2e 69 73 53 6d 61 6c 6c 3f 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 3a 67 28 72 2c 6e 29 2a 28 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 54 6f 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 3d 3d 3d 31 2f 30 29 72 65 74 75 72 6e 20 2d 31 3b 69 66 28 65 3d 3d 3d 2d 31 2f 30 29 72 65 74 75 72 6e 20 31 3b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 72 3d 3d 6e 3f 30 3a 72 3e 6e 3f 31 3a 2d 31 3a 72 3c 30 21 3d 3d 74 Data Ascii: gn?t.sign?1:-1:t.isSmall?this.sign?-1:1:g(r,n)*(this.sign?-1:1)},o.prototype.compareTo=o.prototype.compare,E.prototype.compare=function(e){if(e===1/0)return -1;if(e===-1/0)return 1;var t=F(e),r=this.value,n=t.value;return t.isSmall?r==n?0:r>n?1:-1:r<0!==t
2024-10-24 07:16:18 UTC	1369	IN	Data Raw: 4f 72 45 71 75 61 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 3e 3d 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 45 76 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 31 26 74 68 69 73 2e 76 61 6c 75 65 5b 30 5d 29 3d 3d 30 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 45 76 65 6e 3d 66 Data Ascii: OrEquals=function(e){return 0>=this.compare(e)},i.prototype.leq=i.prototype.lesserOrEquals=E.prototype.leq=E.prototype.lesserOrEquals=o.prototype.leq=o.prototype.lesserOrEquals,o.prototype.isEven=function(){return(1&this.value[0])==0},E.prototype.isEven=f

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.10	49753	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 3f3879b0-501e-0035-0b40-22c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-16849878b78c2tmb7nhatnd68s00000007bg00000000a756 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.10	49752	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 221e1266-901e-0016-4cfc-24efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-r197bdfb6b4t7wszdvrfk02ah400000008w000000000b4xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.10	49754	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:18 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 07f9ef03-d01e-0014-614d-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071618Z-16849878b78bkvbz1ry47zvsas00000007f0000000002saq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.10	49756	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d2a5b3e5-101e-0079-35e1-255913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-16849878b78k46f8kzwxznephs00000007a00000000044r5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.10	49755	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 6764be4f-301e-0099-1efc-246683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-r197bdfb6b49q495mwyebb3r6s0000000a9000000000h04b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.10	49758	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: e5dab064-101e-0046-04f5-2491b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-r197bdfb6b4kkrkjudg185sarw00000001c000000000dduz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.10	49759	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 9658a421-401e-008c-7ff3-2486c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-15b8d89586fqckbz0ssbuzzp1n00000001tg0000000083d6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.10	49760	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:19 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:19 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 80264404-901e-002a-13ad-247a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071619Z-15b8d89586fcvr6p5956n5d0rc00000004d00000000081xd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.10	49762	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	680	OUT	GET /assets/sentry.d30fc24f50e5e3e76b3e.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:20 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/javascript Content-Length: 1131565 Connection: close CF-Ray: 8d782e4a4cc13455-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "4f8f7ac8f509d88d00832626b0034b06" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sezQJK0SGel2ybSjQ36GRReQ5K8y0Bb8OoqEqUpniEpARXXyyRSdwYNQsZLwCkmfep9zXiKA4J0TCRQF3RS8JRSFFJdy%2FcC93QtH18yqPNZAcClQKMlzZ0aTlQtO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:20 UTC	409	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 35 34 38 36 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 65 3d 72 2e 6e 6d 64 28 65 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 73 28 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 29 2c 72 3d 22 30 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 22 2c 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 42 69 67 49 6e 74 3b 66 75 6e 63 74 69 6f 6e 20 5f 28 65 2c 74 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 65 3f 5f 5b 30 5d 3a 76 6f 69 64 20 30 21 3d 3d 74 3f 31 30 21 3d 2b 74 7c 7c 72 3f 59 28 65 2c 74 2c 72 2c 6e 29 3a 46 28 65 29 3a 46 28 Data Ascii: (()=>{var e={654861:function(e,t,r){e=r.nmd(e);var n=function(e){"use strict";var t=s(9007199254740992),r="0123456789abcdefghijklmnopqrstuvwxyz",a="function"==typeof BigInt;function _(e,t,r,n){return void 0===e?_[0]:void 0!==t?10!=+t\|\|r?Y(e,t,r,n):F(e):F(
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 28 65 29 7b 72 65 74 75 72 6e 20 2d 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 3c 65 26 26 65 3c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 32 7d 66 75 6e 63 74 69 6f 6e 20 73 28 65 29 7b 72 65 74 75 72 6e 20 65 3c 31 65 37 3f 5b 65 5d 3a 65 3c 31 65 31 34 3f 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 5d 3a 5b 65 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 37 29 25 31 65 37 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 31 65 31 34 29 5d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 75 28 65 29 3b 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 72 3c 34 26 26 30 3e 67 28 65 2c 74 29 29 73 77 69 74 63 68 28 72 29 7b 63 61 73 65 20 30 3a 72 65 74 75 72 6e 20 30 3b 63 61 73 65 20 31 3a 72 65 74 75 72 6e 20 Data Ascii: (e){return -9007199254740992<e&&e<9007199254740992}function s(e){return e<1e7?[e]:e<1e14?[e%1e7,Math.floor(e/1e7)]:[e%1e7,Math.floor(e/1e7)%1e7,Math.floor(e/1e14)]}function l(e){u(e);var r=e.length;if(r<4&&0>g(e,t))switch(r){case 0:return 0;case 1:return
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 6f 28 54 28 72 2c 4d 61 74 68 2e 61 62 73 28 6e 29 29 2c 74 68 69 73 2e 73 69 67 6e 29 3a 6e 65 77 20 6f 28 41 28 72 2c 6e 29 2c 74 68 69 73 2e 73 69 67 6e 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6c 75 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 73 75 62 74 72 61 63 74 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 69 66 28 74 2e 69 73 53 6d 61 6c 6c 29 7b 69 66 28 63 28 72 Data Ascii: ,n=t.value;return t.isSmall?new o(T(r,Math.abs(n)),this.sign):new o(A(r,n),this.sign)},o.prototype.plus=o.prototype.add,E.prototype.add=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.subtract(t.negate());var n=t.value;if(t.isSmall){if(c(r
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 3b 69 66 28 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 29 72 65 74 75 72 6e 20 74 68 69 73 2e 61 64 64 28 74 2e 6e 65 67 61 74 65 28 29 29 3b 76 61 72 20 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 6e 65 77 20 45 28 72 2d 6e 29 3a 4c 28 6e 2c 4d 61 74 68 2e 61 62 73 28 72 29 2c 72 3e 3d 30 29 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 69 6e 75 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 73 75 62 74 72 61 63 74 3d 66 75 6e 63 74 69 6f Data Ascii: =o.prototype.subtract,E.prototype.subtract=function(e){var t=F(e),r=this.value;if(r<0!==t.sign)return this.add(t.negate());var n=t.value;return t.isSmall?new E(r-n):L(n,Math.abs(r),r>=0)},E.prototype.minus=E.prototype.subtract,i.prototype.subtract=functio
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 6e 2f 32 29 3b 76 61 72 20 61 3d 74 2e 73 6c 69 63 65 28 6e 29 2c 5f 3d 74 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 6f 3d 72 2e 73 6c 69 63 65 28 6e 29 2c 45 3d 72 2e 73 6c 69 63 65 28 30 2c 6e 29 2c 69 3d 65 28 5f 2c 45 29 2c 63 3d 65 28 61 2c 6f 29 2c 73 3d 65 28 41 28 5f 2c 61 29 2c 41 28 45 2c 6f 29 29 2c 6c 3d 41 28 41 28 69 2c 70 28 64 28 64 28 73 2c 69 29 2c 63 29 2c 6e 29 29 2c 70 28 63 2c 32 2a 6e 29 29 3b 72 65 74 75 72 6e 20 75 28 6c 29 2c 6c 7d 28 45 2c 69 29 2c 63 29 3a 6e 65 77 20 6f 28 66 28 45 2c 69 29 2c 63 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 74 69 6d 65 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 75 6c 74 69 70 6c 79 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 6d 75 6c 74 69 70 6c 79 42 79 53 6d 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: n/2);var a=t.slice(n),_=t.slice(0,n),o=r.slice(n),E=r.slice(0,n),i=e(_,E),c=e(a,o),s=e(A(_,a),A(E,o)),l=A(A(i,p(d(d(s,i),c),n)),p(c,2*n));return u(l),l}(E,i),c):new o(f(E,i),c)},o.prototype.times=o.prototype.multiply,E.prototype._multiplyBySmall=function(
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 3d 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2c 5f 5b 30 5d 5d 3b 69 66 28 2d 31 3d 3d 41 29 72 65 74 75 72 6e 5b 65 2e 6e 65 67 61 74 65 28 29 2c 5f 5b 30 5d 5d 3b 76 61 72 20 54 3d 4d 61 74 68 2e 61 62 73 28 41 29 3b 69 66 28 54 3c 31 65 37 29 7b 72 3d 6c 28 28 6e 3d 44 28 4e 2c 54 29 29 5b 30 5d 29 3b 76 61 72 20 4c 3d 6e 5b 31 5d 3b 72 65 74 75 72 6e 28 65 2e 73 69 67 6e 26 26 28 4c 3d 2d 4c 29 2c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 72 29 3f 28 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 26 26 28 72 3d 2d 72 29 2c 5b 6e 65 77 20 45 28 72 29 2c 6e 65 77 20 45 28 4c 29 5d 29 3a 5b 6e 65 77 20 6f 28 72 2c 65 2e 73 69 67 6e 21 3d 3d 63 2e 73 69 67 6e 29 2c 6e 65 77 20 45 28 4c 29 5d 7d 41 3d 73 28 54 29 7d 76 61 72 20 66 3d 67 28 4e 2c 41 29 3b Data Ascii: ===A)return[e,_[0]];if(-1==A)return[e.negate(),_[0]];var T=Math.abs(A);if(T<1e7){r=l((n=D(N,T))[0]);var L=n[1];return(e.sign&&(L=-L),"number"==typeof r)?(e.sign!==c.sign&&(r=-r),[new E(r),new E(L)]):[new o(r,e.sign!==c.sign),new E(L)]}A=s(T)}var f=g(N,A);
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3e 74 2e 6c 65 6e 67 74 68 3f 31 3a 2d 31 3b 66 6f 72 28 76 61 72 20 72 3d 65 2e 6c 65 6e 67 74 68 2d 31 3b 72 3e 3d 30 3b 72 2d 2d 29 69 66 28 65 5b 72 5d 21 3d 3d 74 5b 72 5d 29 72 65 74 75 72 6e 20 65 5b 72 5d 3e 74 5b 72 5d 3f 31 3a 2d 31 3b 72 65 74 75 72 6e 20 30 7d 66 75 6e 63 74 69 6f 6e 20 55 28 65 29 7b 76 61 72 20 74 3d 65 2e 61 62 73 28 29 3b 72 65 74 75 72 6e 21 74 2e 69 73 55 6e 69 74 28 29 26 26 28 21 21 28 74 2e 65 71 75 61 6c 73 28 32 29 7c 7c 74 2e 65 71 75 61 6c 73 28 33 29 7c 7c 74 2e 65 71 75 61 6c 73 28 35 29 29 7c 7c 21 28 74 2e 69 73 45 76 65 6e 28 29 7c 7c 74 2e 69 73 44 69 76 69 73 69 62 6c 65 42 79 28 33 29 7c 7c 74 2e 69 73 44 69 76 69 73 69 62 6c 65 42 79 28 Data Ascii: .length)return e.length>t.length?1:-1;for(var r=e.length-1;r>=0;r--)if(e[r]!==t[r])return e[r]>t[r]?1:-1;return 0}function U(e){var t=e.abs();return!t.isUnit()&&(!!(t.equals(2)\|\|t.equals(3)\|\|t.equals(5))\|\|!(t.isEven()\|\|t.isDivisibleBy(3)\|\|t.isDivisibleBy(
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 6e 67 28 29 2b 22 20 69 73 20 74 6f 6f 20 6c 61 72 67 65 2e 22 29 3b 69 66 28 74 68 69 73 2e 69 73 53 6d 61 6c 6c 26 26 63 28 74 3d 4d 61 74 68 2e 70 6f 77 28 6f 2c 69 29 29 29 72 65 74 75 72 6e 20 6e 65 77 20 45 28 52 28 74 29 29 3b 66 6f 72 28 72 3d 74 68 69 73 2c 6e 3d 5f 5b 31 5d 3b 21 30 26 69 26 26 28 6e 3d 6e 2e 74 69 6d 65 73 28 72 29 2c 2d 2d 69 29 2c 30 21 3d 3d 69 3b 29 7b 3b 69 2f 3d 32 2c 72 3d 72 2e 73 71 75 61 72 65 28 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 70 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 2c 61 3d 42 Data Ascii: ng()+" is too large.");if(this.isSmall&&c(t=Math.pow(o,i)))return new E(R(t));for(r=this,n=_[1];!0&i&&(n=n.times(r),--i),0!==i;){;i/=2,r=r.square()}return n},E.prototype.pow=o.prototype.pow,i.prototype.pow=function(e){var t=F(e),r=this.value,n=t.value,a=B
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 69 67 6e 3f 31 3a 2d 31 3a 74 2e 69 73 53 6d 61 6c 6c 3f 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 3a 67 28 72 2c 6e 29 2a 28 74 68 69 73 2e 73 69 67 6e 3f 2d 31 3a 31 29 7d 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 54 6f 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6d 70 61 72 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 3d 3d 3d 31 2f 30 29 72 65 74 75 72 6e 20 2d 31 3b 69 66 28 65 3d 3d 3d 2d 31 2f 30 29 72 65 74 75 72 6e 20 31 3b 76 61 72 20 74 3d 46 28 65 29 2c 72 3d 74 68 69 73 2e 76 61 6c 75 65 2c 6e 3d 74 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 74 2e 69 73 53 6d 61 6c 6c 3f 72 3d 3d 6e 3f 30 3a 72 3e 6e 3f 31 3a 2d 31 3a 72 3c 30 21 3d 3d 74 2e 73 69 67 6e 3f Data Ascii: ign?1:-1:t.isSmall?this.sign?-1:1:g(r,n)*(this.sign?-1:1)},o.prototype.compareTo=o.prototype.compare,E.prototype.compare=function(e){if(e===1/0)return -1;if(e===-1/0)return 1;var t=F(e),r=this.value,n=t.value;return t.isSmall?r==n?0:r>n?1:-1:r<0!==t.sign?
2024-10-24 07:16:20 UTC	1369	IN	Data Raw: 6c 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 30 3e 3d 74 68 69 73 2e 63 6f 6d 70 61 72 65 28 65 29 7d 2c 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 69 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 45 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 71 3d 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 65 73 73 65 72 4f 72 45 71 75 61 6c 73 2c 6f 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 45 76 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 31 26 74 68 69 73 2e 76 61 6c 75 65 5b 30 5d 29 3d 3d 30 7d 2c 45 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 45 76 65 6e 3d 66 75 6e 63 74 69 6f Data Ascii: ls=function(e){return 0>=this.compare(e)},i.prototype.leq=i.prototype.lesserOrEquals=E.prototype.leq=E.prototype.lesserOrEquals=o.prototype.leq=o.prototype.lesserOrEquals,o.prototype.isEven=function(){return(1&this.value[0])==0},E.prototype.isEven=functio

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.10	49763	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d4d27aa7-601e-0002-1812-22a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-16849878b786vsxz21496wc2qn00000007bg00000000gx2b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.10	49765	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f6bed088-301e-0000-1a9a-24eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-15b8d89586flzzks5bs37v2b9000000002v000000000ff46 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.10	49764	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6a28e11d-901e-0029-65f3-24274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r197bdfb6b4ld6jc5asqwvvz0w00000001dg0000000027h4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.10	49766	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9a9b06d2-601e-0032-5ff9-24eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r197bdfb6b4lbgfqwkqbrm672s000000011000000000g6z8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.10	49767	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:20 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 700672c4-201e-0096-3cf2-24ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071620Z-r197bdfb6b4ld6jc5asqwvvz0w00000001a0000000009ak5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.10	49774	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 14f65908-801e-008f-32d6-202c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-16849878b785jsrm4477mv3ezn000000077000000000gn8w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.10	49770	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 33ade019-101e-0028-30f5-248f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-15b8d89586fcvr6p5956n5d0rc00000004hg0000000003fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.10	49771	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 07aa16c4-201e-0033-7ef4-24b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r197bdfb6b4cz6xrsdncwtgzd40000000p70000000003bt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.10	49772	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 40a513cc-e01e-0051-0ef3-2484b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r197bdfb6b4kkrkjudg185sarw00000001c000000000ddxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.10	49773	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:21 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 13fbacc8-201e-0003-23f4-24f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071621Z-r197bdfb6b4cz6xrsdncwtgzd40000000p8000000000192v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.10	49775	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:21 UTC	684	OUT	GET /assets/webMinimal.183cbc8427e6b143ce21.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:21 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:21 GMT Content-Type: text/javascript Content-Length: 14624305 Connection: close CF-Ray: 8d782e54dd7c4762-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "216cb783d60a3e7c57c9d9ffea99dc3f" Last-Modified: Thu, 24 Oct 2024 03:15:20 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ixCQrCQtV54Kue5d1b5p7%2BlMCcCIJMxPN%2FFqHdhpqUUwMAjyRpOCSv0ivJ802BTzyeLL0ir07WeUKOP7wI9I2GVe1b7dL8kxUmsRl3NoVBpgOMqQXlxVqX%2BhWCjd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 33 38 35 30 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 64 65 2e 6a 73 6f 6e 61 22 3a 5b 22 36 34 34 37 35 33 22 2c 22 33 30 32 34 34 22 5d 2c 22 2e 2f 7a 68 2d 43 4e 2e 6a 73 6f 6e 61 22 3a 5b 22 34 39 34 30 36 32 22 2c 22 35 36 34 34 36 22 5d 2c 22 2e 2f 64 61 2e 6a 73 6f 6e 61 22 3a 5b 22 34 34 38 36 37 22 2c 22 35 37 33 38 37 22 5d 2c 22 2e 2f 65 6c 2e 6a 73 6f 6e 61 22 3a 5b 22 35 38 31 31 34 34 22 2c 22 35 35 36 30 31 22 5d 2c 22 2e 2f 74 72 2e 6a 73 6f 6e 61 22 3a 5b 22 31 34 36 38 37 38 22 2c 22 38 34 33 38 35 22 5d 2c 22 2e 2f 65 73 2d 45 53 2e 6a 73 6f 6e 61 22 3a 5b 22 38 37 32 35 35 30 22 2c 22 34 35 37 34 37 22 5d 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 61 22 3a 5b 22 Data Ascii: (()=>{var e={385007:function(e,t,n){var r={"./de.jsona":["644753","30244"],"./zh-CN.jsona":["494062","56446"],"./da.jsona":["44867","57387"],"./el.jsona":["581144","55601"],"./tr.jsona":["146878","84385"],"./es-ES.jsona":["872550","45747"],"./hr.jsona":["
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 30 31 37 2d 31 31 2d 31 36 2e 6d 70 34 22 3a 22 32 32 31 38 32 35 22 2c 22 2e 2f 63 68 61 6e 6e 65 6c 2d 66 6f 6c 6c 6f 77 69 6e 67 2e 70 6e 67 22 3a 22 32 34 37 38 31 35 22 2c 22 2e 2f 64 69 73 63 6f 76 65 72 79 2e 6a 70 67 22 3a 22 37 37 38 36 30 38 22 2c 22 2e 2f 67 32 35 30 6b 2d 63 6c 2e 6d 70 34 22 3a 22 39 30 39 38 35 31 22 2c 22 2e 2f 68 79 70 65 73 71 75 61 64 2d 68 61 63 6b 2d 77 65 65 6b 2f 68 65 61 64 65 72 2e 70 6e 67 22 3a 22 38 31 39 30 39 31 22 2c 22 2e 2f 68 79 70 65 73 71 75 61 64 2d 68 61 63 6b 2d 77 65 65 6b 2f 70 61 6c 61 64 69 6e 73 2d 6c 6f 6f 74 2e 70 6e 67 22 3a 22 37 34 32 33 30 35 22 2c 22 2e 2f 6b 6f 2d 6e 65 77 2d 79 65 61 72 2e 6a 70 67 22 3a 22 32 36 35 39 32 31 22 2c 22 2e 2f 70 6f 6c 69 73 68 2d 77 65 65 6b 2e 70 6e 67 22 Data Ascii: 017-11-16.mp4":"221825","./channel-following.png":"247815","./discovery.jpg":"778608","./g250k-cl.mp4":"909851","./hypesquad-hack-week/header.png":"819091","./hypesquad-hack-week/paladins-loot.png":"742305","./ko-new-year.jpg":"265921","./polish-week.png"
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 63 6f 64 65 2e 73 76 67 22 3a 22 38 39 34 39 39 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 64 6f 63 75 6d 65 6e 74 2e 73 76 67 22 3a 22 36 37 34 37 32 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 69 6d 61 67 65 2e 73 76 67 22 3a 22 31 30 39 38 33 37 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 70 73 2e 73 76 67 22 3a 22 35 30 34 35 31 34 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 73 6b 65 74 63 68 2e 73 76 67 22 3a 22 33 39 32 38 30 37 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 73 70 72 65 61 64 73 68 65 65 74 2e 73 76 67 22 3a 22 32 39 31 34 31 30 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 75 6e 6b 6e 6f 77 6e 2e 73 76 67 22 3a 22 35 31 36 30 38 33 22 2c 22 2e 2f 69 63 6f 6e 2d 66 69 6c 65 2d 76 69 64 65 6f 2e 73 76 67 22 3a 22 34 33 30 35 Data Ascii: code.svg":"894990","./icon-file-document.svg":"674720","./icon-file-image.svg":"109837","./icon-file-ps.svg":"504514","./icon-file-sketch.svg":"392807","./icon-file-spreadsheet.svg":"291410","./icon-file-unknown.svg":"516083","./icon-file-video.svg":"4305
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 33 32 2e 70 6e 67 22 3a 22 35 34 32 37 31 31 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 34 30 2e 70 6e 67 22 3a 22 38 35 35 32 36 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 65 2d 34 38 2e 70 6e 67 22 3a 22 38 39 37 39 30 36 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 33 32 2e 70 6e 67 22 3a 22 32 30 39 33 36 39 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 34 30 2e 70 6e 67 22 3a 22 38 36 32 38 36 31 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 31 66 33 66 66 2d 34 38 2e 70 6e 67 22 3a 22 33 30 30 38 37 38 22 2c 22 2e 2f 73 70 72 69 74 65 73 68 65 65 74 2d 65 6d 6f 6a 69 2d 33 32 2e 70 6e 67 22 Data Ascii: ./spritesheet-1f3fe-32.png":"542711","./spritesheet-1f3fe-40.png":"855266","./spritesheet-1f3fe-48.png":"897906","./spritesheet-1f3ff-32.png":"209369","./spritesheet-1f3ff-40.png":"862861","./spritesheet-1f3ff-48.png":"300878","./spritesheet-emoji-32.png"
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 61 6c 6c 5f 72 69 6e 67 69 6e 67 5f 73 6e 6f 77 73 67 69 76 69 6e 67 2e 6d 70 33 22 3a 22 33 36 36 34 34 22 2c 22 2e 2f 63 6c 69 70 5f 65 72 72 6f 72 2e 6d 70 33 22 3a 22 34 35 35 39 34 22 2c 22 2e 2f 63 6c 69 70 5f 73 61 76 65 2e 6d 70 33 22 3a 22 31 32 31 34 32 30 22 2c 22 2e 2f 64 64 72 2d 64 6f 77 6e 2e 6d 70 33 22 3a 22 38 37 39 36 32 22 2c 22 2e 2f 64 64 72 2d 6c 65 66 74 2e 6d 70 33 22 3a 22 32 35 35 32 33 37 22 2c 22 2e 2f 64 64 72 2d 72 69 67 68 74 2e 6d 70 33 22 3a 22 38 35 36 31 36 33 22 2c 22 2e 2f 64 64 72 2d 75 70 2e 6d 70 33 22 3a 22 37 32 32 32 33 37 22 2c 22 2e 2f 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 35 38 35 33 38 39 22 2c 22 2e 2f 64 69 73 63 6f 64 6f 2e 6d 70 33 22 3a 22 33 36 31 35 31 30 22 2c 22 2e 2f 64 69 73 63 6f 6e 6e 65 63 74 Data Ascii: all_ringing_snowsgiving.mp3":"36644","./clip_error.mp3":"45594","./clip_save.mp3":"121420","./ddr-down.mp3":"87962","./ddr-left.mp3":"255237","./ddr-right.mp3":"856163","./ddr-up.mp3":"722237","./deafen.mp3":"585389","./discodo.mp3":"361510","./disconnect
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 2e 2f 73 74 61 67 65 5f 77 61 69 74 69 6e 67 2e 6d 70 33 22 3a 22 36 31 37 35 31 30 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 65 6e 64 65 64 2e 6d 70 33 22 3a 22 33 30 37 33 33 34 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 73 74 61 72 74 65 64 2e 6d 70 33 22 3a 22 39 31 31 33 36 38 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 75 73 65 72 5f 6a 6f 69 6e 65 64 2e 6d 70 33 22 3a 22 31 39 35 31 32 39 22 2c 22 2e 2f 73 74 72 65 61 6d 5f 75 73 65 72 5f 6c 65 66 74 2e 6d 70 33 22 3a 22 38 32 38 36 36 30 22 2c 22 2e 2f 73 75 63 63 65 73 73 2e 6d 70 33 22 3a 22 34 39 39 33 35 33 22 2c 22 2e 2f 75 6e 64 65 61 66 65 6e 2e 6d 70 33 22 3a 22 39 33 39 38 39 31 22 2c 22 2e 2f 75 6e 6d 75 74 65 2e 6d 70 33 22 3a 22 33 36 30 33 39 34 22 2c 22 2e 2f 75 73 65 72 5f 6a 6f 69 6e 2e 6d 70 33 22 3a Data Ascii: ./stage_waiting.mp3":"617510","./stream_ended.mp3":"307334","./stream_started.mp3":"911368","./stream_user_joined.mp3":"195129","./stream_user_left.mp3":"828660","./success.mp3":"499353","./undeafen.mp3":"939891","./unmute.mp3":"360394","./user_join.mp3":
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 77 61 7c 61 62 61 63 7c 61 63 28 65 72 7c 6f 6f 7c 73 5c 2d 29 7c 61 69 28 6b 6f 7c 72 6e 29 7c 61 6c 28 61 76 7c 63 61 7c 63 6f 29 7c 61 6d 6f 69 7c 61 6e 28 65 78 7c 6e 79 7c 79 77 29 7c 61 70 74 75 7c 61 72 28 63 68 7c 67 6f 29 7c 61 73 28 74 65 7c 75 73 29 7c 61 74 74 77 7c 61 75 28 64 69 7c 5c 2d 6d 7c 72 20 7c 73 20 29 7c 61 76 61 6e 7c 62 65 28 63 6b 7c 6c 6c 7c 6e 71 29 7c 62 69 28 6c 62 7c 72 64 29 7c 62 6c 28 61 63 7c 61 7a 29 7c 62 72 28 65 7c 76 29 77 7c 62 75 6d 62 7c 62 77 5c 2d 28 6e 7c 75 29 7c 63 35 35 5c 2f 7c 63 61 70 69 7c 63 63 77 61 7c 63 64 6d 5c 2d 7c 63 65 6c 6c 7c 63 68 74 6d 7c 63 6c 64 63 7c 63 6d 64 5c 2d 7c 63 6f 28 6d 70 7c 6e 64 29 7c 63 72 61 77 7c 64 61 28 69 74 7c 6c 6c 7c 6e 67 29 7c 64 62 74 65 7c 64 63 5c 2d 73 7c 64 Data Ascii: wa\|abac\|ac(er\|oo\|s\-)\|ai(ko\|rn)\|al(av\|ca\|co)\|amoi\|an(ex\|ny\|yw)\|aptu\|ar(ch\|go)\|as(te\|us)\|attw\|au(di\|\-m\|r \|s )\|avan\|be(ck\|ll\|nq)\|bi(lb\|rd)\|bl(ac\|az)\|br(e\|v)w\|bumb\|bw\-(n\|u)\|c55\/\|capi\|ccwa\|cdm\-\|cell\|chtm\|cldc\|cmd\-\|co(mp\|nd)\|craw\|da(it\|ll\|ng)\|dbte\|dc\-s\|d
2024-10-24 07:16:21 UTC	1369	IN	Data Raw: 7c 6d 35 29 7c 74 78 5c 2d 39 7c 75 70 28 5c 2e 62 7c 67 31 7c 73 69 29 7c 75 74 73 74 7c 76 34 30 30 7c 76 37 35 30 7c 76 65 72 69 7c 76 69 28 72 67 7c 74 65 29 7c 76 6b 28 34 30 7c 35 5b 30 2d 33 5d 7c 5c 2d 76 29 7c 76 6d 34 30 7c 76 6f 64 61 7c 76 75 6c 63 7c 76 78 28 35 32 7c 35 33 7c 36 30 7c 36 31 7c 37 30 7c 38 30 7c 38 31 7c 38 33 7c 38 35 7c 39 38 29 7c 77 33 63 28 5c 2d 7c 20 29 7c 77 65 62 63 7c 77 68 69 74 7c 77 69 28 67 20 7c 6e 63 7c 6e 77 29 7c 77 6d 6c 62 7c 77 6f 6e 75 7c 78 37 30 30 7c 79 61 73 5c 2d 7c 79 6f 75 72 7c 7a 65 74 6f 7c 7a 74 65 5c 2d 2f 69 2e 74 65 73 74 28 65 2e 73 75 62 73 74 72 28 30 2c 34 29 29 7d 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 28 30 2c 74 2e 69 73 53 61 66 61 72 Data Ascii: \|m5)\|tx\-9\|up(\.b\|g1\|si)\|utst\|v400\|v750\|veri\|vi(rg\|te)\|vk(40\|5[0-3]\|\-v)\|vm40\|voda\|vulc\|vx(52\|53\|60\|61\|70\|80\|81\|83\|85\|98)\|w3c(\-\| )\|webc\|whit\|wi(g \|nc\|nw)\|wmlb\|wonu\|x700\|yas\-\|your\|zeto\|zte\-/i.test(e.substr(0,4))},e.exports=function(){return!(0,t.isSafar
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 65 6d 69 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 34 38 30 38 35 34 22 5d 2c 22 2e 2f 73 6f 75 72 63 65 2d 63 6f 64 65 2d 70 72 6f 2f 73 6f 75 72 63 65 63 6f 64 65 70 72 6f 2d 37 30 30 2d 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 37 31 31 33 31 33 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 34 30 30 2d 6e 6f 72 6d 61 6c 2e 77 6f 66 66 32 22 3a 5b 22 31 33 34 31 33 31 22 5d 2c 22 2e 2f 61 62 63 2d 67 69 6e 74 6f 2d 6e 6f 72 64 2f 61 62 63 67 69 6e 74 6f 6e 6f 72 64 2d 38 30 30 2d 65 78 74 72 61 62 6f 6c 64 2e 77 6f 66 66 32 22 3a 5b 22 38 31 34 37 32 37 22 5d 2c 22 2e 2f 6e 6f 74 6f 2d 73 61 6e 73 2f 6e 6f 74 6f 73 61 6e 73 2d 37 30 30 2d 62 6f 6c 64 69 74 61 6c 69 63 2e 77 6f 66 66 32 22 3a 5b 22 33 37 36 Data Ascii: emibolditalic.woff2":["480854"],"./source-code-pro/sourcecodepro-700-bold.woff2":["711313"],"./noto-sans/notosans-400-normal.woff2":["134131"],"./abc-ginto-nord/abcgintonord-800-extrabold.woff2":["814727"],"./noto-sans/notosans-700-bolditalic.woff2":["376
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 38 38 33 22 2c 22 2e 2f 68 72 22 3a 22 36 30 31 32 30 33 22 2c 22 2e 2f 68 72 2e 6a 73 6f 6e 22 3a 22 36 30 31 32 30 33 22 2c 22 2e 2f 68 75 22 3a 22 32 37 35 31 31 38 22 2c 22 2e 2f 68 75 2e 6a 73 6f 6e 22 3a 22 32 37 35 31 31 38 22 2c 22 2e 2f 69 64 22 3a 22 31 32 36 34 32 22 2c 22 2e 2f 69 64 2e 6a 73 6f 6e 22 3a 22 31 32 36 34 32 22 2c 22 2e 2f 69 74 22 3a 22 33 39 31 35 37 37 22 2c 22 2e 2f 69 74 2e 6a 73 6f 6e 22 3a 22 33 39 31 35 37 37 22 2c 22 2e 2f 6a 61 22 3a 22 38 33 30 36 36 36 22 2c 22 2e 2f 6a 61 2e 6a 73 6f 6e 22 3a 22 38 33 30 36 36 36 22 2c 22 2e 2f 6b 6f 22 3a 22 36 37 36 35 33 22 2c 22 2e 2f 6b 6f 2e 6a 73 6f 6e 22 3a 22 36 37 36 35 33 22 2c 22 2e 2f 6c 74 22 3a 22 37 32 38 31 30 39 22 2c 22 2e 2f 6c 74 2e 6a 73 6f 6e 22 3a 22 37 32 38 Data Ascii: 883","./hr":"601203","./hr.json":"601203","./hu":"275118","./hu.json":"275118","./id":"12642","./id.json":"12642","./it":"391577","./it.json":"391577","./ja":"830666","./ja.json":"830666","./ko":"67653","./ko.json":"67653","./lt":"728109","./lt.json":"728

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.10	49776	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	883	OUT	GET /assets/591980d24607547de30a.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/css Content-Length: 41018 Connection: close CF-Ray: 8d782e586e806b47-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "fbec530f567cb32c81348642102c8348" Last-Modified: Fri, 11 Oct 2024 19:21:44 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IMNmcbXvXS520MqlZ%2F49BE%2BSby6iu%2Bp%2FHO7n26hG0BmcH5zT2QjpzrrK5UWG2cug336VEkJAnHGwfqpKG8PKJ4%2BA%2BGP5GBmvbhPrmrvX1U4%2FFGZ3qV8va3bg77cO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2e 64 69 73 63 6f 72 64 4c 6f 67 6f 5f 62 38 33 61 30 35 7b 68 65 69 67 68 74 3a 33 36 70 78 3b 77 69 64 74 68 3a 31 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 29 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 34 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 63 75 73 74 6f 6d 2d 61 75 74 68 2d 62 6f 78 2d 61 75 74 68 2d 62 6f 78 2d 70 61 64 64 69 6e 67 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d Data Ascii: .discordLogo_b83a05{height:36px;width:112px;background:url(/assets/23a7a3fd6624342117bf.svg)no-repeat;display:none;flex-shrink:0;margin-bottom:16px}.authBox_b83a05{width:480px;padding:var(--custom-auth-box-auth-box-padding);font-size:18px;box-shadow:var(-
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 73 63 72 6f 6c 6c 7d 2e 69 73 2d 6d 6f 62 69 6c 65 20 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 20 2e 64 69 73 63 6f 72 64 4c 6f 67 6f 5f 62 38 33 61 30 35 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 6f 70 3a 31 36 70 78 7d 40 6d 65 64 69 61 28 6d 61 78 2d 77 69 64 74 68 3a 38 33 30 70 78 29 7b 2e 69 73 2d 6d 6f 62 69 6c 65 20 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 2e 61 75 74 68 42 6f 78 45 78 70 61 6e 64 65 64 5f 62 38 33 61 30 35 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 7d 2e 69 73 2d 6d 6f 62 69 6c 65 20 2e 61 75 74 68 42 6f 78 5f 62 38 33 61 30 35 20 2e 63 65 6e 74 65 72 69 6e 67 57 72 61 70 70 65 72 5f 62 38 33 61 30 35 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 Data Ascii: der-radius:0;overflow:scroll}.is-mobile .authBox_b83a05 .discordLogo_b83a05{display:block;top:16px}@media(max-width:830px){.is-mobile .authBox_b83a05.authBoxExpanded_b83a05{max-width:none}}.is-mobile .authBox_b83a05 .centeringWrapper_b83a05{position:relat
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2d 74 65 78 74 2d 6d 75 74 65 64 29 7d 2e 6a 6f 69 6e 69 6e 67 41 73 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 6a 6f 69 6e 69 6e 67 41 73 41 76 61 74 61 72 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 34 70 78 7d 2e 6a 6f 69 6e 69 6e 67 41 73 55 73 65 72 6e 61 6d 65 5f 62 38 33 61 30 35 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 2e 73 70 69 6e 6e 65 72 56 69 64 65 6f 5f 62 38 33 61 30 35 7b 77 69 64 74 68 3a 32 30 30 70 78 3b 68 65 69 67 68 74 3a 32 30 30 70 78 7d 2e 69 6d 61 67 65 5f 62 38 33 61 30 Data Ascii: -text-muted)}.joiningAs_b83a05{margin-top:20px;height:100%;display:flex;justify-content:center;align-items:center}.joiningAsAvatar_b83a05{margin-left:14px}.joiningAsUsername_b83a05{margin-left:5px}.spinnerVideo_b83a05{width:200px;height:200px}.image_b83a0
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 65 63 6f 6e 64 61 72 79 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 77 68 61 74 49 74 65 6d 5f 64 64 61 36 35 62 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6d 6f 64 69 66 69 65 72 2d 61 63 63 65 6e 74 29 7d 2e 70 68 6f 6e 65 46 69 65 6c 64 50 6f 70 6f 75 74 5f 66 66 37 36 31 62 7b 77 69 64 74 68 3a 32 32 30 70 78 3b 68 65 69 67 68 74 3a 32 34 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 34 30 70 78 3b 6c 65 66 74 3a 30 7d 2e 70 68 6f 6e 65 46 69 65 6c 64 50 6f 70 6f 75 74 Data Ascii: {background-color:var(--background-secondary);border-radius:4px;margin-bottom:8px}.whatItem_dda65b{border-top:1px solid var(--background-modifier-accent)}.phoneFieldPopout_ff761b{width:220px;height:240px;position:absolute;top:40px;left:0}.phoneFieldPopout
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 69 67 68 74 54 65 78 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 48 69 67 68 6c 69 67 68 74 3b 63 6f 6c 6f 72 3a 48 69 67 68 6c 69 67 68 74 7d 2e 69 6e 70 75 74 5f 63 63 36 64 64 64 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 69 6e 70 75 74 57 72 61 70 70 65 72 5f 63 63 36 64 64 64 7b 66 6c 65 78 2d 67 72 6f 77 3a 31 7d 2e 69 6e 70 75 74 46 69 65 6c 64 5f 63 63 36 64 64 64 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 65 6e 61 62 6c 65 2d 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 20 2e 69 6e 70 75 74 5f 63 63 36 64 64 64 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 2e 69 6d 61 67 65 5f 61 34 64 39 62 64 7b 68 65 69 67 68 74 Data Ascii: ightText;border-color:Highlight;color:Highlight}.input_cc6ddd{display:flex;align-items:center}.inputWrapper_cc6ddd{flex-grow:1}.inputField_cc6ddd{border:none;background-color:transparent}.enable-forced-colors .input_cc6ddd{border:none}.image_a4d9bd{height
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 31 36 70 78 7d 2e 74 69 74 6c 65 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 68 65 61 64 65 72 2d 70 72 69 6d 61 72 79 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 68 65 69 67 68 74 3a 36 34 30 70 78 29 7b 2e 74 69 74 6c 65 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 7d 7d 2e 61 63 74 69 76 69 74 79 43 6f 75 6e 74 5f 65 37 33 35 32 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 70 78 7d 40 6d 65 64 69 61 28 6d 69 6e 2d 68 65 69 67 68 74 3a 36 34 30 70 78 29 7b 2e 61 63 74 69 Data Ascii: 16px}.title_e73528{margin-top:4px;display:flex;align-items:center;justify-content:center;color:var(--header-primary);font-weight:600}@media(min-height:640px){.title_e73528{margin-top:8px}}.activityCount_e73528{margin-top:4px}@media(min-height:640px){.acti
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 69 6d 65 5f 64 36 61 34 37 35 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 6e 65 77 42 61 64 67 65 5f 64 36 61 34 37 35 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 72 61 6e 64 2d 32 36 30 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 32 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 36 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 65 78 74 2d 74 6f 70 7d 2e 6e 65 77 42 61 64 67 65 54 Data Ascii: ime_d6a475{display:inline-block}.newBadge_d6a475{align-items:center;background-color:var(--brand-260);border-radius:12px;display:inline-flex;flex-shrink:0;height:20px;justify-content:center;margin-right:8px;padding:0 6px;vertical-align:text-top}.newBadgeT
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2e 65 76 65 6e 74 4e 61 6d 65 5f 61 34 65 63 36 32 7b 63 6f 6c 6f 72 3a 42 75 74 74 6f 6e 54 65 78 74 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 77 72 61 70 70 65 72 5f 61 37 31 61 31 63 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 65 63 6f 6e 64 61 72 79 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 3b 70 61 Data Ascii: .eventName_a4ec62{color:ButtonText;-webkit-text-decoration:underline;text-decoration:underline}.wrapper_a71a1c{cursor:default;-webkit-user-select:none;-moz-user-select:none;user-select:none;background-color:var(--background-secondary);border-radius:4px;pa
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 78 3b 68 65 69 67 68 74 3a 38 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 2e 73 74 61 74 75 73 57 72 61 70 70 65 72 5f 61 37 31 61 31 63 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 3a 30 20 31 20 61 75 74 6f 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 66 6c 6f 77 3a 6e 6f 77 72 61 70 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 7d 2e 73 74 61 74 75 73 4f 6e 6c 69 6e 65 5f 61 37 31 61 31 63 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 67 72 65 65 6e 2d 33 36 30 29 7d 2e 73 74 61 74 75 73 4f 66 66 6c 69 6e 65 5f 61 37 31 61 31 63 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 34 30 30 29 7d 2e 63 6f 75 6e 74 5f 61 37 31 61 31 63 7b Data Ascii: x;height:8px;border-radius:50%}.statusWrapper_a71a1c{display:flex;flex:0 1 auto;align-items:center;flex-flow:nowrap;min-width:0}.statusOnline_a71a1c{background-color:var(--green-360)}.statusOffline_a71a1c{background-color:var(--primary-400)}.count_a71a1c{
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 66 6c 65 78 3a 31 20 30 20 61 75 74 6f 7d 2e 62 75 74 74 6f 6e 5f 61 37 31 61 31 63 2e 62 75 74 74 6f 6e 53 69 7a 65 5f 61 37 31 61 31 63 7b 68 65 69 67 68 74 3a 34 30 70 78 7d 2e 67 75 69 6c 64 49 63 6f 6e 45 78 70 69 72 65 64 5f 61 37 31 61 31 63 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 65 63 6f 6e 64 61 72 79 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 35 30 70 78 20 32 36 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: -height:20px;align-self:center;white-space:nowrap;text-overflow:ellipsis;overflow:hidden;flex:1 0 auto}.button_a71a1c.buttonSize_a71a1c{height:40px}.guildIconExpired_a71a1c{background-color:var(--background-secondary);background-size:50px 26px;background-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.10	49778	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	883	OUT	GET /assets/2917679ca8a08c390036.css HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	953	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/css Content-Length: 957 Connection: close CF-Ray: 8d782e59ee012e6a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "20ddaa519e404695d0657d3868d2701f" Last-Modified: Tue, 25 Jun 2024 20:41:32 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sZGdBNj%2BFHWvLm7PIUwmVMGodPlx3%2BRlHM6kNnXj2EUCyR9Zighwauh0QHYejaO6Puml8u%2FeThD75YQBWKo6KMCPz25KK7Wg1jNy5Qzt7CDlifRPlPa5UJCWMb9Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	416	IN	Data Raw: 2e 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 2c 2e 61 63 74 69 76 65 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 32 7d 2e 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 76 69 64 65 6f 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a Data Ascii: .wrapper_cd22e7,.activeWrapper_cd22e7{height:100%;left:0;position:absolute;top:0;width:100%;z-index:1002}.wrapper_cd22e7{pointer-events:none}.videoWrapper_cd22e7{position:absolute;transform:translate(-50%,-50%);top:50%;left:50%;z-index:200;pointer-events:
2024-10-24 07:16:22 UTC	541	IN	Data Raw: 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 32 30 30 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 7d 2e 67 61 64 69 65 6e 74 48 69 67 68 6c 69 67 68 74 5f 63 64 32 32 65 37 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 30 64 65 67 2c 76 61 72 28 2d 2d 70 72 65 6d 69 75 6d 2d 74 69 65 72 2d 32 2d 70 75 72 70 6c 65 2d 66 6f 72 2d 67 72 61 64 69 65 6e 74 73 29 30 25 2c 76 61 72 28 2d 2d 70 72 65 6d 69 75 6d 2d 74 69 65 72 2d 32 2d 70 Data Ascii: er-events:none;z-index:200;top:0;left:0;width:100%;height:100%}.gadientHighlight_cd22e7{position:absolute;width:100%;height:100%;pointer-events:none;background-image:linear-gradient(90deg,var(--premium-tier-2-purple-for-gradients)0%,var(--premium-tier-2-p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.10	49780	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	909	OUT	GET /assets/8234e0a75aa9afb205bd.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	957	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: font/woff2 Content-Length: 43364 Connection: close CF-Ray: 8d782e59fbc96c01-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "281bba49537cf936d1a0df10fb719f63" Last-Modified: Wed, 05 Jun 2024 19:27:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uxyt99QF5r%2FL6bdr16FP7x8UqYnYl0ykCvKTQMl1QcnK7zAaXMxGdQo%2FMcb2NxZ27OgAgsEcRXwQl8P29WVF3kYJ5FHpUr1RYPsBQPQZbOlWSUH7IF%2BNwoZ93mLd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	412	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 a9 64 00 11 00 00 00 01 97 38 00 00 a9 00 00 03 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 78 1b 81 aa 40 1c a1 5c 06 60 00 8e 58 08 82 3e 09 9f 03 11 0c 0a 83 b6 0c 82 f9 22 01 36 02 24 03 9a 0c 0b 8d 08 00 04 20 05 95 05 07 b5 4b 0c 83 0e 5b 1e 71 91 02 aa 63 ed 9f 01 10 35 aa 6e 43 00 a8 fc 55 97 9b e7 1d 3f c1 94 ab 71 1c 7a 6e 1d 3c a9 96 2d ea 01 dc 61 a3 9c 43 cd b3 ad 4a 3b ec c5 38 fb ff ff ff ff 73 93 85 1c d6 ce d2 99 4d 12 40 35 a1 75 ff 46 97 94 11 14 29 17 27 a2 4e f3 02 39 7b 55 92 27 09 e7 75 81 0d f6 7c d8 3b 57 ae f3 99 9d f2 91 1f 67 7a 3b 6d 0e 6f 92 bc 26 41 82 b7 bb f7 be 6f da 2e 8b 93 9b ea bc c6 bb b0 94 56 6d 2f 90 f6 04 01 61 9a 56 4e 46 8b fb ac f0 b5 b4 ba fc 54 2f 24 Data Ascii: wOF2d8x@\`X>"6$ K[qc5nCU?qzn<-aCJ;8sM@5uF)'N9{U'u\|;Wgz;mo&Ao.Vm/aVNFT/$
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: f0 0c 4a 3f b2 39 42 1e 26 c8 b5 66 fb 64 cb 29 07 54 b2 d9 0e 53 ba 80 20 6e 03 2a f6 e3 67 37 4e f7 e2 d1 92 77 19 3d 8e d7 06 7c ed 21 e6 a3 cd 0f af b9 bc 62 f7 ee 73 da ed 0f 9f f1 e6 17 08 7f 71 49 3c 46 3a c6 db dd 70 93 b5 17 79 0b 0c e5 32 07 68 a2 2b 31 4c a5 2c b1 6d 47 5c cf 17 34 aa 45 25 2b 72 aa 97 0e 81 f1 b5 d8 1e a2 b9 dd fd 6f 23 37 46 86 d4 48 a1 2d 2a c6 68 a1 0d 52 1b 98 45 58 64 48 59 b3 00 a1 0d c0 d1 0a 28 06 b4 01 08 2d 4a b6 c5 d8 00 4d 67 88 b5 25 6d e3 8d 35 49 d3 a6 8d 88 de 5d 72 51 6f d2 24 4d c5 d1 2a 6d 11 f5 6d e0 1b c1 64 4c 90 6d cc 90 6e ce 7e 03 e6 ec 99 02 63 6c 54 d0 6d f6 9e 3d 8b 28 0b 88 33 8b 2a b8 c8 ae d9 43 7a 81 8f 70 04 03 2e b9 00 b8 d4 95 bb 6b 81 e9 89 e2 64 46 3f 8a 14 2e 09 f4 80 e0 73 80 c0 01 72 51 Data Ascii: J?9B&fd)TS ng7Nw=\|!bsqI<F:py2h+1L,mG\4E%+ro#7FH-hREXdHY(-JMg%m5I]rQo$MmmdLmn~clTm=(3Czp.kdF?.srQ
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: fa df 93 dc df 6f ad 51 cf a8 51 15 15 11 15 55 a3 af e6 7e fc 4e ec ff a5 6f e9 fb db d2 b7 ec 75 55 45 44 8c 71 8c 63 8c 88 ab 2e a4 4b a9 8c 04 d7 7d 25 1e 17 8b 09 c6 2c 81 7f b5 96 fa 19 69 bc 37 e0 62 4a e9 2c b0 e5 22 bf 5b 09 6e 19 3f 4e fa cc ba e4 a7 9f b3 42 02 9a 64 d7 6b 29 d5 2c 0a 28 6d 80 61 5a 61 1e e5 f7 ac cc 59 d5 0e a0 0e 48 01 36 90 20 c8 bf 7b ed 8c 15 e7 c1 00 e8 67 f4 70 7b 34 01 70 18 87 ff 97 b1 e8 c1 70 0c c4 4b 30 48 a8 18 90 38 a3 20 e3 89 04 23 46 14 8c 16 49 30 3a 4c c1 98 ea 09 26 d4 60 48 fe fa 1b 0c 33 05 ca 3b 74 50 83 45 42 3d b1 f6 50 03 d6 11 34 68 53 83 5e 5e 77 d0 b0 0d 06 0d df 9c a0 d1 8b 0f 9a b8 c4 a0 19 cb 08 9a bd db 41 ef ee 41 d0 47 7b 14 f4 c9 9e 04 cd 5f 7e d0 a2 15 07 2d db f3 a0 e5 a3 07 ad 5d 63 d0 e6 Data Ascii: oQQU~NouUEDqc.K}%,i7bJ,"[n?NBdk),(maZaYH6 {gp{4ppK0H8 #FI0:L&`H3;tPEB=P4hS^^wAAG{_~-]c
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 67 dc 88 a2 a9 90 57 6d 98 e4 27 b0 7a df c2 2b ef d6 50 60 35 95 ab c7 fb 4c e9 13 fe b9 9a 9b 8f 2b 99 7c d7 f2 2e 75 42 1d 20 4b 96 2a bd 65 0d d4 a4 d1 08 cc e9 d9 eb c4 6b 3a 74 96 66 47 4b bc f5 44 88 d2 be d5 81 bf d5 97 d8 57 4c de a4 af c8 2d da f2 19 ca d9 7d 34 f2 4f 83 ee bc 9b 3e c5 82 e3 c4 12 58 3a 2b 80 3d e8 72 a2 7c 1e 7d 83 cd 2e 48 b6 67 b3 3b 9e 16 fa b6 41 67 54 27 dd 78 f3 41 ed fc 13 cf d9 77 f7 20 b1 b0 bb 6f 00 da f8 2e ec 12 e4 86 cf 8e 8d 27 d4 ca e4 85 f3 0d dc 9d dd 03 05 c2 a2 ca 03 a5 87 0b b1 ce 9d ab 01 6c d4 c6 17 db 7c bf 53 65 ce 51 3b 37 22 08 64 b8 3f eb 98 c9 26 fa f7 76 77 ec 8d 25 cf 59 e6 a6 02 8c 99 7b a6 d6 79 72 a3 99 13 ca c7 c3 85 1c bb db b3 de 8e 45 5e 70 1c b4 03 b8 bc 93 7d 37 be 19 64 7c bf 42 fe 7d ff Data Ascii: gWm'z+P`5L+\|.uB K*ek:tfGKDWL-}4O>X:+=r\|}.Hg;AgT'xAw o.'l\|SeQ;7"d?&vw%Y{yrE^p}7d\|B}
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 68 c6 f7 9a 3a dd bc e7 7d 69 3e 40 87 95 fc 6f 33 75 9a 7e e6 f3 db 15 56 fa 4a fa 3d a9 ce 7a 1b 7c ed 1b 1b a3 d3 f4 7b 3f a4 23 46 7b fc ec 17 bf da 3b 1e 73 3c fa ba 4f b3 ba 07 84 cb c2 99 bd 56 62 a9 2f ad b6 c6 77 ef 4e 3f fa c9 c9 ed c3 19 74 f8 5e 26 a4 69 68 6a 69 eb e8 ea e9 1b a0 54 1a 9d c1 64 b1 31 43 dc 2a c1 e1 f2 8a 3f 08 e1 c6 54 9a 89 a9 99 b9 85 a5 95 35 9d c1 64 d9 d8 da d9 bb 72 60 3b 72 8a 7f 63 ec b4 49 13 c0 6a b3 5b 41 b4 eb aa e0 74 a0 02 75 b0 c2 a2 d3 95 a5 b3 db ac 1d b1 c5 e4 2c 2b 4b de ca d2 cb af 30 dc a1 4a 54 85 aa 01 90 86 5c 78 76 d8 ba 42 31 46 b1 1b 82 6a 80 7e 54 2f 1d ed eb d6 be be 5b 7a 4f c7 7b 59 37 f4 d4 a0 89 97 d1 fc cf 67 49 62 97 dd 0f 03 e0 8c 4c 00 c4 a4 32 fd 48 b7 a5 ef 52 62 97 1e d2 b2 5b a5 45 a7 Data Ascii: h:}i>@o3u~VJ=z\|{?#F{;s<OVb/wN?t^&ihjiTd1C*?T5dr`;rcIj[Atu,+K0JT\xvB1Fj~T/[zO{Y7gIbL2HRb[E
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6e 59 42 44 b6 4e 26 94 86 1a 13 93 22 01 fd a8 a4 b6 e9 28 58 ae bd 8c e1 84 e4 0d 29 97 83 28 04 ec 69 8e eb ef e4 06 53 22 8c 79 3e fc c1 4b 57 66 b8 cc c9 1a 2b 33 3e d4 66 70 3e ce a0 50 fa 29 c8 88 0c 44 10 05 22 91 84 c8 b2 28 70 19 79 a8 20 26 52 51 01 4d 64 e3 a7 a5 70 07 18 42 2e 93 16 c3 b1 e4 e4 bd e7 4e 4a b4 54 c0 34 32 53 8b 27 f9 3a b7 e1 6f f7 fa e1 8f 6a a5 61 d5 c0 e2 12 d3 41 d4 60 0b e3 f2 be 01 b3 6a e1 b5 63 44 de bf da a5 0d 80 cc e0 b7 87 d6 ba 4e 3d eb dd 2c bd 97 c5 cc 0d 75 11 04 51 d0 36 b2 57 01 5c 24 b0 82 39 a8 42 db 92 c6 08 92 64 d9 8e 0c e0 73 24 b3 82 f6 3b c8 e7 ee 0a 34 43 4d 1f 0e 96 41 b6 03 16 c6 c1 38 86 60 07 51 a5 b3 8f 7a f4 c3 a9 eb 7f 5e bb c2 d1 cd 9d 53 ec 96 cd 75 46 09 5b d1 35 76 4b 0b af d1 3b 14 84 45 Data Ascii: nYBDN&"(X)(iS"y>KWf+3>fp>P)D"(py &RQMdpB.NJT42S':ojaA`jcDN=,uQ6W\$9Bds$;4CMA8`Qz^SuF[5vK;E
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 85 bb fd e6 7f 3f 5c d0 06 5d c0 00 9b 28 66 5c d2 46 f4 9c 42 5b 95 86 0b 03 01 30 50 52 90 12 98 51 c1 a8 01 0d 30 d2 6b 3c 54 46 46 53 93 a2 9a 60 60 b3 5c e2 eb f9 90 c5 58 99 ad 3f 4a 43 1c 3d 2e a3 86 0e f5 42 4f 84 7d 93 e6 4a fb 61 37 14 70 80 1d 75 c3 69 d3 9b d7 2e 41 82 5d 2f d0 96 7c 75 f2 c2 5d 7a ac 37 a1 b7 9f dc 4b 85 c6 c5 60 37 04 aa bf 91 0c ee 53 79 e6 47 0a 07 62 1c 8a 4c 88 b7 c2 0b 74 84 1d 5a d0 0a f6 a2 50 23 d4 fb 97 7a 11 2b e9 0a 1c 35 47 c9 d1 b0 07 c5 46 55 b0 a4 cd b1 88 90 66 86 00 d9 f9 68 49 aa 85 09 56 de 15 00 c0 fb 00 39 f1 55 9b 1b e7 f9 4f f2 08 50 ca 88 b5 a9 03 6b 29 f0 f8 17 76 d6 25 be 9e 1a ea a0 39 b4 cc 6c 22 2c a4 d5 64 13 b1 6a b7 f2 2b e4 c5 ed da 41 fd 50 49 1f 27 3f 9b 5b f1 4d df 8f 4f 13 ae d8 37 1f 46 Data Ascii: ?\](f\FB[0PRQ0k<TFFS``\X?JC=.BO}Ja7pui.A]/\|u]z7K`7SyGbLtZP#z+5GFUfhIV9UOPk)v%9l",dj+API'?[MO7F
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 4a 69 5f 62 4b f1 ad 65 79 46 16 e0 a6 ea 23 49 e9 16 ac 44 34 6c 69 75 98 71 6f ec 21 47 9b 57 05 9f 14 0e a9 a5 bc c8 ab 44 c7 49 4a a9 48 70 2d d6 51 2c 95 7a ec a2 8b 58 ea b2 06 c7 1c ca 68 c3 15 ac 95 cf 83 59 22 53 53 e1 24 03 48 82 5f a3 2a 0a 1c 46 35 e8 02 ad ef 56 1e 06 a8 75 91 e0 97 09 db 8c 6d a2 47 43 13 b1 a5 ba 05 db 0e 3f 0c 3e 84 8b 11 b6 cc 20 40 45 06 f6 2a 39 5d 31 9b f4 30 7b 28 ea f7 38 8c 33 d6 03 da 3b c2 d5 7d 94 f1 e3 e7 0d 5a 09 7b b8 25 a6 c5 af 72 42 cf e4 73 a5 6c e3 96 bc ca 91 15 6c 64 07 9a d6 df 1d 97 7e 6c b4 45 dd a2 2d fe cf f3 e9 c6 5f 23 38 86 e7 04 59 dd 60 d2 c5 54 7e 17 67 d1 aa dd 86 34 64 1f d7 bd 48 06 d9 7b f7 f0 9e 0b 5e c4 a9 4a e0 32 f2 b1 17 ec 39 cb 59 35 97 0b 6f dc 73 2c aa af 22 e4 5c a7 cd 7a a4 f0 Data Ascii: Ji_bKeyF#ID4liuqo!GWDIJHp-Q,zXhY"SS$H_F5VumGC?> @E9]10{(83;}Z{%rBslld~lE-_#8Y`T~g4dH{^J29Y5os,"\z
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6b b3 17 b3 84 a5 2c 7d d9 bb b7 bc 90 11 88 7f 7b 96 b7 a7 1b d8 e0 86 36 bc 91 df 5e cb 09 93 93 36 f5 cc 66 37 17 32 7c 51 1a 0a 5b 47 6d e1 81 83 5b 56 de 6d 47 dd 85 8d 89 60 61 a4 c5 f0 6d 0f 82 8d b7 ba 73 cb 95 e7 a9 7c 05 0a 15 29 56 a2 43 e3 2d b6 dc 95 91 f3 56 b5 60 37 6e f1 8c ba f3 a7 4d 51 99 d8 02 f0 87 32 38 d1 9f 90 41 50 56 00 87 80 a9 88 21 c0 24 cb 0e 1c ac 89 96 b8 7d 40 d9 89 1d 35 cc db 4a bd ba 64 55 22 06 2f 67 b7 bc cd fd a3 d8 99 0d fe 2a 75 1d 3b 4a 3c 1c 2c c2 66 a7 f1 a2 ad d9 db 7d 0b 82 01 83 b7 c6 c4 83 c0 31 1a ae 4c a3 33 86 97 3c 6c 94 c4 0c 59 0c 64 92 8d 63 d3 bb 70 55 88 9e be 15 38 a5 b1 99 f0 f3 57 7e 7c b5 e2 39 4a 56 d5 83 4c 00 20 b8 44 48 76 e7 69 4d 29 fa e7 3e 0e 0f 4f e4 c8 95 e7 29 08 6b 88 90 50 d0 30 b0 Data Ascii: k,}{6^6f72\|Q[Gm[VmG`ams\|)VC-V`7nMQ28APV!$}@5JdU"/g*u;J<,f}1L3<lYdcpU8W~\|9JVL DHviM)>O)kP0
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 92 76 3d 55 37 d3 74 23 75 11 e9 17 9d 51 51 19 16 99 41 89 59 94 90 79 f1 99 f5 28 cf 68 b9 95 1a a5 87 79 74 3f d7 1e e4 5e 6e c7 2b ca bf 62 2f 3a 57 79 01 bd ec 7c 01 b1 cb ca a1 8a 02 13 d5 27 26 e3 92 8a 7b 4b bd f4 d0 5b 7f 7d 3c aa 99 e6 92 b5 d1 56 8a a6 1a 68 a7 b5 16 5a 8d e1 18 0f 16 3d 40 52 41 2d 15 85 60 c2 d0 21 8d ca 28 8c f2 7c b7 44 ee c5 84 06 3e f2 82 b7 cd 26 83 00 1d e8 a1 79 c3 6b dc 92 66 80 81 f0 90 72 69 6d 88 a1 aa ee 4e 82 89 26 9b 64 8a a9 a6 9b e1 2d ef f8 c0 87 e6 5b f0 a8 18 28 33 8a 54 93 cd be 13 d4 54 46 6b 78 ba 10 23 ba b9 d7 62 3b c1 a1 c1 6d b6 fb 45 ba 95 f7 7f 3f 3f f8 d8 3e 9f d8 6f 8e df bd 68 09 d7 e8 69 de e5 74 ac bc bc e2 d5 85 5f 0f 3c 9f 70 d1 86 a8 1d b7 0e 04 5a b1 f0 16 1b 2d d8 79 8f 83 0f 58 79 47 cb Data Ascii: v=U7t#uQQAYy(hyt?^n+b/:Wy\|'&{K[}<VhZ=@RA-`!(\|D>&ykfrimN&d-[(3TTFkx#b;mE??>ohit_<pZ-yXyG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.10	49781	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	909	OUT	GET /assets/b21c5111a12372139409.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	955	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: font/woff2 Content-Length: 39724 Connection: close CF-Ray: 8d782e5a0a932e25-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "ff5eccde83f118cea0224ebbb9dc3179" Last-Modified: Wed, 05 Jun 2024 19:27:57 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wPF3M9flJwXybELIzX9Yl%2BG1JLDrlxQWwHqvGCSQFy%2FktZV61SXtzPCRSENw4X3jR1z7Ce2JComDVAR7TQGaYcqALKvrv7He0gkcrn2FeFL4MEoEbAelXPfo9UZY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	414	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 9b 2c 00 11 00 00 00 01 7c 50 00 00 9a c6 00 02 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 83 04 1b 81 9a 02 1c a0 20 06 60 00 8e 50 08 82 40 09 8d 57 11 0c 0a 83 a6 04 82 e9 3c 01 36 02 24 03 99 60 0b 8c 72 00 04 20 05 93 3c 07 b4 46 0c 83 60 5b 70 56 71 85 9a 77 ff 53 49 86 ba 2b 9e 53 7f 66 3b 64 53 c3 b6 69 f1 b3 9e ab 20 43 d4 b7 62 6a d8 36 8d 88 77 3b 80 2f d5 fe e1 b2 ff ff ff 4f 4d 26 cf b8 bf 5b b9 6d 6f 2d a1 c0 c7 87 0c 8f 88 34 46 60 04 0f 84 53 65 52 f8 58 7a 50 ae 67 0f ac 6a 0a b9 4c f5 96 a2 0b a2 53 18 54 28 61 c5 15 79 a3 44 90 d3 06 6f 64 bb 2f 29 e3 02 f7 d8 e1 7c 6c f7 1d 0f 7a 6e f4 d2 91 ef a0 54 d0 e2 bc 92 4f 70 5a 50 08 bc b0 b3 63 5c 8c f2 c3 da 25 92 48 96 cb ba 79 04 09 Data Ascii: wOF2,\|PB `P@W<6$`r <F`[pVqwSI+Sf;dSi Cbj6w;/OM&[mo-4F`SeRXzPgjLST(ayDod/)\|lznTOpZPc\%Hy
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6a 65 8b 23 ae 7e 5f a8 88 df fc ff ea 9a 85 13 21 d7 85 e4 99 f9 37 13 65 7f 9e e6 f4 fd ff cf 73 b9 5c 84 60 47 d0 5e b3 15 af 68 d2 42 b2 04 93 09 74 52 a3 4e d5 c0 2b 22 78 55 81 0e e6 ca a8 33 aa 46 7d 30 f8 ff df cd 7a f7 bd 90 40 5e 92 06 69 42 5e 0a 13 b4 0e 75 26 1d ab 0f 9d b3 5f 7b 98 24 5d 0e ab 8c 88 af 98 fe b9 7f 8a 38 6b c6 9a 8c 18 fc 3f ff 63 cf ff e6 5e e7 7e 15 a0 fd 41 32 cd d6 18 54 95 24 16 69 10 09 9d fa 13 59 63 78 21 62 7e 06 78 bb fd bb 33 3a 67 ee 5b ce ba 21 c9 58 95 ce b8 b3 66 67 74 ec 64 75 66 12 92 cc fb 92 75 5a 57 21 d9 19 97 8c 79 f9 c6 aa 28 5d d6 8f 24 d9 49 66 5f fc 9f cd f6 67 36 39 b7 45 66 de 27 7b e2 98 6e 64 43 0e d3 59 74 36 f1 ee 2a c4 3b ee 0d 5c 05 15 4d f5 17 0d dd 15 0d 45 27 da 5e 49 cb dc fb ce 72 46 4a Data Ascii: je#~_!7es\`G^hBtRN+"xU3F}0z@^iB^u&_{$]8k?c^~A2T$iYcx!b~x3:g[!XfgtdufuZW!y(]$If_g69Ef'{ndCYt6*;\ME'^IrFJ
2024-10-24 07:16:22 UTC	1267	IN	Data Raw: 28 2a 8d a5 65 b0 b6 1c 36 54 c0 e6 1e 79 3b 43 20 cb 04 b2 5a 87 3d 95 73 a0 1a 8e f6 8a da 9a a9 af 8d 86 3a bd cf 11 c8 ef 05 f2 27 1d 7e ed 1d 7f 34 ce df 7d e4 72 73 5c ed 3b 77 5a e3 61 db 3c 6f d7 7b 85 00 df e8 d0 de 91 d2 d9 b1 5a 40 16 90 88 84 5c 42 18 4a 14 73 49 e0 55 52 28 25 87 a5 60 04 15 9e a8 d2 f0 fa f2 67 86 80 00 16 e8 85 05 72 f6 b9 56 4e 20 ce 51 f7 8e 08 01 41 72 6f 1c 15 06 8a 42 88 3d 16 74 86 1b 49 c8 1c 58 94 a2 16 6d 42 6e eb 1f 11 06 4a 04 e3 47 65 dc a0 b4 6a 70 e8 88 f3 4e f4 0d e0 73 d0 99 e7 39 20 80 f3 28 80 70 31 94 5a 4a d7 ea b7 30 a5 7b a5 47 a5 b6 cd 2f c1 70 10 fe 6b 64 31 d7 2b 39 37 bf e2 34 ef 34 ce 5a d3 c9 38 50 94 47 07 fe 33 ae 63 8a 00 41 1c 67 38 09 b1 b3 1c 04 71 d1 45 37 c1 5d 62 6b 25 ba 57 da 5a 4f 4d Data Ascii: (*e6Ty;C Z=s:'~4}rs\;wZa<o{Z@\BJsIUR(%`grVN QAroB=tIXmBnJGejpNs9 (p1ZJ0{G/pkd1+9744Z8PG3cAg8qE7]bk%WZOM
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 43 c3 e1 26 06 d5 d7 fb bc 6b 06 14 a1 93 35 aa 30 d6 ee dc 5d 5b 71 93 ac 74 16 fd a7 16 e9 3e 52 0b c6 0b f2 e7 58 f4 b5 23 56 6d 4d e9 a6 f8 8a cf 04 6c e2 2f 74 32 9d 73 5e fd 73 d7 af a1 86 a6 ba 76 f5 7a a3 d9 73 a1 c5 c7 40 d0 48 72 8e 5d 16 3c 5f 9d f1 2f bd 1f 7f 1d e8 99 47 3b f0 c8 b4 ab 91 cf 4a 3f 49 a2 dc c9 12 52 a2 73 ea 97 fa a7 eb 09 fa 76 e7 b0 16 9e 3a 0e 2a 65 1e fb 8d 19 d1 6c 32 42 8b d3 e1 1c d3 5e ae 46 2a d2 7d d6 ec 4b e7 4b 32 87 13 da 24 9d 1c b1 c2 8c 5e 99 8e 9c b7 15 7c d5 af a7 38 79 45 a6 9c fe cc a6 74 13 a2 e2 65 5e 1d f9 5b 8a 78 70 6e 30 e9 6f cd 9f 9a 03 29 4c 7d 5c 11 b8 51 fa 2a 8d 1f 10 92 de 6c 0d 25 73 1d 39 7d 5b 60 83 c1 eb 8d aa 91 7e 64 4e 5e da ab c6 70 56 54 5a 8f a6 eb 67 e3 90 d4 ea 37 56 83 f6 7f 5e 76 Data Ascii: C&k50][qt>RX#VmMl/t2s^svzs@Hr]<_/G;J?IRsv:el2B^F}KK2$^\|8yEte^[xpn0o)L}\Q*l%s9}[`~dN^pVTZg7V^v
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: f8 0c 9f cf 11 6c 07 ec 80 b3 93 40 a1 4f a0 c1 f8 d1 a8 09 a6 d9 53 f8 28 39 3b a3 4f b4 73 38 0f 7c 46 24 10 e1 25 48 83 ad 01 c6 fd 10 0f c0 78 aa 51 2f 44 0a c6 b3 c5 68 be b8 0e 3e 04 3f 33 18 3f 87 f7 0b 90 df c1 fa 17 b4 17 60 bc 0d 5b 02 60 4a 9b a9 3e f1 2a 29 7c 4b 8e dc 15 c5 31 0b 32 47 bb 47 65 0b 90 f3 48 43 24 c1 da 40 e7 10 bf 6c 22 40 43 a6 05 56 6d 51 97 cc 42 6a 42 53 d9 c9 ba e5 a0 3f b1 ac 4d ed a0 97 8d c0 b0 18 53 2e 04 69 5f ee 04 5f 42 04 29 85 8c 58 1c 2b fe 53 7d 40 0b 25 b6 98 6d 30 0c 6f 8a 42 dc 12 56 ec c0 04 d9 29 a2 ec e9 a7 20 51 15 53 2b e2 9b 11 60 93 31 ad 17 8e c5 a4 6d 4d 24 26 67 c3 8c 44 22 68 c8 d9 dd c6 30 a4 3a 12 ed c2 12 7e 24 14 55 cb 6a 8c 9f 29 63 4b 8f e6 15 c4 58 a6 f6 58 a9 7c df 77 ec e1 20 3b 02 b8 9d Data Ascii: l@OS(9;Os8\|F$%HxQ/Dh>?3?`[`J>*)\|K12GGeHC$@l"@CVmQBjBS?MS.i__B)X+S}@%m0oBV) QS+`1mM$&gD"h0:~$Uj)cKXX\|w ;
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 4f 4d 1a 85 a0 43 06 e3 04 7f 1d 7b 2f a4 bc 49 a9 ac 58 4d c5 57 d4 ec ac 26 11 34 2e 52 64 b4 9a 77 57 3b d5 2c e5 b8 b4 93 24 74 98 6d 32 64 09 03 35 69 4a 9b 51 b0 a0 67 ea 9a 26 c8 95 60 75 33 36 f8 10 25 96 66 d5 ee f5 c1 54 02 69 60 0a c6 a4 28 73 d9 5d 4b e3 26 4c 0e 1e 61 69 96 f0 6a 80 0a 81 01 5f 2e 3d 05 59 08 41 c0 bd d2 8c b9 7e a8 81 96 7f 68 8a ea 8b aa 01 9d e2 e9 be c4 3d 04 6e 6e b9 94 06 d2 98 49 d7 5a ea 3c 9d 27 13 b2 48 ec 2c 3d 66 92 8f 08 ec f4 44 61 22 2a ab a4 b4 71 09 69 c8 42 1e aa e8 69 71 e9 b0 07 35 d4 a3 03 4d 18 b4 ef ca a2 9e 5d de 6a 1d 37 5a ee 84 88 53 13 73 6b 1d 03 4d d3 7c 7e a9 09 4e 6b 3c 3a 82 b6 e5 81 69 45 64 80 a6 10 52 99 9d 18 a5 47 00 24 3e 0d b9 1a a3 04 35 ab 22 42 f3 3a 6f ef 1d 21 5e 41 df 1a 95 b3 08 Data Ascii: OMC{/IXMW&4.RdwW;,$tm2d5iJQg&`u36%fTi`(s]K&Laij_.=YA~h=nnIZ<'H,=fDa"*qiBiq5M]j7ZSskM\|~Nk<:iEdRG$>5"B:o!^A
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: ca c6 c7 ec ba e7 b1 9c 32 19 38 ca 9c ea 3e f0 09 9f da f7 84 bc 2c 4e 33 60 c0 80 01 52 ba eb 88 f6 b9 d6 63 38 be 81 98 13 ea cb 8d 31 41 84 10 3c 41 c9 e9 4d ca d0 94 c3 aa cd 85 b1 72 68 1d 15 b5 30 05 8d 20 42 08 e9 30 44 18 0a 11 da 51 7c 6d 2a 48 30 86 27 cc b5 e1 bd 5a b5 97 99 a7 26 4b 89 59 3d 19 2b 80 73 e4 77 87 b5 b8 f2 a3 fb 09 52 4e ee 7a cb b2 f6 f5 0d 87 7e 66 49 1c c2 e3 39 4c 1e c2 e4 12 10 4b 36 fe 3b 29 f0 50 8f 71 39 04 50 22 87 7a 8e 56 66 46 a6 ba 7b c1 86 7a 79 1a 6b 8a 6a 23 4a 63 06 b5 62 42 2e 27 ba d3 53 b2 47 16 e5 33 53 1e c2 cb 50 2e 75 f0 a4 a6 2a 3c 6a ce c1 53 1b 54 74 4a ee 81 ea 80 2a 71 d0 e2 c5 53 3a 94 c4 a9 5b 58 72 f7 ca 1e fb c8 2c 99 e3 30 5d d3 55 69 12 d3 ee 94 1e 98 6a 28 c0 5a 9b 08 1c 2e e6 ac a9 d6 13 ca Data Ascii: 28>,N3`Rc81A<AMrh0 B0DQ\|mH0'Z&KY=+swRNz~fI9LK6;)Pq9P"zVfF{zykj#JcbB.'SG3SP.u<jSTtJ*qS:[Xr,0]Uij(Z.
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 77 41 12 4d c8 05 66 60 e7 af ce b3 eb 94 67 4f a0 f5 da aa 2a 50 db 7d 6d de bd 74 69 cb 9d 53 c3 2d 12 2e d3 12 91 c8 44 25 3a 31 b9 99 f8 e6 13 ad 1f ce 3b a8 7e 08 d6 ee 7d db 17 a7 cd f7 c5 30 6e 66 f8 7f ec b3 b1 dc 29 a7 9d 59 58 ae 85 4a 3e 50 27 b6 78 3b 59 ef de ba 80 3e f1 c5 5a bb 2a c6 2e 04 57 dd d9 09 dc 18 7c 46 e9 46 c1 48 64 57 d8 eb 83 b1 38 a5 85 ed e9 a2 59 e0 33 4c 37 4e 2a 93 6a ab 1b 42 fd 9b 68 3d ea 2e 77 24 57 c8 a7 9c 6e 9c cc 91 e9 1c 8d 9d 03 53 8c 11 f7 37 12 cd 03 9f 83 ba 71 0a b7 52 ef 6c 0a 0f 4e b3 66 32 dc 3d b1 02 f0 49 a9 1b a7 f2 e4 06 57 73 64 68 33 67 a5 e3 c3 1b 17 c0 67 a9 6e bc 84 af 30 ba 5b 36 0e cf f0 76 36 3d 7d 89 3f e0 d3 56 37 5e 2a 50 56 79 fc 5d 23 09 c1 c9 e7 97 3f 69 00 9f c7 ba 71 9a 50 65 f2 b6 76 Data Ascii: wAMf`gOP}mtiS-.D%:1;~}0nf)YXJ>P'x;Y>Z.W\|FFHdW8Y3L7NjBh=.w$WnS7qRlNf2=IWsdh3ggn0[6v6=}?V7^PVy]#?iqPev
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 37 b2 c9 bd dd bb 20 98 c6 2c fa 2b 1c 04 5f 14 82 50 e9 47 7f ec c4 48 91 26 43 96 6c c3 cc 31 cf 7c 79 4a 2d b7 4b 99 6a 35 0e ed cb a6 36 97 20 ba 91 2b 8d fe d1 ec b2 56 6d fc cb 41 8e 84 07 89 48 87 3c 22 11 b9 68 46 3b 3a 31 08 21 c4 b8 c5 3d 5e f1 ce d5 cc a6 95 ff e2 47 2f 36 be bd fd dd fe 8e d3 f6 b4 97 54 4f 42 7e 26 80 ae 76 46 6f 35 e5 45 a7 d7 94 9b 92 aa 65 a2 66 cc 47 a3 44 5b de e8 d2 e3 63 a2 71 f2 4a 25 9c 64 d2 c1 3b 9b 72 98 d4 33 cf 38 d3 cc 52 88 52 50 5e f9 14 5d e0 38 8a 2a a7 2d 6d 6b 7b 4f 14 73 b1 b7 75 f5 4e 1f 1a 69 bc 8f 4d b5 d1 d7 16 5b c5 d1 df 4e 00 09 59 44 08 28 2c f8 3d e6 19 91 58 b0 e4 43 4b 73 e2 bd 8f ab 3b 48 63 c9 f7 39 44 d3 21 9b 09 d6 64 e8 be a4 d8 5c 5a fd 4c a5 85 ce b4 96 76 5b a9 f6 2d 83 76 d3 6f a7 73 Data Ascii: 7 ,+_PGH&Cl1\|yJ-Kj56 +VmAH<"hF;:1!=^G/6TOB~&vFo5EefGD[cqJ%d;r38RRP^]8*-mk{OsuNiM[NYD(,=XCKs;Hc9D!d\ZLv[-vos
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: eb cb 68 21 99 70 a6 b4 ed b9 98 ca f2 01 34 c7 a0 0e 9c 13 0a 2b 18 62 3d 64 fc 73 aa 5d 60 66 1c da 91 27 2f e2 c9 f3 d7 d4 40 eb 13 64 fa 25 8a b3 62 fb d3 f5 67 87 78 56 a7 29 3f ab ab 5d ef 71 c3 a6 05 17 d0 15 84 52 61 da f0 e4 45 23 d5 42 c7 84 ed f2 2b 04 e7 15 f9 28 cc fe 81 dd ee 00 cb 63 5e 5b 33 12 6b e9 13 79 13 35 ed b3 dc c4 be 6f 56 03 5d 3f 28 c3 c1 95 32 f7 5f 54 87 5d d5 86 2e a8 c7 ee 03 bb 70 00 4e b2 93 97 32 cb 8d 8b 39 74 31 b2 b5 97 c6 3e 5b 7b f9 35 f5 b9 0f e0 b4 76 49 c5 9c 65 c2 89 9f 1f ab e3 c9 95 2e 13 88 72 c7 94 3c 0a eb 46 87 e3 7a 10 46 88 a7 6c 19 23 86 47 81 b8 3e 4a cc 78 4b 17 59 ac 64 a8 13 33 69 9e 63 4d c7 3c 44 5a 19 f6 8e b0 a6 3c e7 45 d5 b4 1b ce 7e b4 70 3f 38 3d d0 ad 4f c1 11 24 52 66 99 62 da 31 9c a2 a6 Data Ascii: h!p4+b=ds]`f'/@d%bgxV)?]qRaE#B+(c^[3ky5oV]?(2_T].pN29t1>[{5vIe.r<FzFl#G>JxKYd3icM<DZ<E~p?8=O$Rfb1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.10	49779	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	909	OUT	GET /assets/8bd8143eff37936894aa.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	957	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: font/woff2 Content-Length: 45868 Connection: close CF-Ray: 8d782e5a0dcf6bb9-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d295c40af6fca08f8e0eb5425351f431" Last-Modified: Wed, 05 Jun 2024 19:27:55 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dVbrvwVSxHSlaJFfUgps%2FvF0nK1YcnYW4nnCka5oYpIURRH3bdG%2Fibud0pIyDmIl9OQyYrYCq6v%2FGhNQpMsIB8w3CBCWPlEB6A6srCYqeViRA0y2mT7Ha5fMdNax"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 b3 2c 00 11 00 00 00 01 a8 94 00 00 b2 c8 00 03 00 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 82 78 1b 81 cf 10 1c a1 5c 06 60 00 8e 58 08 82 40 09 9f 03 11 0c 0a 83 b3 54 82 f8 40 01 36 02 24 03 9a 0c 0b 8d 08 00 04 20 05 94 61 07 b5 4b 0c 83 78 5b 54 83 91 01 35 c7 ee 7f 28 a0 da 56 d9 4d aa fa 6d e0 04 d4 87 7b 81 39 86 a0 d3 ea b7 73 34 39 92 f8 79 62 6a d8 ee 1e 80 da 09 89 3e 7d db 6d cb b2 ff ff ff ff cf 4f 26 72 d8 25 e6 92 54 8b 81 51 ec 7f ff 03 35 c2 34 33 b8 79 44 ea d8 75 99 25 12 53 df 77 5e 90 42 f6 2e c2 bb ce 82 2a 31 70 7c 62 32 c4 bc 88 67 87 d4 9c cd 57 75 71 cd b7 42 1b 16 c3 32 a6 65 7e 09 33 0a 12 3e 11 49 c9 a6 8e 54 4c 50 db f5 63 aa 83 f9 8e b9 63 24 38 fc e9 54 6c 65 c5 09 17 Data Ascii: wOF2,x\`X@T@6$ aKx[T5(VMm{9s49ybj>}mO&r%TQ543yDu%Sw^B.*1p\|b2gWuqB2e~3>ITLPcc$8Tle
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 0b 9e cc 23 a1 30 d4 64 89 21 69 d4 ff 33 d5 2a ad 06 c4 19 b9 79 47 8e b7 d2 59 e9 5c bc c6 47 33 59 d6 f5 ab 0a dd 55 bf 9b 00 1a 20 d5 40 93 33 24 28 ed 92 e0 18 5a 19 50 06 8d 02 a9 06 48 dd 50 5a 47 69 9d 3b 63 0c 49 80 94 5d 4a 7e 9c 8f ee 7c ee cc 1a 1f 9d 0d 5d 10 5e 38 17 85 17 64 17 65 9b a6 97 e7 f7 7f aa 96 ed ff 18 fe 15 86 22 fc 84 c5 25 dd 3a d1 51 eb 90 5f bf 56 51 39 87 2e 65 62 06 20 f8 39 18 69 21 8a 4a 58 6e a2 93 76 2f 49 ba c4 75 52 ba 67 5c e6 85 58 39 a4 36 55 ae 2e 26 6d e5 14 53 51 da af 77 d9 6f 79 45 e9 a6 70 77 45 6d 9e ff e7 fa 9f de fd be 25 38 18 8e 63 fd cf 7b 7f e0 e8 e2 5b d1 10 66 38 71 22 01 5b f0 7c 2d 2d e9 4e bf 93 c3 0c 99 76 6c 01 e8 5a 74 80 45 0a 4e 23 69 43 bf 93 c3 7c 87 a9 95 73 96 53 64 72 c8 80 18 ba 8e 20 Data Ascii: #0d!i3*yGY\G3YU @3$(ZPHPZGi;cI]J~\|]^8de"%:Q_VQ9.eb 9i!JXnv/IuRg\X96U.&mSQwoyEpwEm%8c{[f8q"[\|--NvlZtEN#iC\|sSdr
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 95 d4 df da 67 57 e0 9b 4f 0e 39 22 0b 66 a7 19 c4 f4 b3 80 57 c1 f0 f6 59 10 e3 6a 17 e7 e8 82 2b 2e fd a3 a2 5f eb 21 57 ed 85 35 e7 0c 42 b2 b4 19 bc e6 a2 15 5d a8 e8 94 08 6d 3a fe 87 a9 1f c1 81 87 11 b4 11 c8 e4 1f 7a 3b 4f 9f 67 af 45 60 ff fd 40 0e 68 e6 01 72 83 4c f9 ea a9 18 24 b9 29 27 08 58 e8 0d 74 5a e1 4f be b0 9b a6 d6 dd 99 6a ea dc 4b 62 e0 b7 0a 80 5a 33 79 2c d6 ab 41 17 14 d7 b1 33 47 48 95 da a2 07 6c ed b8 f5 a3 35 47 bf 77 d5 c7 a0 54 d2 fa 90 b7 dd 9f c1 1a fc 42 1a 02 39 09 bd 1b 2e a2 8c 4c 30 96 71 7d 20 be 6a 07 0c d3 d8 5d b5 8b b7 c1 3a d8 f5 25 67 f5 b6 39 44 ca aa 7c cc d8 8b 6c 2f bc 35 57 ed 18 96 16 dc da 57 22 4b b1 c1 92 dd af 75 36 6f 6c e4 38 49 2e 70 58 9a bd c0 3f 42 3e 65 f0 ca ba e5 ff 71 64 84 70 be f9 a9 e7 Data Ascii: gWO9"fWYj+._!W5B]m:z;OgE`@hrL$)'XtZOjKbZ3y,A3GHl5GwTB9.L0q} j]:%g9D\|l/5WW"Ku6ol8I.pX?B>eqdp
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6d e4 37 da 4c 6c 95 c7 3f 58 87 e9 66 33 94 38 c9 d5 9f bf 6d 80 cb de f0 93 e2 d3 f1 4d 66 7b 2d 02 87 33 52 35 d7 5a c3 09 31 a1 dc 34 33 0d 50 5f 4e 33 b0 bb 8b 14 c2 13 0a 62 ce f1 a9 2d 5e 93 78 b7 ee 6f 45 3f 53 c6 94 43 4e 56 cc cb ad 75 c2 4e b3 88 63 72 b9 fa 45 fc 94 9d fd 15 86 41 1f e4 d0 3a d4 d4 7f 64 cd a7 43 ef 35 1c 34 d0 74 fd 0d 65 63 a0 b1 f5 c3 37 6c 90 8a aa 36 3f 8d 03 ba 18 36 be c0 b0 94 a8 16 1b 20 e3 1a 9a 27 d2 7d 74 51 1b 9f 41 e0 5b aa 0c f2 4f ad ce d9 19 0c b7 19 40 1b e9 38 6c f9 43 22 d1 00 50 46 9f 43 3e fb 08 03 fa 42 b3 d8 c2 1a fc c8 2d 64 b9 fb 5f 17 b4 ca f2 d1 c3 3e 05 b1 74 5c 00 bb df 42 ef a7 c6 2e 23 4c c4 c7 7a 94 44 77 0c 02 7c 74 fd 64 4a 9b e4 73 bd fe c6 e1 8c 85 1e dd f9 47 6a 2a 0b d3 9f 74 fe aa 97 39 Data Ascii: m7Ll?Xf38mMf{-3R5Z143P_N3b-^xoE?SCNVuNcrEA:dC54tec7l6?6 '}tQA[O@8lC"PFC>B-d_>t\B.#LzDw\|tdJsGj*t9
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: d5 97 9a 6b a9 b7 ef 11 ea 6f bd cd b6 40 da 62 f0 17 60 ff e9 d4 a1 a1 c7 80 1b ee 78 e0 89 17 de f8 e0 8b 1f fe 04 60 24 8e 11 26 9b 62 aa 69 a6 9b 6f 95 d5 d6 58 6b 9d f5 36 da 64 b3 2d b6 da 66 bb 1d 8e 3a e6 b8 13 4e 7a 14 1a 10 2d 88 0e c4 12 f5 f8 1b 60 a0 13 9e e9 5b 51 07 1d 7b 45 f5 fc 12 84 92 d7 7d 10 22 38 79 76 0a 21 84 81 c4 d3 18 c4 a6 0b 41 92 5b 5d 56 b1 1b 0a 19 d1 62 e9 22 ab 28 53 56 5b 8f b1 a1 2c d9 68 07 ce 91 9b 2a 47 9d c4 78 9b 8a c1 80 6a 28 a0 11 1d 02 5b 2c 20 4d 5f 01 69 6c f9 00 5a 10 50 32 a7 62 31 2d 3e 8b 92 8a e7 b4 28 9d 8a d7 80 ea 6d 87 d8 06 00 2c 15 0c 20 7b 67 0a a0 40 d0 2c 7b 00 6e 79 95 10 bf 7c 40 d8 0c 68 0b 48 7b 81 f9 7d 09 66 d1 02 b4 56 05 cc 4d 60 6e 1d 43 c7 b9 13 04 86 35 97 92 7e 4a e7 65 e5 86 7c 44 Data Ascii: ko@b`x`$&bioXk6d-f:Nz-`[Q{E}"8yv!A[]Vb"(SV[,h*Gxj([, M_ilZP2b1->(m, {g@,{ny\|@hH{}fVM`nC5~Je\|D
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 0f 1f 3d 51 53 d7 00 5b 1d 5b 59 e9 aa e7 2d 38 2a 46 8a df 03 8c b4 1f 87 b5 06 fe 48 06 dc 16 43 fd e1 56 00 92 38 1b 67 a8 38 3a d1 05 09 07 47 39 ae ac 82 ca ae 84 bf f2 ff 00 95 0e 73 ea 51 0a 06 df e5 74 32 1d 83 79 20 09 26 29 b6 2a 17 d1 c0 13 e2 3b 1c 80 b1 07 09 07 47 99 9a 53 8f ef 57 01 e5 dd 02 85 1f b8 17 c1 77 a1 c6 db 3e 01 e8 a5 3a a1 68 92 f9 25 17 f8 e6 35 01 cf 5d 71 50 75 de 62 ae ee b1 84 58 53 62 7e 23 02 8c 9e 70 b9 d3 9a c7 1f 33 92 4e a6 f9 7d 07 0c d7 85 18 07 22 0d c2 56 9e b4 8c 60 9c 5d 8c fc 25 fe d2 e0 c3 d8 70 26 7a 83 03 4f a3 f9 1f 07 b8 e2 0d 6f 5e 57 58 7c 1a d8 2e 20 6e fc e5 7d a8 bb d0 41 c2 39 2c 04 09 02 3d a7 2c 73 39 5d b2 cb 69 3e 71 51 7b 4d 6a 39 9d e5 5c c6 94 f3 17 53 4e de 57 38 24 3c 36 1f 3c 4d 9d 09 86 Data Ascii: =QS[[Y-8FHCV8g8:G9sQt2y &);GSWw>:h%5]qPubXSb~#p3N}"V`]%p&zOo^WX\|. n}A9,=,s9]i>qQ{Mj9\SNW8$<6<M
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: d0 a0 42 fd 5e 93 39 23 54 46 b1 bb 5c 1d a2 04 0d 7a 4c 62 d5 85 e6 c6 47 10 34 a9 30 99 33 07 e6 63 af 2d 15 55 53 23 b5 e3 30 6e e3 24 ce db d5 0c 87 27 42 0d d4 a3 45 bc 76 4e b7 a3 3c ef a3 e9 6e 7f 7b 7b 86 3e c3 4f b7 fd af 74 ec a9 4e 48 9c 81 3c a3 dd 91 ae 87 d7 69 99 19 64 47 be 94 93 0c 4d a8 5a 81 2e 97 ab d0 31 42 28 ca 56 95 3a 68 74 6f 83 f1 48 f3 2d ba 7f 8a d4 59 6d af 9b a5 36 4f 53 52 b1 07 8b dd d0 07 1d 30 c8 5e f7 a3 10 da 85 c8 fe 5e 9e 6d 3c 94 4a d9 69 61 27 59 45 b5 d0 7c 40 5f 04 2c 02 40 b2 77 16 fb b3 1d 85 a6 61 7d e5 d5 f6 18 b8 54 3b bb f4 32 eb f7 43 09 df ab 67 8a 81 90 92 41 a6 df 88 9b 12 57 4c 1d 24 15 95 41 9f 21 9a 22 ab 01 39 39 b8 91 43 e0 f2 15 86 9a 49 a4 24 f5 28 8c cb d4 0c 30 a5 37 4c c8 8a 32 c0 ae ff 89 1d Data Ascii: B^9#TF\zLbG403c-US#0n$'BEvN<n{{>OtNH<idGMZ.1B(V:htoH-Ym6OSR0^^m<Jia'YE\|@_,@wa}T;2CgAWL$A!"99CI$(07L2
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: b8 43 53 30 24 1a a3 71 a7 6b 9a 36 77 5b 8e 40 a7 70 ec b9 86 2c 8b af 06 33 1f fc 83 f5 a0 4a c9 f9 e2 17 41 f4 ff 89 6b 01 7a 8f 76 dc 14 b4 fa cf c7 61 5d 73 77 75 66 3b 0d 2a 6f d7 ac 37 05 da c5 05 dd 70 42 13 7a 38 73 8f 38 cf 7e ea f5 e0 b4 df ad e1 1c 6f 09 3d f8 a1 6e 5c 52 c7 50 9a 7c 02 d5 19 72 97 f8 ba 78 e1 3e 01 b3 c7 e7 d4 f9 31 76 82 11 01 6a eb 54 69 33 f0 c4 c4 97 29 e4 6e bd ae eb 11 9e 71 c2 b6 01 82 9f 4e 29 24 46 a8 37 06 57 c6 39 20 1c 7f 3e 10 47 06 dd bc a5 80 21 76 c8 a4 1c 19 de 13 c2 1b d2 fa 7c a0 8d 7d 28 60 d5 e9 ea 78 d8 ef 9c f4 31 a4 fe 8d 5c c4 98 b4 d6 c5 32 1b 03 34 78 af a2 c4 43 cb ad 5a 01 96 e4 16 a8 81 88 90 82 9f 5d 87 9b 63 f9 5b b5 96 0c 6c c4 52 eb 06 b2 20 3d 0d 95 9b 07 55 18 b1 ab 30 59 83 6c 17 3e b3 01 Data Ascii: CS0$qk6w[@p,3JAkzva]swuf;*o7pBz8s8~o=n\RP\|rx>1vjTi3)nqN)$F7W9 >G!v\|}(`x1\24xCZ]c[lR =U0Yl>
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 6e 33 11 68 23 f1 52 17 ec c2 53 bf df 20 70 d4 7b 0a 53 4e ec 58 31 87 71 91 28 06 e4 21 c5 97 db db a6 e0 1d 01 b3 8a 39 c6 f0 9a 99 08 65 ef 7b 68 d5 c9 2c 33 f8 ac da 2e 11 83 aa 97 b5 a1 74 0f 3e d8 8d 8d d0 ba 06 93 c3 55 1e bd 98 38 39 71 28 c1 9b 5d 2f f0 e0 52 3a 4a b0 c2 03 06 7e 35 dc f0 47 45 41 22 30 e0 83 31 6b 4b 0f 72 e0 92 47 0e 5a 72 cb c1 4b 2e 39 64 c9 c9 d0 08 1d 7a 7c f7 03 14 6f 4a 0e 18 97 0e 50 8e c0 4a e9 5b ab f5 2a 6d 68 a3 7a ec 84 c8 52 67 ae 5c 83 90 31 1f 7d d6 35 35 e8 34 68 d2 8a 83 19 63 15 dc 67 2e ec 2e 0d 16 2a 34 ea 31 2e 41 96 32 58 5d 86 4c 59 75 08 eb c9 e2 be 74 22 e4 20 a0 39 55 6a 12 16 91 28 5b b9 af ba 0d 9b b6 06 47 3f 83 d3 2f fc 9a 3f 42 5d 9f 80 d9 0f d9 86 df 86 d5 8f df 85 5f 87 e6 c7 f9 c5 4f 00 87 52 Data Ascii: n3h#RS p{SNX1q(!9e{h,3.t>U89q(]/R:J~5GEA"01kKrGZrK.9dz\|oJPJ[mhzRg\1}554hcg..41.A2X]LYut" 9Uj([G?/?B]_OR
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 53 78 2a 4f fd 19 3c 63 17 e7 24 38 a9 4e ba 97 f3 e5 7e 3d bf 92 9f 8a 34 79 e6 86 5b d8 41 43 a5 cb 9c c3 9c 65 01 87 73 1a 6b d8 c8 36 76 0a 93 b4 0a 45 c5 95 54 56 64 80 2c 55 30 74 06 5d 0f dd a4 cd da a1 46 23 5d 54 bb a6 39 28 7c a2 33 e2 5c 38 6b 9d a1 5b 42 24 02 6b 31 53 8b 78 d6 84 31 c5 02 bf d8 e4 5f d9 87 45 c2 7d 67 0e 40 67 87 0b 56 04 23 3e b5 84 93 7c 8a 4f d5 69 38 43 17 c0 76 4f 42 93 da a4 77 b9 5d 4f ae a4 a7 42 3e 8f 5e 40 26 b6 b1 8b 14 43 0f 2c e6 58 56 0f b4 dc 7f 59 fa 4a 29 6e 1c 68 7f 5c 87 03 80 4a 0a 7d 81 97 9b 6e 73 ff c7 58 fc c4 f8 f7 69 3c bb da a1 31 85 49 4f 6a 62 13 51 42 e1 7b df 61 f6 c6 71 46 be 47 16 1e 1f b2 3f fe 1d fb 83 4e ef bb 5c 7b 2b 38 d7 1b 97 9e 7f 7e 59 7f 4d cb a2 5d ba 65 c1 2e 11 f0 c7 3d bf 8c 3f Data Ascii: Sx*O<c$8N~=4y[ACesk6vETVd,U0t]F#]T9(\|3\8k[B$k1Sx1_E}g@gV#>\|Oi8CvOBw]OB>^@&C,XVYJ)nh\J}nsXi<1IOjbQB{aqFG?N\{+8~YM]e.=?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.10	49782	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	909	OUT	GET /assets/452d7be36bf4b23241bd.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:22 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: font/woff2 Content-Length: 139388 Connection: close CF-Ray: 8d782e5a0ebc0b7a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "db985aaa3c64f10506d96d876e350d47" Last-Modified: Fri, 06 Jan 2023 01:15:23 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XW8rIsIurpi6gWGwxFx8MGRKmvBraZ%2BBSMpahfKLeTHIG2mB4octddakvna5f47266tv7ZnOneHRfOjUeootP%2F8YHTTObCDo5gSCuqY8%2B%2F%2B%2BDlDr%2FzWGp6ciaHSQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 20 7c 00 0f 00 00 00 06 39 84 00 02 20 1b 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 8b 66 1b 84 bc 76 1c d3 04 06 60 00 95 1a 11 08 0a 8f 8e 18 8c 96 65 01 36 02 24 03 f3 54 0b f3 58 00 04 20 05 8a 7c 07 82 bd 5b 0c 07 5b f2 42 b5 cf 7f 63 dc 7b bd ab ca ee 3a ec 77 e9 06 54 0a 6c 1b db 86 04 43 d3 54 2b cf d8 ef 47 93 a0 c6 18 de 1b 02 46 e5 5c 73 1a c7 a8 bb 6d 8c f0 4a 0f 6e 60 eb b6 d2 f1 d0 79 03 f3 aa 36 f2 3c a5 e9 ff ff ff ff ff ff ff ff ff ff ff bf 97 e4 c7 63 9b bd 99 9f cc fc 23 17 e1 08 97 01 82 c8 a1 15 b0 1e d4 0b 6d d5 b6 bb 6e b7 10 85 75 b0 ce 23 24 48 e1 02 2b 19 94 cb 19 31 29 94 6f 71 b6 6c d3 8e 40 b5 0b e9 55 85 87 eb 23 54 70 50 0c fc 10 43 ef c9 88 58 6b 89 60 9c 6b c0 Data Ascii: wOF2 \|9 fv`e6$TX \|[[Bc{:wTlCT+GF\smJn`y6<c#mnu#$H+1)oql@U#TpPCXk`k
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 84 9b f9 33 bf a9 a6 fb 4c 85 6e de 76 7b fe fd 26 e2 4c 8d be 89 d2 f6 dd 49 f1 00 09 16 24 e0 11 c4 2e 01 02 59 5a 43 ff bf a8 d0 d5 b5 03 02 39 96 ae 6a c2 30 18 c7 7e c2 d7 4e 01 26 87 e1 01 7e b9 fd 5b 10 8b ab dc 6e 75 5d ef fa c5 c5 bb 8e 6d 77 b7 5b 34 0b 18 8c c1 e8 16 44 44 25 0c 0c 04 3b f0 8b 60 d4 ff 06 46 62 f6 d7 af f7 8f 57 48 dc c3 2f 15 a4 d2 d3 67 d2 59 65 e6 17 5d 00 dd 32 b3 81 b6 0a 4e a0 13 68 03 6d fc b2 1f b2 0f 9a f3 83 e5 6e 31 3d ec c0 6b 12 a8 a4 0a 55 49 c5 02 fe 2f 70 fd 24 21 35 0f 15 bb d2 9f 8a 5b 08 ad f3 1b 2a 16 6a 9a 8a e6 a5 03 15 3d a7 56 1b 08 1e 82 7d 21 57 5f 94 9f d5 a7 50 bd be 7f cd 02 87 d1 62 58 11 f6 64 e8 3f 16 e8 76 f7 5d 93 6b 5a 81 b4 4c 07 8f d1 08 e1 d1 36 7f 99 a6 8d 5b 87 3d 0f 4d 49 d2 ba 79 b8 e7 Data Ascii: 3Lnv{&LI$.YZC9j0~N&~[nu]mw[4DD%;`FbWH/gYe]2Nhmn1=kUI/p$!5[*j=V}!W_PbXd?v]kZL6[=MIy
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 7a cd f0 7e 51 94 ff 38 d6 14 6d 4f f8 31 d8 a2 fd 7e c8 f2 4c 5e 85 d5 6c 76 9e 98 76 b3 4c db a9 fd 2c ff 72 e6 ff b7 e9 67 3b d7 b0 3b 63 07 f4 82 5a b6 b2 ab 73 ac a0 9d 2d 1a c0 36 67 db 9c 74 e9 52 f1 cc 7d d2 68 ee 3c cf 97 64 ad ff 6a 66 3e 59 1f 47 5a f0 48 4b 63 2d 49 b6 ff da bb 3f 84 1d 72 97 4e b0 24 2f 19 42 fe 0e 29 00 54 e5 a4 42 a8 89 8b 7e cf 56 81 aa 49 d3 12 96 39 29 aa 14 55 91 12 e9 ff 54 2d 5d ce e7 e0 4b 00 45 3e 4b 8b 4b 89 ce 72 48 45 45 e9 ce 31 54 2e dd 54 c4 ff 33 43 0e 07 b3 4c 80 b8 22 44 3d 9f 78 29 49 ba 14 48 4a 45 d8 f5 3d ca 29 b7 76 e7 ce ed ed 3a f4 29 97 ae 6a 37 4d 61 ff 6b 56 4a 57 d6 ca 39 6e 16 06 37 e7 cd c8 e6 4b ad 17 8f 76 66 0f db 80 38 e1 a9 00 a6 df af 5b ad 95 34 e3 fb 02 14 85 b1 e9 b6 6f b4 30 07 60 21 Data Ascii: z~Q8mO1~L^lvvL,rg;;cZs-6gtR}h<djf>YGZHKc-I?rN$/B)TB~VI9)UT-]KE>KKrHEE1T.T3CL"D=x)IHJE=)v:)j7MakVJW9n7Kvf8[4o0`!
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: b9 59 08 ef eb 2d 60 60 df 6d c2 d0 7e d8 86 91 fd 6b 15 e3 fb 7f 26 60 3a 70 2a 04 b0 90 28 2a 1a 60 25 f8 10 b0 15 72 c4 28 46 1a 29 0e 25 3e 5e 1c 4e 7e 02 b8 23 8d 69 c3 5d e9 ca 24 3c 90 c1 e4 e3 31 00 77 07 d7 ba b6 b5 af e3 a1 7f 89 17 7d e6 e4 53 92 93 9e 6c 48 b4 ee 8e c5 43 ec d7 97 00 b2 1d 5b 37 b8 f6 c7 0d 82 6f 7f d9 28 04 f7 c9 72 10 da e7 2b e2 da be da 1c c4 f6 ed 02 46 f7 fd 66 8c ed 9f db 31 1e 18 15 0c 98 48 24 15 05 30 19 24 15 13 a6 42 0c 11 0b 2d fe 7e 2c 86 16 3e 96 23 89 04 e5 c8 62 45 25 f6 78 71 2a fe e4 e1 7c 82 09 e2 5a ba 32 0e d7 33 31 fd 68 f7 79 3c ee de f6 97 8f 07 f7 68 48 a4 51 83 ad 9e 9e 55 23 09 bb 1d df 9a d5 c0 a3 fb 00 a0 d7 57 20 52 f8 e5 b1 09 1c 9d e2 64 0e 09 fe 66 e4 55 fe df c6 a9 e6 1c b3 ae d8 fc 83 26 95 Data Ascii: Y-``m~k&`:p(`%r(F)%>^N~#i]$<1w}SlHC[7o(r+Ff1H$0$B-~,>#bE%xq*\|Z231hy<hHQU#W RdfU&
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 86 d9 cf 90 8b 57 86 4a 20 9c 0b 56 f3 b2 e9 c8 77 c9 dc d3 b8 ed 25 9c ec 7e 14 fd 71 5a dc f3 da d8 f0 33 02 b7 b8 e9 32 37 4f 91 1d 2b 78 20 5a e3 c2 1b ce 35 60 45 8d c0 6e 24 9d cb fd cd 1d 3e da ec 8c d6 e7 cf cb 4a c6 f2 79 99 64 81 16 54 01 89 60 6a e9 c3 97 ef 81 4a 8c 5c 5a c7 e1 3c a9 50 c5 48 e9 18 66 22 f2 c7 ef bf f1 da 02 a7 c7 ef 86 3e 7a 4f cc e4 cb 13 01 c0 55 e8 f6 fb a4 5a 24 c6 c7 f3 96 12 6b 4b db 7d 7e ae 41 56 73 c4 83 b3 cf f2 60 b2 55 49 40 40 88 b1 a6 7a 3b 0e 39 b9 e0 31 bd b7 61 e1 f8 4c 5d 88 97 62 cc 5f af 91 0c 4f 33 d1 09 5e e0 f3 4c 76 6a fe b6 23 ab ec a2 70 0c be 64 bb bb 93 d2 81 0e 7f be a8 b7 5a 73 d3 91 a3 80 04 78 2f 4d 78 87 50 8b 63 24 5e 98 dc 3b 39 f2 f2 7c 75 2d 77 87 7f a5 89 f0 05 46 ce d8 45 b5 67 f6 77 f1 Data Ascii: WJ Vw%~qZ327O+x Z5`En$>JydT`jJ\Z<PHf">zOUZ$kK}~AVs`UI@@z;91aL]b_O3^Lvj#pdZsx/MxPc$^;9\|u-wFEgw
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 07 d0 a1 91 2e a7 d7 f3 d9 53 3a a5 e0 b9 42 44 52 6e 4c 05 e2 bc 4c 87 1e 83 66 fc 42 3f dc ab 9a 83 ee d9 43 27 bd 32 9e 3a a5 e0 41 21 22 79 f3 6d ca b5 54 50 1e 95 3c a6 9d e6 64 8c b1 63 60 50 9e d3 93 fa ed 2b f1 ce 37 72 a5 12 c2 7f a7 21 c0 cf 2e 43 6e ae 0c a9 9f 58 db 7e 6c 77 f7 c9 52 61 33 f2 0f 2c bc b0 75 9f b0 08 71 66 3c 96 ac a5 48 cb 2c 64 ab c8 ea 7f 59 8b ba db d3 6d 78 17 e4 91 52 46 53 07 d9 99 cb 3e ff cc c2 9c a5 28 57 e1 73 36 f4 6c 24 9b d1 a1 fb 5b e3 17 fe e2 54 64 24 46 81 2a 75 c7 33 e3 7f b3 4c c6 2c 33 fb 74 34 ee e9 63 f9 1e c1 8b d8 b3 e2 61 32 91 c4 22 4f 51 16 9f aa 56 ab 2e db d0 61 24 c7 d6 f9 0d 93 b9 0c 62 6e 61 c7 5e 7e 7f 76 e0 f0 ec 5f 79 d7 e7 af d3 cf 7d cd 7e f2 ac 5b bd 1a 85 ff 3e c4 bd 33 cc a6 e3 3b 7f 40 Data Ascii: .S:BDRnLLfB?C'2:A!"ymTP<dc`P+7r!.CnX~lwRa3,uqf<H,dYmxRFS>(Ws6l$[Td$F*u3L,3t4ca2"OQV.a$bna^~v_y}~[>3;@
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: ab b8 ac 9c bc 82 a2 92 b2 1d bb f6 5a 0e 1d 3d a6 43 dd e8 80 86 b4 00 39 81 7a 48 02 0d 50 b4 09 68 a9 12 89 76 12 c9 c1 e3 d5 13 16 c8 84 c2 06 12 0a bf 52 29 d6 68 1a c8 68 0b 3a 5d 03 39 a3 1e 04 89 26 b3 c0 62 f1 5b ad 1c 9b 0d b1 db dd 4e 67 1d 2d 57 35 1d ac 9a ae 37 11 0a d9 62 f1 6a f7 92 e6 74 5a 9d cd 11 d8 e6 6d 85 02 81 43 97 7b 74 34 3a 33 b3 80 df aa c8 ba 08 a4 8f 1f c5 f7 61 50 12 53 50 d2 d2 50 d2 b3 e8 8e e3 b8 6f c8 b6 bb a9 88 52 71 31 a4 b4 02 f2 f9 33 d7 b9 6a 48 6d 03 a4 a9 09 d2 de 4e ab 83 00 3a c9 b9 2e 6a a4 9b 1e ea 61 46 7a d9 a1 3e 6e a4 9f 1f 1a 10 f0 ff 48 f8 45 05 bf a4 e1 2f 1b 63 e3 e6 e3 ab d6 d8 94 0b cc f8 c0 5c 08 2c c4 c0 52 0a 7c 3f ae bf 39 af 7f d3 dc fa 1d b9 fc 27 b6 ff 6f 6a ff ff b9 fd ff ee c7 b0 9d 78 7b Data Ascii: Z=C9zHPhvR)hh:]9&b[Ng-W57bjtZmC{t4:3aPSPPoRq13jHmN:.jaFz>nHE/c\,R\|?9'ojx{
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: d1 a6 41 de d3 1d 00 a2 89 9d 00 45 6f 76 0a ac fd 77 1b ac be ec 10 38 00 17 60 0d 84 20 07 e2 09 47 c0 81 13 13 8d a0 01 70 66 c6 0b 24 0d e9 81 43 23 7a 21 e9 c8 52 1c 64 3d 3b d1 c4 5e 8e 47 1f 27 70 00 2e f3 98 8f 1a bf 60 01 aa dc c4 42 d4 f8 25 8b 51 e5 6e 36 c1 65 1b db e0 b2 9d 5d 50 e0 19 f6 83 9f 97 68 c7 0d 5e a7 1f 4c fc 89 11 48 f2 57 26 21 c1 27 e4 20 2f b7 dc d8 54 be f2 71 ca 1b 9c d7 9c 4d b9 4f de 96 72 9f 3e 8a f2 7f fc 35 ce f7 1f dd 28 04 01 07 50 04 22 1a 40 08 04 04 20 74 74 10 b9 66 10 33 1e 48 90 04 24 4b 05 52 a7 03 e9 b2 82 52 43 28 7b 5b ca d9 de 19 a1 a1 4e 8b 8a a2 76 c6 b6 e8 97 cd 19 6f 46 7a c6 59 9d 1b b4 ad 0e a7 7b 7b 63 87 0e 75 dc b0 61 0a 96 b1 46 bc ae f5 8e 66 8f 86 90 19 8a 32 43 d3 d6 78 3c 23 7c be 39 81 c0 88 Data Ascii: AEovw8` Gpf$C#z!Rd=;^G'p.`B%Qn6e]Ph^LHW&!' /TqMOr>5(P"@ ttf3H$KRRC({[NvoFzY{{cuaFf2Cx<#\|9
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 05 0b 17 ba b0 9d 2f 70 e0 c4 1d 3c c5 0e de 4b 05 41 57 08 11 26 e2 3a 89 90 6c 66 23 6b 3d c5 28 5d 24 42 bd 54 a3 bd 35 d0 a9 1b d2 ce 00 63 3c 7f 4e 73 fc 39 7d dd af 1f ca 18 ff 72 98 b7 77 a4 a3 1c ed 98 3c f6 92 e0 b8 38 be ec e1 84 33 42 e7 94 6b 01 e0 bf 8b 41 3c 2d 0c b4 38 72 5d ba b3 e7 34 10 bd e5 1a 63 5c 75 f6 7b e9 1c 70 d2 39 69 8d ce c9 ee b9 3e e8 4d 15 99 b2 16 e7 b0 1b 1e 66 a6 ea 6a 80 56 cb bb c4 6a ee 3d 12 f6 f7 91 d8 b4 25 49 7b 5d 48 f6 b4 55 a6 6e 55 96 9e 3f 93 ed 53 bd c8 f5 b5 41 94 18 62 14 75 a2 4d a6 cd 54 d3 21 98 6d 3e c3 ce af fa 66 71 4c 94 0a a6 fd 69 b3 31 77 d1 c8 fc 8b e5 3e cb 7e af 03 ee ba ec 61 a9 c3 cb 15 eb 9d 95 b9 ea f0 1c ab 47 99 66 8d b3 2e b2 de 15 89 6c 71 cd 0d 1a dc 72 87 1d fe 71 ec 6e f3 87 3d 1e Data Ascii: /p<KAW&:lf#k=(]$BT5c<Ns9}rw<83BkA<-8r]4c\u{p9i>MfjVj=%I{]HUnU?SAbuMT!m>fqLi1w>~aGf.lqrqn=
2024-10-24 07:16:22 UTC	1369	IN	Data Raw: 55 5b ea 00 7f aa 99 5a 80 48 5a 84 45 43 d1 7b 7e f5 18 40 41 97 63 af a7 fb e6 be 2f 03 2f e1 2b af c2 b6 a9 c3 0f b1 87 e4 43 c6 11 89 f1 80 84 b7 aa fb fb cd 09 d8 ab 45 fa f3 00 b9 91 db 47 a4 66 fe 51 ff a3 7b f8 00 96 63 30 57 a1 11 d2 1c c6 8d ff 58 20 3d ec 3f 4b a1 1a ea 20 7a 3e f0 e3 7f 56 76 f2 4e db 99 3b a7 88 3c a7 5b 9b 23 3c a2 22 16 6a fd a1 55 bb a0 34 3f f6 8d 6f 83 d5 28 76 94 e0 0d 81 10 de d6 3b 9a ab 05 00 db 54 1b b5 ff a2 9f 40 8e f6 f5 85 a3 c9 0f e9 8f c3 d0 98 a6 6e 9e b8 29 54 bb f5 3f 2e 3d 65 36 39 e2 5e e7 02 7b 0f ca 66 64 e2 ee 90 ed ba c1 51 5d fb 55 bb da 82 d3 88 c2 fe fd a5 3c 4f b4 2a ff e3 d6 d3 f0 45 a9 09 52 e7 59 f7 54 bb f2 3f 1e c6 04 e6 76 02 01 15 41 e2 e0 89 5b 83 b6 5b ff 54 f4 94 e3 11 ea 8a db 3d c0 32 Data Ascii: U[ZHZEC{~@Ac//+CEGfQ{c0WX =?K z>VvN;<[#<"jU4?o(v;T@n)T?.=e69^{fdQ]U<O*ERYT?vA[[T=2

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.10	49777	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 3892b43a-301e-0051-71f4-2438bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-15b8d89586fmhkw4gksnr1w3ds0000000e00000000009fnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.10	49786	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 217788b5-401e-0016-11a2-2153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-16849878b78s2lqfdex4tmpp7800000007g0000000000w17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.10	49784	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 04ff5eee-d01e-0049-7af2-24e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-15b8d89586fsx9lfqmgrbzpgmg0000000e4g000000004uk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.10	49783	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6113d354-c01e-00a1-29f4-247e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-15b8d89586ffsjj9qb0gmb1stn00000002sg00000000cpr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.10	49785	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:22 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:22 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 79657049-a01e-0032-1dac-241949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071622Z-15b8d89586flspj6y6m5fk442w00000004dg0000000055wa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:22 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.10	49788	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	909	OUT	GET /assets/48a594e29497835802fe.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: font/woff2 Content-Length: 179380 Connection: close CF-Ray: 8d782e5e0e2d6b77-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7cf1be7696bf689b97230262eade8ad8" Last-Modified: Fri, 06 Jan 2023 01:15:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=StiaqaFn3NG9sF8OxPkkLddxv8%2F0dmWczQE8zWK3w2fS%2BBn2fdysyIYz%2Fk8ridt7k8lqO63d5%2BKY6gxJT0RwjGvsjtHfE1RbH1hMnY4grPDxvg8lXlhKVpjlvtQW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	409	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 bc b4 00 0f 00 00 00 08 95 4c 00 02 bc 51 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 91 08 1b 84 de 46 1c 83 85 76 06 60 00 98 3a 11 08 0a 94 9e 24 90 9b 10 01 36 02 24 03 81 92 40 0b 81 92 44 00 04 20 05 8e 5a 07 83 c6 5c 0c 07 5b 6c 49 d7 01 3c 15 fb ed ed 72 73 b7 4a 08 99 9c a8 e3 48 80 48 cd 47 ca ac ff 4c 63 36 87 58 fe 07 c0 01 a2 a2 ed 32 e9 06 f8 8f 31 dc fb 9c 42 08 d3 dd 64 35 b2 61 96 8e 31 0c d8 00 14 ab f4 5f 28 05 44 c6 d8 26 76 84 ba 1e cc 2e 11 af 5b e0 95 04 51 3d e1 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff bb 4b fe 13 ea f4 fd 7f d2 ff 77 27 9f 2c 79 6c d9 60 0c 31 78 30 8c 59 61 85 11 42 02 85 50 68 9b d2 36 6d 0d 44 89 15 a2 10 6b 45 c5 42 60 9d 7a 47 34 91 92 a5 25 Data Ascii: wOF2LQFv`:$6$@D Z\[lI<rsJHHGLc6X21Bd5a1_(D&v.[Q=Kw',yl`1x0YaBPh6mDkEB`zG4%
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: d6 8b 8a d3 16 b1 87 e1 88 b1 c7 75 69 40 05 27 9a 6d f5 b3 7e a3 64 fe 51 a2 13 76 70 42 76 a6 2b 70 c8 db 39 b2 6c 0f 1d f4 8b 53 62 b9 b3 73 25 05 b9 80 5e 32 0a e5 84 e4 dc da 5a 5d 95 7c 12 15 81 1d e1 b8 ed 3d 2c 15 15 a2 10 a8 40 e9 95 b5 9c aa 1a 5e e3 06 1d 35 92 c8 77 0c 36 f9 61 b7 32 d1 db b1 dd 9f 24 a4 bd 84 5b 76 b9 aa 41 95 15 73 47 a7 74 8e cf f2 89 0a 54 ee e8 4c ad 18 7e a1 f7 8c 88 48 34 b7 a3 26 23 98 92 b6 c0 5d d7 d7 c8 57 e7 e0 be 5d ec 56 92 04 09 0a a2 50 74 17 c4 a2 da aa 92 6f d6 59 15 d4 05 de e8 81 54 e9 e3 2f 96 9f 71 53 d3 93 a8 ba f4 63 a0 4f 28 3c ef cc 2d 27 50 a3 39 73 f0 fc 1d 2f e4 74 b1 d3 47 20 bf be 9a df f1 12 07 f7 b0 6f d6 88 df 62 84 c3 05 b9 38 33 17 5e 22 4b b6 fd 03 b9 83 dd 4a 2b 95 ec 7a 5e 32 78 8b 4c 84 Data Ascii: ui@'m~dQvpBv+p9lSbs%^2Z]\|=,@^5w6a2$[vAsGtTL~H4&#]W]VPtoYT/qScO(<-'P9s/tG ob83^"KJ+z^2xL
2024-10-24 07:16:23 UTC	1269	IN	Data Raw: 1e 2b 8c 86 51 08 43 18 86 30 0c 6e 04 37 5c 1a ee b8 35 dc 70 0d 79 13 9d 26 74 94 da 64 c0 24 f9 65 d9 fe de 66 fa 79 39 dc 92 7b 21 a5 d5 ff 29 5a ac 6d 6c c3 a5 0b 34 80 28 1a 8c 34 c6 40 85 39 76 80 79 92 1d fb de aa 76 88 96 ae 69 1b 31 3d 31 df db 13 f3 5c 72 c9 25 b9 e4 62 5e 49 d3 26 15 0b a9 39 05 0a 5e c5 0b 14 e8 43 e9 17 5a f0 2f f0 e8 3f f6 68 81 87 81 75 3d df 41 68 42 fc f0 bd 91 b5 b3 d0 81 68 66 85 e2 55 b2 09 13 6b d1 d2 3f a2 21 d3 4d 6c 3a 43 fa 84 ea 9a ea dd 9e 09 1e 8a 58 83 46 29 c0 27 ec b9 f9 9f 5b 6a 7b bd a3 74 31 cb 10 d3 76 9b 83 7e fd 7f 92 a4 9b 24 49 92 24 49 92 24 c9 48 92 24 23 49 7a 49 92 b1 2f 9d 5f 92 ac 74 7e 59 49 3a bf 24 9d 5f 56 3a bf 64 ad ac 24 2b 59 59 49 46 92 24 63 25 49 92 8c 24 49 c6 c8 c0 bf cf 7e 6c ef Data Ascii: +QC0n7\5py&td$efy9{!)Zml4(4@9vyvi1=1\r%b^I&9^CZ/?hu=AhBhfUk?!Ml:CXF)'[j{t1v~$I$I$H$#IzI/_t~YI:$_V:d$+YYIF$c%I$I~l
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 9a c1 8d 15 87 80 6e 62 22 63 fd 8b 46 90 45 f8 eb 7e 34 96 50 18 63 54 11 81 78 30 69 bf 1c 15 4c 07 ab 0f b8 20 aa ba bd 32 0f c4 0f 86 40 40 d5 f9 c5 15 23 16 08 25 c5 05 b7 c8 3a 3e 29 ac 13 d0 c2 a9 3b e1 7d 06 84 cf 68 79 f8 77 af d3 43 ce 77 dd 8b 44 c8 e2 15 e9 cc 2f 6b a6 80 df c7 57 5a 8c ab 90 60 bc e7 ff 4c b5 4a fb b3 06 4b 00 eb 58 e2 9a a2 d6 89 bb e7 30 ba 35 b8 0d 12 6a 2f 48 18 6e 14 56 fd 42 b3 ab ba 08 12 e8 1e ce 75 37 64 48 70 0c cd 18 34 20 07 70 0c 21 52 6f 41 69 0d 75 96 3a 63 5d 24 80 e3 24 9e a1 d1 cc 5b 91 e7 24 9e f3 3e 72 26 3a 1f db ec a2 e4 82 f8 22 e7 c2 bd f0 d2 e4 82 ec a2 d0 f9 cc cf 7f af d3 7e 7b 05 71 22 08 24 92 ed 64 f0 54 7b 2a c9 34 4f e6 ff bd 99 56 fa ea 57 21 f9 e5 3d 3d 49 04 24 84 a9 36 ee 58 2e 11 c5 98 e2 Data Ascii: nb"cFE~4PcTx0iL 2@@#%:>);}hywCwD/kWZ`LJKX05j/HnVBu7dHp4 p!RoAiu:c]$$[$>r&:"~{q"$dT{*4OVW!==I$6X.
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: ea 06 0a a4 46 d2 15 ce b4 b6 37 b4 dd 81 ae 14 c6 a0 90 a2 c7 7f 50 04 d5 79 a8 ee 99 d6 34 1f 53 f8 fb ac 55 b9 c9 f2 34 82 6b 93 da ec f0 13 0d 8f 83 27 eb 30 f0 94 67 83 a9 0f 1e fb e9 2c 4b b7 d2 16 78 51 14 e7 e7 92 58 0e a5 fa 07 3b ec d4 41 d5 70 c8 de 83 d6 53 49 88 ba 8c e7 ed 4b 26 76 91 b7 10 21 06 33 98 61 58 b6 4c 51 a5 a8 af 3e 6b 66 55 44 e6 e3 95 af 24 11 42 08 61 84 10 c6 08 f7 1c c6 14 c6 88 a2 f0 18 63 8a da e3 bc 4d 03 b9 b3 c4 3e 9f 04 11 91 20 72 48 10 91 70 88 88 88 64 c8 5c f6 8e df b3 4c fd cf f7 fb ff 49 7a ec fe ec cd d4 18 a3 6a 54 c5 a8 aa 8a a8 aa 88 a8 65 89 8a 88 88 88 1a 3d e7 ed ff ba fc f3 73 cf d8 5b 48 46 5b 32 7d 44 e4 70 d3 30 24 93 78 b3 55 6d 14 e2 a7 fb 21 12 24 04 69 24 34 4d 23 8d 34 8d 04 69 44 82 34 43 08 22 Data Ascii: F7Py4SU4k'0g,KxQX;ApSIK&v!3aXLQ>kfUD$BacM> rHpd\LIzjTe=s[HF[2}Dp0$xUm!$i$4M#4iD4C"
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 7b e8 a2 50 0f 23 39 49 aa 53 b0 5d 12 d9 2e 2b e9 44 ea 40 4b 74 82 24 20 4a 62 d2 24 a5 48 0a aa a4 56 98 12 9b 55 2b 2b 67 74 63 d2 ad bf f9 55 b8 67 bb 77 1b ac 42 9d ce 56 c2 66 1f 91 83 0c bc 30 bc 75 02 ad 1f 8f bd 6f 46 a7 d4 0d 48 42 2c 5b cf 46 12 2b a1 62 6d 78 a9 2d 71 4f 69 94 aa 88 36 1d 31 ea 6d 7c f0 29 3e f9 16 53 7e c6 ef f8 1b 42 ec 02 32 e2 cc 34 ab 98 4d ca 49 c9 3d a2 97 a0 0a 97 d8 ba c4 ce 65 f6 ad 3e bd ac d3 5c 35 cd 53 d3 fb d3 f3 9a 97 d6 f4 f2 da 5e 5d c7 6b 1b 8e f7 df 53 c5 3b 4c 3b b0 86 f7 36 e5 a3 2d bd 7c b5 b5 5d 58 e1 fb 6d fa 69 ab ff b9 8e 4f 25 35 19 74 04 0a f4 96 9a f5 b9 07 e7 e6 d6 8d 83 3a bd 26 20 f1 0e 85 d4 04 79 32 b5 2a 74 2a fd 64 f4 9e 78 8c fb 72 8f 15 9e e8 bd 36 78 e3 54 7c 96 31 b2 ae c9 7e 7d af 3c Data Ascii: {P#9IS].+D@Kt$ Jb$HVU++gtcUgwBVf0uoFHB,[F+bmx-qOi61m\|)>S~B24MI=e>\5S^]kS;L;6-\|]XmiO%5t:& y2tdxr6xT\|1~}<
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: c7 c0 0a ab 7f 6a 6e e2 a0 8d 37 9d 6b 3c f3 f0 a5 e1 6b bf d6 b7 23 83 7d 36 f7 39 f0 63 e8 ae d4 7c fb 57 6a 95 f6 a1 64 9f aa 87 84 71 fb d2 e7 b4 c6 79 ee ce c1 dd be 94 f8 19 30 c8 e4 f7 4a fd 9a de 7f d8 39 99 12 d1 3f e0 48 ef b4 b6 d3 9a 79 1e 2b d5 1c 91 b6 eb 51 c9 7c b0 1b 15 c0 69 99 30 4f 60 32 7f da 47 b2 d5 74 52 7f 10 fb 0e 01 b6 be e9 32 21 96 a1 b8 40 0c ce 07 49 db a0 87 28 fb 7b 76 74 d7 fb c8 85 31 a8 f9 82 6f b0 97 29 8f f4 9e 26 fc 4d 4b 56 f9 4c 5e 12 97 1d 1d ff 44 dd 72 7a bf 82 c9 21 dd af 1b ef 41 44 ee 8d d5 3a 58 52 fb 09 4a 5f f4 80 b7 2c 76 8e 2b 11 19 05 13 3a 7d 33 2f 38 d5 59 d7 6f 7d ff 23 d9 dc c7 24 a5 34 8e bd f5 d4 7f a1 3e 23 b6 5a 57 b1 e5 17 f1 8d 9d f1 e9 91 81 8b a2 50 fa ad dc ca 1a 31 a7 c3 33 dd 65 e0 ae 1a Data Ascii: jn7k<k#}69c\|Wjdqy0J9?Hy+Q\|i0O`2GtR2!@I({vt1o)&MKVL^Drz!AD:XRJ_,v+:}3/8Yo}#$4>#ZWP13e
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 13 9b 55 e9 9c f3 2e b8 e8 92 cb 70 f0 ee 09 14 84 82 8a 86 2e 0d 43 3a 26 16 36 8e 8c 00 ed 3f 27 00 7c 19 08 9f 1b 2c e0 35 0d 81 95 19 04 30 01 4d e7 13 4e 70 df f7 09 19 5e df 8f 69 c2 4c 6e 1b 09 80 9b 23 72 a7 64 22 dc 94 98 89 88 88 89 98 99 88 e8 bb 42 90 6a 1a 99 85 87 92 c5 33 51 e0 73 7b c9 2c 15 b6 8f c7 1a ab ac f8 66 f8 44 be c7 92 5f d1 01 b4 35 79 34 c9 b1 5f d4 74 a9 71 20 9e 8a 94 36 94 c8 53 e7 d0 1f 56 bf c3 84 10 9a d4 a1 09 db 5c fa 14 d0 27 b0 d3 72 c3 96 28 b5 75 aa 22 63 fe bd 07 14 17 13 1e f6 ad 32 38 64 b0 b9 4e 6e 8d 74 2c b9 93 07 4f 5e bc f9 f0 75 dc 09 27 9d 7a ef 74 83 ce e0 65 b8 d4 77 85 3d e9 66 27 59 54 06 87 0c 36 95 dc 1c 3b c0 85 f8 dc f8 69 f3 6b 42 7f d2 53 f4 b7 5a 13 32 d8 1c 60 f2 1a ce 90 cb a1 a4 52 ae 82 96 Data Ascii: U.p.C:&6?'\|,50MNp^iLn#rd"Bj3Qs{,fD_5y4_tq 6SV\'r(u"c28dNnt,O^u'ztew=f'YT6;ikBSZ2`R
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 05 da 2e cd d9 0e 59 9e 76 29 8a b2 47 55 b8 bd ea 02 ec d3 64 e7 2d 5d ce de d6 17 ee 90 59 ce 8e 5a a6 77 cc ba 81 be 61 53 a4 f7 6c 0b f0 be 5d 9e 3e 70 c8 d9 87 8e d9 39 85 cb ce 69 7c 81 3e 26 16 e8 2c 39 bd 0b d4 da fb 11 23 a3 2b 40 b6 ae 82 79 b8 06 e5 e2 16 96 8b 7b 9c b4 6e f1 d2 aa 11 64 74 5f 98 bb 07 a2 b4 ee 8a 73 f1 a5 24 5b 5f cb b3 f5 48 91 af c7 aa 7c 7d ab 49 ab 5e 97 87 1f f4 f5 f4 27 43 46 bf 58 72 f5 2b c8 d7 73 58 4f 7f 45 b9 f8 03 e7 ee 2f b3 00 2f ac 8c 5e 92 4c 5e d1 6c bc 66 99 fc cd b3 f1 8f c8 e4 5f 99 8d ff 94 b7 55 e9 f7 8f 9d 07 c0 4f 93 15 b8 b4 59 89 47 97 2d 70 e9 b3 06 8f 39 f3 bc 3d 11 24 2f f7 70 0f 21 81 47 28 89 3c 43 48 7a 23 ce 3b 20 84 1f 14 23 08 09 10 47 79 49 e3 c0 27 a1 c1 37 69 87 4a 09 f3 4f 2b 0b cc aa 08 Data Ascii: .Yv)GUd-]YZwaSl]>p9i\|>&,9#+@y{ndt_s$[_H\|}I^'CFXr+sXOE//^L^lf_UOYG-p9=$/p!G(<CHz#; #GyI'7iJO+
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 37 21 07 8b 6e 0e df 30 8a 79 0c 66 db 57 cd 7c 7a ca be 37 08 f3 58 cb d6 8a f9 f3 29 95 2d 94 39 75 62 7e e7 b5 73 fa 4d f6 bc de dc 79 1d fa b8 58 ac 2b fc 08 52 68 b6 7d b4 e2 3c 9d be a6 88 11 84 82 58 d8 54 5c 61 db 77 01 ed 32 1b ed a2 14 5a 22 d5 74 91 56 21 b4 22 85 96 42 cf e6 1c d4 8f 02 1a 3e d0 36 4c df 25 74 86 39 e1 c3 e5 d8 cb 61 f3 7c a6 a1 12 06 5d 84 b6 8b 8f 48 7e 4e 27 5f 67 2b af 44 86 a7 4b 04 67 ba 76 72 bd 9f 32 b9 81 ed c7 55 e6 e7 3b ec 84 93 a1 73 73 f9 8c db fc 2d 14 6e fc e9 38 b5 70 9f 3f 6a e5 a1 3c 41 65 b8 f9 e6 42 2c 25 93 27 95 68 85 4e 6c 0b ff 95 74 de 24 67 bf 55 42 8b 58 a2 fd fd 59 71 16 a0 85 0c d2 c9 20 9d 0c d2 69 f6 6e 65 8c cc c0 70 04 06 0c 3b 30 d3 15 10 8c 3d bb 44 0a 09 07 c9 12 3b 6d ff 54 e0 5c a8 d6 bb Data Ascii: 7!n0yfW\|z7X)-9ub~sMyX+Rh}<XT\aw2Z"tV!"B>6L%t9a\|]H~N'_g+DKgvr2U;ss-n8p?j<AeB,%'hNlt$gUBXYq inep;0=D;mT\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.10	49789	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	909	OUT	GET /assets/f5b8aa3411dfc24ff2e6.woff2 HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://discord.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://discord.com/assets/69646.2af8e3f2e60b2cca1cbf.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: font/woff2 Content-Length: 137140 Connection: close CF-Ray: 8d782e5eda3e6c4a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "f9bf0f65660d23c6f359d22720fc55ae" Last-Modified: Fri, 06 Jan 2023 01:15:24 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L8EGAPSng4QBcepOnR0YbyINKXXYyY4S3vNfdiPiwCecB6QXlcbjFzF2ohOyc5AwF6%2B%2BUjvFCaiuIaNBwVHSB6wlJP3otTSm%2BlZswhJ7meo1a5Unr6YINzPEjBw8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 17 b4 00 0f 00 00 00 06 30 cc 00 02 17 55 00 02 01 cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 8b 66 1b 84 bd 1a 1c d3 04 06 60 00 95 1a 11 08 0a 8e fc 24 8c 87 55 01 36 02 24 03 f3 54 0b f3 58 00 04 20 05 8b 14 07 82 bd 5b 0c 07 5b 9e 3b b5 0f fe 9b 8c fd 77 db 4e ad 83 0c c8 a5 5a 6a 55 00 00 95 5d 22 de 75 91 12 24 0f 6b b7 d9 3c f8 97 31 d6 db e0 33 40 69 96 9d 1d 36 0e 49 d7 a5 58 99 f1 af 1e c1 c9 d8 40 79 64 66 e7 68 23 cf 0a 15 d7 e7 1b fe ff ff ff ff ff ff ff ff ff ff ff 7b 49 7e 3c 3a f5 dd 49 ba fb 43 5f 0b 90 c4 b2 01 01 06 03 c6 23 f1 ae 5d 37 69 e3 c4 71 5b 08 2b 50 46 8c 55 e2 c4 c0 78 ef 1d 1c 9c a6 10 18 31 2e 18 62 05 ea 33 31 56 61 a8 98 bc c8 61 42 89 ca e4 ae d7 1f a0 6e d8 56 d8 a1 Data Ascii: wOF20Uf`$U6$TX [[;wNZjU]"u$k<13@i6IX@ydfh#{I~<:IC_#]7iq[+PFUx1.b31VaaBnV
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 0a ae a9 ff ff 7a e6 f0 10 2c cb 82 90 84 24 94 e2 c9 37 fc 77 7f 48 b1 77 48 45 6b 57 75 2c 1b 4f ad c5 2a f3 69 cd 4e 5c 42 cc a4 48 c6 4b 06 28 69 a6 23 c5 5d d9 d1 f5 03 f4 93 00 4b 30 28 2f 02 25 b4 1c da ce 0d ac 7b f0 07 33 c9 71 55 4a 02 4e e2 23 07 b0 b9 6f 5f 18 5c 4b 1f 54 db 01 c9 0a f9 4a 4e 4f 28 0b 9c f0 11 c0 88 ff 77 ec 7f 7b 5f 30 6b 74 93 24 9e c5 73 e1 10 0a a4 44 2c 34 26 57 7c bd 00 40 c0 10 ad b3 e3 19 2e c1 40 81 db ee 21 75 72 21 30 36 6d 86 24 f4 f4 cb ff d6 dd 67 ea ef 50 f3 56 19 92 42 62 11 26 65 17 b5 46 a3 24 4e 72 63 60 08 d6 e6 01 4f 3d 1f 1d fc 3f 4f e4 57 f2 3c 91 0f 3c 11 25 20 0a 26 16 0a 58 11 9b 51 18 b3 6a ce 98 b1 28 dd a6 0b dd 78 f8 76 b6 b0 0b 3f 44 71 1c c7 f1 68 3c d8 06 ec 13 7a ab 6b e9 6b 52 01 6a eb 13 b3 Data Ascii: z,$7wHwHEkWu,O*iN\BHK(i#]K0(/%{3qUJN#o_\KTJNO(w{_0kt$sD,4&W\|@.@!ur!06m$gPVBb&eF$Nrc`O=?OW<<% &XQj(xv?Dqh<zkkRj
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: e8 6d ac 55 d2 51 82 82 90 ff fc 19 8d 6c c9 de 6c 2a bb 46 8f 10 e2 99 6b e9 67 78 85 28 58 66 e2 d3 76 bd 63 3b 1f 14 c3 82 d4 f6 fe 1e 39 cd e7 75 8e 30 43 89 1a 3d 35 a1 06 30 c2 ff e3 b2 9f 9e fd 64 86 b6 b4 62 2c 42 9d 77 1f 5d 2a d8 99 49 7e 29 45 82 46 a8 9f d0 42 a9 0e ab e1 79 72 a5 52 ab 0f 06 a9 a7 68 b1 09 09 85 6b e5 f4 fc de 22 72 77 8a 8a 3a 86 0b cd 60 11 0a 2e 0c 0c 2c 0f 7e 27 82 5e 7e 69 47 11 2e 88 2d b6 e0 80 c6 f7 e6 50 3e 2c 16 3e fb a5 62 97 00 4a 5a 41 99 40 70 1a ed 5b 37 dd 77 2d fe a7 9a d9 fe 27 1d 67 c0 9d 95 43 2e 25 57 eb a2 e8 44 90 e0 f3 07 b1 e2 fd 25 a4 f5 5c 95 2a 87 90 e8 84 cb eb bb ce 9d 3b 95 aa dd 85 dc 56 e6 f9 ea 26 7c f3 80 7e ba 94 73 1c 50 33 87 e1 09 de 82 86 da ff a5 6a 35 47 80 10 15 ec 09 d6 f4 06 ef 2d Data Ascii: mUQllFkgx(Xfvc;9u0C=50db,Bw]I~)EFByrRhk"rw:`.,~'^~iG.-P>,>bJZA@p[7w-'gC.%WD%\*;V&\|~sP3j5G-
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 65 07 7f 7f aa f3 10 49 f3 db 6e 67 e7 93 cc 61 17 28 1d 12 af bd 5e 7d bd c3 a6 ea 9b 85 db 01 fa 58 e4 31 ee f3 fd 6a 79 f7 dd f4 ab 9f 05 12 c5 a1 a0 a1 64 95 dd ac f4 e6 33 15 d0 ad 7f 57 c3 14 6e 04 71 b5 b5 7c 42 a1 82 41 9c 9e 87 80 ea 71 dd 45 38 96 39 eb 12 94 d5 28 2e a4 f4 4a 56 c9 1f 23 b9 98 c8 d3 3c 58 fb 52 39 d6 f5 83 59 3e 59 cc d0 4a 3f ad f1 db 3a 66 36 f8 6b 33 2b 5b d9 d8 cb dd 01 1e a6 f3 f2 3e 7f 33 05 9b 93 48 7f 37 96 a4 f1 06 f1 2c 1d e2 e9 7a 95 a1 f7 95 fa 51 6d cc af f6 71 45 5c 85 d7 e9 1d ee 2a be 7a b5 2a ae 41 e9 b8 fa 33 c4 ac 9e 5e 0f 97 62 9b 1d 76 bb bc 0e 82 9c 40 b9 40 72 99 ea 1a dd 0d a6 bb 7c 8f 00 a9 3b 76 fb 5e cf a4 5d b3 b5 47 39 4b a0 85 80 32 bb 47 e3 99 18 2f 25 ec d2 ee 63 f0 52 4c 6e d0 65 4c 63 9f 8d 2b Data Ascii: eInga(^}X1jyd3Wnq\|BAqE89(.JV#<XR9Y>YJ?:f6k3+[>3H7,zQmqE\zA3^bv@@r\|;v^]G9K2G/%cRLneLc+
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 10 8b e0 4b d9 34 f4 37 7f 26 d3 96 f6 f4 cf ab 28 d7 8b d0 0c c7 7d bc ae 68 af c9 ec 37 e5 d4 dd 14 ca e2 5b 36 cd 2e a7 4b 1f ff b6 d1 5c bc f6 65 4f 91 03 51 81 6f e6 21 5d c4 3a 2c 23 e5 13 ca 7f d2 23 27 ab 9f b6 f5 f6 fb d8 68 20 7e 8b 4d ac 8d 7c 6f 7a fc e3 c8 92 e9 e3 97 4a fb 76 11 a5 c5 4e 8b 9b a0 b6 d0 04 0c ab a6 2e b8 54 d3 68 4b 23 a3 a3 89 70 ae 3c e2 60 b2 ca c0 1e 28 e9 ea b0 f0 5b 7d dd d0 cf 60 9a 16 18 71 d5 a5 08 4a 8e 60 9e cc 93 69 1a 73 bd c2 c3 c8 82 ad 96 85 68 b7 83 5a 9d 4a fa 9f d4 a7 37 fe a6 ea e5 d7 d6 be 8a dd 61 0b 46 16 ac 8e 3f 9f 7b 76 ef 77 20 33 cf ee c9 d8 cf 6a c5 19 db b6 8c ac 52 79 1a 20 a2 38 46 4a e0 3d 47 3a fb e2 16 b5 fd fd 14 38 be 59 0d 15 68 83 eb 24 d5 68 35 2f 5d 05 90 9a 4a d0 16 85 2f 79 7e 2b 48 Data Ascii: K47&(}h7[6.K\eOQo!]:,##'h ~M\|ozJvN.ThK#p<`([}`qJ`ishZJ7aF?{vw 3jRy 8FJ=G:8Yh$h5/]J/y~+H
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 7b 06 b4 9a 0c 78 e0 8a 86 41 23 f9 da 0e 8e c5 6a a6 a1 82 ae 90 01 a2 44 92 13 78 56 a1 e4 70 22 15 0d 48 52 44 40 e9 3b ae 29 a6 54 b5 50 4f af fa df 34 08 c3 9a 01 92 96 61 95 75 6d ec 69 73 d0 1e c6 87 55 13 6b 5b bd e6 1b cd 8a b4 ac fc 79 a4 75 02 53 25 66 12 40 5a ca c9 82 de 04 bd 54 62 9a 60 5d 54 10 34 a0 4c 5e 65 c8 5a d0 b4 aa f3 11 ab f5 09 61 08 6b 31 cf a2 d6 c7 bc 61 16 dd 67 90 9b 64 0f d7 d4 04 29 1e f1 0d 9d 22 4c e8 70 95 6b bb c4 39 d0 d5 28 d5 73 1f 11 44 9a f5 a8 0e c8 d7 2c ca ba 26 7d f1 03 cf 99 97 d5 38 a6 ba 8e a0 84 de 75 18 30 b6 10 4b 0e b9 8c 32 16 2d d5 0a ac b2 a6 9d 57 db 3d 8e d2 31 ec 0f da 35 c3 24 6a 51 87 20 cc 28 17 c1 60 10 18 12 04 c9 20 49 92 80 0c 82 20 20 03 33 e2 c0 fb 32 4e 89 85 24 e5 4c e4 6a 94 3c 36 8e Data Ascii: {xA#jDxVp"HRD@;)TPO4aumisUk[yuS%f@ZTb`]T4L^eZak1agd)"Lpk9(sD,&}8u0K2-W=15$jQ (` I 32N$Lj<6
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 76 52 69 6e 27 75 36 f6 57 ef 83 93 06 c0 7d 8d a0 6b 4d 90 2b cd b0 6b 2d 88 2b ad a8 6b 6d 98 2b ed b8 8b 97 88 2e 5e 26 bb 78 85 ea e2 35 ba 1b 03 0c cf bc c1 74 63 84 e3 64 8c e7 64 42 e0 64 4a e4 84 28 71 b2 61 72 eb 5b 8b 5b bf 61 9f fd 4e bd f3 27 73 df ff 84 fb fe 56 ee fb 07 57 40 80 63 a2 dc a4 fb a8 90 78 a8 45 24 02 58 82 24 40 2d 2f 58 98 7c e0 69 e5 87 08 53 10 2a 4c 21 95 f5 c3 c2 d6 0f 0f 5f 3f 2a 6a 59 34 b4 d2 e8 e8 65 31 30 4a 63 62 96 c5 c2 2a 8d 8d 1d 83 8b 1b 83 8f 1f 43 48 18 43 4c 1c 43 4a 1a 43 4e 5e 90 82 22 5a 3d ca 1c 54 54 d1 52 a9 73 d0 d0 54 a5 a3 ab ca c0 50 95 85 25 a8 16 ac 85 6b c5 5e a0 d6 1c 45 68 c3 59 a0 4e a2 85 ea 2c 56 96 5a b5 85 ea 26 11 51 83 86 8c 92 92 11 64 64 0a d5 47 63 59 b2 b2 b5 c8 c9 45 d4 a4 a9 1c 2d Data Ascii: vRin'u6W}kM+k-+km+.^&x5tcddBdJ(qar[[aN'sVW@cxE$X$@-/X\|iSL!_?jY4e10Jcb*CHCLCJCN^"Z=TTRsTP%k^EhYN,VZ&QddGcYE-
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: cb 1b d6 e6 79 bb f4 4d b9 a3 de 12 3f 89 0a 9f 13 4f 94 f9 39 f5 24 99 9f bb 9f 2c f3 fb d4 bb 89 f6 fe f1 56 68 24 de 03 34 c1 f8 38 40 13 1f 1f 01 34 f9 a6 32 34 85 87 18 9a 12 43 0b 4d 85 e1 84 a6 da 88 42 93 32 b2 d0 d4 1b 5d 68 9a 8c a5 80 69 f5 4a bb de 59 c3 b8 c6 55 dd f8 c7 ff ed ba 5b a6 ad 76 de 9d 89 2f 2b f7 29 23 bf 86 9f ae e9 7f da 49 6f d5 9f e3 73 e6 f9 a8 9d 65 9f db 8d 60 6f b5 20 67 7f 81 ab 28 11 8f f2 e8 86 cc 6b b9 2d 2b 46 17 d5 a7 75 54 79 44 55 07 95 24 7d 3c 38 d8 d2 7f 69 26 49 5b 58 32 d9 0a 72 a3 c8 cb 9a c3 6d 25 b5 f3 06 4d 43 50 9a a0 69 09 ea 03 68 1f d1 5b 4d dc 1a ac 81 12 09 c6 90 13 a6 75 aa ea 36 24 69 98 31 98 4e f0 fc a9 de 66 27 54 42 85 42 9f a8 dd c8 53 41 a5 b4 35 58 19 ed 8a c7 22 02 cd 43 d0 36 a8 aa be 08 Data Ascii: yM?O9$,Vh$48@424CMB2]hiJYU[v/+)#Iose`o g(k-+FuTyDU$}<8i&I[X2rm%MCPih[Mu6$i1Nf'TBBSA5X"C6
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: b7 d7 70 6e b4 99 bf 23 60 fe 8b 7f b2 92 5d 4c 97 8b 2f 19 e5 d2 8c 3b cd d5 99 95 c4 ad 59 77 91 9c d9 76 95 dc 6a b9 dc b7 41 4f f6 78 30 ec 00 c0 31 83 29 40 34 60 2a 30 0c 44 0f 66 48 42 c9 a8 b4 51 3a 83 0c 95 c9 38 93 c4 38 b4 91 9a 75 6e 69 39 96 21 bb b2 a5 20 14 de ab 51 54 44 1d c6 94 d0 24 53 ba d3 4c 4d 23 c2 2d 1d 9b 53 96 4e cd af 44 97 56 55 25 76 5f 3f 30 a0 cd 35 1a d8 8e 9e 19 d2 9e da 0d 6b 7f 3d de 3c b6 61 64 bf 34 6a 9f 3e d0 ae cb 8d 68 df c3 26 f4 69 b1 39 fd da 6c cb 90 bd b3 58 1c 7b 20 10 7a a7 03 15 b2 8b dd ec 61 2f fb d8 1f 0e b4 ae ff 85 e7 c6 b9 bd 99 bd 77 a7 ba 34 5f 95 42 dc e6 0a 77 c3 b5 76 f2 87 1d 27 44 44 58 67 25 fb f6 e4 ad 37 d5 e0 ca 3e be dd 58 d2 7b 7b fe b6 9c e9 16 1b 45 7f df 09 81 ed c3 0a d8 7b 29 e0 b6 Data Ascii: pn#`]L/;YwvjAOx01)@4`*0DfHBQ:88uni9! QTD$SLM#-SNDVU%v_?05k=<ad4j>h&i9lX{ za/w4_Bwv'DDXg%7>X{{E{)
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 0a ec 30 dc fd 49 b7 ce 1e 9d fe e2 bb d4 b7 e4 5a e9 45 ef 0a fb 18 e4 fc 2f ed e6 ed cd 45 c8 85 92 42 6f 6e a4 ae 93 f0 77 69 99 10 39 e0 12 30 45 08 41 4a 09 19 cf 51 18 71 88 d0 c8 10 ad 35 86 a7 15 21 2a 9a 83 b6 d8 e1 5c b4 54 72 2c 58 b7 36 92 22 2d 91 85 7a e4 05 4c 2e 22 bd 43 42 e7 8d 17 92 90 8d 24 85 d2 21 25 c2 89 4a 0a 8b f6 5a aa ad f4 2a 99 23 6e 99 48 05 78 12 da 5a 35 3c 06 2b 52 9e 63 c0 7d 62 f9 38 ec 75 0a 7a 4a 75 09 69 5d ae 44 5a 13 b2 b6 83 5c 2b 02 08 73 95 ea 0c 2c 5b e0 2f a2 44 da 9f 5c f5 04 fa e8 84 20 94 d2 00 e7 b4 b8 09 28 07 b9 6e fa 29 63 13 24 0c 34 6a d9 6f 8a 72 5d a2 0a 5a 63 f0 98 d6 09 f3 4e 6d 1f 94 da 51 ed 89 f6 06 38 13 2f 33 a0 5e 01 da 52 2b 3a 83 63 08 69 78 6c 80 6c 80 53 e7 6c 07 0f 22 43 46 f4 ef 78 a0 Data Ascii: 0IZE/EBonwi90EAJQq5!\Tr,X6"-zL."CB$!%JZ#nHxZ5<+Rc}b8uzJui]DZ\+s,[/D\ (n)c$4jor]ZcNmQ8/3^R+:cixllSl"CFx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.10	49791	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	1638	OUT	GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Context-Properties: eyJsb2NhdGlvbiI6IkFjY2VwdCBJbnZpdGUgUGFnZSJ9 X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=31536000; includeSubDomains; preload vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: BYPASS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8WtB7LKk8Rf6HVYrtT8yTc7TfGNVyCUGsZEQ%2FtK07Dxhq4bacSFRu1w2gtK1%2FK5r25pEwu%2B9RvRTFn5IPni6YzyTyTy3QsAEEKaU7MckTZJvgiRdkkVwnE2xt8pJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e60195c47a6-DFW
2024-10-24 07:16:23 UTC	599	IN	Data Raw: 37 63 61 31 0d 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 33 33 30 36 38 37 35 35 30 31 35 2e 72 31 69 34 72 61 54 6a 30 6b 70 30 4a 39 44 38 6c 33 62 52 49 38 77 2d 56 6c 6b 22 2c 22 61 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 5b 32 38 31 30 32 30 35 34 38 37 2c 31 2c 31 2c 2d 31 2c 33 2c 38 35 30 33 2c 30 2c 30 5d 2c 5b 32 36 31 37 32 31 38 34 34 34 2c 34 2c 31 2c 2d 31 2c 32 2c 32 37 33 31 2c 30 2c 30 5d 2c 5b 33 30 33 35 36 37 34 37 36 37 2c 30 2c 31 2c 2d 31 2c 30 2c 33 32 31 36 2c 30 2c 30 5d 2c 5b 31 36 30 39 37 38 32 31 35 31 2c 30 2c 31 2c 2d 31 2c 32 2c 31 32 33 31 2c 30 2c 30 5d 2c 5b 33 36 34 33 33 36 32 37 35 31 2c 30 2c 31 2c 2d 31 2c 30 2c 37 35 39 36 2c 30 2c 30 5d 2c 5b 33 37 35 33 30 33 34 34 36 36 2c 31 2c Data Ascii: 7ca1{"fingerprint":"1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-Vlk","assignments":[[2810205487,1,1,-1,3,8503,0,0],[2617218444,4,1,-1,2,2731,0,0],[3035674767,0,1,-1,0,3216,0,0],[1609782151,0,1,-1,2,1231,0,0],[3643362751,0,1,-1,0,7596,0,0],[3753034466,1,
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 31 2c 30 2c 39 32 34 2c 30 2c 30 5d 2c 5b 33 35 35 37 34 38 30 37 31 32 2c 30 2c 31 2c 2d 31 2c 30 2c 38 31 35 30 2c 30 2c 30 5d 2c 5b 38 35 33 34 30 33 31 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 32 38 38 38 2c 30 2c 30 5d 2c 5b 32 34 39 31 30 30 35 30 31 39 2c 34 2c 31 2c 2d 31 2c 30 2c 34 31 33 38 2c 30 2c 30 5d 2c 5b 33 38 38 39 30 37 37 38 30 34 2c 32 2c 31 2c 2d 31 2c 30 2c 39 36 37 35 2c 30 2c 30 5d 2c 5b 34 30 37 39 32 31 34 33 31 39 2c 32 2c 31 2c 2d 31 2c 30 2c 31 37 35 35 2c 30 2c 30 5d 2c 5b 31 35 33 32 32 38 30 35 34 38 2c 31 36 2c 31 2c 2d 31 2c 35 2c 37 34 2c 30 2c 30 5d 2c 5b 31 30 39 35 37 37 39 31 35 34 2c 30 2c 31 2c 2d 31 2c 34 2c 38 34 33 31 2c 30 2c 30 5d 2c 5b 31 33 39 38 30 30 37 38 33 39 2c 30 2c 31 2c 2d 31 2c 32 2c 36 34 34 36 2c 30 Data Ascii: 1,0,924,0,0],[3557480712,0,1,-1,0,8150,0,0],[853403133,4,1,-1,0,2888,0,0],[2491005019,4,1,-1,0,4138,0,0],[3889077804,2,1,-1,0,9675,0,0],[4079214319,2,1,-1,0,1755,0,0],[1532280548,16,1,-1,5,74,0,0],[1095779154,0,1,-1,4,8431,0,0],[1398007839,0,1,-1,2,6446,0
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 35 36 35 31 2c 30 2c 31 2c 2d 31 2c 31 2c 38 36 33 30 2c 30 2c 30 5d 2c 5b 33 37 33 35 33 31 31 35 36 2c 30 2c 33 2c 2d 31 2c 30 2c 37 33 34 37 2c 30 2c 30 5d 2c 5b 32 34 32 39 32 31 36 30 35 39 2c 30 2c 31 2c 2d 31 2c 30 2c 33 34 36 37 2c 30 2c 30 5d 2c 5b 31 36 31 37 37 34 39 37 34 33 2c 30 2c 31 2c 2d 31 2c 30 2c 32 30 39 2c 30 2c 30 5d 2c 5b 32 39 33 37 33 32 39 39 31 30 2c 31 2c 31 2c 2d 31 2c 32 2c 31 35 32 31 2c 30 2c 30 5d 2c 5b 32 38 38 39 36 38 37 30 36 2c 30 2c 31 2c 2d 31 2c 33 2c 36 31 37 39 2c 30 2c 30 5d 2c 5b 31 30 34 35 37 33 30 32 30 33 2c 33 2c 31 2c 2d 31 2c 31 2c 39 31 33 30 2c 30 2c 30 5d 2c 5b 33 35 32 32 33 37 38 37 31 36 2c 30 2c 31 2c 2d 31 2c 31 2c 36 38 38 34 2c 30 2c 30 5d 2c 5b 32 30 39 31 32 30 32 35 37 34 2c 30 2c 31 2c 2d Data Ascii: 5651,0,1,-1,1,8630,0,0],[373531156,0,3,-1,0,7347,0,0],[2429216059,0,1,-1,0,3467,0,0],[1617749743,0,1,-1,0,209,0,0],[2937329910,1,1,-1,2,1521,0,0],[288968706,0,1,-1,3,6179,0,0],[1045730203,3,1,-1,1,9130,0,0],[3522378716,0,1,-1,1,6884,0,0],[2091202574,0,1,-
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 31 35 37 35 2c 30 2c 30 5d 2c 5b 33 39 35 30 38 34 37 35 33 37 2c 33 2c 31 2c 2d 31 2c 30 2c 31 39 35 36 2c 30 2c 30 5d 2c 5b 33 39 32 37 31 34 35 37 39 37 2c 30 2c 31 2c 2d 31 2c 33 2c 39 36 37 31 2c 30 2c 30 5d 2c 5b 32 32 34 30 30 39 38 30 32 35 2c 30 2c 31 2c 2d 31 2c 30 2c 31 39 36 35 2c 30 2c 31 5d 2c 5b 38 32 32 36 37 36 31 33 34 2c 32 2c 31 2c 2d 31 2c 30 2c 39 31 31 38 2c 30 2c 30 5d 2c 5b 31 38 39 34 32 38 38 31 31 33 2c 30 2c 32 2c 2d 31 2c 34 2c 39 39 38 37 2c 30 2c 30 5d 2c 5b 32 35 33 38 35 39 31 30 37 37 2c 30 2c 31 2c 2d 31 2c 36 2c 38 35 33 39 2c 30 2c 30 5d 2c 5b 32 30 35 33 31 36 32 38 32 31 2c 30 2c 31 2c 2d 31 2c 31 2c 33 39 31 2c 30 2c 30 5d 2c 5b 32 38 31 36 35 37 37 36 32 36 2c 30 2c 31 2c 2d 31 2c 32 2c 39 36 39 32 2c 30 2c 30 5d Data Ascii: 1575,0,0],[3950847537,3,1,-1,0,1956,0,0],[3927145797,0,1,-1,3,9671,0,0],[2240098025,0,1,-1,0,1965,0,1],[822676134,2,1,-1,0,9118,0,0],[1894288113,0,2,-1,4,9987,0,0],[2538591077,0,1,-1,6,8539,0,0],[2053162821,0,1,-1,1,391,0,0],[2816577626,0,1,-1,2,9692,0,0]
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 31 2c 2d 31 2c 30 2c 36 38 36 2c 30 2c 31 5d 2c 5b 32 32 34 34 33 36 39 32 39 39 2c 34 2c 37 2c 2d 31 2c 30 2c 33 38 36 35 2c 30 2c 31 5d 2c 5b 33 37 37 35 35 39 34 37 33 31 2c 33 2c 31 2c 2d 31 2c 30 2c 33 38 37 32 2c 30 2c 30 5d 2c 5b 32 32 31 30 37 30 38 30 30 37 2c 32 2c 31 2c 2d 31 2c 30 2c 34 38 37 38 2c 30 2c 31 5d 2c 5b 32 34 39 31 39 34 33 34 34 37 2c 30 2c 31 2c 2d 31 2c 30 2c 31 38 35 35 2c 30 2c 31 5d 2c 5b 36 37 33 36 35 37 38 37 32 2c 30 2c 31 2c 2d 31 2c 32 2c 31 34 38 32 2c 30 2c 30 5d 2c 5b 33 38 37 32 37 35 37 39 38 2c 32 2c 32 2c 2d 31 2c 30 2c 38 35 35 35 2c 30 2c 31 5d 2c 5b 32 39 37 39 39 32 36 32 34 30 2c 30 2c 31 2c 2d 31 2c 30 2c 32 31 31 35 2c 30 2c 30 5d 2c 5b 34 34 30 39 38 30 34 37 38 2c 34 2c 33 2c 2d 31 2c 30 2c 38 34 36 34 Data Ascii: 1,-1,0,686,0,1],[2244369299,4,7,-1,0,3865,0,1],[3775594731,3,1,-1,0,3872,0,0],[2210708007,2,1,-1,0,4878,0,1],[2491943447,0,1,-1,0,1855,0,1],[673657872,0,1,-1,2,1482,0,0],[387275798,2,2,-1,0,8555,0,1],[2979926240,0,1,-1,0,2115,0,0],[440980478,4,3,-1,0,8464
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 38 38 31 38 31 2c 34 2c 31 2c 2d 31 2c 30 2c 33 36 31 32 2c 30 2c 30 5d 2c 5b 33 34 33 38 37 32 31 30 2c 32 2c 33 2c 2d 31 2c 30 2c 34 39 38 34 2c 30 2c 30 5d 2c 5b 36 30 31 30 31 34 37 34 39 2c 34 2c 31 2c 2d 31 2c 30 2c 31 34 33 34 2c 30 2c 31 5d 2c 5b 37 35 38 34 31 33 37 37 32 2c 30 2c 31 2c 2d 31 2c 30 2c 36 31 36 2c 30 2c 30 5d 2c 5b 32 39 31 36 39 37 32 32 33 33 2c 34 2c 31 2c 2d 31 2c 30 2c 39 30 31 37 2c 30 2c 31 5d 2c 5b 34 32 38 37 32 38 38 37 37 30 2c 31 2c 30 2c 2d 31 2c 30 2c 35 31 31 2c 31 2c 31 5d 2c 5b 32 31 38 36 30 35 34 31 33 33 2c 31 2c 30 2c 2d 31 2c 30 2c 31 32 32 30 2c 31 2c 31 5d 2c 5b 32 38 38 32 36 35 36 39 30 36 2c 32 2c 31 2c 2d 31 2c 30 2c 36 34 30 39 2c 31 2c 31 5d 2c 5b 35 32 39 33 30 36 32 34 30 2c 31 2c 31 2c 2d 31 2c 30 Data Ascii: 88181,4,1,-1,0,3612,0,0],[34387210,2,3,-1,0,4984,0,0],[601014749,4,1,-1,0,1434,0,1],[758413772,0,1,-1,0,616,0,0],[2916972233,4,1,-1,0,9017,0,1],[4287288770,1,0,-1,0,511,1,1],[2186054133,1,0,-1,0,1220,1,1],[2882656906,2,1,-1,0,6409,1,1],[529306240,1,1,-1,0
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 32 30 36 38 37 35 32 2c 30 2c 31 2c 2d 31 2c 30 2c 31 37 39 38 2c 30 2c 30 5d 2c 5b 34 30 32 34 30 37 39 33 39 37 2c 30 2c 31 2c 2d 31 2c 30 2c 31 37 31 31 2c 30 2c 31 5d 2c 5b 32 37 31 37 36 34 37 39 30 37 2c 33 2c 31 2c 2d 31 2c 30 2c 37 38 30 31 2c 30 2c 31 5d 2c 5b 32 36 32 32 36 36 32 30 36 37 2c 31 2c 31 2c 2d 31 2c 30 2c 31 36 37 31 2c 31 2c 31 5d 2c 5b 32 32 38 33 30 36 31 33 37 32 2c 32 2c 31 2c 2d 31 2c 30 2c 37 31 34 33 2c 30 2c 30 5d 2c 5b 31 33 36 32 36 32 36 33 35 33 2c 33 2c 32 2c 2d 31 2c 30 2c 37 32 33 35 2c 30 2c 31 5d 2c 5b 32 37 35 30 34 37 37 32 39 32 2c 32 2c 30 2c 2d 31 2c 30 2c 35 34 35 33 2c 30 2c 30 5d 2c 5b 32 36 32 32 35 30 32 37 34 38 2c 30 2c 31 2c 2d 31 2c 30 2c 39 37 39 38 2c 30 2c 30 5d 2c 5b 33 32 35 34 37 32 36 31 39 39 Data Ascii: 2068752,0,1,-1,0,1798,0,0],[4024079397,0,1,-1,0,1711,0,1],[2717647907,3,1,-1,0,7801,0,1],[2622662067,1,1,-1,0,1671,1,1],[2283061372,2,1,-1,0,7143,0,0],[1362626353,3,2,-1,0,7235,0,1],[2750477292,2,0,-1,0,5453,0,0],[2622502748,0,1,-1,0,9798,0,0],[3254726199
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 5b 34 32 30 30 35 39 35 30 36 37 2c 22 32 30 32 32 2d 30 31 5f 67 75 69 6c 64 5f 72 6f 6c 65 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 5f 74 72 69 61 6c 73 22 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 32 32 39 34 38 38 38 39 34 33 2c 5b 5b 32 36 39 30 37 35 32 31 35 36 2c 37 37 30 31 33 39 33 30 31 5d 2c 5b 31 39 38 32 38 30 34 31 32 31 2c 31 30 30 30 30 5d 5d 5d 5d 5d 2c 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 47 55 49 4c 44 5f 52 4f 4c 45 5f 53 55 42 53 43 52 49 50 Data Ascii: [4200595067,"2022-01_guild_role_subscription_trials",0,[[[[1,[{"s":0,"e":10000}]]],[[2294888943,[[2690752156,770139301],[1982804121,10000]]]]],[[[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["GUILD_ROLE_SUBSCRIP
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 39 30 38 31 31 34 33 39 32 32 36 33 30 34 39 32 37 37 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 37 39 37 31 31 36 33 38 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 36 2c 22 6b 22 3a 5b 22 39 30 38 31 31 34 33 39 32 32 36 33 30 34 39 32 37 37 22 2c 22 34 34 33 35 38 34 38 37 37 38 32 39 35 35 34 31 37 37 22 2c 22 32 32 33 30 37 30 34 36 39 31 34 38 39 30 31 33 37 36 22 2c 22 32 32 34 35 36 35 38 33 36 32 37 37 34 38 31 34 37 33 22 2c 22 34 38 38 34 34 34 38 37 39 38 33 36 34 31 33 39 37 35 22 2c 22 37 35 36 36 34 34 31 37 36 36 31 Data Ascii: e":10000}]]],[]]],[{"b":1,"k":["908114392263049277"]}],[],null,null,0,0],[179711638,null,0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[{"b":6,"k":["908114392263049277","443584877829554177","223070469148901376","224565836277481473","488444879836413975","75664417661
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 47 55 49 4c 44 5f 4f 4e 42 4f 41 52 44 49 4e 47 5f 41 44 4d 49 4e 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 32 34 35 37 39 30 33 31 30 37 2c 6e 75 6c 6c 2c 32 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 32 30 30 30 7d 2c 7b 22 73 22 3a 38 30 30 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 2c 5b 31 2c 5b 7b 22 73 22 3a 34 30 30 30 2c 22 65 22 3a 36 30 30 30 7d 5d 5d 2c 5b 32 2c 5b 7b 22 73 22 3a 36 30 30 30 2c 22 65 22 3a Data Ascii: [[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["GUILD_ONBOARDING_ADMIN_ONLY"]]]]]]]],null,null,0,0],[2457903107,null,2,[[[[-1,[{"s":0,"e":2000},{"s":8000,"e":10000}]],[1,[{"s":4000,"e":6000}]],[2,[{"s":6000,"e":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.10	49796	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	872	OUT	GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 3530 Connection: close CF-Ray: 8d782e60ece06c5c-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "be6064ff8c1d480afb80fe48762a06c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tDa5TpQhheovKDTlqA8Ys1DERw8rzsJMDtGPI1OKZ5djVglY64bzKffsLqJyd9RrX1Yklf5jH5lCcPdy0ehN2Xl0TlZi2DwZwIx3bUF1DwyF7F4FpDYTl8fkYtbs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	407	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 35 30 34 30 35 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 65 29 7b 65 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 65 28 35 31 38 32 36 33 29 2c 65 28 39 37 30 31 37 33 29 2c 65 28 35 32 30 37 31 32 29 2c 65 28 32 36 38 31 31 31 29 2c 65 28 39 34 31 34 39 37 29 2c 65 28 33 32 30 32 36 29 2c 65 28 34 38 30 38 33 39 29 2c 65 28 37 34 34 32 38 35 29 2c 65 28 34 39 32 32 35 37 29 2c 65 28 38 37 33 38 31 37 29 2c 65 28 38 36 33 39 34 32 29 2c 65 28 36 34 32 35 34 39 29 2c 65 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 3d 65 28 37 38 38 39 30 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 72 29 7b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 5d 7c 72 5b 34 5d 3c 3c 38 2c 73 3d 28 36 33 26 63 29 2f 36 33 2c 70 3d 28 63 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 64 3d 28 63 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 76 3d 63 3e 3e 32 33 2c 68 3d 6c 3e 3e 31 35 2c 62 3d 69 28 33 2c 68 3f 76 3f 35 3a 37 3a 37 26 6c 29 2c 67 3d 69 28 33 2c 68 3f 37 26 6c 3a 76 3f 35 3a 37 29 2c 79 3d 76 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 76 3f 36 3a 35 2c 77 3d 30 2c 78 3d 28 74 2c 65 2c 6e 29 3d 3e 7b 6c 65 74 20 6f 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 6c 65 74 20 69 3d 66 3f 30 3a 31 3b 69 2a 65 3c 74 2a 28 65 2d 66 29 3b 69 2b 2b 29 6f 2e 70 75 73 68 28 28 28 72 5b 6d 2b 28 77 3e 3e 31 29 5d 3e Data Ascii: ]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>1)]>
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 66 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 63 61 6c 6c 28 66 2e 65 78 70 6f 72 74 73 2c 66 2c 66 2e 65 78 70 6f 72 74 73 2c 65 29 2c 66 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 72 2c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 65 2e 4f 28 76 6f 69 64 20 30 2c 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 22 31 37 31 37 31 36 22 29 7d 29 3b 72 65 74 75 72 6e 20 72 3d 65 2e 4f 28 72 29 7d 2c 65 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 72 26 26 72 2e 5f 5f 65 73 4d 6f 64 Data Ascii: ;if(void 0!==o)return o.exports;var f=t[n]={exports:{}};return r[n].call(f.exports,f,f.exports,e),f.exports}e.m=r,e.x=function(){var r=e.O(void 0,["78187","71984","43222"],function(){return e("171716")});return r=e.O(r)},e.n=function(r){var t=r&&r.__esMod
2024-10-24 07:16:23 UTC	385	IN	Data Raw: 34 22 2c 22 34 33 32 32 32 22 5d 2e 6d 61 70 28 65 2e 65 2c 65 29 29 2e 74 68 65 6e 28 72 29 7d 7d 29 28 29 2c 28 28 29 3d 3e 7b 76 61 72 20 72 3d 7b 37 37 34 35 39 3a 31 7d 3b 65 2e 66 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 21 72 5b 74 5d 26 26 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 65 2e 70 2b 65 2e 75 28 74 29 29 7d 3b 76 61 72 20 74 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 2c 6e 3d 74 2e 70 75 73 68 2e 62 69 6e 64 28 74 29 3b 74 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6f 3d 74 5b 30 5d 2c 66 3d 74 5b 31 5d 2c 69 3d 74 5b 32 5d 3b 66 6f 72 28 76 61 72 20 75 20 69 6e 20 Data Ascii: 4","43222"].map(e.e,e)).then(r)}})(),(()=>{var r={77459:1};e.f.i=function(t,n){!r[t]&&importScripts(e.p+e.u(t))};var t=this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[],n=t.push.bind(t);t.push=function(t){var o=t[0],f=t[1],i=t[2];for(var u in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.10	49797	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	872	OUT	GET /assets/29a63f12209c956d9204.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	968	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: application/javascript Content-Length: 2750 Connection: close CF-Ray: 8d782e611dce2e5f-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "390a7ab1f964aa8cb1b87dd13732c3bc" Last-Modified: Tue, 30 Jul 2024 22:07:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W64EHsHNcZGsPx9APo1PMwdrBVJht0H1SWv5KXtA0GhTQFLTLJskgoo6T08msikHPGiCmErx3TDy080%2Bhws2l4Uml3StEpIu3Uio7%2B55%2FWzVDssRGqGptvLNwkKn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	401	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 33 37 39 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 69 3b 6e 2e 64 28 72 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 28 69 3d 65 7c 7c 28 65 3d 7b 7d 29 29 5b 69 2e 4e 4f 4e 45 3d 30 5d 3d 22 4e 4f 4e 45 22 2c 69 5b 69 2e 53 4f 43 49 41 4c 3d 31 5d 3d 22 53 4f 43 49 41 4c 22 2c 69 5b 69 2e 43 41 53 55 41 4c 3d 32 5d 3d 22 43 41 53 55 41 4c 22 2c 69 5b 69 2e 43 4f 4d 50 45 54 49 54 49 56 45 3d 33 5d 3d 22 43 4f 4d 50 45 54 49 54 49 56 45 22 2c 69 5b 69 2e 43 52 45 41 54 49 56 45 3d 34 5d 3d 22 43 52 45 41 54 49 56 45 22 2c 69 5b 69 2e 56 45 Data Ascii: (()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VE
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 6e 28 31 33 37 39 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 29 7b 6c 65 74 20 6e 3d 30 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 2e 67 61 6d 65 73 26 26 28 6e 2b 3d 32 2a 72 2e 67 61 6d 65 73 2e 66 69 6c 74 65 72 28 72 3d 3e 74 2e 67 61 6d 65 73 2e 69 6e 63 6c 75 64 65 73 28 72 29 29 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 72 2e 70 6c 61 79 73 74 79 6c 65 26 26 28 72 2e 70 6c 61 79 73 74 79 6c 65 3d 3d 3d 74 2e 70 6c 61 79 73 74 79 6c 65 3f 6e 2b 3d 32 3a 65 2e 4a 5b 74 2e 70 6c 61 79 73 74 79 6c 65 5d 3d 3d 3d 65 2e 4a 5b 72 2e 70 6c 61 79 73 74 79 6c 65 5d 26 26 28 6e 2b 3d 31 29 29 2c 6e 75 6c 6c 21 3d 72 2e 74 72 61 69 74 73 26 26 28 6e 2b 3d 32 2a 41 Data Ascii: nction(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+=2A
2024-10-24 07:16:23 UTC	980	IN	Data Raw: 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 7d 2c 28 28 29 3d 3e 7b 76 61 72 20 74 3d 5b 5d 3b 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 69 2c 75 29 7b 69 66 28 65 29 7b 75 3d 75 7c 7c 30 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3e 30 26 26 74 5b 6f 2d 31 5d 5b 32 5d 3e 75 3b 6f 2d 2d 29 Data Ascii: try{return this\|\|Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.o=function(t,r){return Object.prototype.hasOwnProperty.call(t,r)},(()=>{var t=[];n.O=function(r,e,i,u){if(e){u=u\|\|0;for(var o=t.length;o>0&&t[o-1][2]>u;o--)

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.10	49793	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: b1315031-501e-000a-22f5-240180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-r197bdfb6b4lbgfqwkqbrm672s000000012g00000000bznh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.10	49795	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: c0884099-101e-0046-3a40-2291b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-16849878b78plcdqu15wsb8864000000078000000000cy3a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.10	49792	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a363c0e5-301e-003f-5298-25266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-16849878b78p6ttkmyustyrk8s00000007bg000000001as1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.10	49790	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ee7a308c-c01e-00a1-620b-227e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-16849878b7862vlcc7m66axrs000000007ag00000000c52k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.10	49794	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8b572347-501e-008c-80f2-21cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071623Z-16849878b78s2lqfdex4tmpp7800000007e0000000004ede x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.10	49798	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:23 UTC	868	OUT	GET /assets/55ad931ed92a15c15709.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:23 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:23 GMT Content-Type: text/javascript Content-Length: 109613 Connection: close CF-Ray: 8d782e614db7345e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "80f500d4d0495e5c74e9b92cbc26f088" Last-Modified: Tue, 15 Oct 2024 21:49:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fq47lcjcp5oDC8rAVxcyFkEfrKsy%2BQVyzXsQj%2FU2tdLX6qOx4PKUWL%2B5zll1tpnHs5ysboXseGLkc4Htnbj3R7ME6dzRngfull1vH9MONHx5T8LCzqYE79nNOW9V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 33 32 38 38 22 5d 2c 7b 34 37 33 34 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 5e 6e 2c 72 3d 30 3b 6e 3e 3d 34 3b 29 74 3d 28 36 35 35 33 35 26 28 74 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 38 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 31 36 7c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 69 66 28 30 3c 31 2a 6e 26 26 30 3c 74 2e 69 6e 64 65 78 4f 66 28 22 5c 66 22 29 29 72 65 74 75 72 6e 20 74 2e 72 65 70 6c 61 63 65 28 6d 2c 28 35 38 3d 3d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 3f 22 22 3a 22 24 31 22 29 2b 65 2e 74 72 69 6d 28 29 29 7d 72 65 74 75 72 6e 20 65 2b 74 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 74 2c 6e 2c 69 29 7b 76 61 72 20 61 3d 65 2b 22 3b 22 2c 75 3d 32 2a 74 2b 33 2a 6e 2b 34 2a 69 3b 69 66 28 39 34 34 3d 3d 3d 75 29 7b 65 3d 61 2e 69 6e 64 65 78 4f 66 28 22 3a 22 2c 39 29 2b 31 3b 76 61 72 20 73 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 65 2c 61 2e 6c 65 6e 67 74 68 2d 31 29 2e 74 72 69 6d 28 29 3b 72 65 74 75 72 6e 20 73 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 65 29 2e 74 72 69 6d 28 29 2b 73 2b 22 3b 22 Data Ascii: if(0<1n&&0<t.indexOf("\f"))return t.replace(m,(58===e.charCodeAt(0)?"":"$1")+e.trim())}return e+t}function o(e,t,n,i){var a=e+";",u=2t+3n+4i;if(944===u){e=a.indexOf(":",9)+1;var s=a.substring(e,a.length-1).trim();return s=a.substring(0,e).trim()+s+";"
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 2b 73 2b 61 3b 63 61 73 65 20 31 30 30 35 3a 72 65 74 75 72 6e 20 64 2e 74 65 73 74 28 61 29 3f 61 2e 72 65 70 6c 61 63 65 28 70 2c 22 3a 2d 77 65 62 6b 69 74 2d 22 29 2b 61 2e 72 65 70 6c 61 63 65 28 70 2c 22 3a 2d 6d 6f 7a 2d 22 29 2b 61 3a 61 3b 63 61 73 65 20 31 65 33 3a 73 77 69 74 63 68 28 74 3d 28 73 3d 61 2e 73 75 62 73 74 72 69 6e 67 28 31 33 29 2e 74 72 69 6d 28 29 29 2e 69 6e 64 65 78 4f 66 28 22 2d 22 29 2b 31 2c 73 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2b 73 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 29 7b 63 61 73 65 20 32 32 36 3a 73 3d 61 2e 72 65 70 6c 61 63 65 28 62 2c 22 74 62 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 33 32 3a 73 3d 61 2e 72 65 70 6c 61 63 65 28 62 2c 22 74 62 2d 72 6c 22 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 Data Ascii: +s+a;case 1005:return d.test(a)?a.replace(p,":-webkit-")+a.replace(p,":-moz-")+a:a;case 1e3:switch(t=(s=a.substring(13).trim()).indexOf("-")+1,s.charCodeAt(0)+s.charCodeAt(t)){case 226:s=a.replace(b,"tb");break;case 232:s=a.replace(b,"tb-rl");break;case 2
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 2d 6d 6f 7a 2d 22 2b 73 2e 72 65 70 6c 61 63 65 28 22 66 69 6c 6c 2d 22 2c 22 22 29 29 2b 61 3b 62 72 65 61 6b 3b 63 61 73 65 20 39 36 32 3a 69 66 28 61 3d 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 28 31 30 32 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 35 29 3f 22 2d 6d 73 2d 22 2b 61 3a 22 22 29 2b 61 2c 32 31 31 3d 3d 3d 6e 2b 69 26 26 31 30 35 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 31 33 29 26 26 30 3c 61 2e 69 6e 64 65 78 4f 66 28 22 74 72 61 6e 73 66 6f 72 6d 22 2c 31 30 29 29 72 65 74 75 72 6e 20 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 61 2e 69 6e 64 65 78 4f 66 28 22 3b 22 2c 32 37 29 2b 31 29 2e 72 65 70 6c 61 63 65 28 66 2c 22 24 31 2d 77 65 62 6b 69 74 2d 24 32 22 29 2b 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 72 Data Ascii: -moz-"+s.replace("fill-",""))+a;break;case 962:if(a="-webkit-"+a+(102===a.charCodeAt(5)?"-ms-"+a:"")+a,211===n+i&&105===a.charCodeAt(13)&&0<a.indexOf("transform",10))return a.substring(0,a.indexOf(";",27)+1).replace(f,"$1-webkit-$2")+a}return a}function r
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 2b 2b 4e 3b 4e 3c 55 3b 29 7b 73 77 69 74 63 68 28 68 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 29 29 7b 63 61 73 65 20 31 32 33 3a 6d 2b 2b 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 32 35 3a 6d 2d 2d 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 37 3a 73 77 69 74 63 68 28 68 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 2b 31 29 29 7b 63 61 73 65 20 34 32 3a 63 61 73 65 20 34 37 3a 65 3a 7b 66 6f 72 28 54 3d 4e 2b 31 3b 54 3c 6a 3b 2b 2b 54 29 73 77 69 74 63 68 28 73 2e 63 68 61 72 43 6f 64 65 41 74 28 54 29 29 7b 63 61 73 65 20 34 37 3a 69 66 28 34 32 3d 3d 3d 68 26 26 34 32 3d 3d 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 54 2d 31 29 26 26 4e 2b 32 21 3d 3d 54 29 7b 4e 3d 54 2b 31 3b 62 72 65 61 6b 20 65 7d 62 72 65 61 6b 3b 63 61 73 65 20 31 30 3a 69 66 28 34 Data Ascii: ++N;N<U;){switch(h=s.charCodeAt(N)){case 123:m++;break;case 125:m--;break;case 47:switch(h=s.charCodeAt(N+1)){case 42:case 47:e:{for(T=N+1;T<j;++T)switch(s.charCodeAt(T)){case 47:if(42===h&&42===s.charCodeAt(T-1)&&N+2!==T){N=T+1;break e}break;case 10:if(4
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 6b 7d 64 65 66 61 75 6c 74 3a 35 38 21 3d 3d 48 2e 63 68 61 72 43 6f 64 65 41 74 28 5f 2d 31 29 26 26 28 57 2b 3d 6f 28 48 2c 66 2c 68 2c 48 2e 63 68 61 72 43 6f 64 65 41 74 28 32 29 29 29 7d 42 3d 52 3d 54 3d 66 3d 30 2c 48 3d 22 22 2c 68 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 4e 29 7d 7d 73 77 69 74 63 68 28 68 29 7b 63 61 73 65 20 31 33 3a 63 61 73 65 20 31 30 3a 34 37 3d 3d 3d 78 3f 78 3d 30 3a 30 3d 3d 3d 31 2b 66 26 26 31 30 37 21 3d 3d 70 26 26 30 3c 48 2e 6c 65 6e 67 74 68 26 26 28 52 3d 31 2c 48 2b 3d 22 5c 30 22 29 2c 30 3c 50 2a 56 26 26 61 28 30 2c 48 2c 75 2c 6e 2c 6b 2c 77 2c 57 2e 6c 65 6e 67 74 68 2c 70 2c 64 2c 70 29 2c 77 3d 31 2c 6b 2b 2b 3b 62 72 65 61 6b 3b 63 61 73 65 20 35 39 3a 63 61 73 65 20 31 32 35 3a 69 66 28 30 3d 3d Data Ascii: k}default:58!==H.charCodeAt(_-1)&&(W+=o(H,f,h,H.charCodeAt(2)))}B=R=T=f=0,H="",h=s.charCodeAt(++N)}}switch(h){case 13:case 10:47===x?x=0:0===1+f&&107!==p&&0<H.length&&(R=1,H+="\0"),0<P*V&&a(0,H,u,n,k,w,W.length,p,d,p),w=1,k++;break;case 59:case 125:if(0==
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 31 31 31 3a 57 3d 57 2e 72 65 70 6c 61 63 65 28 45 2c 22 3a 2d 6d 6f 7a 2d 24 31 22 29 2b 57 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 31 32 3a 57 3d 57 2e 72 65 70 6c 61 63 65 28 67 2c 22 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 24 31 22 29 2b 57 2e 72 65 70 6c 61 63 65 28 67 2c 22 3a 3a 2d 6d 6f 7a 2d 24 31 22 29 2b 57 2e 72 65 70 6c 61 63 65 28 67 2c 22 3a 2d 6d 73 2d 69 6e 70 75 74 2d 24 31 22 29 2b 57 7d 46 3d 30 7d 7d 72 65 74 75 72 6e 20 47 2b 57 2b 7a 7d 28 4d 2c 75 2c 6e 2c 30 2c 30 29 3b 72 65 74 75 72 6e 20 30 3c 50 26 26 76 6f 69 64 20 30 21 3d 3d 28 73 3d 61 28 2d 32 2c 70 2c 75 2c 75 2c 6b 2c 77 2c 70 2e 6c 65 6e 67 74 68 2c 30 2c 30 2c 30 29 29 26 26 28 70 3d 73 29 2c 54 3d 22 22 2c 46 3d 30 2c 77 3d 6b 3d 31 2c 70 7d 76 61 72 20 6c 3d Data Ascii: 111:W=W.replace(E,":-moz-$1")+W;break;case 112:W=W.replace(g,"::-webkit-input-$1")+W.replace(g,"::-moz-$1")+W.replace(g,":-ms-input-$1")+W}F=0}}return G+W+z}(M,u,n,0,0);return 0<P&&void 0!==(s=a(-2,p,u,u,k,w,p.length,0,0,0))&&(p=s),T="",F=0,w=k=1,p}var l=
2024-10-24 07:16:23 UTC	1369	IN	Data Raw: 6c 6c 4f 70 61 63 69 74 79 3a 31 2c 66 6c 6f 6f 64 4f 70 61 63 69 74 79 3a 31 2c 73 74 6f 70 4f 70 61 63 69 74 79 3a 31 2c 73 74 72 6f 6b 65 44 61 73 68 61 72 72 61 79 3a 31 2c 73 74 72 6f 6b 65 44 61 73 68 6f 66 66 73 65 74 3a 31 2c 73 74 72 6f 6b 65 4d 69 74 65 72 6c 69 6d 69 74 3a 31 2c 73 74 72 6f 6b 65 4f 70 61 63 69 74 79 3a 31 2c 73 74 72 6f 6b 65 57 69 64 74 68 3a 31 7d 7d 2c 36 32 34 38 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 6e 28 32 33 30 33 37 31 29 2c 72 3d 6e 28 34 30 30 33 36 31 29 2c 69 3d 6e 28 34 37 33 34 35 32 29 2c 61 3d 6e 28 31 38 34 38 32 36 29 2c 75 3d 6e 28 39 39 32 32 37 38 29 2c 73 3d 6e 2e 6e 28 75 29 2c 6c 3d 2f 5b 41 2d 5a 5d 7c 5e 6d 73 2f 67 2c 63 3d Data Ascii: llOpacity:1,floodOpacity:1,stopOpacity:1,strokeDasharray:1,strokeDashoffset:1,strokeMiterlimit:1,strokeOpacity:1,strokeWidth:1}},624813:function(e,t,n){"use strict";var o=n(230371),r=n(400361),i=n(473452),a=n(184826),u=n(992278),s=n.n(u),l=/[A-Z]\|^ms/g,c=
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 74 68 69 73 2e 69 73 53 70 65 65 64 79 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 65 2e 73 68 65 65 74 29 72 65 74 75 72 6e 20 65 2e 73 68 65 65 74 3b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 64 6f 63 75 6d 65 6e 74 2e 73 74 79 6c 65 53 68 65 65 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 69 66 28 64 6f 63 75 6d 65 6e 74 2e 73 74 79 6c 65 53 68 65 65 74 73 5b 74 5d 2e 6f 77 6e 65 72 4e 6f 64 65 3d 3d 3d 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 73 74 79 6c 65 53 68 65 65 74 73 5b 74 5d 7d 28 74 68 69 73 2e 74 61 67 73 5b 74 68 69 73 2e 74 61 67 73 2e 6c 65 6e 67 74 68 2d 31 5d 29 3b 74 72 79 7b 6e 2e 69 6e 73 65 72 74 52 75 6c 65 28 65 2c 6e 2e 63 73 73 52 75 6c 65 73 2e 6c 65 6e 67 74 68 29 7d 63 61 74 63 68 28 65 29 Data Ascii: this.isSpeedy){var n=function(e){if(e.sheet)return e.sheet;for(var t=0;t<document.styleSheets.length;t++)if(document.styleSheets[t].ownerNode===e)return document.styleSheets[t]}(this.tags[this.tags.length-1]);try{n.insertRule(e,n.cssRules.length)}catch(e)
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 6e 29 7b 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 65 5b 6e 5d 3f 76 6f 69 64 20 30 21 3d 3d 76 2e 72 65 67 69 73 74 65 72 65 64 5b 65 5b 6e 5d 5d 3f 74 2b 3d 6e 2b 22 7b 22 2b 76 2e 72 65 67 69 73 74 65 72 65 64 5b 65 5b 6e 5d 5d 2b 22 7d 22 3a 74 2b 3d 63 28 6e 29 2b 22 3a 22 2b 70 28 6e 2c 65 5b 6e 5d 29 2b 22 3b 22 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 5b 6e 5d 29 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 5b 6e 5d 5b 30 5d 26 26 76 6f 69 64 20 30 3d 3d 3d 76 2e 72 65 67 69 73 74 65 72 65 64 5b 65 5b 6e 5d 5b 30 5d 5d 3f 65 5b 6e 5d 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 2b 3d 63 28 6e 29 2b 22 3a 22 2b 70 28 6e 2c 65 29 2b 22 3b 22 7d 29 3a 74 2b 3d 6e 2b 22 7b 22 2b 79 Data Ascii: ction(n){"object"!=typeof e[n]?void 0!==v.registered[e[n]]?t+=n+"{"+v.registered[e[n]]+"}":t+=c(n)+":"+p(n,e[n])+";":Array.isArray(e[n])&&"string"==typeof e[n][0]&&void 0===v.registered[e[n][0]]?e[n].forEach(function(e){t+=c(n)+":"+p(n,e)+";"}):t+=n+"{"+y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.10	49799	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	745	OUT	GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: application/javascript Content-Length: 13374 Connection: close CF-Ray: 8d782e652dc44692-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d0c788b157ff96a2dd902c97bfc889f6" Last-Modified: Fri, 28 Jun 2024 00:43:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I3QlbjrG7UZsWFU5rQKDVH6U14fQuwpx0v4jyfQXOltwaVVjkNPQC2nAr254QD9ckBDwgyRHzBgx0XwAyMGQ4UcnTf9riT1DlVWO1rzmHEV%2B7CbK3Sc7CJbCxyiR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	404	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 38 31 38 37 22 5d 2c 7b 35 32 36 39 38 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 7d 2c 32 34 30 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 29 2c 6f 3d 72 28 39 38 30 38 35 35 29 2c 69 3d 72 28 34 39 36 39 33 29 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 75 29 7b 76 61 72 20 63 2c 66 3d 65 28 6e 29 2c 61 3d 69 28 66 29 2c 73 3d 6f 28 75 2c 61 29 3b 69 66 28 74 26 26 72 21 3d 72 29 7b 66 6f 72 28 3b 61 3e 73 3b 29 69 66 28 28 63 3d 66 5b 73 2b 2b 5d 29 21 3d 63 29 72 65 74 75 72 6e 21 30 7d 65 6c 73 65 20 66 6f 72 28 3b 61 3e 73 3b 73 2b 2b 29 69 66 28 28 74 7c 7c 73 20 69 6e 20 66 29 26 26 66 5b 73 5d 3d 3d 3d 72 29 72 65 74 75 72 6e 20 74 7c 7c 73 7c 7c 30 3b 72 65 74 75 72 6e 21 74 26 26 2d 31 7d 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 7b 69 6e 63 6c 75 64 65 73 3a 75 28 21 30 29 2c 69 6e 64 65 78 4f 66 3a 75 28 21 31 29 7d 7d 2c 33 Data Ascii: ),o=r(980855),i=r(49693),u=function(t){return function(n,r,u){var c,f=e(n),a=i(f),s=o(u,a);if(t&&r!=r){for(;a>s;)if((c=f[s++])!=c)return!0}else for(;a>s;s++)if((t\|\|s in f)&&f[s]===r)return t\|\|s\|\|0;return!t&&-1}};t.exports={includes:u(!0),indexOf:u(!1)}},3
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 74 72 79 7b 6f 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 7d 63 61 74 63 68 28 72 29 7b 65 5b 74 5d 3d 6e 7d 72 65 74 75 72 6e 20 6e 7d 7d 2c 33 32 35 30 30 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 37 21 3d 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 7b 7d 2c 31 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 Data Ascii: =r(161581),o=Object.defineProperty;t.exports=function(t,n){try{o(e,t,{value:n,configurable:!0,writable:!0})}catch(r){e[t]=n}return n}},325008:function(t,n,r){var e=r(936940);t.exports=!e(function(){return 7!==Object.defineProperty({},1,{get:function(){ret
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 30 21 3d 3d 70 29 7b 69 66 28 74 79 70 65 6f 66 20 6c 3d 3d 74 79 70 65 6f 66 20 70 29 63 6f 6e 74 69 6e 75 65 3b 66 28 6c 2c 70 29 7d 28 74 2e 73 68 61 6d 7c 7c 70 26 26 70 2e 73 68 61 6d 29 26 26 69 28 6c 2c 22 73 68 61 6d 22 2c 21 30 29 2c 75 28 72 2c 73 2c 6c 2c 74 29 7d 7d 7d 2c 39 33 36 39 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 72 65 74 75 72 6e 21 21 74 28 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 21 30 7d 7d 7d 2c 39 36 32 35 35 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d Data Ascii: 0!==p){if(typeof l==typeof p)continue;f(l,p)}(t.sham\|\|p&&p.sham)&&i(l,"sham",!0),u(r,s,l,t)}}},936940:function(t){t.exports=function(t){try{return!!t()}catch(t){return!0}}},962557:function(t,n,r){var e=r(936940);t.exports=!e(function(){var t=(function(){}
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 2c 37 34 30 33 36 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 38 31 30 33 31 29 2c 6f 3d 72 28 33 33 39 37 31 38 29 2c 69 3d 65 28 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 29 3b 74 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 68 61 73 4f 77 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 69 28 6f 28 74 29 2c 6e 29 7d 7d 2c 36 32 34 39 30 36 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 33 34 39 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 2c 69 3d 72 28 37 32 32 30 36 33 29 3b 74 Data Ascii: Function("return this")()},740362:function(t,n,r){var e=r(581031),o=r(339718),i=e({}.hasOwnProperty);t.exports=Object.hasOwn\|\|function(t,n){return i(o(t),n)}},624906:function(t){t.exports={}},34924:function(t,n,r){var e=r(325008),o=r(936940),i=r(722063);t
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 74 29 3a 65 28 74 2c 7b 7d 29 7d 2c 67 65 74 74 65 72 46 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 72 3b 69 66 28 21 66 28 6e 29 7c 7c 28 72 3d 6f 28 6e 29 29 2e 74 79 70 65 21 3d 3d 74 29 74 68 72 6f 77 20 79 28 22 49 6e 63 6f 6d 70 61 74 69 62 6c 65 20 72 65 63 65 69 76 65 72 2c 20 22 2b 74 2b 22 20 72 65 71 75 69 72 65 64 22 29 3b 72 65 74 75 72 6e 20 72 7d 7d 7d 7d 2c 33 35 34 38 34 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 37 34 31 32 34 29 2c 6f 3d 65 2e 61 6c 6c 3b 74 2e 65 78 70 6f 72 74 73 3d 65 2e 49 53 5f 48 54 4d 4c 44 44 41 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 Data Ascii: t):e(t,{})},getterFor:function(t){return function(n){var r;if(!f(n)\|\|(r=o(n)).type!==t)throw y("Incompatible receiver, "+t+" required");return r}}}},354848:function(t,n,r){var e=r(174124),o=e.all;t.exports=e.IS_HTMLDDA?function(t){return"function"==typeof
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6e 29 2c 6d 3d 63 26 26 21 6f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 38 21 3d 3d 62 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 22 6c 65 6e 67 74 68 22 2c 7b 76 61 6c 75 65 3a 38 7d 29 2e 6c 65 6e 67 74 68 7d 29 2c 78 3d 53 74 72 69 6e 67 28 53 74 72 69 6e 67 29 2e 73 70 6c 69 74 28 22 53 74 72 69 6e 67 22 29 2c 64 3d 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 22 53 79 6d 62 6f 6c 28 22 3d 3d 3d 79 28 76 28 6e 29 2c 30 2c 37 29 26 26 28 6e 3d 22 5b 22 2b 67 28 76 28 6e 29 2c 2f 5e 53 79 6d 62 6f 6c 5c 28 28 5b 5e 29 5d 2a 29 5c 29 2f 2c 22 24 31 22 29 2b 22 5d 22 29 2c 72 26 26 72 2e 67 65 74 74 65 72 26 26 28 6e 3d 22 67 65 74 20 22 2b 6e 29 2c 72 26 26 72 2e 73 65 74 74 65 72 26 26 28 6e 3d 22 73 65 74 Data Ascii: n),m=c&&!o(function(){return 8!==b(function(){},"length",{value:8}).length}),x=String(String).split("String"),d=t.exports=function(t,n,r){"Symbol("===y(v(n),0,7)&&(n="["+g(v(n),/^Symbol$([^)]*)$/,"$1")+"]"),r&&r.getter&&(n="get "+n),r&&r.setter&&(n="set
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 20 73 75 70 70 6f 72 74 65 64 22 29 3b 72 65 74 75 72 6e 22 76 61 6c 75 65 22 69 6e 20 72 26 26 28 74 5b 6e 5d 3d 72 2e 76 61 6c 75 65 29 2c 74 7d 7d 2c 33 34 37 37 32 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 32 36 35 31 35 29 2c 69 3d 72 28 36 31 30 30 36 37 29 2c 75 3d 72 28 38 37 39 29 2c 63 3d 72 28 32 39 39 36 32 33 29 2c 66 3d 72 28 39 36 36 36 30 36 29 2c 61 3d 72 28 37 34 30 33 36 32 29 2c 73 3d 72 28 33 34 39 32 34 29 2c 70 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 3b 6e 2e 66 3d 65 3f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 74 3d 63 28 74 29 2c 6e 3d 66 28 6e 29 2c 73 29 74 72 79 7b 72 65 74 75 72 6e Data Ascii: supported");return"value"in r&&(t[n]=r.value),t}},347722:function(t,n,r){var e=r(325008),o=r(926515),i=r(610067),u=r(879),c=r(299623),f=r(966606),a=r(740362),s=r(34924),p=Object.getOwnPropertyDescriptor;n.f=e?p:function(t,n){if(t=c(t),n=f(n),s)try{return
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 33 33 29 2c 66 3d 6f 28 5b 5d 2e 63 6f 6e 63 61 74 29 3b 74 2e 65 78 70 6f 72 74 73 3d 65 28 22 52 65 66 6c 65 63 74 22 2c 22 6f 77 6e 4b 65 79 73 22 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 69 2e 66 28 63 28 74 29 29 2c 72 3d 75 2e 66 3b 72 65 74 75 72 6e 20 72 3f 66 28 6e 2c 72 28 74 29 29 3a 6e 7d 7d 2c 36 37 36 31 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 31 37 39 29 2c 6f 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 74 68 72 6f 77 20 6f 28 22 43 61 6e 27 74 20 63 61 6c 6c 20 6d 65 74 68 6f 64 20 6f 6e 20 22 2b 74 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 38 38 33 35 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e Data Ascii: 33),f=o([].concat);t.exports=e("Reflect","ownKeys")\|\|function(t){var n=i.f(c(t)),r=u.f;return r?f(n,r(t)):n}},676125:function(t,n,r){var e=r(35179),o=TypeError;t.exports=function(t){if(e(t))throw o("Can't call method on "+t);return t}},883539:function(t,n
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 72 28 39 35 39 33 31 38 29 2c 6f 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3e 30 3f 6f 28 65 28 74 29 2c 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 31 29 3a 30 7d 7d 2c 33 33 39 37 31 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 36 37 36 31 32 35 29 2c 6f 3d 4f 62 6a 65 63 74 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 28 65 28 74 29 29 7d 7d 2c 36 39 31 35 35 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 32 36 35 31 35 29 2c 6f 3d 72 28 36 32 32 32 38 31 29 2c 69 3d 72 28 33 32 33 39 37 39 29 2c 75 3d 72 28 39 39 35 37 33 39 29 2c 63 3d 72 28 33 33 37 38 35 36 Data Ascii: r(959318),o=Math.min;t.exports=function(t){return t>0?o(e(t),9007199254740991):0}},339718:function(t,n,r){var e=r(676125),o=Object;t.exports=function(t){return o(e(t))}},691558:function(t,n,r){var e=r(926515),o=r(622281),i=r(323979),u=r(995739),c=r(337856

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.10	49800	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	1686	OUT	POST /api/v9/science HTTP/1.1 Host: discord.com Connection: keep-alive Content-Length: 1122 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Fingerprint: 1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-Vlk X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York Content-Type: application/json X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Origin: https://discord.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	1122	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 75 73 65 72 5f 66 69 6e 67 65 72 70 72 69 6e 74 5f 63 68 61 6e 67 65 64 22 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 63 6c 69 65 6e 74 5f 74 72 61 63 6b 5f 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 32 39 37 35 34 31 38 33 30 33 36 2c 22 6f 6c 64 5f 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 6e 75 6c 6c 2c 22 6e 65 77 5f 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 33 33 30 36 38 37 35 35 30 31 35 22 2c 22 63 6c 69 65 6e 74 5f 70 65 72 66 6f 72 6d 61 6e 63 65 5f 6d 65 6d 6f 72 79 22 3a 30 2c 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 66 65 61 74 75 72 65 73 22 3a 31 32 38 2c 22 72 65 6e 64 65 72 65 64 5f 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 55 53 22 2c 22 75 70 74 69 6d 65 5f Data Ascii: {"events":[{"type":"user_fingerprint_changed","properties":{"client_track_timestamp":1729754183036,"old_fingerprint":null,"new_fingerprint":"1298907933068755015","client_performance_memory":0,"accessibility_features":128,"rendered_locale":"en-US","uptime_
2024-10-24 07:16:24 UTC	842	IN	HTTP/1.1 401 Unauthorized Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Length: 0 Connection: close vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-origin: https://discord.com via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2BR7iMTa%2F4VkD2vLdyOE1EUBcQ3Fvi6CAy96XUioJPpYXxRD90StVtOwTA1Rk7C6G2VyZKfqY1z6oLmUlaw9dXfoe8gIGWlgCOCJ8xpPekpFKefvgbkPo9b8uqmb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e65a8f46be9-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.10	49802	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	1685	OUT	POST /api/v9/science HTTP/1.1 Host: discord.com Connection: keep-alive Content-Length: 720 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Super-Properties: eyJvcyI6IldpbmRvd3MiLCJicm93c2VyIjoiQ2hyb21lIiwiZGV2aWNlIjoiIiwic3lzdGVtX2xvY2FsZSI6ImVuLVVTIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExNy4wLjAuMCBTYWZhcmkvNTM3LjM2IiwiYnJvd3Nlcl92ZXJzaW9uIjoiMTE3LjAuMC4wIiwib3NfdmVyc2lvbiI6IjEwIiwicmVmZXJyZXIiOiIiLCJyZWZlcnJpbmdfZG9tYWluIjoiIiwicmVmZXJyZXJfY3VycmVudCI6IiIsInJlZmVycmluZ19kb21haW5fY3VycmVudCI6IiIsInJlbGVhc2VfY2hhbm5lbCI6InN0YWJsZSIsImNsaWVudF9idWlsZF9udW1iZXIiOjMzODU0MCwiY2xpZW50X2V2ZW50X3NvdXJjZSI6bnVsbH0= X-Fingerprint: 1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-Vlk X-Debug-Options: bugReporterEnabled sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Discord-Timezone: America/New_York Content-Type: application/json X-Discord-Locale: en-US sec-ch-ua-platform: "Windows" Accept: / Origin: https://discord.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	720	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 65 78 70 65 72 69 6d 65 6e 74 5f 75 73 65 72 5f 74 72 69 67 67 65 72 65 64 22 2c 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 33 33 30 36 38 37 35 35 30 31 35 2e 72 31 69 34 72 61 54 6a 30 6b 70 30 4a 39 44 38 6c 33 62 52 49 38 77 2d 56 6c 6b 22 2c 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 63 6c 69 65 6e 74 5f 74 72 61 63 6b 5f 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 32 39 37 35 34 31 38 33 30 35 31 2c 22 6e 61 6d 65 22 3a 22 32 30 32 33 2d 30 39 5f 72 65 64 65 73 69 67 6e 65 64 5f 69 63 6f 6e 73 5f 65 78 70 65 72 69 6d 65 6e 74 22 2c 22 72 65 76 69 73 69 6f 6e 22 3a 31 2c 22 70 6f 70 75 6c 61 74 69 6f 6e 22 3a 30 2c 22 62 75 63 6b 65 74 22 3a 31 2c 22 6c 6f 63 61 74 69 Data Ascii: {"events":[{"type":"experiment_user_triggered","fingerprint":"1298907933068755015.r1i4raTj0kp0J9D8l3bRI8w-Vlk","properties":{"client_track_timestamp":1729754183051,"name":"2023-09_redesigned_icons_experiment","revision":1,"population":0,"bucket":1,"locati
2024-10-24 07:16:24 UTC	844	IN	HTTP/1.1 401 Unauthorized Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Length: 0 Connection: close vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers access-control-allow-origin: https://discord.com via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mn2dIGkJBJyBbpz7u9O%2F9e4rclvLPk5FINhc37a92hWhysdL4m6GVJxmquZsdcxC4N5eKCOhfOwOMpyzHjmP11MDDTN7XpEPMe%2B0KbAnpU9Thh4WPdzRnEZ%2F1w03"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e65df896c1c-DFW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.10	49801	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	673	OUT	GET /assets/ac625b77a0bab0ee72df.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: application/javascript Content-Length: 3530 Connection: close CF-Ray: 8d782e65e8356c58-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "be6064ff8c1d480afb80fe48762a06c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9y6WcYMlpprjBXdZZo4FErenWI5XRMTM3pp3jK9PcM%2F9Dri2e9TOwiyNAQmb3xuEDq4kxY47wLGoy0YLtuFkgRA0R7X2lSXUho%2BYDiHvy3fUxjXzcC2OEEXPBaRO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	403	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 35 30 34 30 35 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 65 29 7b 65 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 65 28 35 31 38 32 36 33 29 2c 65 28 39 37 30 31 37 33 29 2c 65 28 35 32 30 37 31 32 29 2c 65 28 32 36 38 31 31 31 29 2c 65 28 39 34 31 34 39 37 29 2c 65 28 33 32 30 32 36 29 2c 65 28 34 38 30 38 33 39 29 2c 65 28 37 34 34 32 38 35 29 2c 65 28 34 39 32 32 35 37 29 2c 65 28 38 37 33 38 31 37 29 2c 65 28 38 36 33 39 34 32 29 2c 65 28 36 34 32 35 34 39 29 2c 65 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 3d 65 28 37 38 38 39 30 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 72 29 7b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{"use strict";var r={504053:function(r,t,e){e.d(t,{F:function(){return o}}),e(518263),e(970173),e(520712),e(268111),e(941497),e(32026),e(480839),e(744285),e(492257),e(873817),e(863942),e(642549),e(653041);var n=e(788900);function o(r){let t=function(
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 73 3d 28 36 33 26 63 29 2f 36 33 2c 70 3d 28 63 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 64 3d 28 63 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 76 3d 63 3e 3e 32 33 2c 68 3d 6c 3e 3e 31 35 2c 62 3d 69 28 33 2c 68 3f 76 3f 35 3a 37 3a 37 26 6c 29 2c 67 3d 69 28 33 2c 68 3f 37 26 6c 3a 76 3f 35 3a 37 29 2c 79 3d 76 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 76 3f 36 3a 35 2c 77 3d 30 2c 78 3d 28 74 2c 65 2c 6e 29 3d 3e 7b 6c 65 74 20 6f 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 66 3d 30 3b 66 3c 65 3b 66 2b 2b 29 66 6f 72 28 6c 65 74 20 69 3d 66 3f 30 3a 31 3b 69 2a 65 3c 74 2a 28 65 2d 66 29 3b 69 2b 2b 29 6f 2e 70 75 73 68 28 28 28 72 5b 6d 2b 28 77 3e 3e Data Ascii: =r[3]\|r[4]<<8,s=(63&c)/63,p=(c>>6&63)/31.5-1,d=(c>>12&63)/31.5-1,v=c>>23,h=l>>15,b=i(3,h?v?5:7:7&l),g=i(3,h?7&l:v?5:7),y=v?(15&r[5])/15:1,O=(r[5]>>4)/15,m=v?6:5,w=0,x=(t,e,n)=>{let o=[];for(let f=0;f<e;f++)for(let i=f?0:1;ie<t(e-f);i++)o.push(((r[m+(w>>
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 74 5b 6e 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 6f 29 72 65 74 75 72 6e 20 6f 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 66 3d 74 5b 6e 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 72 5b 6e 5d 2e 63 61 6c 6c 28 66 2e 65 78 70 6f 72 74 73 2c 66 2c 66 2e 65 78 70 6f 72 74 73 2c 65 29 2c 66 2e 65 78 70 6f 72 74 73 7d 65 2e 6d 3d 72 2c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 65 2e 4f 28 76 6f 69 64 20 30 2c 5b 22 37 38 31 38 37 22 2c 22 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 22 31 37 31 37 31 36 22 29 7d 29 3b 72 65 74 75 72 6e 20 72 3d 65 2e 4f 28 72 29 7d 2c 65 2e 6e 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 72 26 26 72 2e 5f 5f 65 Data Ascii: t[n];if(void 0!==o)return o.exports;var f=t[n]={exports:{}};return r[n].call(f.exports,f,f.exports,e),f.exports}e.m=r,e.x=function(){var r=e.O(void 0,["78187","71984","43222"],function(){return e("171716")});return r=e.O(r)},e.n=function(r){var t=r&&r.__e
2024-10-24 07:16:24 UTC	389	IN	Data Raw: 37 31 39 38 34 22 2c 22 34 33 32 32 32 22 5d 2e 6d 61 70 28 65 2e 65 2c 65 29 29 2e 74 68 65 6e 28 72 29 7d 7d 29 28 29 2c 28 28 29 3d 3e 7b 76 61 72 20 72 3d 7b 37 37 34 35 39 3a 31 7d 3b 65 2e 66 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 21 72 5b 74 5d 26 26 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 65 2e 70 2b 65 2e 75 28 74 29 29 7d 3b 76 61 72 20 74 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 2c 6e 3d 74 2e 70 75 73 68 2e 62 69 6e 64 28 74 29 3b 74 2e 70 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6f 3d 74 5b 30 5d 2c 66 3d 74 5b 31 5d 2c 69 3d 74 5b 32 5d 3b 66 6f 72 28 76 61 72 20 75 Data Ascii: 71984","43222"].map(e.e,e)).then(r)}})(),(()=>{var r={77459:1};e.f.i=function(t,n){!r[t]&&importScripts(e.p+e.u(t))};var t=this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[],n=t.push.bind(t);t.push=function(t){var o=t[0],f=t[1],i=t[2];for(var u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.10	49808	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/1f7f046253c197b5a419.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	974	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/javascript Content-Length: 17462 Connection: close CF-Ray: 8d782e660e0a4678-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "3b98c1ef9293d482a5099fdb6984946f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wqFaQx19YRv34M7lMHb8oWAN0FJ%2Bh%2F%2B8ZpAoOxKDF%2B5nAOoXtHoTpjS7vzKTu9oa5NYUnpgxYkQD7gH%2FHKXE6IKcNiuz0%2BSIWbaDiw8IFJOWpqUIPnp19D%2BX%2B%2FUK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 35 38 31 32 22 5d 2c 7b 38 38 34 38 33 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 72 28 33 31 31 35 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 7d 69 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 6e 2c 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 72 2c 6e 2c 69 2c 61 29 7b 69 66 28 61 21 3d 3d 6f 29 7b 76 61 72 20 75 3d 45 72 72 6f 72 28 22 43 61 6c 6c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Call
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 65 6e 67 74 68 7d 2c 70 75 74 42 69 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 6c 65 6e 67 74 68 2f 38 29 3b 74 68 69 73 2e 62 75 66 66 65 72 2e 6c 65 6e 67 74 68 3c 3d 65 26 26 74 68 69 73 2e 62 75 66 66 65 72 2e 70 75 73 68 28 30 29 2c 74 26 26 28 74 68 69 73 2e 62 75 66 66 65 72 5b 65 5d 7c 3d 31 32 38 3e 3e 3e 74 68 69 73 2e 6c 65 6e 67 74 68 25 38 29 2c 74 68 69 73 2e 6c 65 6e 67 74 68 2b 2b 7d 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 65 7d 2c 39 33 33 39 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 4c 3a 31 2c 4d 3a 30 2c 51 3a 33 2c 48 3a 32 7d 7d 2c 36 36 39 30 31 33 3a 66 75 6e 63 Data Ascii: :function(){return this.length},putBit:function(t){var e=Math.floor(this.length/8);this.buffer.length<=e&&this.buffer.push(0),t&&(this.buffer[e]\|=128>>>this.length%8),this.length++}},t.exports=e},933982:function(t){t.exports={L:1,M:0,Q:3,H:2}},669013:func
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 74 7c 7c 65 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 74 2b 22 2c 22 2b 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 5d 5b 65 5d 7d 2c 6c 2e 67 65 74 4d 6f 64 75 6c 65 43 6f 75 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 7d 2c 6c 2e 6d 61 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 74 79 70 65 4e 75 6d 62 65 72 3c 31 29 7b 76 61 72 20 74 3d 31 3b 66 6f 72 28 74 3d 31 3b 74 3c 34 30 3b 74 2b 2b 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 67 65 74 52 53 42 6c 6f Data Ascii: function(t,e){if(t<0\|\|this.moduleCount<=t\|\|e<0\|\|this.moduleCount<=e)throw Error(t+","+e);return this.modules[t][e]},l.getModuleCount=function(){return this.moduleCount},l.make=function(){if(this.typeNumber<1){var t=1;for(t=1;t<40;t++){for(var e=n.getRSBlo
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 3c 3d 65 2b 6f 29 26 26 28 30 3c 3d 72 26 26 72 3c 3d 36 26 26 28 30 3d 3d 6f 7c 7c 36 3d 3d 6f 29 7c 7c 30 3c 3d 6f 26 26 6f 3c 3d 36 26 26 28 30 3d 3d 72 7c 7c 36 3d 3d 72 29 7c 7c 32 3c 3d 72 26 26 72 3c 3d 34 26 26 32 3c 3d 6f 26 26 6f 3c 3d 34 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 30 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 31 29 7d 2c 6c 2e 67 65 74 42 65 73 74 4d 61 73 6b 50 61 74 74 65 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 65 3d 30 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 74 68 69 73 2e 6d 61 6b 65 49 6d 70 6c 28 21 30 2c 72 29 3b 76 61 72 20 6f 3d 61 2e 67 65 74 4c 6f 73 74 50 6f 69 6e 74 28 74 68 69 73 29 3b 28 30 3d 3d 72 7c 7c 74 3e Data Ascii: <=e+o)&&(0<=r&&r<=6&&(0==o\|\|6==o)\|\|0<=o&&o<=6&&(0==r\|\|6==r)\|\|2<=r&&r<=4&&2<=o&&o<=4?this.modules[t+r][e+o]=!0:this.modules[t+r][e+o]=!1)},l.getBestMaskPattern=function(){for(var t=0,e=0,r=0;r<8;r++){this.makeImpl(!0,r);var o=a.getLostPoint(this);(0==r\|\|t>
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 5d 5b 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 33 29 5d 3d 6f 7d 7d 2c 6c 2e 73 65 74 75 70 54 79 70 65 49 6e 66 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 68 69 73 2e 65 72 72 6f 72 43 6f 72 72 65 63 74 4c 65 76 65 6c 3c 3c 33 7c 65 2c 6f 3d 61 2e 67 65 74 42 43 48 54 79 70 65 49 6e 66 6f 28 72 29 2c 6e 3d 30 3b 6e 3c 31 35 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 21 74 26 26 28 6f 3e 3e 6e 26 31 29 3d 3d 31 3b 6e 3c 36 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 38 5d 3d 69 3a 6e 3c 38 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 2b 31 5d 5b 38 5d 3d 69 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 31 35 2b 6e 5d 5b 38 5d 3d 69 7d 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e Data Ascii: ][Math.floor(r/3)]=o}},l.setupTypeInfo=function(t,e){for(var r=this.errorCorrectLevel<<3\|e,o=a.getBCHTypeInfo(r),n=0;n<15;n++){var i=!t&&(o>>n&1)==1;n<6?this.modules[n][8]=i:n<8?this.modules[n+1][8]=i:this.modules[this.moduleCount-15+n][8]=i}for(var n=0;n
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 74 68 29 2c 73 3d 41 72 72 61 79 28 65 2e 6c 65 6e 67 74 68 29 2c 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 66 3d 65 5b 6c 5d 2e 64 61 74 61 43 6f 75 6e 74 2c 68 3d 65 5b 6c 5d 2e 74 6f 74 61 6c 43 6f 75 6e 74 2d 66 3b 6f 3d 4d 61 74 68 2e 6d 61 78 28 6f 2c 66 29 2c 6e 3d 4d 61 74 68 2e 6d 61 78 28 6e 2c 68 29 2c 69 5b 6c 5d 3d 41 72 72 61 79 28 66 29 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 69 5b 6c 5d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 69 5b 6c 5d 5b 67 5d 3d 32 35 35 26 74 2e 62 75 66 66 65 72 5b 67 2b 72 5d 3b 72 2b 3d 66 3b 76 61 72 20 63 3d 61 2e 67 65 74 45 72 72 6f 72 43 6f 72 72 65 63 74 50 6f 6c 79 6e 6f 6d 69 61 6c 28 68 29 2c 64 3d 6e 65 77 20 75 28 69 5b 6c 5d 2c 63 2e 67 65 74 4c 65 6e 67 74 68 28 29 2d 31 Data Ascii: th),s=Array(e.length),l=0;l<e.length;l++){var f=e[l].dataCount,h=e[l].totalCount-f;o=Math.max(o,f),n=Math.max(n,h),i[l]=Array(f);for(var g=0;g<i[l].length;g++)i[l][g]=255&t.buffer[g+r];r+=f;var c=a.getErrorCorrectPolynomial(h),d=new u(i[l],c.getLength()-1
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 32 31 5d 2c 5b 37 2c 34 32 2c 31 34 2c 34 2c 34 33 2c 31 35 5d 2c 5b 34 2c 31 33 33 2c 31 30 37 5d 2c 5b 38 2c 35 39 2c 33 37 2c 31 2c 36 30 2c 33 38 5d 2c 5b 38 2c 34 34 2c 32 30 2c 34 2c 34 35 2c 32 31 5d 2c 5b 31 32 2c 33 33 2c 31 31 2c 34 2c 33 34 2c 31 32 5d 2c 5b 33 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 34 2c 36 34 2c 34 30 2c 35 2c 36 35 2c 34 31 5d 2c 5b 31 31 2c 33 36 2c 31 36 2c 35 2c 33 37 2c 31 37 5d 2c 5b 31 31 2c 33 36 2c 31 32 2c 35 2c 33 37 2c 31 33 5d 2c 5b 35 2c 31 30 39 2c 38 37 2c 31 2c 31 31 30 2c 38 38 5d 2c 5b 35 2c 36 35 2c 34 31 2c 35 2c 36 36 2c 34 32 5d 2c 5b 35 2c 35 34 2c 32 34 2c 37 2c 35 35 2c 32 35 5d 2c 5b 31 31 2c 33 36 2c 31 32 5d 2c 5b 35 2c 31 32 32 2c 39 38 2c 31 2c 31 32 33 2c 39 39 5d 2c 5b Data Ascii: 21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12],[5,122,98,1,123,99],[
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 35 34 2c 32 34 2c 32 35 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 35 2c 34 36 2c 31 36 5d 2c 5b 31 33 2c 31 34 35 2c 31 31 35 2c 33 2c 31 34 36 2c 31 31 36 5d 2c 5b 32 2c 37 34 2c 34 36 2c 32 39 2c 37 35 2c 34 37 5d 2c 5b 34 32 2c 35 34 2c 32 34 2c 31 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 38 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 5d 2c 5b 31 30 2c 37 34 2c 34 36 2c 32 33 2c 37 35 2c 34 37 5d 2c 5b 31 30 2c 35 34 2c 32 34 2c 33 35 2c 35 35 2c 32 35 5d 2c 5b 31 39 2c 34 35 2c 31 35 2c 33 35 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 31 34 2c 37 34 2c 34 36 2c 32 31 2c 37 35 2c 34 37 5d 2c 5b 32 39 2c 35 34 2c 32 34 2c 31 39 2c 35 35 2c 32 35 5d 2c 5b 31 Data Ascii: 54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,55,25],[1
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 67 6c 6f 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 3c 31 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 6c 6f 67 28 22 2b 74 2b 22 29 22 29 3b 72 65 74 75 72 6e 20 65 2e 4c 4f 47 5f 54 41 42 4c 45 5b 74 5d 7d 2c 67 65 78 70 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 3b 74 3c 30 3b 29 74 2b 3d 32 35 35 3b 66 6f 72 28 3b 74 3e 3d 32 35 36 3b 29 74 2d 3d 32 35 35 3b 72 65 74 75 72 6e 20 65 2e 45 58 50 5f 54 41 42 4c 45 5b 74 5d 7d 2c 45 58 50 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 2c 4c 4f 47 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 7d 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 65 2e 45 58 50 5f 54 41 42 4c 45 5b 72 5d 3d 31 3c 3c 72 3b 66 6f 72 28 76 61 72 20 72 3d 38 Data Ascii: ion(t){for(var e={glog:function(t){if(t<1)throw Error("glog("+t+")");return e.LOG_TABLE[t]},gexp:function(t){for(;t<0;)t+=255;for(;t>=256;)t-=255;return e.EXP_TABLE[t]},EXP_TABLE:Array(256),LOG_TABLE:Array(256)},r=0;r<8;r++)e.EXP_TABLE[r]=1<<r;for(var r=8
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 30 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 35 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3b 72 65 74 75 72 6e 28 74 3c 3c 31 30 7c 65 29 5e 75 2e 47 31 35 5f 4d 41 53 4b 7d 2c 67 65 74 42 43 48 54 79 70 65 4e 75 6d 62 65 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 32 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 38 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 38 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 Data Ascii: ction(t){for(var e=t<<10;u.getBCHDigit(e)-u.getBCHDigit(u.G15)>=0;)e^=u.G15<<u.getBCHDigit(e)-u.getBCHDigit(u.G15);return(t<<10\|e)^u.G15_MASK},getBCHTypeNumber:function(t){for(var e=t<<12;u.getBCHDigit(e)-u.getBCHDigit(u.G18)>=0;)e^=u.G18<<u.getBCHDigit(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.10	49809	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	673	OUT	GET /assets/29a63f12209c956d9204.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	972	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: application/javascript Content-Length: 2750 Connection: close CF-Ray: 8d782e660b864650-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "390a7ab1f964aa8cb1b87dd13732c3bc" Last-Modified: Tue, 30 Jul 2024 22:07:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rw9ZuYVqOrjUz2Z1bgNd7%2FRLSJCDOCvEcrno2wji%2BPC%2BZiedZEXYtxgx9TJBTn0ysDfvi78H8ZNWhCHxYlbOrca142ZFFne6ctjRsypQ8%2BzsCD%2FQVshMIqTiX9TX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	397	IN	Data Raw: 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 74 3d 7b 31 33 37 39 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 69 3b 6e 2e 64 28 72 2c 7b 4a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 7d 29 2c 28 69 3d 65 7c 7c 28 65 3d 7b 7d 29 29 5b 69 2e 4e 4f 4e 45 3d 30 5d 3d 22 4e 4f 4e 45 22 2c 69 5b 69 2e 53 4f 43 49 41 4c 3d 31 5d 3d 22 53 4f 43 49 41 4c 22 2c 69 5b 69 2e 43 41 53 55 41 4c 3d 32 5d 3d 22 43 41 53 55 41 4c 22 2c 69 5b 69 2e 43 4f 4d 50 45 54 49 54 49 56 45 3d 33 5d 3d 22 43 4f 4d 50 45 54 49 54 49 56 45 22 2c 69 5b 69 2e 43 52 45 41 54 49 56 45 3d 34 5d 3d 22 43 52 45 41 54 49 56 45 22 2c 69 5b 69 2e 56 45 Data Ascii: (()=>{"use strict";var t={137920:function(t,r,n){var e,i;n.d(r,{J:function(){return u},z:function(){return e}}),(i=e\|\|(e={}))[i.NONE=0]="NONE",i[i.SOCIAL=1]="SOCIAL",i[i.CASUAL=2]="CASUAL",i[i.COMPETITIVE=3]="COMPETITIVE",i[i.CREATIVE=4]="CREATIVE",i[i.VE
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 65 3d 6e 28 31 33 37 39 32 30 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 74 2c 72 29 7b 6c 65 74 20 6e 3d 30 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 2e 67 61 6d 65 73 26 26 28 6e 2b 3d 32 2a 72 2e 67 61 6d 65 73 2e 66 69 6c 74 65 72 28 72 3d 3e 74 2e 67 61 6d 65 73 2e 69 6e 63 6c 75 64 65 73 28 72 29 29 2e 6c 65 6e 67 74 68 29 2c 6e 75 6c 6c 21 3d 72 2e 70 6c 61 79 73 74 79 6c 65 26 26 28 72 2e 70 6c 61 79 73 74 79 6c 65 3d 3d 3d 74 2e 70 6c 61 79 73 74 79 6c 65 3f 6e 2b 3d 32 3a 65 2e 4a 5b 74 2e 70 6c 61 79 73 74 79 6c 65 5d 3d 3d 3d 65 2e 4a 5b 72 2e 70 6c 61 79 73 74 79 6c 65 5d 26 26 28 6e 2b 3d 31 29 29 2c 6e 75 6c 6c 21 3d 72 2e 74 72 61 69 74 73 26 26 28 6e 2b Data Ascii: y:function(){return i}});var e=n(137920);function i(t,r){let n=0;return null!=r.games&&(n+=2*r.games.filter(r=>t.games.includes(r)).length),null!=r.playstyle&&(r.playstyle===t.playstyle?n+=2:e.J[t.playstyle]===e.J[r.playstyle]&&(n+=1)),null!=r.traits&&(n+
2024-10-24 07:16:24 UTC	984	IN	Data Raw: 68 69 73 3b 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 22 29 28 29 7d 63 61 74 63 68 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 29 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 7d 7d 28 29 2c 6e 2e 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 7d 2c 28 28 29 3d 3e 7b 76 61 72 20 74 3d 5b 5d 3b 6e 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 72 2c 65 2c 69 2c 75 29 7b 69 66 28 65 29 7b 75 3d 75 7c 7c 30 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3e 30 26 26 74 5b 6f 2d 31 5d 5b 32 5d 3e 75 3b Data Ascii: his;try{return this\|\|Function("return this")()}catch(t){if("object"==typeof window)return window}}(),n.o=function(t,r){return Object.prototype.hasOwnProperty.call(t,r)},(()=>{var t=[];n.O=function(r,e,i,u){if(e){u=u\|\|0;for(var o=t.length;o>0&&t[o-1][2]>u;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.10	49810	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	868	OUT	GET /assets/d67c5e680608266a1f63.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:24 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: application/javascript Content-Length: 7728 Connection: close CF-Ray: 8d782e669d672fec-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1c6b9d0ad743762986197ae0e81874c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iu6sCVARYDBy2%2B7vtPaEN4OOhuMSRCDnNj4MiJadNzMuRAYw%2FN8ypyurh7erGruHDMEC4lL5ndinciNPjSWiNIRgz6Q%2Bp0pFsi9uEfEzCXC0TyiHhvf01t%2BKvVnb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:24 UTC	399	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 35 34 39 32 22 5d 2c 7b 38 34 39 31 34 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4d 61 70 29 72 65 74 75 72 6e 20 4d 61 70 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 76 61 72 20 6e 3d 2d 31 3b 72 65 74 75 72 6e 20 74 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 30 5d 3d 3d 3d 65 26 26 28 6e 3d 72 2c 21 30 29 7d 29 2c 6e 7d Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 68 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 74 28 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 2c 65 29 2c 72 3d 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 5b 6e 5d 3b 72 65 74 75 72 6e 20 72 26 26 72 5b 31 5d 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 72 3d 74 28 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 2c 65 29 3b 7e 72 3f 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 5b 72 5d 5b 31 5d 3d 6e 3a 74 68 69 73 2e 5f 5f 65 6e 74 72 69 65 73 5f 5f 2e 70 75 73 68 28 5b 65 2c 6e 5d 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 Data Ascii: h},enumerable:!0,configurable:!0}),e.prototype.get=function(e){var n=t(this.__entries__,e),r=this.__entries__[n];return r&&r[1]},e.prototype.set=function(e,n){var r=t(this.__entries__,e);~r?this.__entries__[r][1]=n:this.__entries__.push([e,n])},e.prototyp
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 6f 6e 20 61 28 29 7b 76 61 72 20 74 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 69 66 28 6e 29 7b 69 66 28 74 2d 69 3c 32 29 72 65 74 75 72 6e 3b 72 3d 21 30 7d 65 6c 73 65 20 6e 3d 21 30 2c 72 3d 21 31 2c 73 65 74 54 69 6d 65 6f 75 74 28 63 2c 32 30 29 3b 69 3d 74 7d 72 65 74 75 72 6e 20 61 7d 28 74 68 69 73 2e 72 65 66 72 65 73 68 2e 62 69 6e 64 28 74 68 69 73 29 2c 32 30 29 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 4f 62 73 65 72 76 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 21 7e 74 68 69 73 2e 6f 62 73 65 72 76 65 72 73 5f 2e 69 6e 64 65 78 4f 66 28 74 29 26 26 74 68 69 73 2e 6f 62 73 65 72 76 65 72 73 5f 2e 70 75 73 68 28 74 29 2c 21 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 26 26 74 68 69 73 2e 63 6f 6e 6e 65 63 74 5f 28 29 Data Ascii: on a(){var t=Date.now();if(n){if(t-i<2)return;r=!0}else n=!0,r=!1,setTimeout(c,20);i=t}return a}(this.refresh.bind(this),20)}return t.prototype.addObserver=function(t){!~this.observers_.indexOf(t)&&this.observers_.push(t),!this.connected_&&this.connect_()
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 64 5f 26 26 64 6f 63 75 6d 65 6e 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 53 75 62 74 72 65 65 4d 6f 64 69 66 69 65 64 22 2c 74 68 69 73 2e 72 65 66 72 65 73 68 29 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 73 4f 62 73 65 72 76 65 72 5f 3d 6e 75 6c 6c 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 41 64 64 65 64 5f 3d 21 31 2c 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 3d 21 31 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 6e 54 72 61 6e 73 69 74 69 6f 6e 45 6e 64 5f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2e 70 72 6f 70 65 72 74 79 4e 61 6d 65 2c 6e 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 3b 63 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 21 7e 6e Data Ascii: d_&&document.removeEventListener("DOMSubtreeModified",this.refresh),this.mutationsObserver_=null,this.mutationEventsAdded_=!1,this.connected_=!1},t.prototype.onTransitionEnd_=function(t){var e=t.propertyName,n=void 0===e?"":e;c.some(function(t){return!!~n
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 66 28 21 65 26 26 21 6e 29 72 65 74 75 72 6e 20 64 3b 76 61 72 20 72 3d 66 28 74 29 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 74 29 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 7d 2c 6e 3d 30 2c 72 3d 5b 22 74 6f 70 22 2c 22 72 69 67 68 74 22 2c 22 62 6f 74 74 6f 6d 22 2c 22 6c 65 66 74 22 5d 3b 6e 3c 72 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 72 5b 6e 5d 2c 6f 3d 74 5b 22 70 61 64 64 69 6e 67 2d 22 2b 69 5d 3b 65 5b 69 5d 3d 70 28 6f 29 7d 72 65 74 75 72 6e 20 65 7d 28 72 29 2c 6f 3d 69 2e 6c 65 66 74 2b 69 2e 72 69 67 68 74 2c 73 3d 69 2e 74 6f 70 2b 69 2e 62 6f 74 74 6f 6d 2c 63 3d 70 28 72 2e 77 69 64 74 68 29 2c 61 3d 70 28 72 2e 68 65 69 67 68 74 29 3b 69 66 28 22 62 6f 72 64 65 72 2d 62 Data Ascii: f(!e&&!n)return d;var r=f(t).getComputedStyle(t),i=function(t){for(var e={},n=0,r=["top","right","bottom","left"];n<r.length;n++){var i=r[n],o=t["padding-"+i];e[i]=p(o)}return e}(r),o=i.left+i.right,s=i.top+i.bottom,c=p(r.width),a=p(r.height);if("border-b
2024-10-24 07:16:24 UTC	1369	IN	Data Raw: 22 31 20 61 72 67 75 6d 65 6e 74 20 72 65 71 75 69 72 65 64 2c 20 62 75 74 20 6f 6e 6c 79 20 30 20 70 72 65 73 65 6e 74 2e 22 29 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 45 6c 65 6d 65 6e 74 7c 7c 21 28 45 6c 65 6d 65 6e 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 4f 62 6a 65 63 74 29 29 72 65 74 75 72 6e 3b 69 66 28 21 28 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 66 28 74 29 2e 45 6c 65 6d 65 6e 74 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 27 70 61 72 61 6d 65 74 65 72 20 31 20 69 73 20 6e 6f 74 20 6f 66 20 74 79 70 65 20 22 45 6c 65 6d 65 6e 74 22 2e 27 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 6f 62 73 65 72 76 61 74 69 6f 6e 73 5f 3b 69 66 28 21 65 2e 68 61 73 28 74 29 29 65 2e 73 65 74 28 74 2c 6e 65 77 20 62 28 74 29 Data Ascii: "1 argument required, but only 0 present.");if("undefined"==typeof Element\|\|!(Element instanceof Object))return;if(!(t instanceof f(t).Element))throw TypeError('parameter 1 is not of type "Element".');var e=this.observations_;if(!e.has(t))e.set(t,new b(t)
2024-10-24 07:16:24 UTC	484	IN	Data Raw: 61 6b 4d 61 70 3a 6e 65 77 20 72 2c 77 3d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 69 66 28 21 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 2e 22 29 3b 69 66 28 21 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 31 20 61 72 67 75 6d 65 6e 74 20 72 65 71 75 69 72 65 64 2c 20 62 75 74 20 6f 6e 6c 79 20 30 20 70 72 65 73 65 6e 74 2e 22 29 3b 76 61 72 20 6e 3d 6e 65 77 20 79 28 65 2c 68 2e 67 65 74 49 6e 73 74 61 6e 63 65 28 29 2c 74 68 69 73 29 3b 67 2e 73 65 74 28 74 68 69 73 2c 6e 29 7d 3b 5b 22 6f 62 73 65 72 76 65 22 2c 22 75 6e 6f 62 73 Data Ascii: akMap:new r,w=function t(e){if(!(this instanceof t))throw TypeError("Cannot call a class as a function.");if(!arguments.length)throw TypeError("1 argument required, but only 0 present.");var n=new y(e,h.getInstance(),this);g.set(this,n)};["observe","unobs

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.10	49807	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 931f542e-301e-000c-75f2-21323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-16849878b78x6gn56mgecg60qc00000000kg0000000017yh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.10	49805	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: fffa9526-501e-0035-49f2-24c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-r197bdfb6b4kkrkjudg185sarw00000001bg00000000esdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.10	49804	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 34547014-f01e-003f-75cc-20d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-16849878b78z5q7jpbgf6e9mcw00000007b000000000gn6f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.10	49806	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: fa910cef-e01e-003c-72dd-21c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-16849878b78k8q5pxkgux3mbgg000000077000000000gabu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.10	49803	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: b12d28ce-501e-000a-62f4-240180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071624Z-15b8d89586fdmfsg1u7xrpfws000000002zg000000004nxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.10	49811	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	689	OUT	GET /api/v9/experiments?with_guild_experiments=true HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	768	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=31536000; includeSubDomains; preload vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: BYPASS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=08tTrmIrbaN6IbyOL7TprWriPhbjnuUBZVtWpCP3gTyej9UOYt3pdccXeW2aRJRywO2ihBIa645OCJvl8z%2FNXWb%2F6dfSVZ2hgM8Bxx9qc7UHLCmfLlZJIlXb2SGJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Server: cloudflare CF-RAY: 8d782e6739e88d29-DFW
2024-10-24 07:16:25 UTC	601	IN	Data Raw: 37 30 38 31 0d 0a 7b 22 66 69 6e 67 65 72 70 72 69 6e 74 22 3a 22 31 32 39 38 39 30 37 39 33 37 35 31 30 37 38 35 30 38 38 2e 35 2d 47 34 47 45 59 53 32 73 4f 55 4d 65 30 30 4e 4d 32 52 49 42 4e 5f 4a 44 6f 22 2c 22 61 73 73 69 67 6e 6d 65 6e 74 73 22 3a 5b 5b 32 38 31 30 32 30 35 34 38 37 2c 31 2c 31 2c 2d 31 2c 33 2c 39 36 33 34 2c 30 2c 30 5d 2c 5b 32 36 31 37 32 31 38 34 34 34 2c 34 2c 31 2c 2d 31 2c 32 2c 33 33 37 34 2c 30 2c 30 5d 2c 5b 33 30 33 35 36 37 34 37 36 37 2c 30 2c 31 2c 2d 31 2c 30 2c 38 37 37 30 2c 30 2c 30 5d 2c 5b 31 36 30 39 37 38 32 31 35 31 2c 30 2c 31 2c 2d 31 2c 32 2c 34 32 37 36 2c 30 2c 30 5d 2c 5b 33 36 34 33 33 36 32 37 35 31 2c 30 2c 31 2c 2d 31 2c 30 2c 33 37 30 34 2c 30 2c 30 5d 2c 5b 33 37 35 33 30 33 34 34 36 36 2c 31 2c Data Ascii: 7081{"fingerprint":"1298907937510785088.5-G4GEYS2sOUMe00NM2RIBN_JDo","assignments":[[2810205487,1,1,-1,3,9634,0,0],[2617218444,4,1,-1,2,3374,0,0],[3035674767,0,1,-1,0,8770,0,0],[1609782151,0,1,-1,2,4276,0,0],[3643362751,0,1,-1,0,3704,0,0],[3753034466,1,
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 31 35 35 32 2c 30 2c 30 5d 2c 5b 32 34 39 31 30 30 35 30 31 39 2c 34 2c 31 2c 2d 31 2c 30 2c 31 32 38 36 2c 30 2c 30 5d 2c 5b 33 38 38 39 30 37 37 38 30 34 2c 32 2c 31 2c 2d 31 2c 30 2c 38 37 37 38 2c 30 2c 30 5d 2c 5b 34 30 37 39 32 31 34 33 31 39 2c 32 2c 31 2c 2d 31 2c 30 2c 35 30 37 37 2c 30 2c 30 5d 2c 5b 31 30 33 34 36 36 31 33 30 36 2c 30 2c 31 2c 2d 31 2c 30 2c 39 39 35 35 2c 30 2c 30 5d 2c 5b 38 32 38 32 35 31 37 31 30 2c 32 2c 31 2c 2d 31 2c 31 2c 37 37 36 36 2c 30 2c 30 5d 2c 5b 33 31 32 34 30 30 33 33 31 36 2c 31 2c 31 2c 2d 31 2c 30 2c 31 35 34 36 2c 30 2c 30 5d 2c 5b 32 36 37 36 33 34 38 35 30 36 2c 30 2c 31 2c 2d 31 2c 30 2c 35 37 30 31 2c 30 2c 30 5d 2c 5b 34 31 33 36 35 37 34 38 30 32 2c 30 2c 31 2c 2d 31 2c 31 2c 35 36 33 36 2c 30 2c 30 Data Ascii: 1552,0,0],[2491005019,4,1,-1,0,1286,0,0],[3889077804,2,1,-1,0,8778,0,0],[4079214319,2,1,-1,0,5077,0,0],[1034661306,0,1,-1,0,9955,0,0],[828251710,2,1,-1,1,7766,0,0],[3124003316,1,1,-1,0,1546,0,0],[2676348506,0,1,-1,0,5701,0,0],[4136574802,0,1,-1,1,5636,0,0
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2c 31 2c 2d 31 2c 30 2c 39 35 32 33 2c 30 2c 30 5d 2c 5b 33 32 30 35 30 32 37 35 35 36 2c 30 2c 31 2c 2d 31 2c 32 2c 36 37 38 32 2c 30 2c 30 5d 2c 5b 32 37 39 31 38 32 37 32 36 33 2c 32 2c 31 2c 2d 31 2c 30 2c 34 39 33 2c 30 2c 30 5d 2c 5b 38 36 38 30 38 38 35 34 35 2c 30 2c 31 2c 2d 31 2c 30 2c 33 34 34 32 2c 30 2c 30 5d 2c 5b 31 37 39 34 38 30 31 38 39 31 2c 30 2c 35 2c 2d 31 2c 30 2c 32 38 33 37 2c 30 2c 30 5d 2c 5b 33 33 38 32 30 33 36 36 39 36 2c 33 2c 35 2c 2d 31 2c 34 2c 35 35 32 39 2c 30 2c 30 5d 2c 5b 31 33 32 30 30 37 36 37 35 33 2c 30 2c 31 2c 2d 31 2c 30 2c 34 39 39 38 2c 30 2c 30 5d 2c 5b 38 32 35 36 31 38 32 30 38 2c 30 2c 31 2c 2d 31 2c 30 2c 31 33 33 36 2c 30 2c 31 5d 2c 5b 32 31 38 30 33 37 39 35 31 33 2c 30 2c 31 2c 2d 31 2c 34 2c 35 37 Data Ascii: ,1,-1,0,9523,0,0],[3205027556,0,1,-1,2,6782,0,0],[2791827263,2,1,-1,0,493,0,0],[868088545,0,1,-1,0,3442,0,0],[1794801891,0,5,-1,0,2837,0,0],[3382036696,3,5,-1,4,5529,0,0],[1320076753,0,1,-1,0,4998,0,0],[825618208,0,1,-1,0,1336,0,1],[2180379513,0,1,-1,4,57
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 30 32 35 35 39 2c 37 2c 31 2c 2d 31 2c 31 2c 39 32 34 32 2c 30 2c 30 5d 2c 5b 32 34 38 37 38 32 33 37 34 32 2c 35 2c 31 2c 2d 31 2c 30 2c 33 33 35 35 2c 30 2c 30 5d 2c 5b 32 37 32 36 37 38 39 30 39 30 2c 30 2c 31 2c 2d 31 2c 30 2c 38 36 30 2c 30 2c 30 5d 2c 5b 38 37 38 30 34 30 30 34 34 2c 31 2c 31 2c 2d 31 2c 30 2c 38 33 33 33 2c 30 2c 31 5d 2c 5b 31 36 35 38 33 32 34 33 33 39 2c 32 2c 31 2c 2d 31 2c 30 2c 34 33 36 38 2c 30 2c 30 5d 2c 5b 31 36 33 33 32 38 39 31 32 34 2c 30 2c 31 2c 2d 31 2c 32 2c 31 38 33 36 2c 30 2c 30 5d 2c 5b 31 37 30 35 36 37 31 32 32 35 2c 30 2c 31 2c 2d 31 2c 30 2c 34 36 35 33 2c 30 2c 30 5d 2c 5b 34 37 34 31 35 39 36 31 36 2c 31 2c 31 2c 2d 31 2c 30 2c 35 38 31 37 2c 30 2c 30 5d 2c 5b 32 35 35 38 39 39 30 30 32 38 2c 30 2c 31 2c Data Ascii: 02559,7,1,-1,1,9242,0,0],[2487823742,5,1,-1,0,3355,0,0],[2726789090,0,1,-1,0,860,0,0],[878040044,1,1,-1,0,8333,0,1],[1658324339,2,1,-1,0,4368,0,0],[1633289124,0,1,-1,2,1836,0,0],[1705671225,0,1,-1,0,4653,0,0],[474159616,1,1,-1,0,5817,0,0],[2558990028,0,1,
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 33 31 39 35 35 2c 22 32 30 32 31 2d 30 36 5f 67 75 69 6c 64 5f 72 6f 6c 65 5f 73 75 62 73 63 72 69 70 74 69 6f 6e 73 22 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 37 32 30 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 2c 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 34 37 35 30 7d 2c 7b 22 73 22 3a 34 37 35 30 2c 22 65 22 3a 35 32 30 30 7d 2c 7b 22 73 22 3a 35 32 30 30 2c 22 65 22 3a 35 37 30 30 7d 2c 7b 22 73 22 3a 35 37 30 30 2c 22 65 22 3a 36 32 30 30 7d 2c 7b 22 73 22 3a 36 32 30 30 2c 22 65 22 3a 37 32 30 30 7d 5d 5d 5d 2c 5b 5b 32 32 39 34 38 38 38 39 34 33 2c 5b 5b 32 36 39 30 37 35 32 31 35 36 2c 31 34 30 35 38 33 31 39 35 35 5d 2c 5b 31 39 38 32 38 30 34 31 32 31 2c 31 30 30 30 30 5d 5d 5d 5d 5d 2c 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 Data Ascii: 31955,"2021-06_guild_role_subscriptions",0,[[[[-1,[{"s":7200,"e":10000}]],[1,[{"s":0,"e":4750},{"s":4750,"e":5200},{"s":5200,"e":5700},{"s":5700,"e":6200},{"s":6200,"e":7200}]]],[[2294888943,[[2690752156,1405831955],[1982804121,10000]]]]],[[[-1,[{"s":0,"e
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 30 2c 22 6b 22 3a 5b 22 38 31 34 36 36 39 36 30 34 38 34 30 30 31 33 38 37 34 22 5d 7d 2c 7b 22 62 22 3a 32 2c 22 6b 22 3a 5b 22 31 30 36 34 39 35 39 35 36 30 38 39 30 32 30 34 32 37 31 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 34 31 32 33 33 37 39 39 30 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 37 39 39 33 34 39 33 35 38 37 37 36 35 34 39 33 37 38 22 2c 22 37 36 33 38 33 38 34 37 39 32 39 33 33 34 39 38 39 39 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 33 36 37 34 39 36 33 32 30 34 2c 6e 75 6c 6c 2c 32 2c 5b 5b 5b 5b 31 2c Data Ascii: }]]],[]]],[{"b":0,"k":["814669604840013874"]},{"b":2,"k":["1064959560890204271"]}],[],null,null,0,0],[1412337990,null,0,[[[[-1,[{"s":0,"e":10000}]]],[]]],[{"b":1,"k":["799349358776549378","763838479293349899"]}],[],null,null,0,0],[3674963204,null,2,[[[[1,
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 50 41 52 54 4e 45 52 45 44 22 5d 5d 5d 5d 5d 5d 2c 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 43 4f 4d 4d 55 4e 49 54 59 22 5d 5d 5d 5d 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 37 36 33 38 33 38 34 37 39 32 39 33 33 34 39 38 39 39 22 2c 22 36 35 31 35 39 37 35 31 34 34 30 37 30 31 38 35 31 36 22 2c 22 38 39 37 31 36 32 30 39 32 36 35 32 36 38 33 33 31 34 22 2c 22 32 37 30 33 30 31 36 38 30 32 31 32 35 30 38 36 37 33 22 2c 22 34 30 33 33 31 32 31 34 35 39 33 38 33 38 32 38 34 39 22 2c 22 38 31 36 37 38 34 36 37 39 37 31 37 30 34 34 32 37 36 22 2c Data Ascii: 1604612045,[[1183251248,["PARTNERED"]]]]]],[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["COMMUNITY"]]]]]]],[{"b":1,"k":["763838479293349899","651597514407018516","897162092652683314","270301680212508673","403312145938382849","816784679717044276",
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 5d 5d 5d 5d 5d 5d 5d 2c 5b 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 31 34 34 33 38 37 36 30 34 35 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 39 35 39 35 34 34 39 31 36 38 34 38 30 32 39 37 31 36 22 2c 22 39 36 36 30 39 35 30 30 33 31 33 36 39 38 33 31 32 31 22 2c 22 39 36 38 32 33 32 30 34 33 37 31 34 35 38 38 37 30 33 22 2c 22 39 35 39 31 39 35 36 35 34 38 31 33 35 33 32 32 30 32 22 2c 22 39 34 39 33 39 36 30 34 33 37 34 33 37 38 39 31 31 36 22 2c 22 39 35 34 34 37 33 38 38 34 32 37 33 34 39 36 31 32 34 22 2c 22 31 30 34 32 31 34 38 31 36 38 37 32 36 34 38 37 31 30 31 22 5d 7d 5d 2c 5b 5d 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: ]]]]]]],[],[],null,null,0,0],[1443876045,null,0,[[[[1,[{"s":0,"e":10000}]]],[]]],[{"b":1,"k":["959544916848029716","966095003136983121","968232043714588703","959195654813532202","949396043743789116","954473884273496124","1042148168726487101"]}],[],null,nu
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 31 32 31 2c 31 30 30 30 30 5d 5d 5d 5d 5d 2c 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5d 5d 5d 2c 5b 5d 2c 5b 5b 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 49 4e 54 45 52 4e 41 4c 5f 45 4d 50 4c 4f 59 45 45 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 5d 5d 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 30 2c 30 5d 2c 5b 32 34 36 32 32 31 36 37 38 35 2c 6e 75 6c 6c 2c 30 2c 5b 5b 5b 5b 2d 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 43 4f 4d 4d 55 4e 49 54 59 22 5d 5d 5d 5d 2c 5b 32 39 31 38 34 30 32 32 Data Ascii: 121,10000]]]]],[[[-1,[{"s":0,"e":10000}]]],[]]],[],[[[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["INTERNAL_EMPLOYEE_ONLY"]]]]]]]],null,null,0,0],[2462216785,null,0,[[[[-1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["COMMUNITY"]]]],[29184022
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 49 4e 54 45 52 4e 41 4c 5f 45 4d 50 4c 4f 59 45 45 5f 4f 4e 4c 59 22 5d 5d 5d 5d 5d 5d 2c 5b 5b 5b 31 2c 5b 7b 22 73 22 3a 30 2c 22 65 22 3a 31 30 30 30 30 7d 5d 5d 5d 2c 5b 5b 31 36 30 34 36 31 32 30 34 35 2c 5b 5b 31 31 38 33 32 35 31 32 34 38 2c 5b 22 53 48 41 52 45 44 5f 43 41 4e 56 41 53 5f 46 52 49 45 4e 44 53 5f 41 4e 44 5f 46 41 4d 49 4c 59 5f 54 45 53 54 22 5d 5d 5d 5d 5d 5d 5d 2c 5b 7b 22 62 22 3a 31 2c 22 6b 22 3a 5b 22 31 30 37 38 38 30 37 32 37 39 39 37 39 32 32 31 30 33 32 22 2c 22 39 34 32 38 37 39 33 38 31 32 33 30 30 36 33 36 35 36 22 2c 22 31 37 32 30 35 36 38 32 37 33 33 35 34 30 39 36 36 35 22 2c Data Ascii: s":0,"e":10000}]]],[[1604612045,[[1183251248,["INTERNAL_EMPLOYEE_ONLY"]]]]]],[[[1,[{"s":0,"e":10000}]]],[[1604612045,[[1183251248,["SHARED_CANVAS_FRIENDS_AND_FAMILY_TEST"]]]]]]],[{"b":1,"k":["1078807279979221032","942879381230063656","172056827335409665",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.10	49812	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:24 UTC	745	OUT	GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	979	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: application/javascript Content-Length: 21811 Connection: close CF-Ray: 8d782e68b82d2cdb-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "0fbb77d1b69f18df0fdcf836de1c4106" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xUzpjlEOu2X7onQVwmAdhoa%2FcNN%2BK3JK2JtbGFA9r%2BrDKXtAIa%2Fo38tkYcw3NNTM4yAn7r%2FUNQbLtaemzbjrN8XeYb1%2F%2BOxb8phbDb%2Fh0edEbU8uN0hKYSr8DFks"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 31 39 38 34 22 5d 2c 7b 37 37 32 34 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 33 33 36 37 36 29 2c 6f 3d 6e 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 7d 7d 2c 36 30 33 35 32 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 29 26 26 28 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 4c 28 22 49 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f 63 61 74 69 6f 6e 22 29 7d 2c 50 29 29 66 6f 72 28 65 20 69 6e 20 4e 29 61 5b 65 5d 26 26 77 28 61 5b 65 5d 2c 46 29 3b 69 66 28 28 21 50 7c 7c 21 55 7c 7c 55 3d 3d 3d 5f 29 26 26 28 55 3d 46 2e 70 72 6f 74 6f 74 79 70 65 2c 50 29 29 66 6f 72 28 65 20 69 6e 20 4e 29 61 5b 65 5d 26 26 77 28 61 5b 65 5d 2e 70 72 6f 74 6f 74 79 70 65 2c 55 29 3b 69 66 28 50 26 26 41 28 4d 29 21 3d 3d 55 26 26 77 28 4d 2c 55 29 2c 66 26 26 21 79 28 55 2c 42 29 29 66 6f 72 28 65 20 69 6e 20 56 3d 21 30 2c 67 28 55 2c 42 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f Data Ascii: Function.prototype)&&(F=function(){throw L("Incorrect invocation")},P))for(e in N)a[e]&&w(a[e],F);if((!P\|\|!U\|\|U===_)&&(U=F.prototype,P))for(e in N)a[e]&&w(a[e].prototype,U);if(P&&A(M)!==U&&w(M,U),f&&!y(U,B))for(e in V=!0,g(U,B,{configurable:!0,get:functio
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 29 2c 6c 3d 6e 28 31 34 34 37 34 38 29 2c 41 3d 6e 28 32 37 36 33 32 31 29 2c 77 3d 6e 28 35 33 37 34 34 33 29 2e 66 2c 78 3d 6e 28 36 39 32 39 39 34 29 2c 62 3d 6e 28 31 37 35 34 34 30 29 2c 54 3d 6e 28 38 36 35 33 31 32 29 2c 45 3d 6e 28 36 34 34 36 35 39 29 2c 49 3d 66 2e 50 52 4f 50 45 52 2c 52 3d 66 2e 43 4f 4e 46 49 47 55 52 41 42 4c 45 2c 6d 3d 22 41 72 72 61 79 42 75 66 66 65 72 22 2c 4f 3d 22 44 61 74 61 56 69 65 77 22 2c 4d 3d 22 70 72 6f 74 6f 74 79 70 65 22 2c 46 3d 22 57 72 6f 6e 67 20 69 6e 64 65 78 22 2c 55 3d 45 2e 67 65 74 74 65 72 46 6f 72 28 6d 29 2c 5f 3d 45 2e 67 65 74 74 65 72 46 6f 72 28 4f 29 2c 4c 3d 45 2e 73 65 74 2c 42 3d 65 5b 6d 5d 2c 43 3d 42 2c 53 3d 43 26 26 43 5b 4d 5d 2c 50 3d 65 5b 4f 5d 2c 56 3d 50 26 26 50 5b 4d 5d 2c Data Ascii: ),l=n(144748),A=n(276321),w=n(537443).f,x=n(692994),b=n(175440),T=n(865312),E=n(644659),I=f.PROPER,R=f.CONFIGURABLE,m="ArrayBuffer",O="DataView",M="prototype",F="Wrong index",U=E.getterFor(m),_=E.getterFor(O),L=E.set,B=e[m],C=B,S=C&&C[M],P=e[O],V=P&&P[M],
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 34 38 33 36 34 39 29 2c 28 74 6f 2e 67 65 74 49 6e 74 38 28 30 29 7c 7c 21 74 6f 2e 67 65 74 49 6e 74 38 28 31 29 29 26 26 73 28 56 2c 7b 73 65 74 49 6e 74 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 69 28 74 68 69 73 2c 74 2c 72 3c 3c 32 34 3e 3e 32 34 29 7d 2c 73 65 74 55 69 6e 74 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 69 28 74 68 69 73 2c 74 2c 72 3c 3c 32 34 3e 3e 32 34 29 7d 7d 2c 7b 75 6e 73 61 66 65 3a 21 30 7d 29 7d 65 6c 73 65 20 53 3d 28 43 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 70 28 74 68 69 73 2c 53 29 3b 76 61 72 20 72 3d 64 28 74 29 3b 4c 28 74 68 69 73 2c 7b 74 79 70 65 3a 6d 2c 62 79 74 65 73 3a 59 28 57 28 72 29 2c 30 29 2c 62 79 74 65 4c 65 6e 67 74 68 3a 72 7d 29 2c 21 69 26 26 28 74 68 69 73 2e 62 79 74 65 4c 65 6e Data Ascii: 483649),(to.getInt8(0)\|\|!to.getInt8(1))&&s(V,{setInt8:function(t,r){ti(this,t,r<<24>>24)},setUint8:function(t,r){ti(this,t,r<<24>>24)}},{unsafe:!0})}else S=(C=function(t){p(this,S);var r=d(t);L(this,{type:m,bytes:Y(W(r),0),byteLength:r}),!i&&(this.byteLen
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 32 2c 74 2c 4b 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 2c 73 65 74 55 69 6e 74 31 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 32 2c 74 2c 4b 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 2c 73 65 74 49 6e 74 33 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 34 2c 74 2c 71 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 2c 73 65 74 55 69 6e 74 33 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 24 28 74 68 69 73 2c 34 2c 74 2c 71 2c 72 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e Data Ascii: (t,r){$(this,2,t,K,r,arguments.length>2&&arguments[2])},setUint16:function(t,r){$(this,2,t,K,r,arguments.length>2&&arguments[2])},setInt32:function(t,r){$(this,4,t,q,r,arguments.length>2&&arguments[2])},setUint32:function(t,r){$(this,4,t,q,r,arguments.len
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 65 28 64 2c 67 29 2c 45 3d 66 28 62 29 2c 49 3d 30 2c 52 3d 6c 7c 7c 61 2c 6d 3d 72 3f 52 28 76 2c 45 29 3a 6e 7c 7c 70 3f 52 28 76 2c 30 29 3a 76 6f 69 64 20 30 3b 45 3e 49 3b 49 2b 2b 29 69 66 28 28 68 7c 7c 49 20 69 6e 20 62 29 26 26 28 77 3d 54 28 41 3d 62 5b 49 5d 2c 49 2c 78 29 2c 74 29 29 7b 69 66 28 72 29 6d 5b 49 5d 3d 77 3b 65 6c 73 65 20 69 66 28 77 29 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 33 3a 72 65 74 75 72 6e 21 30 3b 63 61 73 65 20 35 3a 72 65 74 75 72 6e 20 41 3b 63 61 73 65 20 36 3a 72 65 74 75 72 6e 20 49 3b 63 61 73 65 20 32 3a 63 28 6d 2c 41 29 7d 65 6c 73 65 20 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 34 3a 72 65 74 75 72 6e 21 31 3b 63 61 73 65 20 37 3a 63 28 6d 2c 41 29 7d 7d 72 65 74 75 72 6e 20 79 3f 2d 31 3a 6f 7c 7c Data Ascii: e(d,g),E=f(b),I=0,R=l\|\|a,m=r?R(v,E):n\|\|p?R(v,0):void 0;E>I;I++)if((h\|\|I in b)&&(w=T(A=b[I],I,x),t)){if(r)m[I]=w;else if(w)switch(t){case 3:return!0;case 5:return A;case 6:return I;case 2:c(m,A)}else switch(t){case 4:return!1;case 7:c(m,A)}}return y?-1:o\|\|
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 3c 6f 3f 72 5b 75 2b 2b 5d 3a 6e 5b 66 2b 2b 5d 3b 72 65 74 75 72 6e 20 74 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 69 7d 2c 33 30 38 30 32 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 34 39 38 35 37 36 29 2c 6f 3d 6e 28 39 33 33 36 37 36 29 2c 69 3d 6e 28 36 32 32 32 38 31 29 2c 75 3d 6e 28 36 34 31 32 33 36 29 28 22 73 70 65 63 69 65 73 22 29 2c 66 3d 41 72 72 61 79 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 20 65 28 74 29 26 26 28 6f 28 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 28 72 3d 3d 3d 66 7c 7c 65 28 72 2e 70 72 6f 74 6f 74 79 70 65 29 29 3f 72 3d 76 6f 69 64 20 30 3a 69 28 72 29 26 26 6e 75 6c 6c 3d 3d 3d 28 72 3d 72 5b 75 5d 29 26 26 28 72 3d Data Ascii: <o?r[u++]:n[f++];return t};t.exports=i},308020:function(t,r,n){var e=n(498576),o=n(933676),i=n(622281),u=n(641236)("species"),f=Array;t.exports=function(t){var r;return e(t)&&(o(r=t.constructor)&&(r===f\|\|e(r.prototype))?r=void 0:i(r)&&null===(r=r[u])&&(r=
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 63 28 72 3d 66 28 74 29 2c 75 29 29 3f 6e 3a 61 3f 69 28 72 29 3a 22 4f 62 6a 65 63 74 22 3d 3d 3d 28 65 3d 69 28 72 29 29 26 26 6f 28 72 2e 63 61 6c 6c 65 65 29 3f 22 41 72 67 75 6d 65 6e 74 73 22 3a 65 7d 7d 2c 31 38 32 38 36 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 36 36 36 30 36 29 2c 6f 3d 6e 28 39 37 31 33 31 29 2c 69 3d 6e 28 38 37 39 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 75 3d 65 28 72 29 3b 75 20 69 6e 20 74 3f 6f 2e 66 28 74 2c 75 2c 69 28 30 2c 6e 29 29 3a 74 5b 75 5d 3d 6e 7d 7d 2c 39 30 33 33 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 38 35 39 32 30 Data Ascii: ":"string"==typeof(n=c(r=f(t),u))?n:a?i(r):"Object"===(e=i(r))&&o(r.callee)?"Arguments":e}},182867:function(t,r,n){var e=n(966606),o=n(97131),i=n(879);t.exports=function(t,r,n){var u=e(r);u in t?o.f(t,u,i(0,n)):t[u]=n}},90338:function(t,r,n){var e=n(85920
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 40 40 69 74 65 72 61 74 6f 72 22 29 7c 7c 75 5b 65 28 74 29 5d 7d 7d 2c 39 38 31 39 37 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 32 36 35 31 35 29 2c 6f 3d 6e 28 35 32 36 39 38 38 29 2c 69 3d 6e 28 32 34 30 33 33 29 2c 75 3d 6e 28 39 33 38 35 30 37 29 2c 66 3d 6e 28 31 31 36 39 37 29 2c 61 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 76 61 72 20 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 32 3f 66 28 74 29 3a 72 3b 69 66 28 6f 28 6e 29 29 72 65 74 75 72 6e 20 69 28 65 28 6e 2c 74 29 29 3b 74 68 72 6f 77 20 61 28 75 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 69 74 65 72 61 62 6c 65 22 29 7d 7d 2c 33 33 39 33 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c Data Ascii: @@iterator")\|\|u[e(t)]}},981971:function(t,r,n){var e=n(926515),o=n(526988),i=n(24033),u=n(938507),f=n(11697),a=TypeError;t.exports=function(t,r){var n=arguments.length<2?f(t):r;if(o(n))return i(e(n,t));throw a(u(t)+" is not iterable")}},339399:function(t,
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 33 36 29 2c 6f 3d 6e 28 38 37 34 36 35 32 29 2c 69 3d 65 28 22 69 74 65 72 61 74 6f 72 22 29 2c 75 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 74 26 26 28 6f 2e 41 72 72 61 79 3d 3d 3d 74 7c 7c 75 5b 69 5d 3d 3d 3d 74 29 7d 7d 2c 34 39 38 35 37 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 33 33 32 39 31 36 29 3b 74 2e 65 78 70 6f 72 74 73 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 41 72 72 61 79 22 3d 3d 3d 65 28 74 29 7d 7d 2c 35 33 36 35 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 37 34 39 37 31 29 3b Data Ascii: 36),o=n(874652),i=e("iterator"),u=Array.prototype;t.exports=function(t){return void 0!==t&&(o.Array===t\|\|u[i]===t)}},498576:function(t,r,n){var e=n(332916);t.exports=Array.isArray\|\|function(t){return"Array"===e(t)}},536524:function(t,r,n){var e=n(974971);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.10	49813	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	673	OUT	GET /assets/55ad931ed92a15c15709.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 109613 Connection: close CF-Ray: 8d782e68de5ae552-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "80f500d4d0495e5c74e9b92cbc26f088" Last-Modified: Tue, 15 Oct 2024 21:49:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0uQ6Gc003LynAtKoGbbXcw0A2O4dkvRIKUfkvycW7pTiJwCA6hWq2LLSgHVUPTHIAYo9f4rH8fDJYIi%2FWwp9f6QStTV73OqHHWqeHDqBK%2F%2F%2Bjdcx8A75TF5A27ta"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	404	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 33 32 38 38 22 5d 2c 7b 34 37 33 34 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 65 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 5e 6e 2c 72 3d 30 3b 6e 3e 3d 34 3b 29 74 3d 28 36 35 35 33 35 26 28 74 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 38 7c 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 2b 2b 72 29 29 3c 3c 31 36 7c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["63288"],{473452:function(e,t){"use strict";t.Z=function(e){for(var t,n=e.length,o=n^n,r=0;n>=4;)t=(65535&(t=255&e.charCodeAt(r)\|(255&e.charCodeAt(++r))<<8\|(255&e.charCodeAt(++r))<<16\|
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 33 35 26 74 29 2a 31 35 34 30 34 38 33 34 37 37 2b 28 28 28 74 3e 3e 3e 31 36 29 2a 31 35 34 30 34 38 33 34 37 37 26 36 35 35 33 35 29 3c 3c 31 36 29 29 2c 6e 2d 3d 34 2c 2b 2b 72 3b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 20 33 3a 6f 5e 3d 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 32 29 29 3c 3c 31 36 3b 63 61 73 65 20 32 3a 6f 5e 3d 28 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 2b 31 29 29 3c 3c 38 3b 63 61 73 65 20 31 3a 6f 5e 3d 32 35 35 26 65 2e 63 68 61 72 43 6f 64 65 41 74 28 72 29 2c 6f 3d 28 36 35 35 33 35 26 6f 29 2a 31 35 34 30 34 38 33 34 37 37 2b 28 28 28 6f 3e 3e 3e 31 36 29 2a 31 35 34 30 34 38 33 34 37 37 26 36 35 35 33 35 29 3c 3c 31 36 29 7d 72 65 74 75 72 6e 20 6f 5e 3d 6f 3e 3e 3e 31 33 2c 6f 3d 28 36 35 Data Ascii: 35&t)1540483477+(((t>>>16)1540483477&65535)<<16)),n-=4,++r;switch(n){case 3:o^=(255&e.charCodeAt(r+2))<<16;case 2:o^=(255&e.charCodeAt(r+1))<<8;case 1:o^=255&e.charCodeAt(r),o=(65535&o)1540483477+(((o>>>16)1540483477&65535)<<16)}return o^=o>>>13,o=(65
2024-10-24 07:16:25 UTC	1262	IN	Data Raw: 65 74 75 72 6e 20 31 31 36 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 33 29 3f 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3a 61 3b 63 61 73 65 20 39 36 33 3a 72 65 74 75 72 6e 20 31 31 30 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 35 29 3f 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3a 61 3b 63 61 73 65 20 31 30 30 39 3a 69 66 28 31 30 30 21 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 34 29 29 62 72 65 61 6b 3b 63 61 73 65 20 39 36 39 3a 63 61 73 65 20 39 34 32 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 61 3b 63 61 73 65 20 39 37 38 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 22 2d 6d 6f 7a 2d 22 2b 61 2b 61 3b 63 61 73 65 20 31 30 31 39 3a 63 61 73 65 20 39 38 33 3a 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 Data Ascii: eturn 116===a.charCodeAt(3)?"-webkit-"+a+a:a;case 963:return 110===a.charCodeAt(5)?"-webkit-"+a+a:a;case 1009:if(100!==a.charCodeAt(4))break;case 969:case 942:return"-webkit-"+a+a;case 978:return"-webkit-"+a+"-moz-"+a+a;case 1019:case 983:return"-webkit-"
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 6e 20 61 7d 72 65 74 75 72 6e 22 2d 77 65 62 6b 69 74 2d 22 2b 61 2b 22 2d 6d 73 2d 22 2b 73 2b 61 3b 63 61 73 65 20 31 30 31 37 3a 69 66 28 2d 31 3d 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 22 73 74 69 63 6b 79 22 2c 39 29 29 62 72 65 61 6b 3b 63 61 73 65 20 39 37 35 3a 73 77 69 74 63 68 28 74 3d 28 61 3d 65 29 2e 6c 65 6e 67 74 68 2d 31 30 2c 75 3d 28 73 3d 28 33 33 3d 3d 3d 61 2e 63 68 61 72 43 6f 64 65 41 74 28 74 29 3f 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 74 29 3a 61 29 2e 73 75 62 73 74 72 69 6e 67 28 65 2e 69 6e 64 65 78 4f 66 28 22 3a 22 2c 37 29 2b 31 29 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2b 28 30 7c 73 2e 63 68 61 72 43 6f 64 65 41 74 28 37 29 29 29 7b 63 61 73 65 20 32 30 33 3a 69 66 28 31 31 31 3e 73 2e 63 68 61 Data Ascii: n a}return"-webkit-"+a+"-ms-"+s+a;case 1017:if(-1===a.indexOf("sticky",9))break;case 975:switch(t=(a=e).length-10,u=(s=(33===a.charCodeAt(t)?a.substring(0,t):a).substring(e.indexOf(":",7)+1).trim()).charCodeAt(0)+(0\|s.charCodeAt(7))){case 203:if(111>s.cha
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 75 62 73 74 72 69 6e 67 28 30 2c 33 21 3d 3d 74 3f 6e 3a 31 30 29 3b 72 65 74 75 72 6e 20 6e 3d 65 2e 73 75 62 73 74 72 69 6e 67 28 6e 2b 31 2c 65 2e 6c 65 6e 67 74 68 2d 31 29 2c 4c 28 32 21 3d 3d 74 3f 6f 3a 6f 2e 72 65 70 6c 61 63 65 28 78 2c 22 24 31 22 29 2c 6e 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 29 7b 76 61 72 20 6e 3d 6f 28 74 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 2c 74 2e 63 68 61 72 43 6f 64 65 41 74 28 32 29 29 3b 72 65 74 75 72 6e 20 6e 21 3d 3d 74 2b 22 3b 22 3f 6e 2e 72 65 70 6c 61 63 65 28 43 2c 22 20 6f 72 20 28 24 31 29 22 29 2e 73 75 62 73 74 72 69 6e 67 28 34 29 3a 22 28 22 2b 74 2b 22 29 22 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 2c 6e 2c 6f 2c 72 2c 69 2c Data Ascii: ubstring(0,3!==t?n:10);return n=e.substring(n+1,e.length-1),L(2!==t?o:o.replace(x,"$1"),n,t)}function i(e,t){var n=o(t,t.charCodeAt(0),t.charCodeAt(1),t.charCodeAt(2));return n!==t+";"?n.replace(C," or ($1)").substring(4):"("+t+")"}function a(e,t,n,o,r,i,
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2b 2b 3b 63 61 73 65 20 34 30 3a 68 2b 2b 3b 63 61 73 65 20 33 34 3a 63 61 73 65 20 33 39 3a 66 6f 72 28 3b 4e 2b 2b 3c 6a 26 26 73 2e 63 68 61 72 43 6f 64 65 41 74 28 4e 29 21 3d 3d 68 3b 29 3b 7d 69 66 28 30 3d 3d 3d 6d 29 62 72 65 61 6b 3b 4e 2b 2b 7d 69 66 28 6d 3d 73 2e 73 75 62 73 74 72 69 6e 67 28 5f 2c 4e 29 2c 30 3d 3d 3d 66 26 26 28 66 3d 28 48 3d 48 2e 72 65 70 6c 61 63 65 28 6c 2c 22 22 29 2e 74 72 69 6d 28 29 29 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 29 2c 36 34 3d 3d 3d 66 29 7b 73 77 69 74 63 68 28 30 3c 52 26 26 28 48 3d 48 2e 72 65 70 6c 61 63 65 28 63 2c 22 22 29 29 2c 68 3d 48 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 29 7b 63 61 73 65 20 31 30 30 3a 63 61 73 65 20 31 30 39 3a 63 61 73 65 20 31 31 35 3a 63 61 73 65 20 34 35 3a 52 3d Data Ascii: ++;case 40:h++;case 34:case 39:for(;N++<j&&s.charCodeAt(N)!==h;);}if(0===m)break;N++}if(m=s.substring(_,N),0===f&&(f=(H=H.replace(l,"").trim()).charCodeAt(0)),64===f){switch(0<R&&(H=H.replace(c,"")),h=H.charCodeAt(1)){case 100:case 109:case 115:case 45:R=
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2e 63 68 61 72 41 74 28 4e 29 2c 68 29 7b 63 61 73 65 20 39 3a 63 61 73 65 20 33 32 3a 69 66 28 30 3d 3d 3d 53 2b 4f 2b 78 29 73 77 69 74 63 68 28 49 29 7b 63 61 73 65 20 34 34 3a 63 61 73 65 20 35 38 3a 63 61 73 65 20 39 3a 63 61 73 65 20 33 32 3a 62 3d 22 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 33 32 21 3d 3d 68 26 26 28 62 3d 22 20 22 29 7d 62 72 65 61 6b 3b 63 61 73 65 20 30 3a 62 3d 22 5c 5c 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 32 3a 62 3d 22 5c 5c 66 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 31 3a 62 3d 22 5c 5c 76 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 33 38 3a 30 3d 3d 3d 53 2b 78 2b 4f 26 26 28 52 3d 42 3d 31 2c 62 3d 22 5c 66 22 2b 62 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 38 3a 69 66 28 30 3d 3d 3d 53 2b 78 2b 4f 2b 46 26 Data Ascii: .charAt(N),h){case 9:case 32:if(0===S+O+x)switch(I){case 44:case 58:case 9:case 32:b="";break;default:32!==h&&(b=" ")}break;case 0:b="\\0";break;case 12:b="\\f";break;case 11:b="\\v";break;case 38:0===S+x+O&&(R=B=1,b="\f"+b);break;case 108:if(0===S+x+O+F&
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2c 66 3d 2f 28 5b 2c 3a 20 5d 29 28 74 72 61 6e 73 66 6f 72 6d 29 2f 67 2c 68 3d 2f 2c 5c 72 2b 3f 2f 67 2c 6d 3d 2f 28 5b 5c 74 5c 72 5c 6e 20 5d 29 2a 5c 66 3f 26 2f 67 2c 76 3d 2f 40 28 6b 5c 77 2b 29 5c 73 2a 28 5c 53 2a 29 5c 73 2a 2f 2c 67 3d 2f 3a 3a 28 70 6c 61 63 65 29 2f 67 2c 45 3d 2f 3a 28 72 65 61 64 2d 6f 6e 6c 79 29 2f 67 2c 62 3d 2f 5b 73 76 68 5d 5c 77 2b 2d 5b 74 62 6c 72 5d 7b 32 7d 2f 2c 79 3d 2f 5c 28 5c 73 2a 28 2e 2a 29 5c 73 2a 5c 29 2f 67 2c 43 3d 2f 28 5b 5c 73 5c 53 5d 2a 3f 29 3b 2f 67 2c 4f 3d 2f 2d 73 65 6c 66 7c 66 6c 65 78 2d 2f 67 2c 78 3d 2f 5b 5e 5d 2a 3f 28 3a 5b 72 70 5d 5b 65 6c 5d 61 5b 5c 77 2d 5d 2b 29 5b 5e 5d 2a 2f 2c 41 3d 2f 73 74 72 65 74 63 68 7c 3a 5c 73 2a 5c 77 2b 5c 2d 28 3f 3a 63 6f 6e 74 65 7c 61 76 61 Data Ascii: ,f=/([,: ])(transform)/g,h=/,\r+?/g,m=/([\t\r\n ])\f?&/g,v=/@(k\w+)\s(\S)\s/,g=/::(place)/g,E=/:(read-only)/g,b=/[svh]\w+-[tblr]{2}/,y=/$\s(.)\s$/g,C=/([\s\S]?);/g,O=/-self\|flex-/g,x=/[^]?(:[rp][el]a[\w-]+)[^]/,A=/stretch\|:\s*\w+\-(?:conte\|ava
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 26 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 2c 70 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 7c 7c 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 74 3f 22 22 3a 31 3d 3d 3d 72 2e 5a 5b 65 5d 7c 7c 34 35 3d 3d 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 31 29 7c 7c 69 73 4e 61 4e 28 74 29 7c 7c 30 3d 3d 3d 74 3f 74 3a 74 2b 22 70 78 22 7d 2c 64 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 30 2c 72 3d 22 22 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 6f 5d 3b 69 66 28 6e 75 6c 6c 21 3d 69 29 7b 76 61 72 20 61 3d 76 6f 69 64 20 30 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 69 29 7b 63 61 73 65 22 62 6f 6f 6c 65 61 6e 22 3a Data Ascii: &").toLowerCase()}),p=function(e,t){return null==t\|\|"boolean"==typeof t?"":1===r.Z[e]\|\|45===e.charCodeAt(1)\|\|isNaN(t)\|\|0===t?t:t+"px"},d=function e(t){for(var n=t.length,o=0,r="";o<n;o++){var i=t[o];if(null!=i){var a=void 0;switch(typeof i){case"boolean":
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 6f 29 2c 6f 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 65 2b 28 74 7c 7c 22 22 29 29 29 7d 74 68 69 73 2e 63 74 72 2b 2b 2c 74 68 69 73 2e 63 74 72 25 36 35 65 33 3d 3d 30 26 26 74 68 69 73 2e 74 61 67 73 2e 70 75 73 68 28 68 28 74 68 69 73 2e 6f 70 74 73 29 29 7d 2c 74 2e 66 6c 75 73 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 74 61 67 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 7d 29 2c 74 68 69 73 2e 74 61 67 73 3d 5b 5d 2c 74 68 69 73 2e 63 74 72 3d 30 2c 74 68 69 73 2e 69 6e 6a 65 63 74 65 64 3d 21 31 7d 2c 65 7d 28 29 3b 74 2e 5a 3d 66 75 6e 63 74 69 Data Ascii: o),o.appendChild(document.createTextNode(e+(t\|\|"")))}this.ctr++,this.ctr%65e3==0&&this.tags.push(h(this.opts))},t.flush=function(){this.tags.forEach(function(e){return e.parentNode.removeChild(e)}),this.tags=[],this.ctr=0,this.injected=!1},e}();t.Z=functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.10	49815	35.190.80.1	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	520	OUT	OPTIONS /report/v4?s=a%2BR7iMTa%2F4VkD2vLdyOE1EUBcQ3Fvi6CAy96XUioJPpYXxRD90StVtOwTA1Rk7C6G2VyZKfqY1z6oLmUlaw9dXfoe8gIGWlgCOCJ8xpPekpFKefvgbkPo9b8uqmb HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://discord.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:16:25 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Thu, 24 Oct 2024 07:16:25 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.10	49814	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	745	OUT	GET /assets/1bab9b095996b8d024ce.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/assets/ac625b77a0bab0ee72df.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	974	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: application/javascript Content-Length: 7078 Connection: close CF-Ray: 8d782e6b0835e712-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "45a3ee5ff96bdb2dd7fbb2846b5ea494" Last-Modified: Tue, 18 Jun 2024 19:13:27 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uynWUZmWMHeibse3e17x4jGWo6pb4HnA%2FMan7FRrUKgggTRu%2BSmwkU8XlMCRFv2bhpH5X14hOP%2FHgZM1mO7lkYwq8xx4D2oYxX%2BdCNaSm%2BXbreMk9r842GBSm%2BjD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	395	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 33 32 32 32 22 5d 2c 7b 33 34 30 36 31 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 33 35 34 38 34 38 29 2c 6e 3d 53 74 72 69 6e 67 2c 63 3d 54 79 70 65 45 72 72 6f 72 3b 72 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 72 7c 7c 65 28 72 29 29 72 65 74 75 72 6e 20 72 3b 74 68 72 6f 77 20 63 28 22 43 61 6e 27 74 20 73 65 74 20 22 2b 6e 28 72 29 2b 22 20 61 73 20 61 20 70 72 6f 74 6f 74 79 70 65 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 6e 65 77 20 72 29 21 3d 3d 72 2e 70 72 6f 74 6f 74 79 70 65 7d 29 7d 2c 33 33 39 39 35 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 49 6e 64 65 78 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 49 4e 44 45 58 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 31 2c 6d 3a 31 7d 2c 44 4f 4d 53 74 72 69 6e 67 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 44 4f 4d 53 54 52 49 4e 47 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 32 2c 6d 3a 30 7d 2c 48 69 65 72 61 72 63 68 79 52 65 71 75 65 73 74 45 72 72 6f 72 3a 7b 73 3a 22 48 49 45 52 41 52 43 48 59 5f 52 45 51 55 45 53 54 5f 45 52 52 22 2c 63 3a 33 2c 6d 3a 31 7d 2c 57 72 6f 6e 67 44 6f 63 75 6d 65 6e 74 45 72 72 6f 72 3a 7b 73 3a 22 57 52 4f 4e 47 5f 44 4f 43 55 4d 45 4e 54 5f 45 52 52 22 2c 63 3a 34 2c 6d Data Ascii: new r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 72 2c 74 2c 6f 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 65 28 6e 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 72 2c 74 29 5b 6f 5d 29 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 7d 2c 36 32 30 36 32 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 35 34 35 35 37 36 29 3b 72 2e 65 78 70 6f 72 74 73 3d 65 28 22 64 6f 63 75 6d 65 6e 74 22 2c 22 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 22 29 7d 2c 38 37 34 36 35 32 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 38 30 33 39 33 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 2c 6e 3d 6f 28 32 34 30 33 33 29 2c 63 3d 6f 28 39 34 35 36 37 29 2c 69 3d 6f 28 32 30 32 32 33 34 29 2c Data Ascii: r,t,o){try{return e(n(Object.getOwnPropertyDescriptor(r,t)[o]))}catch(r){}}},620623:function(r,t,o){var e=o(545576);r.exports=e("document","documentElement")},874652:function(r){r.exports={}},803938:function(r,t,o){var e,n=o(24033),c=o(94567),i=o(202234),
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 63 28 72 29 3b 69 66 28 65 28 74 2c 61 29 29 72 65 74 75 72 6e 20 74 5b 61 5d 3b 76 61 72 20 6f 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 6e 28 6f 29 26 26 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 3f 6f 2e 70 72 6f 74 6f 74 79 70 65 3a 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 66 3f 45 3a 6e 75 6c 6c 7d 7d 2c 38 33 35 38 38 34 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 32 32 32 35 33 31 29 2c 6e 3d 6f 28 32 30 32 32 33 34 29 3b 72 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 7c 7c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 65 28 72 2c 6e 29 7d 7d 2c 32 37 36 33 32 31 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b Data Ascii: :function(r){var t=c(r);if(e(t,a))return t[a];var o=t.constructor;return n(o)&&t instanceof o?o.prototype:t instanceof f?E:null}},835884:function(r,t,o){var e=o(222531),n=o(202234);r.exports=Object.keys\|\|function(r){return e(r,n)}},276321:function(r,t,o){
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 69 6e 20 6e 65 77 20 6d 28 31 2c 32 29 2c 79 3d 6d 26 26 6c 26 26 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 64 29 2c 4e 3d 21 21 79 26 26 21 28 79 2e 77 72 69 74 61 62 6c 65 26 26 79 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 29 2c 68 3d 76 26 26 21 4e 26 26 21 54 3b 65 28 7b 67 6c 6f 62 61 6c 3a 21 30 2c 63 6f 6e 73 74 72 75 63 74 6f 72 3a 21 30 2c 66 6f 72 63 65 64 3a 5f 7c 7c 68 7d 2c 7b 44 4f 4d 45 78 63 65 70 74 69 6f 6e 3a 68 3f 49 3a 6d 7d 29 3b 76 61 72 20 44 3d 63 28 64 29 2c 53 3d 44 2e 70 72 6f 74 6f 74 79 70 65 3b 69 66 28 53 2e 63 6f 6e 73 74 72 75 63 74 6f 72 21 3d 3d 44 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 21 5f 26 26 75 28 53 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 69 28 31 Data Ascii: in new m(1,2),y=m&&l&&Object.getOwnPropertyDescriptor(n,d),N=!!y&&!(y.writable&&y.configurable),h=v&&!N&&!T;e({global:!0,constructor:!0,forced:_\|\|h},{DOMException:h?I:m});var D=c(d),S=D.prototype;if(S.constructor!==D){for(var b in!_&&u(S,"constructor",i(1
2024-10-24 07:16:25 UTC	1207	IN	Data Raw: 6f 6e 28 72 29 7b 6c 65 74 7b 50 49 3a 74 2c 6d 69 6e 3a 6f 2c 6d 61 78 3a 6e 2c 63 6f 73 3a 63 2c 72 6f 75 6e 64 3a 69 7d 3d 4d 61 74 68 2c 75 3d 72 5b 30 5d 7c 72 5b 31 5d 3c 3c 38 7c 72 5b 32 5d 3c 3c 31 36 2c 61 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 66 3d 28 36 33 26 75 29 2f 36 33 2c 45 3d 28 75 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 73 3d 28 75 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 70 3d 75 3e 3e 32 33 2c 52 3d 61 3e 3e 31 35 2c 6c 3d 6e 28 33 2c 52 3f 70 3f 35 3a 37 3a 37 26 61 29 2c 5f 3d 6e 28 33 2c 52 3f 37 26 61 3a 70 3f 35 3a 37 29 2c 64 3d 70 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 70 3f 36 3a 35 2c 49 3d 30 2c 41 3d 28 74 2c 6f 2c 65 29 3d 3e 7b 6c 65 74 20 6e 3d Data Ascii: on(r){let{PI:t,min:o,max:n,cos:c,round:i}=Math,u=r[0]\|r[1]<<8\|r[2]<<16,a=r[3]\|r[4]<<8,f=(63&u)/63,E=(u>>6&63)/31.5-1,s=(u>>12&63)/31.5-1,p=u>>23,R=a>>15,l=n(3,R?p?5:7:7&a),_=n(3,R?7&a:p?5:7),d=p?(15&r[5])/15:1,O=(r[5]>>4)/15,m=p?6:5,I=0,A=(t,o,e)=>{let n=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.10	49817	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/d86788be99e870993214.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	959	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 8761 Connection: close CF-Ray: 8d782e6b499d478a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "102fe4fdec4447c9891c9f3faeae0474" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cd61h8D6pfd3SbG7rVqKnFzi9yfB%2BLEGQYTMAypbXbra3R0frUMZ1zTxOlksDwUaSIBq57c86kAeZ7N6lntNkfAWK2TbgHZ67ju%2F43E9ZzEgVu7eOUYKX7wINt2E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	410	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 38 35 34 33 22 5d 2c 7b 37 32 35 34 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 7d 29 3b 76 61 72 20 73 3d 6e 28 34 35 34 35 38 35 29 2c 61 3d 6e 28 35 35 31 34 35 32 29 2c 6c 3d 6e 28 35 33 32 39 30 31 29 3b 6c 65 74 20 72 3d 7b 2e 2e 2e 73 2e 5a 2e 67 75 69 6c 64 45 76 65 6e 74 52 75 6c 65 73 2e 6c 69 6e 6b 2c 72 65 61 63 74 3a 28 30 2c 6c 2e 5a 29 28 7b 65 6e 61 62 6c 65 42 75 69 6c 64 4f 76 65 72 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverr
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 75 6c 64 53 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 3a 21 30 7d 29 2e 72 65 61 63 74 7d 2c 75 3d 73 2e 5a 2e 72 65 61 63 74 50 61 72 73 65 72 46 6f 72 28 7b 2e 2e 2e 73 2e 5a 2e 67 75 69 6c 64 45 76 65 6e 74 52 75 6c 65 73 2c 6c 69 6e 6b 3a 72 2c 63 68 61 6e 6e 65 6c 4d 65 6e 74 69 6f 6e 3a 69 7d 29 7d 2c 33 31 35 34 31 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 73 3d 6e 28 31 39 32 33 37 39 29 2c 61 3d 6e 28 34 34 32 38 33 37 29 2c 6c 3d 6e 28 38 39 37 32 38 35 29 2c 72 3d 6e 28 39 32 34 33 30 31 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 2c 74 2c 6e 29 7b 6c 65 74 20 69 3d 28 30 2c 61 2e 65 37 29 28 5b 72 2e 5a 50 5d 2c 28 29 3d 3e 72 Data Ascii: uldStopPropagation:!0}).react},u=s.Z.reactParserFor({...s.Z.guildEventRules,link:r,channelMention:i})},315416:function(e,t,n){n.d(t,{Z:function(){return i}});var s=n(192379),a=n(442837),l=n(897285),r=n(924301);function i(e,t,n){let i=(0,a.e7)([r.ZP],()=>r
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 28 37 33 31 30 30 36 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 6c 65 74 7b 73 6f 75 72 63 65 3a 74 2c 63 6c 61 73 73 4e 61 6d 65 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 6e 75 6c 6c 3a 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 72 2e 63 6f 6e 74 61 69 6e 65 72 2c 6e 29 2c 73 74 79 6c 65 3a 7b 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 3a 22 75 72 6c 28 22 2e 63 6f 6e 63 61 74 28 74 2c 22 29 22 29 7d 7d 29 7d 7d 2c 37 34 32 35 39 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 48 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 52 66 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 2c 5a 50 3a 66 75 6e 63 74 69 6f 6e Data Ascii: (731006);function i(e){let{source:t,className:n}=e;return null==t?null:(0,s.jsx)("div",{className:l()(r.container,n),style:{backgroundImage:"url(".concat(t,")")}})}},742593:function(e,t,n){n.d(t,{HZ:function(){return h},Rf:function(){return g},ZP:function
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 72 63 3a 6e 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 61 2c 32 30 29 2c 73 69 7a 65 3a 69 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 30 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 6e 75 6c 6c 21 3d 41 3f 41 3a 6e 2e 75 73 65 72 6e 61 6d 65 2c 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 63 72 65 61 74 6f 72 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 69 2e 54 6f 6f 6c 74 69 70 2c 7b 74 65 78 74 3a 76 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 45 56 45 4e 54 5f 49 4e 54 45 52 45 53 54 45 44 5f 43 4f 55 4e 54 2e 66 6f 72 6d 61 74 28 7b 63 6f 75 6e 74 3a 4c 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 65 3d 3e 28 30 2c 73 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 72 73 76 70 43 6f 75 6e 74 2c 2e 2e 2e 65 2c 63 68 Data Ascii: src:n.getAvatarURL(a,20),size:i.AvatarSizes.SIZE_20,"aria-label":null!=A?A:n.username,className:x.creator})}),(0,s.jsx)(i.Tooltip,{text:v.Z.Messages.GUILD_EVENT_INTERESTED_COUNT.format({count:L}),children:e=>(0,s.jsxs)("div",{className:x.rsvpCount,...e,ch
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 65 76 69 65 77 3a 4e 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 5f 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 67 2c 7b 6e 61 6d 65 3a 6c 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 72 2c 68 65 61 64 65 72 56 61 72 69 61 6e 74 3a 74 2c 64 65 73 63 72 69 70 74 69 6f 6e 43 6c 61 73 73 4e 61 6d 65 3a 6e 2c 74 72 75 6e 63 61 74 65 3a 63 2c 67 75 69 6c 64 49 64 3a 6f 2c 69 6d 61 67 65 53 6f 75 72 63 65 3a 69 7d 29 5d 7d 29 7d 7d 2c 33 39 30 39 36 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 7d 7d 29 2c 6e 28 34 37 31 32 30 29 3b 76 61 72 20 73 2c 61 2c 6c 3d 6e 28 32 30 30 36 35 31 29 2c 72 3d 6e 28 31 39 32 33 37 39 29 2c 69 3d 6e 28 31 32 30 33 35 36 29 2c 75 3d 6e 2e 6e 28 69 Data Ascii: eview:N,recurrenceId:_}),(0,s.jsx)(g,{name:l,description:r,headerVariant:t,descriptionClassName:n,truncate:c,guildId:o,imageSource:i})]})}},390966:function(e,t,n){n.d(t,{z:function(){return L}}),n(47120);var s,a,l=n(200651),r=n(192379),i=n(120356),u=n.n(i
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 45 5f 43 48 41 4e 4e 45 4c 5f 48 41 50 50 45 4e 49 4e 47 5f 4e 4f 57 3a 78 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 53 54 41 47 45 5f 43 48 41 4e 4e 45 4c 5f 4c 49 56 45 5f 4e 4f 57 29 3b 6c 65 74 20 70 3d 28 30 2c 5f 2e 5a 29 28 49 2c 41 29 2c 5b 7b 73 74 61 72 74 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 6a 2c 65 6e 64 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 4f 2c 63 75 72 72 65 6e 74 4f 72 50 61 73 74 45 76 65 6e 74 3a 4d 2c 75 70 63 6f 6d 69 6e 67 45 76 65 6e 74 3a 55 2c 64 69 66 66 4d 69 6e 75 74 65 73 3a 77 7d 2c 47 5d 3d 72 2e 75 73 65 53 74 61 74 65 28 28 30 2c 54 2e 75 62 29 28 74 2c 69 29 29 3b 72 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 47 28 28 30 2c 54 2e 75 62 29 28 74 2c 69 29 29 3b 6c 65 74 20 65 3d 73 65 74 49 6e 74 65 72 76 61 Data Ascii: E_CHANNEL_HAPPENING_NOW:x.Z.Messages.STAGE_CHANNEL_LIVE_NOW);let p=(0,_.Z)(I,A),[{startDateTimeString:j,endDateTimeString:O,currentOrPastEvent:M,upcomingEvent:U,diffMinutes:w},G]=r.useState((0,T.ub)(t,i));r.useEffect(()=>{G((0,T.ub)(t,i));let e=setInterva
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2c 69 63 6f 6e 43 6f 6c 6f 72 3a 63 2e 68 65 78 2c 74 65 78 74 43 6f 6c 6f 72 3a 6f 2c 74 6f 6f 6c 74 69 70 54 65 78 74 3a 74 7d 7d 29 28 7b 74 69 6d 65 53 74 61 74 75 73 3a 62 2c 74 65 78 74 42 72 61 6e 64 3a 5a 2c 74 65 78 74 50 6f 73 69 74 69 76 65 3a 43 2c 74 65 78 74 44 61 6e 67 65 72 3a 52 2c 65 6e 64 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 4f 2c 73 74 61 72 74 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 6a 7d 29 2c 5b 62 2c 5a 2c 43 2c 52 2c 4f 2c 6a 5d 29 2c 57 3d 6e 75 6c 6c 3b 69 66 28 6e 75 6c 6c 21 3d 53 29 7b 6c 65 74 20 65 3d 28 30 2c 54 2e 48 6f 29 28 53 29 3b 57 3d 78 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 45 43 55 52 52 45 4e 43 45 5f 52 55 4c 45 2e 66 6f 72 6d 61 74 Data Ascii: ,iconColor:c.hex,textColor:o,tooltipText:t}})({timeStatus:b,textBrand:Z,textPositive:C,textDanger:R,endDateTimeString:O,startDateTimeString:j}),[b,Z,C,R,O,j]),W=null;if(null!=S){let e=(0,T.Ho)(S);W=x.Z.Messages.GUILD_SCHEDULED_EVENT_RECURRENCE_RULE.format
2024-10-24 07:16:25 UTC	137	IN	Data Raw: 2e 6a 73 78 29 28 64 2e 54 65 78 74 2c 7b 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 61 72 79 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 78 73 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 6c 64 72 65 6e 3a 57 7d 29 5d 7d 29 5d 7d 29 7d 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 64 38 36 37 38 38 62 65 39 39 65 38 37 30 39 39 33 32 31 34 2e 6a 73 2e 6d 61 70 Data Ascii: .jsx)(d.Text,{color:"header-secondary",variant:"text-xs/normal",children:W})]})]})}}}]);//# sourceMappingURL=d86788be99e870993214.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.10	49816	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/a14c32460cf87caa605c.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 12443 Connection: close CF-Ray: 8d782e6b4efc2e6b-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1fb8462302f6fbb9323f187505f5393f" Last-Modified: Tue, 15 Oct 2024 21:50:01 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PXGX1gWLM2bFY%2F42%2FnEWFKNyc%2FRXEiLWv1GG4GT1ilttyUmCtlRC7oIXeIz%2FhLrtnk4GhyRF9mT8cuZTTp9HCnQWAyMA0lEPHN8XumBrBjl93%2F6KlGIlr8YfoC8W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	403	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 35 33 39 33 22 5d 2c 7b 33 39 32 34 35 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 2c 25 33 43 73 76 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 36 36 20 33 38 27 20 77 69 64 74 68 3d 27 36 36 27 20 68 65 69 67 68 74 3d 27 33 38 27 25 33 45 25 33 43 72 65 63 74 20 78 3d 27 30 27 20 79 3d 27 30 27 20 77 69 64 74 68 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["95393"],{392459:function(e){e.exports="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 66 38' width='66' height='38'%3E%3Crect x='0' y='0' width
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 36 2e 31 32 32 20 35 2e 38 36 34 20 32 35 39 20 35 30 27 20 77 69 64 74 68 3d 27 32 35 39 27 20 68 65 69 67 68 74 3d 27 35 30 27 25 33 45 25 33 43 70 61 74 68 20 66 69 6c 6c 3d 27 25 32 33 30 30 30 30 30 30 27 20 66 69 6c 6c 2d 72 75 6c 65 3d 27 65 76 65 6e 6f 64 64 27 20 64 3d 27 4d 20 36 38 2e 31 32 32 20 31 31 2e 38 36 34 20 4c 20 31 39 32 2e 31 32 32 20 31 31 2e 38 36 34 20 43 20 31 39 33 2e 37 37 39 20 31 31 2e 38 36 34 20 31 39 35 2e 31 32 32 20 31 33 2e 32 30 37 20 31 39 35 2e 31 32 32 20 31 34 2e 38 36 34 20 4c 20 31 39 35 2e 31 32 32 20 32 38 2e 38 36 34 20 43 20 31 39 35 2e 31 32 32 20 33 30 2e 35 32 31 20 31 Data Ascii: g xmlns='http://www.w3.org/2000/svg' viewBox='6.122 5.864 259 50' width='259' height='50'%3E%3Cpath fill='%23000000' fill-rule='evenodd' d='M 68.122 11.864 L 192.122 11.864 C 193.779 11.864 195.122 13.207 195.122 14.864 L 195.122 28.864 C 195.122 30.521 1
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 28 37 34 39 32 31 30 29 2c 69 3d 6c 28 35 39 34 31 37 34 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 6c 65 74 20 6e 3d 28 30 2c 74 2e 65 37 29 28 5b 69 2e 64 65 66 61 75 6c 74 5d 2c 28 29 3d 3e 69 2e 64 65 66 61 75 6c 74 2e 67 65 74 55 73 65 72 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 63 72 65 61 74 6f 72 5f 69 64 29 2c 5b 65 5d 29 3b 72 65 74 75 72 6e 20 73 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 6e 75 6c 6c 3d 3d 6e 26 26 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 63 72 65 61 74 6f 72 5f 69 64 29 21 3d 6e 75 6c 6c 26 26 61 2e 5a 2e 72 65 71 75 65 73 74 4d 65 6d 62 65 72 73 42 79 49 64 28 65 2e 67 75 69 6c 64 5f 69 64 2c 65 2e 63 72 65 61 74 6f 72 5f 69 64 29 7d 2c 5b 65 2c 6e 5d 29 2c 6e 7d 7d 2c 31 31 38 36 38 3a 66 Data Ascii: (749210),i=l(594174);function o(e){let n=(0,t.e7)([i.default],()=>i.default.getUser(null==e?void 0:e.creator_id),[e]);return s.useEffect(()=>{null==n&&(null==e?void 0:e.creator_id)!=null&&a.Z.requestMembersById(e.guild_id,e.creator_id)},[e,n]),n}},11868:f
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 61 5d 29 3b 69 66 28 6e 75 6c 6c 3d 3d 4e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 20 49 3d 6e 75 6c 6c 3d 3d 43 3f 76 6f 69 64 20 30 3a 43 2e 49 63 6f 6e 43 6f 6d 70 6f 6e 65 6e 74 2c 78 3d 28 30 2c 73 2e 6a 73 78 73 29 28 73 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 49 26 26 28 30 2c 73 2e 6a 73 78 29 28 49 2c 7b 73 69 7a 65 3a 22 78 73 22 2c 63 6f 6c 6f 72 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 63 68 61 6e 6e 65 6c 49 63 6f 6e 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 63 68 61 6e 6e 65 6c 44 65 73 63 72 69 70 74 69 6f 6e 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 78 73 2f 6e 6f 72 6d 61 6c 22 2c 63 68 69 Data Ascii: a]);if(null==N)return null;let I=null==C?void 0:C.IconComponent,x=(0,s.jsxs)(s.Fragment,{children:[null!=I&&(0,s.jsx)(I,{size:"xs",color:"currentColor",className:k.channelIcon}),(0,s.jsx)(r.Text,{className:k.channelDescription,variant:"text-xs/normal",chi
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 2c 6f 6e 43 6c 69 63 6b 3a 65 3d 3e 7b 21 63 26 26 76 28 65 29 7d 2c 63 6f 6c 6f 72 3a 63 3f 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2e 54 52 41 4e 53 50 41 52 45 4e 54 3a 72 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2e 47 52 45 45 4e 2c 63 68 69 6c 64 72 65 6e 3a 63 3f 5a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 56 49 45 57 5f 44 45 54 41 49 4c 3a 5a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4a 4f 49 4e 5f 47 55 49 4c 44 7d 29 3a 69 3f 28 30 2c 73 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 62 75 74 74 6f 6e 2c 73 69 7a 65 3a 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 2c 64 69 73 61 62 Data Ascii: Button.Sizes.SMALL,onClick:e=>{!c&&v(e)},color:c?r.Button.Colors.TRANSPARENT:r.Button.Colors.GREEN,children:c?Z.Z.Messages.GUILD_SCHEDULED_EVENT_VIEW_DETAIL:Z.Z.Messages.JOIN_GUILD}):i?(0,s.jsx)(r.Button,{className:k.button,size:r.Button.Sizes.SMALL,disab
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 3b 6c 65 74 20 54 3d 28 30 2c 45 2e 78 74 29 28 6c 29 2c 5f 3d 28 30 2c 45 2e 5a 32 29 28 6c 29 2c 5a 3d 6c 2e 65 6e 74 69 74 79 5f 74 79 70 65 3d 3d 3d 42 2e 57 58 2e 45 58 54 45 52 4e 41 4c 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 6d 2e 5a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 69 28 29 28 7b 5b 6b 2e 63 6c 69 63 6b 61 62 6c 65 5d 3a 75 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 73 29 28 72 2e 43 6c 69 63 6b 61 62 6c 65 2c 7b 6f 6e 43 6c 69 63 6b 3a 67 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 6c 2e 69 6d 61 67 65 26 26 28 30 2c 73 2e 6a 73 78 29 28 66 2e 5a 2c 7b 73 6f 75 72 63 65 3a 28 30 2c 4c 2e 5a 29 28 6c 29 2c 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 62 61 6e 6e 65 72 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 53 2e 5a 50 Data Ascii: ;let T=(0,E.xt)(l),_=(0,E.Z2)(l),Z=l.entity_type===B.WX.EXTERNAL;return(0,s.jsx)(m.Z,{className:i()({[k.clickable]:u}),children:(0,s.jsxs)(r.Clickable,{onClick:g,children:[null!=l.image&&(0,s.jsx)(f.Z,{source:(0,L.Z)(l),className:k.banner}),(0,s.jsx)(S.ZP
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 45 52 45 53 54 45 44 3f 72 2e 67 76 2e 55 4e 49 4e 54 45 52 45 53 54 45 44 3a 72 2e 67 76 2e 49 4e 54 45 52 45 53 54 45 44 2c 45 3d 68 3d 3d 3d 72 2e 67 76 2e 49 4e 54 45 52 45 53 54 45 44 3f 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 53 56 50 5f 50 49 43 4b 45 52 5f 48 45 41 44 45 52 5f 49 4e 54 45 52 45 53 54 45 44 3a 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 53 56 50 5f 50 49 43 4b 45 52 5f 48 45 41 44 45 52 5f 55 4e 49 4e 54 45 52 45 53 54 45 44 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 61 2e 43 6f 6e 66 69 72 6d 4d 6f 64 61 6c 2c 7b 2e 2e 2e 4e 2c 68 65 61 64 65 72 3a 45 2c 63 6f 6e 66 69 72 6d 54 65 78 74 3a 75 Data Ascii: ERESTED?r.gv.UNINTERESTED:r.gv.INTERESTED,E=h===r.gv.INTERESTED?u.Z.Messages.GUILD_SCHEDULED_EVENT_RSVP_PICKER_HEADER_INTERESTED:u.Z.Messages.GUILD_SCHEDULED_EVENT_RSVP_PICKER_HEADER_UNINTERESTED;return(0,s.jsx)(a.ConfirmModal,{...N,header:E,confirmText:u
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 72 65 73 6f 6c 76 69 6e 67 42 61 63 6b 67 72 6f 75 6e 64 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 72 65 73 6f 6c 76 69 6e 67 46 61 6b 65 42 75 74 74 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 72 65 73 6f 6c 76 69 6e 67 42 61 63 6b 67 72 6f 75 6e 64 7d 29 7d 29 5d 7d 29 3a 6c 7d 29 7d 2c 6a 3d 65 3d 3e 7b 76 61 72 20 6e 3b 6c 65 74 7b 61 70 70 6c 69 63 61 74 69 6f 6e 3a 6c 2c 67 75 69 6c 64 3a 74 2c 63 68 61 6e 6e 65 6c 3a 61 2c 6f 6e 43 6c 69 63 6b 3a 63 2c 65 78 70 69 72 65 64 3a 64 3d 21 31 2c 75 73 65 72 3a 76 2c 63 6c 61 73 73 4e 61 6d Data Ascii: s.jsx)("div",{className:g.resolvingBackground})}),(0,s.jsx)("div",{className:g.resolvingFakeButton,children:(0,s.jsx)("div",{className:g.resolvingBackground})})]}):l})},j=e=>{var n;let{application:l,guild:t,channel:a,onClick:c,expired:d=!1,user:v,classNam
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 7d 2c 66 3d 65 3d 3e 7b 6c 65 74 7b 6d 65 6d 62 65 72 73 4f 6e 6c 69 6e 65 3a 6e 2c 6d 65 6d 62 65 72 73 3a 6c 7d 3d 65 2c 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 6e 26 26 6e 3e 30 26 26 74 2e 70 75 73 68 28 28 30 2c 73 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 73 74 61 74 75 73 57 72 61 70 70 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 73 2e 6a 73 78 29 28 22 69 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 73 74 61 74 75 73 4f 6e 6c 69 6e 65 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 63 6f 75 6e 74 2c 63 68 69 6c 64 72 65 6e 3a 45 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 49 4e 53 54 41 4e 54 5f 49 4e 56 49 54 45 5f 47 55 49 4c 44 5f 4d 45 4d 42 45 52 Data Ascii: },f=e=>{let{membersOnline:n,members:l}=e,t=[];return null!=n&&n>0&&t.push((0,s.jsxs)("div",{className:g.statusWrapper,children:[(0,s.jsx)("i",{className:g.statusOnline}),(0,s.jsx)("span",{className:g.count,children:E.Z.Messages.INSTANT_INVITE_GUILD_MEMBER
2024-10-24 07:16:25 UTC	1088	IN	Data Raw: 73 70 6c 61 73 68 2c 73 69 7a 65 3a 34 30 30 2a 28 30 2c 76 2e 78 5f 29 28 29 7d 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6f 3f 6e 75 6c 6c 3a 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 67 2e 69 6e 76 69 74 65 53 70 6c 61 73 68 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 29 28 22 69 6d 67 22 2c 7b 73 72 63 3a 6f 2c 61 6c 74 3a 22 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 69 28 29 28 67 2e 69 6e 76 69 74 65 53 70 6c 61 73 68 49 6d 61 67 65 2c 7b 5b 67 2e 69 6e 76 69 74 65 53 70 6c 61 73 68 49 6d 61 67 65 4c 6f 61 64 65 64 5d 3a 6c 7d 29 2c 6f 6e 4c 6f 61 64 3a 28 29 3d 3e 61 28 21 30 29 7d 29 7d 29 7d 2c 5a 3d 65 3d 3e 7b 6c 65 74 7b 67 75 69 6c 64 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 Data Ascii: splash,size:400*(0,v.x_)()});return null==o?null:(0,s.jsx)("div",{className:g.inviteSplash,children:(0,s.jsx)("img",{src:o,alt:"",className:i()(g.inviteSplashImage,{[g.inviteSplashImageLoaded]:l}),onLoad:()=>a(!0)})})},Z=e=>{let{guild:n}=e;return(0,s.jsx)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.10	49818	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/94ec0c2b39908933eed3.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 20718 Connection: close CF-Ray: 8d782e6b58a83acf-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "a2754accda171158f8f581ad49dfbb9c" Last-Modified: Fri, 18 Oct 2024 01:03:30 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qVrMC9iW0x5HLOxaFTrdWoqcK76sXv1pJZGZ6fLe4txH5U9qLky42o7p2U7cIuqs5%2F9PryTvMx9lJE31Ncz7EtgICGMQ46P0RXHI3eB7IbeDq18tpilyR5Xc6WFq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	411	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 35 37 38 38 22 5d 2c 7b 35 33 33 33 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6c 65 74 20 69 3b 76 61 72 20 73 3d 6e 28 35 34 34 38 39 31 29 2c 72 3d 6e 28 35 37 30 31 34 30 29 2c 6c 3d 6e 28 37 32 38 33 34 35 29 2c 6f 3d 6e 28 38 31 32 32 30 36 29 2c 61 3d 6e 28 36 32 35 31 32 38 29 2c 64 3d 6e 28 33 33 35 31 33 31 29 2c 75 3d 6e 28 36 36 39 30 37 39 29 2c 63 3d 6e 28 39 38 31 36 33 31 29 2c 5f 3d 6e 28 34 37 34 39 33 36 29 3b 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 45 28 65 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["25788"],{533307:function(e,t,n){let i;var s=n(544891),r=n(570140),l=n(728345),o=n(812206),a=n(625128),d=n(335131),u=n(669079),c=n(981631),_=n(474936);async function E(e){
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 45 22 2c 63 6f 64 65 3a 65 7d 29 3b 74 72 79 7b 6c 65 74 20 69 3d 61 77 61 69 74 20 28 30 2c 75 2e 62 54 29 28 65 2c 74 2c 6e 29 3b 69 66 28 6e 75 6c 6c 21 3d 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 26 26 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 21 3d 3d 5f 2e 43 4c 29 7b 6c 65 74 20 65 3d 6f 2e 5a 2e 67 65 74 41 70 70 6c 69 63 61 74 69 6f 6e 28 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 29 3b 69 66 28 6e 75 6c 6c 3d 3d 65 29 74 72 79 7b 61 77 61 69 74 20 6c 2e 5a 50 2e 66 65 74 63 68 41 70 70 6c 69 63 61 74 69 6f 6e 28 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 69 66 28 69 2e 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 3d 3d 3d 63 2e 58 41 4a 29 74 72 79 7b 61 77 61 69 74 20 28 30 2c 64 2e 6a Data Ascii: E",code:e});try{let i=await (0,u.bT)(e,t,n);if(null!=i.application_id&&i.application_id!==_.CL){let e=o.Z.getApplication(i.application_id);if(null==e)try{await l.ZP.fetchApplication(i.application_id)}catch(e){}}if(i.application_id===c.XAJ)try{await (0,d.j
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 62 6f 64 79 7d 63 61 74 63 68 28 6e 29 7b 72 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 49 46 54 5f 43 4f 44 45 5f 43 52 45 41 54 45 5f 46 41 49 4c 55 52 45 22 2c 73 6b 75 49 64 3a 65 2c 73 75 62 73 63 72 69 70 74 69 6f 6e 50 6c 61 6e 49 64 3a 74 7d 29 7d 7d 2c 61 73 79 6e 63 20 72 65 76 6f 6b 65 47 69 66 74 43 6f 64 65 28 65 29 7b 72 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 49 46 54 5f 43 4f 44 45 5f 52 45 56 4f 4b 45 22 2c 63 6f 64 65 3a 65 7d 29 3b 74 72 79 7b 61 77 61 69 74 20 73 2e 74 6e 2e 64 65 6c 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 55 53 45 52 5f 47 49 46 54 5f 43 4f 44 45 5f 52 45 56 4f 4b 45 28 65 29 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 72 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 Data Ascii: body}catch(n){r.Z.dispatch({type:"GIFT_CODE_CREATE_FAILURE",skuId:e,subscriptionPlanId:t})}},async revokeGiftCode(e){r.Z.dispatch({type:"GIFT_CODE_REVOKE",code:e});try{await s.tn.del({url:c.ANM.USER_GIFT_CODE_REVOKE(e),oldFormErrors:!0}),r.Z.dispatch({typ
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 20 74 3b 6c 65 74 7b 73 70 65 61 6b 65 72 3a 6e 2c 67 75 69 6c 64 49 64 3a 73 2c 69 73 45 6d 62 65 64 3a 72 7d 3d 65 2c 6c 3d 6e 65 77 20 45 2e 5a 28 6e 2e 75 73 65 72 29 3b 72 65 74 75 72 6e 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 6f 2e 41 76 61 74 61 72 2c 7b 73 72 63 3a 6c 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 73 2c 72 3f 31 36 3a 32 34 29 2c 73 69 7a 65 3a 72 3f 6f 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 31 36 3a 6f 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 34 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 22 22 2e 63 6f 6e 63 61 74 28 6e 2e 6e 69 63 6b 2c 22 2d 61 76 61 74 61 72 22 29 2c 63 Data Ascii: t;let{speaker:n,guildId:s,isEmbed:r}=e,l=new E.Z(n.user);return(0,i.jsxs)("div",{className:h.speaker,children:[(0,i.jsx)(o.Avatar,{src:l.getAvatarURL(s,r?16:24),size:r?o.AvatarSizes.SIZE_16:o.AvatarSizes.SIZE_24,"aria-label":"".concat(n.nick,"-avatar"),c
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 74 61 67 65 49 6e 73 74 61 6e 63 65 3a 6e 2c 67 75 69 6c 64 3a 72 2c 69 73 43 61 72 64 3a 45 3d 21 31 2c 69 73 45 6d 62 65 64 3a 66 3d 21 31 2c 6f 6e 43 6c 69 63 6b 3a 53 7d 3d 65 2c 49 3d 73 2e 75 73 65 4d 65 6d 6f 28 28 29 3d 3e 6e 75 6c 6c 3d 3d 72 3f 6e 75 6c 6c 3a 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 5a 50 3f 72 3a 6e 65 77 20 5f 2e 5a 50 28 72 29 2c 5b 72 5d 29 3b 69 66 28 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 75 6c 6c 3d 3d 49 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 7b 74 6f 70 69 63 3a 67 2c 73 70 65 61 6b 65 72 5f 63 6f 75 6e 74 3a 43 2c 70 61 72 74 69 63 69 70 61 6e 74 5f 63 6f 75 6e 74 3a 41 7d 3d 6e 2c 76 3d 6e 75 6c 6c 21 3d 3d 28 74 3d 6e 2e 6d 65 6d 62 65 72 73 29 26 26 76 6f 69 64 20 30 21 3d 3d 74 3f 74 3a 5b 5d 2c 52 3d 66 3f 76 Data Ascii: tageInstance:n,guild:r,isCard:E=!1,isEmbed:f=!1,onClick:S}=e,I=s.useMemo(()=>null==r?null:r instanceof _.ZP?r:new _.ZP(r),[r]);if(null==n\|\|null==I)return null;let{topic:g,speaker_count:C,participant_count:A}=n,v=null!==(t=n.members)&&void 0!==t?t:[],R=f?v
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 68 2e 6d 65 6d 62 65 72 73 2c 7b 5b 68 2e 65 6d 62 65 64 5d 3a 66 7d 29 2c 63 68 69 6c 64 72 65 6e 3a 5b 52 2e 6c 65 6e 67 74 68 3e 30 26 26 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 73 2c 63 68 69 6c 64 72 65 6e 3a 5b 52 2e 6d 61 70 28 65 3d 3e 28 30 2c 69 2e 6a 73 78 29 28 6d 2c 7b 73 70 65 61 6b 65 72 3a 65 2c 67 75 69 6c 64 49 64 3a 49 2e 69 64 2c 69 73 45 6d 62 65 64 3a 66 7d 2c 65 2e 75 73 65 72 2e 69 64 29 29 2c 4f 3e 30 3f 28 30 2c 69 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 73 70 65 61 6b 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 69 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e Data Ascii: ,{className:l()(h.members,{[h.embed]:f}),children:[R.length>0&&(0,i.jsxs)("div",{className:h.speakers,children:[R.map(e=>(0,i.jsx)(m,{speaker:e,guildId:I.id,isEmbed:f},e.user.id)),O>0?(0,i.jsxs)("div",{className:h.speaker,children:[(0,i.jsx)("div",{classN
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2e 44 45 45 50 5f 4c 49 4e 4b 5f 43 4c 49 43 4b 45 44 2c 7b 66 69 6e 67 65 72 70 72 69 6e 74 3a 28 30 2c 6f 2e 4b 29 28 6e 2e 66 69 6e 67 65 72 70 72 69 6e 74 29 2c 61 74 74 65 6d 70 74 5f 69 64 3a 6e 2e 61 74 74 65 6d 70 74 49 64 2c 73 6f 75 72 63 65 3a 6e 2e 75 74 6d 53 6f 75 72 63 65 7d 29 2c 45 2e 5a 2e 6c 61 75 6e 63 68 28 74 2c 65 3d 3e 7b 21 65 26 26 28 30 2c 64 2e 64 4c 29 28 63 2e 5a 2e 66 61 6c 6c 62 61 63 6b 52 6f 75 74 65 29 7d 29 7d 7d 2c 31 34 34 31 31 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 4c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 69 2c 73 2c 72 3d 6e 28 39 39 30 35 34 37 29 2c 6c 3d 6e 28 35 34 34 38 39 31 29 2c 6f 3d 6e 28 35 37 30 31 34 30 29 2c 61 3d 6e 28 Data Ascii: .DEEP_LINK_CLICKED,{fingerprint:(0,o.K)(n.fingerprint),attempt_id:n.attemptId,source:n.utmSource}),E.Z.launch(t,e=>{!e&&(0,d.dL)(c.Z.fallbackRoute)})}},144114:function(e,t,n){n.d(t,{L:function(){return s}});var i,s,r=n(990547),l=n(544891),o=n(570140),a=n(
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 6e 3a 6e 7d 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 76 61 6c 69 64 61 74 65 50 68 6f 6e 65 46 6f 72 53 75 70 70 6f 72 74 3a 65 3d 3e 6c 2e 74 6e 2e 70 6f 73 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 56 45 52 49 46 59 5f 50 48 4f 4e 45 5f 46 4f 52 5f 54 49 43 4b 45 54 2c 62 6f 64 79 3a 7b 74 6f 6b 65 6e 3a 65 7d 2c 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2c 61 73 79 6e 63 20 76 65 72 69 66 79 50 68 6f 6e 65 28 65 2c 74 29 7b 6c 65 74 20 6e 3d 21 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 7c 7c 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 33 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 Data Ascii: n:n},oldFormErrors:!0}),validatePhoneForSupport:e=>l.tn.post({url:c.ANM.VERIFY_PHONE_FOR_TICKET,body:{token:e},oldFormErrors:!0}),async verifyPhone(e,t){let n=!(arguments.length>2)\|\|void 0===arguments[2]\|\|arguments[2],i=arguments.length>3&&void 0!==argume
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 62 6f 74 2c 64 69 73 63 72 69 6d 69 6e 61 74 6f 72 3a 22 30 30 30 30 22 7d 2c 74 2c 38 30 29 7d 66 75 6e 63 74 69 6f 6e 20 45 28 65 29 7b 6c 65 74 20 74 3d 28 30 2c 61 2e 5f 49 29 28 65 2e 75 73 65 72 6e 61 6d 65 29 2e 72 65 70 6c 61 63 65 28 75 2e 52 4e 2c 22 22 29 2e 72 65 70 6c 61 63 65 28 75 2e 69 46 2c 22 2e 22 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 74 29 2e 63 6f 6e 63 61 74 28 65 2e 64 69 73 63 72 69 6d 69 6e 61 74 6f 72 29 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 33 32 29 7d 6c 65 74 20 70 3d 5b 22 40 22 2c 22 23 22 2c 22 3a 22 5d 2c 68 3d 5b 22 60 60 60 22 2c 22 64 69 73 63 6f 72 64 22 2c 22 68 79 70 65 73 71 75 61 64 22 2c 22 73 79 73 74 65 6d 20 6d 65 73 73 61 67 65 22 2c 22 73 79 73 74 65 Data Ascii: bot,discriminator:"0000"},t,80)}function E(e){let t=(0,a._I)(e.username).replace(u.RN,"").replace(u.iF,".").toLowerCase();return"".concat(t).concat(e.discriminator).substring(0,32)}let p=["@","#",":"],h=["```","discord","hypesquad","system message","syste
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 4c 5f 45 52 52 4f 52 2c 6d 65 73 73 61 67 65 3a 22 22 7d 29 29 2e 6f 74 68 65 72 77 69 73 65 28 28 29 3d 3e 76 6f 69 64 20 30 29 7d 66 75 6e 63 74 69 6f 6e 20 43 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 32 30 32 34 2c 32 2c 34 29 2e 74 6f 4c 6f 63 61 6c 65 44 61 74 65 53 74 72 69 6e 67 28 65 2c 7b 6d 6f 6e 74 68 3a 22 6c 6f 6e 67 22 2c 64 61 79 3a 22 6e 75 6d 65 72 69 63 22 2c 79 65 61 72 3a 22 6e 75 6d 65 72 69 63 22 7d 29 7d 7d 2c 31 30 38 34 32 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 2c 6e 28 34 37 31 32 30 29 3b 76 61 72 20 69 3d 6e 28 37 37 32 38 34 38 29 2c 73 3d 6e 28 35 37 39 38 30 36 29 2c 72 3d 6e 28 36 32 36 31 33 35 29 Data Ascii: L_ERROR,message:""})).otherwise(()=>void 0)}function C(e){return new Date(2024,2,4).toLocaleDateString(e,{month:"long",day:"numeric",year:"numeric"})}},108427:function(e,t,n){n.d(t,{e:function(){return d}}),n(47120);var i=n(772848),s=n(579806),r=n(626135)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.10	49824	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/36e086bbcea2eace814d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:25 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/javascript Content-Length: 18183 Connection: close CF-Ray: 8d782e6c8d774752-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "cb2e31554ec3ce69856dd70c281a6db7" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K2LrxUcB9OWrsUChenH8VQByxr1ZlphzF2bI0HJG20YMK9O3GaIaQwNcNPA1eujKXDb04Vf%2F4YtAWQ0ZWM%2FbqQrVa19%2Fn5BCSRmrx7dtiFTres638abI%2BdcsV1V5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 30 37 37 38 22 5d 2c 7b 34 31 38 37 35 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 62 37 64 31 64 63 36 62 30 37 34 36 31 30 31 37 31 39 63 35 2e 70 6e 67 22 7d 2c 34 39 34 32 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 38 35 31 35 33 66 65 37 31 38 37 33 64 61 30 66 35 38 30 32 2e 73 76 67 22 7d 2c 33 32 30 34 34 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["10778"],{418757:function(e){e.exports="/assets/b7d1dc6b0746101719c5.png"},494207:function(e){e.exports="/assets/85153fe71873da0f5802.svg"},320440:function(e){e.exports="/
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 36 36 39 35 37 4c 35 31 2e 30 33 35 34 20 33 2e 36 32 36 36 31 43 35 31 2e 39 37 38 33 20 33 2e 39 31 32 32 37 20 35 32 2e 39 30 35 37 20 34 2e 32 33 33 36 32 20 35 33 2e 38 31 36 31 20 34 2e 35 38 39 31 31 43 35 34 2e 31 33 31 31 20 33 2e 39 38 37 35 33 20 35 34 2e 34 38 33 32 20 33 2e 34 30 38 34 37 20 35 34 2e 38 36 39 34 20 32 2e 38 35 34 39 38 5a 4d 37 35 2e 34 31 30 39 20 32 36 2e 31 38 33 39 43 37 36 2e 30 31 32 35 20 32 35 2e 38 36 38 39 20 37 36 2e 35 39 31 35 20 32 35 2e 35 31 36 38 20 37 37 2e 31 34 35 20 32 35 2e 31 33 30 36 43 37 37 2e 35 37 30 39 20 32 36 2e 31 39 33 35 20 37 37 2e 39 35 32 35 20 32 37 2e 32 37 39 20 37 38 2e 32 38 37 35 20 32 38 2e 33 38 34 37 4c 37 37 2e 33 33 30 34 20 32 38 2e 36 37 34 36 4c 37 36 2e 33 37 33 34 20 32 38 Data Ascii: 66957L51.0354 3.62661C51.9783 3.91227 52.9057 4.23362 53.8161 4.58911C54.1311 3.98753 54.4832 3.40847 54.8694 2.85498ZM75.4109 26.1839C76.0125 25.8689 76.5915 25.5168 77.145 25.1306C77.5709 26.1935 77.9525 27.279 78.2875 28.3847L77.3304 28.6746L76.3734 28
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2e 31 38 30 34 35 20 33 36 2e 32 37 31 35 43 32 2e 30 36 31 31 32 20 33 37 2e 34 39 37 37 20 32 20 33 38 2e 37 34 31 34 20 32 20 34 30 43 32 20 34 31 2e 32 35 38 36 20 32 2e 30 36 31 31 32 20 34 32 2e 35 30 32 33 20 32 2e 31 38 30 34 35 20 34 33 2e 37 32 38 35 4c 31 2e 31 38 35 31 35 20 34 33 2e 38 32 35 33 4c 30 2e 31 38 39 38 35 33 20 34 33 2e 39 32 32 32 43 30 2e 30 36 34 32 36 38 20 34 32 2e 36 33 31 38 20 30 20 34 31 2e 33 32 33 34 20 30 20 34 30 5a 4d 32 2e 36 36 39 35 37 20 35 31 2e 33 32 35 34 4c 31 2e 37 31 32 35 33 20 35 31 2e 36 31 35 33 43 32 2e 34 37 38 39 37 20 35 34 2e 31 34 35 31 20 33 2e 34 38 39 32 36 20 35 36 2e 35 36 38 38 20 34 2e 37 31 36 30 34 20 35 38 2e 38 35 39 32 4c 35 2e 35 39 37 35 36 20 35 38 2e 33 38 37 31 4c 36 2e 34 37 39 Data Ascii: .18045 36.2715C2.06112 37.4977 2 38.7414 2 40C2 41.2586 2.06112 42.5023 2.18045 43.7285L1.18515 43.8253L0.189853 43.9222C0.064268 42.6318 0 41.3234 0 40ZM2.66957 51.3254L1.71253 51.6153C2.47897 54.1451 3.48926 56.5688 4.71604 58.8592L5.59756 58.3871L6.479
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 31 2e 30 33 35 34 43 37 35 2e 36 34 35 36 20 35 33 2e 34 33 37 35 20 37 34 2e 36 38 36 32 20 35 35 2e 37 33 39 33 20 37 33 2e 35 32 30 39 20 35 37 2e 39 31 34 39 4c 37 34 2e 34 30 32 34 20 35 38 2e 33 38 37 31 5a 22 2c 66 69 6c 6c 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 7d 29 2c 28 30 2c 45 2e 6a 73 78 29 28 22 63 69 72 63 6c 65 22 2c 7b 63 78 3a 22 36 38 22 2c 63 79 3a 22 31 32 22 2c 72 3a 22 31 32 22 2c 66 69 6c 6c 3a 22 23 35 38 36 35 66 32 22 7d 29 2c 28 30 2c 45 2e 6a 73 78 29 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 37 33 2e 33 33 33 32 20 31 31 2e 34 30 37 35 48 36 38 2e 35 39 32 34 56 36 2e 36 36 36 37 35 48 36 37 2e 34 30 37 32 56 31 31 2e 34 30 37 35 48 36 32 2e 36 36 36 35 56 31 32 2e 35 39 32 37 48 36 37 2e 34 30 37 32 56 31 37 2e 33 33 33 Data Ascii: 1.0354C75.6456 53.4375 74.6862 55.7393 73.5209 57.9149L74.4024 58.3871Z",fill:"currentColor"}),(0,E.jsx)("circle",{cx:"68",cy:"12",r:"12",fill:"#5865f2"}),(0,E.jsx)("path",{d:"M73.3332 11.4075H68.5924V6.66675H67.4072V11.4075H62.6665V12.5927H67.4072V17.333
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 34 20 32 38 2e 35 33 39 34 20 35 31 2e 37 30 34 48 32 38 2e 30 35 39 34 56 34 39 2e 32 36 38 48 32 38 2e 35 37 35 34 43 32 39 2e 34 38 37 34 20 34 39 2e 32 36 38 20 32 39 2e 39 35 35 34 20 34 39 2e 36 36 34 20 32 39 2e 39 35 35 34 20 35 30 2e 34 35 36 5a 4d 33 37 2e 38 32 39 32 20 35 36 4c 33 37 2e 35 35 33 32 20 35 34 2e 32 32 34 48 33 35 2e 30 30 39 32 56 34 37 2e 37 32 48 33 32 2e 39 35 37 32 56 35 36 48 33 37 2e 38 32 39 32 5a 4d 34 35 2e 39 35 35 38 20 35 31 2e 38 34 38 43 34 35 2e 39 35 35 38 20 34 39 2e 32 39 32 20 34 34 2e 34 30 37 38 20 34 37 2e 35 36 34 20 34 32 2e 30 30 37 38 20 34 37 2e 35 36 34 43 33 39 2e 36 30 37 38 20 34 37 2e 35 36 34 20 33 38 2e 30 34 37 38 20 34 39 2e 33 30 34 20 33 38 2e 30 34 37 38 20 35 31 2e 38 37 32 43 33 38 2e 30 Data Ascii: 4 28.5394 51.704H28.0594V49.268H28.5754C29.4874 49.268 29.9554 49.664 29.9554 50.456ZM37.8292 56L37.5532 54.224H35.0092V47.72H32.9572V56H37.8292ZM45.9558 51.848C45.9558 49.292 44.4078 47.564 42.0078 47.564C39.6078 47.564 38.0478 49.304 38.0478 51.872C38.0
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 6f 6c 64 46 6f 72 6d 45 72 72 6f 72 73 3a 21 30 7d 29 2e 74 68 65 6e 28 73 3d 3e 7b 6c 65 74 20 61 3d 73 2e 62 6f 64 79 3b 5f 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 41 43 43 45 50 54 5f 53 55 43 43 45 53 53 22 2c 63 6f 64 65 3a 65 2c 67 75 69 6c 64 3a 61 7d 29 2c 74 2e 5a 2e 69 73 43 6f 6e 6e 65 63 74 65 64 28 29 3f 72 2e 5a 2e 61 64 64 43 6f 6e 64 69 74 69 6f 6e 61 6c 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 28 28 29 3d 3e 7b 69 66 28 6e 75 6c 6c 21 3d 72 2e 5a 2e 67 65 74 47 75 69 6c 64 28 61 2e 69 64 29 29 72 65 74 75 72 6e 28 30 2c 6e 2e 58 29 28 61 2e 69 64 29 2c 6c 28 61 29 2c 21 31 7d 29 3a 28 28 30 2c 6e 2e 58 29 28 61 2e 69 64 29 2c 6c 28 61 29 29 7d 2c 73 3d 3e 7b 5f 2e 5a 2e 64 69 Data Ascii: oldFormErrors:!0}).then(s=>{let a=s.body;_.Z.dispatch({type:"GUILD_TEMPLATE_ACCEPT_SUCCESS",code:e,guild:a}),t.Z.isConnected()?r.Z.addConditionalChangeListener(()=>{if(null!=r.Z.getGuild(a.id))return(0,n.X)(a.id),l(a),!1}):((0,n.X)(a.id),l(a))},s=>{_.Z.di
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 54 49 54 4c 45 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 53 5f 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 43 52 45 41 54 4f 52 53 5f 48 4f 42 42 49 45 53 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 Data Ascii: .Z.Messages.GUILD_TEMPLATE_MODAL_TITLE_CREATORS_HOBBIES,description:_.Z.Messages.GUILD_TEMPLATE_MODAL_DESCRIPTION_CREATORS_HOBBIES,nameLabel:_.Z.Messages.GUILD_TEMPLATES_FORM_LABEL_SERVER_NAME_CREATORS_HOBBIES,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,d
2024-10-24 07:16:25 UTC	1369	IN	Data Raw: 54 45 4d 50 4c 41 54 45 53 5f 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 53 54 55 44 59 5f 47 52 4f 55 50 53 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 65 66 61 75 6c 74 4e 61 6d 65 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 44 45 46 41 55 4c 54 5f 53 45 52 56 45 52 5f 4e 41 4d 45 5f 53 54 55 44 59 5f 47 52 4f 55 50 53 2c 61 75 74 68 6f 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 44 49 53 43 4f 52 44 5f 4e 41 4d 45 7d 3b 63 61 73 65 20 45 2e 48 51 2e 43 52 45 41 54 45 5f 46 52 4f 4d 5f 53 43 52 41 54 43 48 3a 72 65 74 75 72 6e 7b 68 65 61 64 65 72 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 Data Ascii: TEMPLATES_FORM_LABEL_SERVER_NAME_STUDY_GROUPS,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,defaultName:_.Z.Messages.GUILD_TEMPLATE_DEFAULT_SERVER_NAME_STUDY_GROUPS,author:_.Z.Messages.DISCORD_NAME};case E.HQ.CREATE_FROM_SCRATCH:return{header:_.Z.Messages.G
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 54 49 54 4c 45 5f 47 49 54 48 55 42 5f 48 41 43 4b 41 54 48 4f 4e 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4d 4f 44 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 5f 47 49 54 48 55 42 5f 48 41 43 4b 41 54 48 4f 4e 2c 6e 61 6d 65 4c 61 62 65 6c 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 46 4f 52 4d 5f 4c 41 42 45 4c 5f 53 45 52 56 45 52 5f 4e 41 4d 45 2c 74 65 72 6d 73 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 45 52 56 45 52 5f 47 55 49 44 45 4c 49 4e 45 53 2c 64 65 66 61 75 6c 74 4e 61 6d 65 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 43 52 45 41 54 45 5f 53 Data Ascii: _.Z.Messages.GUILD_TEMPLATE_MODAL_TITLE_GITHUB_HACKATHON,description:_.Z.Messages.GUILD_TEMPLATE_MODAL_DESCRIPTION_GITHUB_HACKATHON,nameLabel:_.Z.Messages.FORM_LABEL_SERVER_NAME,terms:_.Z.Messages.CREATE_SERVER_GUIDELINES,defaultName:_.Z.Messages.CREATE_S
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 7c 7c 61 72 67 75 6d 65 6e 74 73 5b 31 5d 2c 5b 61 2c 74 5d 3d 5f 2e 75 73 65 53 74 61 74 65 28 22 22 29 2c 5b 6e 2c 72 5d 3d 5f 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 5b 4c 2c 6c 5d 3d 5f 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 69 3d 28 30 2c 52 2e 5a 29 28 65 2e 63 6f 64 65 29 3b 5f 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 28 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 6c 65 74 20 65 3d 6f 2e 64 65 66 61 75 6c 74 2e 67 65 74 43 75 72 72 65 6e 74 55 73 65 72 28 29 3b 69 66 28 6e 75 6c 6c 3d 3d 65 29 74 72 79 7b 65 3d 61 77 61 69 74 20 28 30 2c 43 2e 6b 29 28 29 7d 63 61 74 63 68 28 65 29 7b 63 2e 5a 2e 76 65 72 69 66 79 53 53 4f 54 6f 6b 65 6e 28 6e 75 6c 6c 29 7d 6e 75 6c 6c 21 3d 65 26 26 74 28 69 2e 64 65 66 61 75 Data Ascii: \|\|arguments[1],[a,t]=_.useState(""),[n,r]=_.useState(null),[L,l]=_.useState(null),i=(0,R.Z)(e.code);_.useEffect(()=>{(async function e(){let e=o.default.getCurrentUser();if(null==e)try{e=await (0,C.k)()}catch(e){c.Z.verifySSOToken(null)}null!=e&&t(i.defau

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.10	49822	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 39b78571-501e-0016-43f4-24181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071625Z-15b8d89586fx2hlt035xdehq580000000e5g0000000041fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.10	49821	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d2bab0c5-801e-0078-24f3-24bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071625Z-r197bdfb6b49k6rsrbz098tg8000000004e000000000fp9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.10	49819	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 043e3b4b-d01e-0049-50ae-24e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071625Z-15b8d89586fdmfsg1u7xrpfws000000002zg000000004nxw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.10	49823	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c52d6895-f01e-001f-0bd3-205dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071625Z-16849878b785g992cz2s9gk35c00000007a000000000e04s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:25 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.10	49820	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 135f94f0-d01e-002b-2a55-2225fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071625Z-16849878b78ngdnlw4w0762cms00000007c000000000df6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.10	49826	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/6df906184440a6461f5c.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:26 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/javascript Content-Length: 11167 Connection: close CF-Ray: 8d782e6e9d556c68-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "8aaa605c48dc545f185ca77c921139d3" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RrCxRcPMmrbPuUtRqpu71NiSrqLrYQOKOrjetdbme%2F3BQSwog9eGFuTl923a9UNHfr1c%2FvOJiFbc3d8sOOkWaAql9%2FrCLj5Z1dvQc7f%2F%2BleGdIBfSVYNvMVEz3dJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:26 UTC	403	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 35 32 30 33 30 22 5d 2c 7b 34 38 35 35 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 3b 76 61 72 20 6e 3d 73 28 36 38 39 39 33 38 29 3b 6c 65 74 20 6c 3d 7b 67 65 74 20 77 65 62 61 75 74 68 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 57 45 42 41 55 54 48 4e 5f 4e 41 4d 45 7d 2c 67 65 74 20 74 6f 74 70 28 29 7b 72 65 74 75 72 6e 20 6e 2e 5a 2e 4d 65 73 73 61 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["52030"],{48550:function(e,t,s){s.d(t,{P:function(){return l}});var n=s(689938);let l={get webauthn(){return n.Z.Messages.MFA_V2_WEBAUTHN_NAME},get totp(){return n.Z.Messa
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 42 41 43 4b 55 50 5f 4e 41 4d 45 7d 7d 7d 2c 31 32 34 38 36 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 43 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 59 52 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 7d 7d 29 2c 73 28 34 37 31 32 30 29 2c 73 28 34 31 31 31 30 34 29 3b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 2c 6c 3d 73 28 31 39 32 33 37 39 29 2c 69 3d 73 28 34 38 31 30 36 30 29 2c 72 3d 73 28 34 34 37 30 39 37 29 2c 6f 3d 73 28 38 37 33 31 32 34 29 2c 61 3d 73 28 32 34 38 39 30 32 29 2c 64 3d 73 28 31 36 30 35 31 31 29 2c 75 3d 73 28 35 31 36 39 33 29 2c 63 3d 73 28 39 37 33 38 31 30 29 2c 68 3d 73 28 36 38 39 39 33 38 29 3b Data Ascii: Z.Messages.MFA_V2_BACKUP_NAME}}},124860:function(e,t,s){s.d(t,{Cd:function(){return f},YR:function(){return S}}),s(47120),s(411104);var n=s(200651),l=s(192379),i=s(481060),r=s(447097),o=s(873124),a=s(248902),d=s(160511),u=s(51693),c=s(973810),h=s(689938);
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 6e 2e 6a 73 78 29 28 66 2c 7b 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 74 2c 6d 66 61 46 69 6e 69 73 68 3a 73 2c 6f 6e 43 6c 6f 73 65 3a 72 2c 6f 6e 45 61 72 6c 79 43 6c 6f 73 65 3a 72 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 53 28 65 2c 74 2c 73 29 7b 28 30 2c 69 2e 6f 70 65 6e 4d 6f 64 61 6c 29 28 73 3d 3e 28 30 2c 6e 2e 6a 73 78 29 28 6d 2c 7b 66 69 6e 69 73 68 3a 74 2c 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 65 2c 2e 2e 2e 73 7d 29 2c 7b 6f 6e 43 6c 6f 73 65 43 61 6c 6c 62 61 63 6b 3a 28 29 3d 3e 7b 73 28 45 72 72 6f 72 28 68 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 43 41 4e 43 45 4c 45 44 29 29 7d 7d 29 7d 7d 2c 35 30 37 34 35 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 3b 73 28 31 Data Ascii: n.jsx)(f,{mfaChallenge:t,mfaFinish:s,onClose:r,onEarlyClose:r})})}function S(e,t,s){(0,i.openModal)(s=>(0,n.jsx)(m,{finish:t,mfaChallenge:e,...s}),{onCloseCallback:()=>{s(Error(h.Z.Messages.MFA_V2_CANCELED))}})}},507453:function(e,t,s){var n=s(200651);s(1
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 72 6d 61 6c 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 6f 2e 73 75 62 74 69 74 6c 65 2c 63 68 69 6c 64 72 65 6e 3a 74 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 4d 6f 64 61 6c 43 6c 6f 73 65 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6f 2e 63 6c 6f 73 65 42 75 74 74 6f 6e 2c 6f 6e 43 6c 69 63 6b 3a 73 7d 29 5d 7d 29 7d 7d 7d 2c 34 34 37 30 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 2c 73 28 37 35 37 31 34 33 29 2c 73 28 34 37 31 32 30 29 2c 73 28 37 37 33 36 30 33 29 3b 76 61 72 20 6e 3d 73 28 32 30 30 36 35 31 29 2c 6c 3d 73 28 31 39 32 33 37 39 29 2c 69 3d 73 28 36 35 38 35 35 30 29 2c 72 3d 73 28 34 38 31 30 36 30 29 2c 6f 3d 73 28 35 30 37 Data Ascii: rmal",className:o.subtitle,children:t}),(0,n.jsx)(l.ModalCloseButton,{className:o.closeButton,onClick:s})]})}}},447097:function(e,t,s){s.d(t,{Z:function(){return d}}),s(757143),s(47120),s(773603);var n=s(200651),l=s(192379),i=s(658550),r=s(481060),o=s(507
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 32 33 37 39 29 2c 69 3d 73 28 34 38 31 30 36 30 29 2c 72 3d 73 28 35 30 37 34 35 33 29 2c 6f 3d 73 28 36 38 39 39 33 38 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 6c 65 74 7b 6d 66 61 43 68 61 6c 6c 65 6e 67 65 3a 74 2c 66 69 6e 69 73 68 3a 73 2c 73 65 74 53 6c 69 64 65 3a 61 2c 6f 6e 43 6c 6f 73 65 3a 64 2c 69 73 53 6c 69 64 65 52 65 61 64 79 3a 75 7d 3d 65 2c 5b 63 2c 68 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 21 31 29 2c 5b 66 2c 6d 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 5b 53 2c 5f 5d 3d 6c 2e 75 73 65 53 74 61 74 65 28 22 22 29 2c 67 3d 6c 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 6c 2e 75 73 65 45 66 66 65 63 74 28 28 29 3d 3e 7b 69 66 28 75 29 7b 76 61 72 20 65 3b 6e 75 6c 6c 3d 3d 3d 28 65 3d 67 2e 63 75 Data Ascii: 2379),i=s(481060),r=s(507453),o=s(689938);function a(e){let{mfaChallenge:t,finish:s,setSlide:a,onClose:d,isSlideReady:u}=e,[c,h]=l.useState(!1),[f,m]=l.useState(null),[S,_]=l.useState(""),g=l.useRef(null);return l.useEffect(()=>{if(u){var e;null===(e=g.cu
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 2c 6f 6e 43 6c 69 63 6b 3a 28 29 3d 3e 7b 73 28 65 2e 74 79 70 65 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 54 65 78 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 61 2e 6c 69 73 74 49 74 65 6d 54 65 78 74 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6d 64 2f 73 65 6d 69 62 6f 6c 64 22 2c 63 68 69 6c 64 72 65 6e 3a 72 2e 50 5b 65 2e 74 79 70 65 5d 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6c 2e 43 68 65 76 72 6f 6e 53 6d 61 6c 6c 52 69 67 68 74 49 63 6f 6e 2c 7b 73 69 7a 65 3a 22 63 75 73 74 6f 6d 22 2c 63 6f 6c 6f 72 3a 22 63 75 72 72 65 6e 74 43 6f 6c 6f 72 22 2c 77 69 64 74 68 3a 32 30 2c 68 65 69 67 68 74 3a 32 30 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 2e 6c 69 73 74 49 74 65 6d 41 72 72 6f 77 7d 29 5d 7d 2c 65 2e 74 79 70 65 29 29 Data Ascii: ,onClick:()=>{s(e.type)},children:[(0,n.jsx)(l.Text,{className:a.listItemText,variant:"text-md/semibold",children:r.P[e.type]}),(0,n.jsx)(l.ChevronSmallRightIcon,{size:"custom",color:"currentColor",width:20,height:20,className:a.listItemArrow})]},e.type))
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 6f 73 65 3a 66 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 61 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 6f 2e 46 6f 72 6d 49 74 65 6d 2c 7b 74 69 74 6c 65 3a 75 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 54 57 4f 5f 46 41 5f 45 4e 54 45 52 5f 54 4f 4b 45 4e 5f 4e 4f 5f 42 41 43 4b 55 50 5f 4c 41 42 45 4c 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 73 6d 73 49 6e 70 75 74 43 6f 6e 74 61 69 6e 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 54 65 78 74 49 6e 70 75 74 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 73 6d 73 49 6e 70 75 74 2c 69 6e 70 75 74 52 65 66 3a 4d 2c 6f 6e 43 68 61 6e 67 65 3a 5a Data Ascii: ose:f}),(0,n.jsx)(a.Z.SlideContent,{children:(0,n.jsxs)(o.FormItem,{title:u.Z.Messages.TWO_FA_ENTER_TOKEN_NO_BACKUP_LABEL,children:[(0,n.jsxs)("div",{className:c.smsInputContainer,children:[(0,n.jsx)(o.TextInput,{className:c.smsInput,inputRef:M,onChange:Z
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 26 26 76 6f 69 64 20 30 21 3d 3d 73 3f 73 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6d 65 73 73 61 67 65 29 7d 29 2e 66 69 6e 61 6c 6c 79 28 28 29 3d 3e 7b 66 28 21 31 29 7d 29 7d 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2e 53 6c 69 64 65 48 65 61 64 65 72 2c 7b 6f 6e 43 6c 6f 73 65 3a 75 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 6e 2e 6a 73 78 73 29 28 72 2e 46 6f 72 6d 49 74 65 6d 2c 7b 74 69 74 6c 65 3a 61 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 54 57 4f 5f 46 41 5f 45 4e 54 45 52 5f 54 4f 4b 45 4e 5f 4e 4f 5f 42 41 43 4b 55 50 5f 4c 41 42 45 4c 2c 63 68 69 6c 64 Data Ascii: &&void 0!==s?s:null===(t=e.body)\|\|void 0===t?void 0:t.message)}).finally(()=>{f(!1)})},children:[(0,n.jsx)(o.Z.SlideHeader,{onClose:u}),(0,n.jsx)(o.Z.SlideContent,{children:(0,n.jsxs)(r.FormItem,{title:a.Z.Messages.TWO_FA_ENTER_TOKEN_NO_BACKUP_LABEL,child
2024-10-24 07:16:26 UTC	1181	IN	Data Raw: 48 4e 5f 47 45 4e 45 52 49 43 5f 45 52 52 4f 52 29 7d 66 69 6e 61 6c 6c 79 7b 5f 28 21 31 29 7d 7d 3b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 73 29 28 6e 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 75 2e 5a 2e 53 6c 69 64 65 48 65 61 64 65 72 2c 7b 6f 6e 43 6c 6f 73 65 3a 6d 7d 29 2c 28 30 2c 6e 2e 6a 73 78 73 29 28 75 2e 5a 2e 53 6c 69 64 65 43 6f 6e 74 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 6e 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 73 75 62 6d 69 74 74 69 6e 67 3a 53 2c 6f 6e 43 6c 69 63 6b 3a 43 2c 63 68 69 6c 64 72 65 6e 3a 68 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 46 41 5f 56 32 5f 57 45 42 41 55 54 48 4e 5f 43 54 41 7d 29 2c 28 30 2c 6e 2e 6a 73 78 29 28 75 2e 5a 2e 53 6c 69 Data Ascii: HN_GENERIC_ERROR)}finally{_(!1)}};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(u.Z.SlideHeader,{onClose:m}),(0,n.jsxs)(u.Z.SlideContent,{children:[(0,n.jsx)(r.Button,{submitting:S,onClick:C,children:h.Z.Messages.MFA_V2_WEBAUTHN_CTA}),(0,n.jsx)(u.Z.Sli

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.10	49825	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:25 UTC	868	OUT	GET /assets/fdc71c23d09e18e94ce2.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:26 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/javascript Content-Length: 11547 Connection: close CF-Ray: 8d782e6ea82b4653-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "ac6ce4e7ff5f746693ab549f03be7ade" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3LdfRTDuPZWd9DzjRNbvqtmzh5ztSReXYB3X9J9g4GDLPkpp3P%2FAIIhBJoBeFn37nKl6BwQJjIu%2FP1mYBPboIcru8TD5hFLY1FvT7CqdPO0MuJweGjSyioPNR%2FEx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:26 UTC	407	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 30 36 32 38 22 5d 2c 7b 32 33 31 34 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 65 30 34 62 63 62 37 33 31 36 66 37 32 30 35 65 38 35 66 62 2e 73 76 67 22 7d 2c 37 34 38 33 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 32 33 61 37 61 33 66 64 36 36 32 34 33 34 32 31 31 37 62 66 2e 73 76 67 22 7d 2c 32 30 36 38 31 38 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["90628"],{231443:function(e){e.exports="/assets/e04bcb7316f7205e85fb.svg"},74830:function(e){e.exports="/assets/23a7a3fd6624342117bf.svg"},206818:function(e){e.exports="/a
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 32 33 62 2e 6d 70 34 22 7d 2c 35 35 34 33 35 35 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 66 62 37 30 63 36 33 32 35 61 37 64 37 32 38 63 62 36 64 30 2e 70 6e 67 22 7d 2c 39 39 31 39 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 34 38 61 64 31 39 65 38 30 30 38 33 62 65 65 36 38 32 64 32 2e 77 65 62 6d 22 7d 2c 37 38 37 34 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 61 34 37 36 38 36 33 64 34 66 34 34 31 36 31 38 38 34 30 66 2e 6d 6f 76 22 7d 2c 36 33 35 35 30 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 73 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 38 37 63 33 61 62 64 39 30 65 32 Data Ascii: 23b.mp4"},554355:function(e){e.exports="/assets/fb70c6325a7d728cb6d0.png"},991989:function(e,s,n){e.exports=n.p+"48ad19e80083bee682d2.webm"},787462:function(e,s,n){e.exports=n.p+"a476863d4f441618840f.mov"},635507:function(e,s,n){e.exports=n.p+"87c3abd90e2
2024-10-24 07:16:26 UTC	1261	IN	Data Raw: 6d 65 3a 68 2e 67 75 69 6c 64 49 63 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 28 30 2c 74 2e 6a 73 78 29 28 69 2e 56 6a 2c 7b 67 75 69 6c 64 3a 73 2c 73 69 7a 65 3a 69 2e 56 6a 2e 53 69 7a 65 73 2e 4c 41 52 47 45 52 2c 61 6e 69 6d 61 74 65 3a 21 30 7d 29 7d 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 3b 73 2e 5a 3d 65 3d 3e 7b 76 61 72 20 73 3b 6c 65 74 20 6e 2c 61 2c 75 2c 7b 69 6e 76 69 74 65 3a 6f 2c 64 69 73 61 62 6c 65 55 73 65 72 3a 66 3d 21 31 2c 65 72 72 6f 72 3a 53 2c 66 6c 61 74 41 63 74 69 76 69 74 79 43 6f 75 6e 74 3a 76 3d 21 31 2c 69 73 52 65 67 69 73 74 65 72 3a 4d 3d 21 31 7d 3d 65 2c 7b 63 75 72 72 65 6e 74 55 73 65 72 3a 52 2c 6d 75 6c 74 69 41 63 63 6f 75 6e 74 73 3a 4f 7d 3d 28 30 2c 6c 2e 63 6a 29 28 5b 6d 2e 5a 2c 45 2e 64 65 Data Ascii: me:h.guildIcon,children:(0,t.jsx)(i.Vj,{guild:s,size:i.Vj.Sizes.LARGER,animate:!0})});else return null};s.Z=e=>{var s;let n,a,u,{invite:o,disableUser:f=!1,error:S,flatActivityCount:v=!1,isRegister:M=!1}=e,{currentUser:R,multiAccounts:O}=(0,l.cj)([m.Z,E.de
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 65 3a 68 2e 69 63 6f 6e 2c 67 75 69 6c 64 3a 44 2c 73 69 7a 65 3a 69 2e 56 6a 2e 53 69 7a 65 73 2e 53 4d 41 4c 4c 7d 29 29 2c 61 3d 44 2e 6e 61 6d 65 2c 6e 75 6c 6c 21 3d 5a 26 26 28 61 3d 5a 2e 6e 61 6d 65 2c 75 3d 28 30 2c 74 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 74 2e 6a 73 78 29 28 69 2e 44 4b 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 61 70 70 49 6e 2c 63 68 69 6c 64 72 65 6e 3a 6a 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 45 4d 42 45 44 44 45 44 5f 41 43 54 49 56 49 54 49 45 53 5f 49 4e 56 49 54 45 5f 49 4e 7d 29 2c 28 30 2c 74 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 67 75 69 6c 64 43 6f 6e 74 61 69 6e 65 72 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 74 2e 6a 73 78 29 28 69 2e Data Ascii: e:h.icon,guild:D,size:i.Vj.Sizes.SMALL})),a=D.name,null!=Z&&(a=Z.name,u=(0,t.jsxs)("div",{children:[(0,t.jsx)(i.DK,{className:h.appIn,children:j.Z.Messages.EMBEDDED_ACTIVITIES_INVITE_IN}),(0,t.jsxs)("div",{className:h.guildContainer,children:[(0,t.jsx)(i.
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 73 78 29 28 69 2e 44 78 2c 7b 63 68 69 6c 64 72 65 6e 3a 53 7d 29 5d 7d 29 3a 28 30 2c 74 2e 6a 73 78 73 29 28 74 2e 46 72 61 67 6d 65 6e 74 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 74 2e 6a 73 78 29 28 69 2e 44 4b 2c 7b 63 68 69 6c 64 72 65 6e 3a 56 7d 29 2c 28 30 2c 74 2e 6a 73 78 73 29 28 69 2e 44 78 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 74 69 74 6c 65 2c 63 68 69 6c 64 72 65 6e 3a 5b 6e 75 6c 6c 21 3d 44 3f 28 30 2c 74 2e 6a 73 78 29 28 63 2e 5a 2c 7b 67 75 69 6c 64 3a 44 2c 63 6c 61 73 73 4e 61 6d 65 3a 68 2e 67 75 69 6c 64 42 61 64 67 65 2c 74 6f 6f 6c 74 69 70 50 6f 73 69 74 69 6f 6e 3a 22 6c 65 66 74 22 7d 29 3a 6e 75 6c 6c 2c 6e 2c 61 5d 7d 29 5d 7d 29 2c 75 2c 6e 75 6c 6c 21 3d 5a 7c 7c 42 7c 7c 28 6e 75 6c 6c 3d 3d 6f 3f 76 6f 69 64 20 Data Ascii: sx)(i.Dx,{children:S})]}):(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i.DK,{children:V}),(0,t.jsxs)(i.Dx,{className:h.title,children:[null!=D?(0,t.jsx)(c.Z,{guild:D,className:h.guildBadge,tooltipPosition:"left"}):null,n,a]})]}),u,null!=Z\|\|B\|\|(null==o?void
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 6c 64 72 65 6e 3a 6e 7d 29 7d 2c 67 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 73 72 63 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 22 69 6d 67 22 2c 7b 61 6c 74 3a 22 22 2c 73 72 63 3a 6e 2c 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 45 2e 69 6d 61 67 65 2c 73 29 7d 29 7d 2c 6a 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 2e 2e 2e 6e 7d 3d 65 2c 61 3d 6e 2e 6c 6f 6f 6b 3d 3d 3d 72 2e 42 75 74 74 6f 6e 2e 4c 6f 6f 6b 73 2e 4c 49 4e 4b 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 72 2e 42 75 74 74 6f 6e 2c 7b 73 69 7a 65 3a 61 3f 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 4d 49 4e 3a 72 2e 42 75 74 74 6f 6e 2e 53 69 7a 65 73 2e 4c 41 52 47 45 2c 66 75 6c 6c 57 69 64 74 68 3a 21 61 2c 63 6c Data Ascii: ldren:n})},g=e=>{let{className:s,src:n}=e;return(0,t.jsx)("img",{alt:"",src:n,className:l()(E.image,s)})},j=e=>{let{className:s,...n}=e,a=n.look===r.Button.Looks.LINK;return(0,t.jsx)(r.Button,{size:a?r.Button.Sizes.MIN:r.Button.Sizes.LARGE,fullWidth:!a,cl
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 6c 6c 21 3d 67 3f 28 30 2c 74 2e 6a 73 78 29 28 72 2e 46 6f 72 6d 54 65 78 74 2c 7b 74 79 70 65 3a 72 2e 46 6f 72 6d 54 65 78 74 2e 54 79 70 65 73 2e 44 45 53 43 52 49 50 54 49 4f 4e 2c 63 6c 61 73 73 4e 61 6d 65 3a 45 2e 64 65 73 63 72 69 70 74 69 6f 6e 2c 63 68 69 6c 64 72 65 6e 3a 67 7d 29 3a 6e 75 6c 6c 5d 7d 29 7d 2c 76 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 74 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 45 2e 62 6c 6f 63 6b 2c 73 29 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 7d 2c 4d 3d 65 3d 3e 7b 6c 65 74 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 63 68 69 6c 64 72 65 6e 3a 6e 2c 69 73 50 72 6f 6d 69 6e 65 6e 74 3a 61 7d 3d 65 Data Ascii: ll!=g?(0,t.jsx)(r.FormText,{type:r.FormText.Types.DESCRIPTION,className:E.description,children:g}):null]})},v=e=>{let{className:s,children:n}=e;return(0,t.jsx)("div",{className:l()(E.block,s),children:n})},M=e=>{let{className:s,children:n,isProminent:a}=e
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 28 30 2c 74 2e 6a 73 78 29 28 72 2e 54 65 78 74 2c 7b 74 61 67 3a 22 73 70 61 6e 22 2c 76 61 72 69 61 6e 74 3a 22 74 65 78 74 2d 6d 64 2f 6e 6f 72 6d 61 6c 22 2c 63 6f 6c 6f 72 3a 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 61 72 79 22 2c 63 68 69 6c 64 72 65 6e 3a 5f 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 4d 55 4c 54 49 5f 41 43 43 4f 55 4e 54 5f 53 45 52 56 45 52 5f 49 4e 56 49 54 45 5f 4a 4f 49 4e 49 4e 47 5f 41 53 7d 29 2c 28 30 2c 74 2e 6a 73 78 29 28 68 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 45 2e 6a 6f 69 6e 69 6e 67 41 73 41 76 61 74 61 72 2c 73 72 63 3a 73 2e 67 65 74 41 76 61 74 61 72 55 52 4c 28 76 6f 69 64 20 30 2c 32 34 29 2c 73 69 7a 65 3a 72 2e 41 76 61 74 61 72 53 69 7a 65 73 2e 53 49 5a 45 5f 32 34 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 73 2e Data Ascii: (0,t.jsx)(r.Text,{tag:"span",variant:"text-md/normal",color:"header-secondary",children:_.Z.Messages.MULTI_ACCOUNT_SERVER_INVITE_JOINING_AS}),(0,t.jsx)(h,{className:E.joiningAsAvatar,src:s.getAvatarURL(void 0,24),size:r.AvatarSizes.SIZE_24,"aria-label":s.
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 35 34 33 35 35 29 2c 4e 3d 6e 28 39 39 31 39 38 39 29 2c 5f 3d 6e 28 37 38 37 34 36 32 29 2c 45 3d 6e 28 36 33 35 35 30 37 29 2c 78 3d 6e 28 34 37 30 37 39 34 29 2c 70 3d 6e 28 38 38 36 37 37 37 29 3b 66 75 6e 63 74 69 6f 6e 20 54 28 65 29 7b 6c 65 74 7b 6d 6f 76 44 61 72 6b 3a 73 3d 6d 2c 6d 6f 76 4c 69 67 68 74 3a 6e 3d 5f 2c 6d 70 34 44 61 72 6b 3a 61 3d 64 2c 6d 70 34 4c 69 67 68 74 3a 6c 3d 45 2c 70 6e 67 44 61 72 6b 3a 72 3d 49 2c 70 6e 67 4c 69 67 68 74 3a 69 3d 78 2c 77 65 62 6d 44 61 72 6b 3a 6f 3d 4e 2c 77 65 62 6d 4c 69 67 68 74 3a 54 3d 70 7d 3d 65 2c 67 3d 28 30 2c 75 2e 76 75 29 28 29 2c 6a 3d 5b 28 30 2c 74 2e 6a 73 78 29 28 22 73 6f 75 72 63 65 22 2c 7b 73 72 63 3a 61 2c 74 79 70 65 3a 22 76 69 64 65 6f 2f 6d 70 34 22 7d 2c 22 6d 70 34 22 Data Ascii: 54355),N=n(991989),_=n(787462),E=n(635507),x=n(470794),p=n(886777);function T(e){let{movDark:s=m,movLight:n=_,mp4Dark:a=d,mp4Light:l=E,pngDark:r=I,pngLight:i=x,webmDark:o=N,webmLight:T=p}=e,g=(0,u.vu)(),j=[(0,t.jsx)("source",{src:a,type:"video/mp4"},"mp4"
2024-10-24 07:16:26 UTC	296	IN	Data Raw: 49 4c 22 2c 61 2e 56 45 52 49 46 59 5f 50 49 4e 3d 22 56 45 52 49 46 59 5f 50 49 4e 22 2c 61 2e 53 45 4c 45 43 54 5f 53 43 48 4f 4f 4c 3d 22 53 45 4c 45 43 54 5f 53 43 48 4f 4f 4c 22 2c 61 2e 53 45 4c 45 43 54 5f 53 43 48 4f 4f 4c 5f 53 45 41 52 43 48 3d 22 53 45 4c 45 43 54 5f 53 43 48 4f 4f 4c 5f 53 45 41 52 43 48 22 2c 61 2e 53 55 42 4d 49 54 5f 53 43 48 4f 4f 4c 3d 22 53 55 42 4d 49 54 5f 53 43 48 4f 4f 4c 22 2c 61 2e 45 4d 41 49 4c 5f 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 3d 22 45 4d 41 49 4c 5f 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 22 2c 61 2e 45 4d 41 49 4c 5f 57 41 49 54 4c 49 53 54 3d 22 45 4d 41 49 4c 5f 57 41 49 54 4c 49 53 54 22 3b 6c 65 74 20 6c 3d 22 38 38 34 39 32 34 38 37 33 30 31 35 36 38 39 32 32 36 22 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 Data Ascii: IL",a.VERIFY_PIN="VERIFY_PIN",a.SELECT_SCHOOL="SELECT_SCHOOL",a.SELECT_SCHOOL_SEARCH="SELECT_SCHOOL_SEARCH",a.SUBMIT_SCHOOL="SUBMIT_SCHOOL",a.EMAIL_CONFIRMATION="EMAIL_CONFIRMATION",a.EMAIL_WAITLIST="EMAIL_WAITLIST";let l="884924873015689226"}}]);//# sou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.10	49827	35.190.80.1	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	466	OUT	POST /report/v4?s=a%2BR7iMTa%2F4VkD2vLdyOE1EUBcQ3Fvi6CAy96XUioJPpYXxRD90StVtOwTA1Rk7C6G2VyZKfqY1z6oLmUlaw9dXfoe8gIGWlgCOCJ8xpPekpFKefvgbkPo9b8uqmb HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 442 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 07:16:26 UTC	442	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 39 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 36 36 39 2c 22 6d 65 74 68 6f 64 22 3a 22 50 4f 53 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 69 6e 76 69 74 65 2f 70 72 69 76 61 74 65 63 6f 6d 6d 75 6e 69 74 79 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 36 32 2e 31 35 39 2e 31 33 38 2e 32 33 32 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a Data Ascii: [{"age":19,"body":{"elapsed_time":669,"method":"POST","phase":"application","protocol":"http/1.1","referrer":"https://discord.com/invite/privatecommunity","sampling_fraction":1.0,"server_ip":"162.159.138.232","status_code":401,"type":"http.error"},"type":
2024-10-24 07:16:26 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Thu, 24 Oct 2024 07:16:26 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.10	49828	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	868	OUT	GET /assets/89b7ddebcacbe8dfbd3a.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:26 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/javascript Content-Length: 18462 Connection: close CF-Ray: 8d782e716856b78f-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "dc15d17d50a8a78e8c593e27fa1eaf57" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OH2K9NRwD%2B0KJGNGs3gwRONUzGnf8E70w69EgXIQx8JxmHGTX5foJcnMiQ1%2BdFoDZQN5JM20NMM5h8dotXF2QW%2B3ToZlMvXBw%2Bb6gZmvI8GSCLGMaZFf99w0339%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 30 30 31 31 22 5d 2c 7b 34 38 32 36 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 65 62 62 35 62 34 31 64 65 38 32 33 66 62 63 31 39 64 31 32 2e 70 6e 67 22 7d 2c 34 35 30 31 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 31 65 34 39 33 32 61 37 61 66 62 62 31 66 63 64 62 61 32 64 2e 70 6e 67 22 7d 2c 37 33 33 39 34 39 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["20011"],{482682:function(t){t.exports="/assets/ebb5b41de823fbc19d12.png"},450125:function(t){t.exports="/assets/1e4932a7afbb1fcdba2d.png"},733949:function(t){t.exports="/
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 7d 7d 29 2c 65 28 34 37 31 32 30 29 3b 76 61 72 20 73 2c 6e 3d 65 28 32 30 30 36 35 31 29 2c 68 3d 65 28 31 39 32 33 37 39 29 2c 61 3d 65 28 31 32 30 33 35 36 29 2c 72 3d 65 2e 6e 28 61 29 2c 6c 3d 65 28 37 34 38 37 38 30 29 2c 6f 3d 65 28 34 38 31 30 36 30 29 2c 64 3d 65 28 39 38 31 36 33 31 29 2c 75 3d 65 28 35 35 39 37 33 37 29 3b 66 75 6e 63 74 69 6f 6e 20 63 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 63 Data Ascii: {Z:function(){return p}}),e(47120);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(748780),o=e(481060),d=e(981631),u=e(559737);function c(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}c
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 3d 31 2f 31 32 30 3b 63 6c 61 73 73 20 79 20 65 78 74 65 6e 64 73 28 73 3d 68 2e 43 6f 6d 70 6f 6e 65 6e 74 29 7b 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 4d 6f 75 6e 74 28 29 7b 74 68 69 73 2e 69 6e 69 74 69 61 6c 69 7a 65 28 29 7d 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 55 70 64 61 74 65 28 74 29 7b 6c 65 74 7b 77 61 76 65 53 74 61 74 65 3a 69 7d 3d 74 68 69 73 2e 70 72 6f 70 73 3b 69 3d 3d 3d 76 2e 68 4f 2e 46 49 4c 4c 49 4e 47 26 26 69 21 3d 3d 74 2e 77 61 76 65 53 74 61 74 65 26 26 74 68 69 73 2e 77 61 76 65 46 69 6c 6c 28 29 7d 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 6e 6d 6f 75 6e 74 28 29 7b 74 68 69 73 2e 74 65 72 6d 69 6e 61 74 65 28 29 7d 69 6e 69 74 69 61 6c 69 7a 65 28 29 7b 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 2e 66 6f 72 45 61 63 68 28 74 3d 3e Data Ascii: =1/120;class y extends(s=h.Component){componentDidMount(){this.initialize()}componentDidUpdate(t){let{waveState:i}=this.props;i===v.hO.FILLING&&i!==t.waveState&&this.waveFill()}componentWillUnmount(){this.terminate()}initialize(){this.children.forEach(t=>
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 63 61 6e 76 61 73 43 6f 6e 74 65 78 74 3a 69 7d 3d 74 68 69 73 3b 69 66 28 6e 75 6c 6c 21 3d 69 29 69 2e 66 69 6c 6c 53 74 79 6c 65 3d 74 2c 69 2e 66 69 6c 6c 52 65 63 74 28 30 2c 30 2c 74 68 69 73 2e 77 69 64 74 68 2c 74 68 69 73 2e 68 65 69 67 68 74 29 2c 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 2e 66 6f 72 45 61 63 68 28 74 3d 3e 74 2e 72 65 6e 64 65 72 28 69 29 29 7d 72 65 6e 64 65 72 28 29 7b 6c 65 74 7b 77 61 76 65 53 74 61 74 65 3a 74 2c 68 69 64 65 46 61 6c 6c 62 61 63 6b 3a 69 2c 65 6d 62 65 64 64 65 64 3a 65 7d 3d 74 68 69 73 2e 70 72 6f 70 73 3b 72 65 74 75 72 6e 28 30 2c 6e 2e 6a 73 78 29 28 64 2e 41 63 63 65 73 73 69 62 69 6c 69 74 79 50 72 65 66 65 72 65 6e 63 65 73 43 6f 6e 74 65 78 74 2e 43 6f 6e 73 75 Data Ascii: =this.props,{canvasContext:i}=this;if(null!=i)i.fillStyle=t,i.fillRect(0,0,this.width,this.height),this.children.forEach(t=>t.render(i))}render(){let{waveState:t,hideFallback:i,embedded:e}=this.props;return(0,n.jsx)(d.AccessibilityPreferencesContext.Consu
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 75 6c 6c 21 3d 69 26 26 28 74 2e 77 69 64 74 68 3d 65 2a 6e 2c 74 2e 68 65 69 67 68 74 3d 73 2a 6e 2c 74 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 65 2b 22 70 78 22 2c 74 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 73 2b 22 70 78 22 2c 69 2e 73 63 61 6c 65 28 6e 2c 6e 29 29 2c 65 3c 3d 78 3f 74 68 69 73 2e 70 61 75 73 65 28 29 3a 74 68 69 73 2e 70 6c 61 79 28 29 2c 74 68 69 73 2e 77 61 76 65 2e 72 65 73 69 7a 65 57 61 76 65 28 29 2c 74 68 69 73 2e 72 65 6e 64 65 72 41 6e 69 6d 61 74 69 6f 6e 28 29 7d 29 2c 62 28 74 68 69 73 2c 22 68 61 6e 64 6c 65 56 69 73 69 62 69 6c 69 74 79 43 68 61 6e 67 65 22 2c 28 29 3d 3e 7b 64 6f 63 75 6d 65 6e 74 2e 68 69 64 64 65 6e 3f 74 68 69 73 2e 64 65 6c 61 79 65 64 50 61 75 73 65 28 29 3a 74 68 69 73 2e 70 6c 61 79 28 29 7d 29 Data Ascii: ull!=i&&(t.width=en,t.height=sn,t.style.width=e+"px",t.style.height=s+"px",i.scale(n,n)),e<=x?this.pause():this.play(),this.wave.resizeWave(),this.renderAnimation()}),b(this,"handleVisibilityChange",()=>{document.hidden?this.delayedPause():this.play()})
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 7d 7d 2c 35 36 38 31 35 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 29 7b 65 2e 64 28 69 2c 7b 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 7d 7d 29 2c 65 28 34 37 31 32 30 29 3b 76 61 72 20 73 2c 6e 3d 65 28 32 30 30 36 35 31 29 2c 68 3d 65 28 31 39 32 33 37 39 29 2c 61 3d 65 28 31 32 30 33 35 36 29 2c 72 3d 65 2e 6e 28 61 29 2c 6c 3d 65 28 34 37 37 36 39 30 29 2c 6f 3d 65 28 38 37 37 36 30 34 29 2c 64 3d 65 28 36 32 34 31 33 38 29 2c 75 3d 65 28 31 33 33 38 35 33 29 2c 63 3d 65 28 36 38 36 36 39 34 29 2c 70 3d 65 28 38 39 38 36 32 35 29 2c 6d 3d 65 28 32 30 31 36 38 30 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 Data Ascii: }},568154:function(t,i,e){e.d(i,{h:function(){return w}}),e(47120);var s,n=e(200651),h=e(192379),a=e(120356),r=e.n(a),l=e(477690),o=e(877604),d=e(624138),u=e(133853),c=e(686694),p=e(898625),m=e(201680);function f(t,i,e){return i in t?Object.defineProperty
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 64 74 68 3e 76 7d 72 65 6e 64 65 72 53 70 6c 61 73 68 41 72 74 28 29 7b 6c 65 74 7b 73 70 6c 61 73 68 3a 74 2c 65 6d 62 65 64 64 65 64 3a 69 7d 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 77 69 64 74 68 3a 65 2c 68 65 69 67 68 74 3a 73 7d 3d 74 68 69 73 2e 73 74 61 74 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 3f 28 30 2c 6e 2e 6a 73 78 29 28 6f 2e 5a 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 72 28 29 28 6d 2e 72 69 67 68 74 53 70 6c 69 74 2c 7b 5b 6d 2e 65 6d 62 65 64 64 65 64 5d 3a 69 7d 29 2c 73 72 63 3a 74 2c 77 69 64 74 68 3a 65 2c 68 65 69 67 68 74 3a 73 2c 6f 6e 4c 6f 61 64 3a 74 68 69 73 2e 68 61 6e 64 6c 65 4c 6f 61 64 7d 29 3a 6e 75 6c 6c 7d 72 65 6e 64 65 72 57 61 76 65 28 29 7b 6c 65 74 7b 77 61 76 65 53 74 61 74 65 3a 74 2c 75 70 64 61 74 65 57 61 Data Ascii: dth>v}renderSplashArt(){let{splash:t,embedded:i}=this.props,{width:e,height:s}=this.state;return null!=t?(0,n.jsx)(o.Z,{className:r()(m.rightSplit,{[m.embedded]:i}),src:t,width:e,height:s,onLoad:this.handleLoad}):null}renderWave(){let{waveState:t,updateWa
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 6c 65 74 7b 63 75 72 72 65 6e 74 54 61 72 67 65 74 3a 69 7d 3d 74 2c 7b 6e 61 74 75 72 61 6c 57 69 64 74 68 3a 65 2c 6e 61 74 75 72 61 6c 48 65 69 67 68 74 3a 73 7d 3d 69 2c 6e 3d 67 28 65 2c 73 29 3b 6e 75 6c 6c 21 3d 6e 26 26 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 6e 29 2c 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 7b 73 70 6c 61 73 68 4c 6f 61 64 65 64 3a 21 30 7d 29 2c 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 29 7d 29 7d 7d 66 28 62 2c 22 64 65 66 61 75 6c 74 50 72 6f 70 73 22 2c Data Ascii: let{currentTarget:i}=t,{naturalWidth:e,naturalHeight:s}=i,n=g(e,s);null!=n&&this.setState(n),this.setState({splashLoaded:!0}),window.removeEventListener("resize",this.handleResize),window.addEventListener("resize",this.handleResize)})}}f(b,"defaultProps",
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 64 65 64 22 2c 21 31 29 2c 68 28 74 68 69 73 2c 22 69 73 46 69 6c 6c 65 64 22 2c 21 31 29 2c 68 28 74 68 69 73 2c 22 61 6c 70 68 61 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 6d 78 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 6d 79 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 78 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 79 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 76 65 6c 58 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 76 65 6c 59 22 2c 30 29 2c 68 28 74 68 69 73 2c 22 74 61 72 67 65 74 58 22 2c 34 30 29 2c 68 28 74 68 69 73 2c 22 74 61 72 67 65 74 59 22 2c 34 30 29 2c 68 28 74 68 69 73 2c 22 73 70 72 69 6e 67 22 2c 7b 66 72 69 63 74 69 6f 6e 3a 36 30 2c 74 65 6e 73 69 6f 6e 3a 31 30 30 7d 29 2c 68 28 74 68 69 73 2c 22 68 61 6e 64 6c 65 4d 6f 75 73 65 4d 6f 76 65 22 2c 74 3d 3e 7b Data Ascii: ded",!1),h(this,"isFilled",!1),h(this,"alpha",0),h(this,"mx",0),h(this,"my",0),h(this,"x",0),h(this,"y",0),h(this,"velX",0),h(this,"velY",0),h(this,"targetX",40),h(this,"targetY",40),h(this,"spring",{friction:60,tension:100}),h(this,"handleMouseMove",t=>{
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 76 61 72 20 73 3d 65 28 39 35 36 38 34 33 29 2c 6e 3d 65 28 37 32 32 37 33 34 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 69 2c 65 29 7b 72 65 74 75 72 6e 20 69 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 69 2c 7b 76 61 6c 75 65 3a 65 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 69 5d 3d 65 2c 74 7d 69 2e 5a 3d 63 6c 61 73 73 20 74 7b 69 6e 69 74 69 61 6c 69 7a 65 28 29 7b 74 68 69 73 2e 70 61 72 74 69 63 6c 65 73 3d 5b 5d 2c 74 68 69 73 2e 77 69 6e 64 2e 69 6e 69 74 69 61 6c 69 7a 65 28 29 2c 74 68 69 73 2e 6c 6f 61 64 49 6e 54 69 6d 65 72 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 29 3d 3e 7b 66 6f 72 28 6c 65 74 20 Data Ascii: var s=e(956843),n=e(722734);function h(t,i,e){return i in t?Object.defineProperty(t,i,{value:e,enumerable:!0,configurable:!0,writable:!0}):t[i]=e,t}i.Z=class t{initialize(){this.particles=[],this.wind.initialize(),this.loadInTimer=setTimeout(()=>{for(let

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.10	49830	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	868	OUT	GET /assets/af6b8f380faee0e9f47d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:26 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/javascript Content-Length: 9359 Connection: close CF-Ray: 8d782e716d54346e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "52287a03a33104e4e3508b67501db130" Last-Modified: Tue, 15 Oct 2024 21:50:03 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8wGUBy5PYf9HIPY8n%2B5eAu2DzENKCgW%2F11TMpp3HPeralyKZSGdp%2FcODLQnboyAopiBDRzlZ9FU1SYccYxgDGB5N0%2FipaAHMYskUQDMK2tHKGrc2xWDA%2BzZddvZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:26 UTC	404	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 37 37 35 22 5d 2c 7b 32 39 32 38 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 30 30 66 65 38 61 36 35 35 37 65 32 30 34 65 62 39 35 30 33 2e 73 76 67 22 7d 2c 32 33 31 32 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 39 39 30 35 34 37 29 2c 69 3d 6e 28 32 38 33 36 39 33 29 2c 6c 3d 6e 28 35 37 30 31 34 30 29 2c 75 3d 6e 28 35 37 33 32 36 31 29 2c 6f 3d 6e 28 39 38 31 36 33 31 29 3b 65 2e 5a 3d 7b 73 69 67 6e 75 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["4775"],{292824:function(t){t.exports="/assets/00fe8a6557e204eb9503.svg"},231239:function(t,e,n){var r=n(990547),i=n(283693),l=n(570140),u=n(573261),o=n(981631);e.Z={signu
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 3a 74 3d 3e 7b 76 61 72 20 65 3b 6c 65 74 20 6e 3d 21 31 2c 72 3d 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 65 6d 61 69 6c 5f 64 6f 6d 61 69 6e 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 72 26 26 28 6e 3d 2d 31 21 3d 3d 72 2e 73 70 6c 69 74 28 22 2e 22 29 2e 69 6e 64 65 78 4f 66 28 22 65 64 75 22 29 29 2c 28 30 2c 69 2e 69 47 29 28 7b 69 73 5f 65 64 75 5f 65 6d 61 69 6c 3a 6e 7d 29 7d 7d 7d 29 2c 73 65 6e 64 56 65 72 69 66 69 63 61 74 69 6f 6e 45 6d 61 69 6c 3a 61 73 79 6e 63 28 74 2c 65 2c 6e 29 3d 3e 28 61 77 61 69 74 20 75 2e 5a 2e 70 6f 73 74 28 7b 75 72 6c 3a 6f 2e 41 4e 4d 2e 48 55 42 5f 45 4d 41 49 4c 5f 56 45 52 49 46 59 5f 53 45 Data Ascii: :t=>{var e;let n=!1,r=null==t?void 0:null===(e=t.body)\|\|void 0===e?void 0:e.email_domain;return null!=r&&(n=-1!==r.split(".").indexOf("edu")),(0,i.iG)({is_edu_email:n})}}}),sendVerificationEmail:async(t,e,n)=>(await u.Z.post({url:o.ANM.HUB_EMAIL_VERIFY_SE
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 31 29 3b 69 66 28 6e 28 31 39 32 33 37 39 29 2c 31 32 36 33 33 3d 3d 6e 2e 6a 29 76 61 72 20 69 3d 6e 28 35 31 32 39 36 39 29 3b 76 61 72 20 6c 3d 6e 28 38 36 30 39 31 31 29 2c 75 3d 6e 28 39 38 31 36 33 31 29 2c 6f 3d 6e 28 31 38 38 37 38 35 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 6c 65 74 20 74 3d 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2b 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 72 65 74 75 72 6e 20 6f 2e 61 3f 75 2e 5a 35 63 2e 52 45 47 49 53 54 45 52 3a 28 30 2c 6c 2e 55 69 29 28 74 2c 21 31 29 7d 65 2e 5a 3d 31 32 36 33 33 3d 3d 6e 2e 6a 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 30 2c 72 2e 6a 73 78 29 28 69 2e 6c 5f 2c 7b 74 6f 3a 61 28 29 7d 29 7d 3a 6e 75 6c 6c 7d 2c 39 36 32 32 32 30 3a 66 75 6e 63 74 69 6f Data Ascii: 1);if(n(192379),12633==n.j)var i=n(512969);var l=n(860911),u=n(981631),o=n(188785);function a(){let t=location.pathname+location.search;return o.a?u.Z5c.REGISTER:(0,l.Ui)(t,!1)}e.Z=12633==n.j?function(){return(0,r.jsx)(i.l_,{to:a()})}:null},962220:functio
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 72 69 7a 61 74 69 6f 6e 3a 6f 7d 2c 72 65 74 72 69 65 73 3a 33 7d 29 7d 63 61 74 63 68 28 65 29 7b 6c 65 74 20 74 3d 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 73 74 61 74 75 73 29 3d 3d 3d 34 30 31 7c 7c 28 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 73 74 61 74 75 73 29 3d 3d 3d 34 30 33 3b 6c 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 74 3f 22 4d 55 4c 54 49 5f 41 43 43 4f 55 4e 54 5f 56 41 4c 49 44 41 54 45 5f 54 4f 4b 45 4e 5f 46 41 49 4c 55 52 45 22 3a 22 4d 55 4c 54 49 5f 41 43 43 4f 55 4e 54 5f 56 41 4c 49 44 41 54 45 5f 54 4f 4b 45 4e 5f 53 55 43 43 45 53 53 22 2c 75 73 65 72 49 64 3a 75 7d 29 3b 72 65 74 75 72 6e 7d 6c 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 74 3d 3d 3d 75 3f 22 43 55 52 52 45 4e 54 5f Data Ascii: rization:o},retries:3})}catch(e){let t=(null==e?void 0:e.status)===401\|\|(null==e?void 0:e.status)===403;l.Z.dispatch({type:t?"MULTI_ACCOUNT_VALIDATE_TOKEN_FAILURE":"MULTI_ACCOUNT_VALIDATE_TOKEN_SUCCESS",userId:u});return}l.Z.dispatch({type:t===u?"CURRENT_
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 41 52 4b 45 54 49 4e 47 5f 55 4e 43 4c 41 49 4d 45 44 22 2c 69 5b 69 2e 49 4e 56 49 54 45 5f 55 4e 43 4c 41 49 4d 45 44 3d 31 5d 3d 22 49 4e 56 49 54 45 5f 55 4e 43 4c 41 49 4d 45 44 22 2c 69 5b 69 2e 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 3d 32 5d 3d 22 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 22 2c 69 5b 69 2e 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 5f 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 3d 33 5d 3d 22 4f 52 47 41 4e 49 43 5f 52 45 47 49 53 54 45 52 45 44 5f 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 22 7d 2c 31 37 39 36 34 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 2c 69 3d 6e 28 34 34 32 38 33 37 29 2c 6c 3d 6e 28 35 37 30 31 34 30 29 3b 66 75 6e 63 74 69 6f 6e 20 75 28 74 2c 65 Data Ascii: ARKETING_UNCLAIMED",i[i.INVITE_UNCLAIMED=1]="INVITE_UNCLAIMED",i[i.ORGANIC_REGISTERED=2]="ORGANIC_REGISTERED",i[i.ORGANIC_REGISTERED_GUILD_TEMPLATE=3]="ORGANIC_REGISTERED_GUILD_TEMPLATE"},179645:function(t,e,n){var r,i=n(442837),l=n(570140);function u(t,e
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 30 37 32 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6c 2c 75 2c 6f 2c 61 2c 63 2c 73 2c 5f 2c 64 3b 6e 2e 64 28 65 2c 7b 45 57 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 46 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 4d 4b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 58 32 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 6d 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 2c 28 61 3d 72 7c 7c 28 72 3d 7b 7d 29 29 2e 55 4e 4b 4e 4f 57 4e 3d 22 75 6e 6b 6e 6f 77 6e 22 2c 61 2e 41 4e 59 3d 22 61 6e 79 22 2c 61 2e 49 4e 56 49 54 45 3d 22 69 6e 76 69 74 65 22 2c 61 2e 4f 52 47 41 4e 49 43 3d 22 6f 72 67 61 6e 69 63 5f Data Ascii: 0724:function(t,e,n){var r,i,l,u,o,a,c,s,_,d;n.d(e,{EW:function(){return o},FF:function(){return i},MK:function(){return r},X2:function(){return u},mx:function(){return l}}),(a=r\|\|(r={})).UNKNOWN="unknown",a.ANY="any",a.INVITE="invite",a.ORGANIC="organic_
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 73 29 3b 69 66 28 6e 75 6c 6c 3d 3d 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 6c 65 74 7b 5b 6e 5d 3a 72 7d 3d 65 28 29 2e 66 6c 6f 77 73 2c 69 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 64 28 6e 29 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 63 75 72 72 65 6e 74 53 74 65 70 29 21 3d 6e 75 6c 6c 3f 6e 3a 6e 75 6c 6c 7d 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 66 28 74 2c 65 29 7b 6c 65 74 7b 5b 74 5d 3a 6e 2c 2e 2e 2e 72 7d 3d 45 2e 67 65 74 53 74 61 74 65 28 29 2e 66 6c 6f 77 73 2c 6c 3d 6e 75 6c 6c 21 3d 6e 3f 6e 3a 64 28 74 29 3b 69 66 28 28 6e 75 6c 6c 3d 3d 6c 3f 76 6f 69 64 20 30 3a 6c 2e 63 75 72 72 65 6e 74 53 74 65 70 29 3d 3d 6e 75 6c 6c 7c 7c 6c 2e 63 75 72 72 65 6e 74 53 74 65 70 21 3d 3d 65 29 28 30 2c 69 2e 6a 29 28 28 29 Data Ascii: s);if(null==n)return null;let{[n]:r}=e().flows,i=null!=r?r:d(n);return(null==i?void 0:i.currentStep)!=null?n:null}}));function f(t,e){let{[t]:n,...r}=E.getState().flows,l=null!=n?n:d(t);if((null==l?void 0:l.currentStep)==null\|\|l.currentStep!==e)(0,i.j)(()
2024-10-24 07:16:26 UTC	741	IN	Data Raw: 7b 2e 2e 2e 45 2e 67 65 74 53 74 61 74 65 28 29 2e 66 6c 6f 77 73 7d 3b 64 65 6c 65 74 65 20 65 5b 74 2e 74 79 70 65 5d 2c 28 30 2c 69 2e 6a 29 28 28 29 3d 3e 7b 45 2e 73 65 74 53 74 61 74 65 28 7b 66 6c 6f 77 73 3a 65 2c 63 75 72 72 65 6e 74 46 6c 6f 77 3a 6e 75 6c 6c 7d 29 7d 29 7d 7d 7d 2c 74 3d 3e 6e 75 6c 6c 21 3d 74 2e 63 75 72 72 65 6e 74 46 6c 6f 77 3f 74 2e 66 6c 6f 77 73 5b 74 2e 63 75 72 72 65 6e 74 46 6c 6f 77 5d 3a 76 6f 69 64 20 30 29 3b 66 75 6e 63 74 69 6f 6e 20 41 28 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 45 2e 67 65 74 53 74 61 74 65 28 29 2e 61 63 74 69 76 65 46 6c 6f 77 28 29 7d 65 2e 5a 3d 7b 66 6c 6f 77 53 74 61 72 74 3a 66 2c 66 6c 6f 77 53 74 65 70 4f 72 53 74 61 72 74 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 41 28 29 3f Data Ascii: {...E.getState().flows};delete e[t.type],(0,i.j)(()=>{E.setState({flows:e,currentFlow:null})})}}},t=>null!=t.currentFlow?t.flows[t.currentFlow]:void 0);function A(){return null!=E.getState().activeFlow()}e.Z={flowStart:f,flowStepOrStart:function(t,e){A()?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.10	49829	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	868	OUT	GET /assets/ea8b2ed5e609f40e7f7b.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:26 UTC	966	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/javascript Content-Length: 17794 Connection: close CF-Ray: 8d782e716ec12c89-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "8f5beb794777eac4c63978cd0ef850f4" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7RleKZ50tAE02apgH8IX7rvHUjUEhJhO%2FwTrKN3SGU%2BIFFKsQgobiWkJdzTgPbe7BGY5ahNlDzjYPhn0VP6%2FoL%2B8mJvwppTxGzux%2FGvgAhtf0Lfun0nIoxLxPPT7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:26 UTC	403	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 31 32 36 30 22 5d 2c 7b 32 36 32 33 30 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 61 66 64 34 34 61 65 30 35 31 32 36 62 35 66 61 62 34 30 64 2e 73 76 67 22 7d 2c 39 33 35 32 32 37 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 35 30 62 39 36 36 30 31 31 37 31 66 64 33 36 31 31 30 31 63 2e 73 76 67 22 7d 2c 34 37 39 34 39 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 73 28 37 35 37 31 34 33 29 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["11260"],{26230:function(e){e.exports="/assets/afd44ae05126b5fab40d.svg"},935227:function(e){e.exports="/assets/50b96601171fd361101c.svg"},479495:function(e,t,s){s(757143)
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 3d 73 28 31 32 34 38 36 30 29 2c 67 3d 73 28 31 30 38 34 32 37 29 2c 78 3d 73 28 33 31 34 38 39 37 29 2c 4e 3d 73 28 35 38 35 34 38 33 29 2c 76 3d 73 28 39 38 31 36 33 31 29 2c 45 3d 73 28 36 38 39 39 33 38 29 2c 53 3d 73 28 31 31 33 32 30 37 29 3b 66 75 6e 63 74 69 6f 6e 20 41 28 65 2c 74 2c 73 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 73 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 73 2c 65 7d 75 2e 5a 50 2e 69 6e 69 74 69 61 6c 69 7a 65 28 29 3b 63 6c 61 73 73 20 6a 20 65 78 74 65 6e 64 73 28 6e 3d 69 2e 50 75 72 65 43 6f 6d 70 6f 6e 65 6e 74 29 Data Ascii: =s(124860),g=s(108427),x=s(314897),N=s(585483),v=s(981631),E=s(689938),S=s(113207);function A(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}u.ZP.initialize();class j extends(n=i.PureComponent)
2024-10-24 07:16:26 UTC	1272	IN	Data Raw: 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 4c 4f 47 49 4e 5f 52 45 53 45 54 22 7d 29 7d 2c 77 69 64 74 68 3a 34 38 30 7d 29 7d 29 7d 72 65 6e 64 65 72 53 75 63 63 65 65 64 65 64 28 29 7b 72 65 74 75 72 6e 28 30 2c 72 2e 6a 73 78 73 29 28 6d 2e 5a 50 2c 7b 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 72 2e 6a 73 78 29 28 22 69 6d 67 22 2c 7b 61 6c 74 3a 22 22 2c 73 72 63 3a 73 28 32 36 32 33 30 29 2c 63 6c 61 73 73 4e 61 6d 65 3a 6f 28 29 28 53 2e 6d 61 72 67 69 6e 42 6f 74 74 6f 6d 32 30 2c 63 2e 74 71 3f 53 2e 6d 61 72 67 69 6e 54 6f 70 32 30 3a 22 22 29 7d 29 2c 28 30 2c 72 2e 6a 73 78 29 28 6d 2e 44 78 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 53 2e 6d 61 72 67 69 6e 42 6f 74 74 6f 6d 34 30 2c 63 68 69 6c 64 72 65 6e 3a 45 2e 5a 2e 4d 65 73 73 61 67 65 73 Data Ascii: .dispatch({type:"LOGIN_RESET"})},width:480})})}renderSucceeded(){return(0,r.jsxs)(m.ZP,{children:[(0,r.jsx)("img",{alt:"",src:s(26230),className:o()(S.marginBottom20,c.tq?S.marginTop20:"")}),(0,r.jsx)(m.Dx,{className:S.marginBottom40,children:E.Z.Messages
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 7d 7d 29 2c 41 28 74 68 69 73 2c 22 68 61 6e 64 6c 65 54 6f 6b 65 6e 53 75 62 6d 69 74 4d 46 41 76 32 22 2c 28 65 2c 74 29 3d 3e 7b 6c 65 74 7b 6c 6f 63 61 74 69 6f 6e 3a 73 2c 6d 66 61 54 69 63 6b 65 74 3a 6e 2c 6f 6e 4c 6f 67 69 6e 53 75 63 63 65 73 73 3a 72 2c 72 65 73 65 74 54 6f 6b 65 6e 3a 69 2c 73 6f 75 72 63 65 3a 61 7d 3d 74 68 69 73 2e 70 72 6f 70 73 2c 7b 70 61 73 73 77 6f 72 64 3a 6f 7d 3d 74 68 69 73 2e 73 74 61 74 65 3b 69 66 28 30 3d 3d 3d 6f 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 64 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 4c 4f 47 49 4e 5f 52 45 53 45 54 22 7d 29 2c 50 72 6f 6d 69 73 65 2e 72 65 6a 65 63 74 28 29 3b 6c 65 74 20 6c 3d 69 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 21 3d 73 26 26 28 6c 3d 28 30 2c 70 2e 5a 29 Data Ascii: }}),A(this,"handleTokenSubmitMFAv2",(e,t)=>{let{location:s,mfaTicket:n,onLoginSuccess:r,resetToken:i,source:a}=this.props,{password:o}=this.state;if(0===o.length)return d.Z.dispatch({type:"LOGIN_RESET"}),Promise.reject();let l=i;return(null!=s&&(l=(0,p.Z)
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 75 63 63 65 73 73 3a 21 31 7d 7d 7d 41 28 6a 2c 22 64 65 66 61 75 6c 74 50 72 6f 70 73 22 2c 7b 74 72 61 6e 73 69 74 69 6f 6e 54 6f 3a 65 3d 3e 73 2e 67 2e 6c 6f 63 61 74 69 6f 6e 2e 61 73 73 69 67 6e 28 65 29 2c 72 65 70 6c 61 63 65 57 69 74 68 3a 65 3d 3e 73 2e 67 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 65 29 7d 29 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 3d 28 30 2c 75 2e 63 6a 29 28 5b 78 2e 64 65 66 61 75 6c 74 5d 2c 28 29 3d 3e 28 7b 6c 6f 67 69 6e 53 74 61 74 75 73 3a 78 2e 64 65 66 61 75 6c 74 2e 67 65 74 4c 6f 67 69 6e 53 74 61 74 75 73 28 29 2c 6d 66 61 54 69 63 6b 65 74 3a 78 2e 64 65 66 61 75 6c 74 2e 67 65 74 4d 46 41 54 69 63 6b 65 74 28 29 2c 65 72 72 6f 72 73 3a 78 2e 64 65 66 61 75 6c 74 2e 67 65 74 Data Ascii: uccess:!1}}}A(j,"defaultProps",{transitionTo:e=>s.g.location.assign(e),replaceWith:e=>s.g.location.replace(e)});t.Z=function(e){let t=(0,u.cj)([x.default],()=>({loginStatus:x.default.getLoginStatus(),mfaTicket:x.default.getMFATicket(),errors:x.default.get
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 28 34 37 31 32 30 29 2c 73 28 36 35 33 30 34 31 29 3b 76 61 72 20 6e 2c 72 2c 69 3d 73 28 32 30 30 36 35 31 29 2c 61 3d 73 28 31 39 32 33 37 39 29 2c 6f 3d 73 28 31 32 30 33 35 36 29 2c 6c 3d 73 2e 6e 28 6f 29 2c 63 3d 73 28 36 30 30 31 36 34 29 2c 75 3d 73 28 36 38 30 39 32 34 29 3b 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 74 2c 73 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 73 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 73 2c 65 7d 63 6c 61 73 73 20 68 20 65 78 74 65 6e 64 73 28 6e 3d 61 2e 50 75 72 65 43 6f 6d 70 6f 6e 65 6e 74 29 7b 72 65 6e 64 65 Data Ascii: (47120),s(653041);var n,r,i=s(200651),a=s(192379),o=s(120356),l=s.n(o),c=s(600164),u=s(680924);function d(e,t,s){return t in e?Object.defineProperty(e,t,{value:s,enumerable:!0,configurable:!0,writable:!0}):e[t]=s,e}class h extends(n=a.PureComponent){rende
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 75 73 3a 30 3d 3d 3d 65 2c 6f 6e 43 68 61 6e 67 65 3a 74 3d 3e 74 68 69 73 2e 68 61 6e 64 6c 65 43 68 61 6e 67 65 28 65 2c 74 29 2c 6f 6e 4b 65 79 44 6f 77 6e 3a 74 3d 3e 74 68 69 73 2e 68 61 6e 64 6c 65 4b 65 79 44 6f 77 6e 28 65 2c 74 29 2c 63 6c 61 73 73 4e 61 6d 65 3a 74 7d 2c 65 29 29 3b 72 65 74 75 72 6e 28 30 2c 69 2e 6a 73 78 29 28 63 2e 5a 2c 7b 61 6c 69 67 6e 3a 63 2e 5a 2e 41 6c 69 67 6e 2e 43 45 4e 54 45 52 2c 6a 75 73 74 69 66 79 3a 63 2e 5a 2e 4a 75 73 74 69 66 79 2e 43 45 4e 54 45 52 2c 63 6c 61 73 73 4e 61 6d 65 3a 65 2c 63 68 69 6c 64 72 65 6e 3a 6e 7d 29 7d 73 65 74 43 6f 64 65 42 6c 6f 63 6b 52 65 66 28 65 2c 74 29 7b 74 68 69 73 2e 5f 63 6f 64 65 42 6c 6f 63 6b 52 65 66 73 5b 65 5d 3d 74 7d 68 61 6e 64 6c 65 43 68 61 6e 67 65 28 65 2c Data Ascii: us:0===e,onChange:t=>this.handleChange(e,t),onKeyDown:t=>this.handleKeyDown(e,t),className:t},e));return(0,i.jsx)(c.Z,{align:c.Z.Align.CENTER,justify:c.Z.Justify.CENTER,className:e,children:n})}setCodeBlockRef(e,t){this._codeBlockRefs[e]=t}handleChange(e,
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 6c 74 5d 2c 28 29 3d 3e 28 7b 63 75 72 72 65 6e 74 55 73 65 72 3a 43 2e 64 65 66 61 75 6c 74 2e 67 65 74 43 75 72 72 65 6e 74 55 73 65 72 28 29 2c 68 69 64 65 50 72 69 76 61 74 65 44 61 74 61 3a 66 2e 5a 2e 68 69 64 65 50 65 72 73 6f 6e 61 6c 49 6e 66 6f 72 6d 61 74 69 6f 6e 2c 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 3a 6d 2e 64 65 66 61 75 6c 74 2e 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 28 29 7d 29 29 2c 45 3d 6e 65 77 20 70 2e 5a 28 73 29 2c 79 3d 6f 26 26 28 6e 75 6c 6c 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 69 64 29 3d 3d 3d 45 2e 69 64 2c 54 3d 73 2e 74 6f 6b 65 6e 53 74 61 74 75 73 3d 3d 3d 76 2e 71 2e 49 4e 56 41 4c 49 44 2c 49 3d 61 7c 7c 45 2e 69 73 50 6f 6d 65 6c 6f 28 29 3f 6e 75 6c 6c 3a 22 23 22 2e 63 6f 6e 63 61 74 28 45 2e 64 69 Data Ascii: lt],()=>({currentUser:C.default.getCurrentUser(),hidePrivateData:f.Z.hidePersonalInformation,isAuthenticated:m.default.isAuthenticated()})),E=new p.Z(s),y=o&&(null==r?void 0:r.id)===E.id,T=s.tokenStatus===v.q.INVALID,I=a\|\|E.isPomelo()?null:"#".concat(E.di
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 2e 6a 58 45 2e 4d 41 4e 41 47 45 5f 41 43 43 4f 55 4e 54 53 5f 4d 4f 44 41 4c 7d 7d 29 2c 4e 2e 79 44 28 73 2e 69 64 29 2c 6e 28 31 2c 73 2e 69 64 29 7d 2c 63 6f 6c 6f 72 3a 75 2e 42 75 74 74 6f 6e 2e 43 6f 6c 6f 72 73 2e 50 52 49 4d 41 52 59 2c 63 68 69 6c 64 72 65 6e 3a 54 3f 41 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 53 57 49 54 43 48 5f 41 43 43 4f 55 4e 54 53 5f 41 43 54 49 4f 4e 5f 4c 4f 47 5f 49 4e 3a 74 7d 29 2c 28 30 2c 69 2e 6a 73 78 29 28 75 2e 42 75 74 74 6f 6e 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6a 2e 75 73 65 72 41 63 74 69 6f 6e 4d 65 6e 75 2c 6f 6e 43 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 30 2c 68 2e 76 71 29 28 65 2c 65 3d 3e 7b 6c 65 74 7b 6f 6e 53 65 6c 65 63 74 3a 74 7d 3d 65 3b 72 65 74 75 72 6e 28 30 2c 69 2e 6a 73 78 29 Data Ascii: .jXE.MANAGE_ACCOUNTS_MODAL}}),N.yD(s.id),n(1,s.id)},color:u.Button.Colors.PRIMARY,children:T?A.Z.Messages.SWITCH_ACCOUNTS_ACTION_LOG_IN:t}),(0,i.jsx)(u.Button,{className:j.userActionMenu,onClick:function(e){(0,h.vq)(e,e=>{let{onSelect:t}=e;return(0,i.jsx)
2024-10-24 07:16:26 UTC	1369	IN	Data Raw: 49 54 43 48 45 44 3d 31 5d 3d 22 53 57 49 54 43 48 45 44 22 2c 72 5b 72 2e 52 45 4d 4f 56 45 44 3d 32 5d 3d 22 52 45 4d 4f 56 45 44 22 7d 2c 37 34 32 34 35 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 73 29 7b 76 61 72 20 6e 2c 72 3b 73 2e 64 28 74 2c 7b 4e 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 6f 39 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 28 72 3d 6e 7c 7c 28 6e 3d 7b 7d 29 29 2e 50 48 4f 4e 45 3d 22 70 68 6f 6e 65 22 2c 72 2e 45 4d 41 49 4c 3d 22 65 6d 61 69 6c 22 3b 6c 65 74 20 69 3d 2f 5e 5b 2d 28 29 20 5c 64 5d 2b 24 2f 2c 61 3d 65 3d 3e 65 2e 73 74 61 72 74 73 57 69 74 68 28 22 2b 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 74 29 7b 72 65 74 75 72 6e 22 70 68 6f 6e 65 22 3d 3d 3d 65 Data Ascii: ITCHED=1]="SWITCHED",r[r.REMOVED=2]="REMOVED"},742458:function(e,t,s){var n,r;s.d(t,{Nz:function(){return n},o9:function(){return o}}),(r=n\|\|(n={})).PHONE="phone",r.EMAIL="email";let i=/^[-() \d]+$/,a=e=>e.startsWith("+");function o(e,t){return"phone"===e

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.10	49833	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:26 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 013f0f94-801e-00ac-2ef3-24fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071626Z-15b8d89586fsx9lfqmgrbzpgmg0000000e2g000000008shc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:26 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.10	49832	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 2f548e5b-201e-003c-5d24-2130f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071626Z-16849878b78dkr6tqerbnpg1zc00000007d0000000006wsn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.10	49834	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:26 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8c481607-b01e-0053-3f2b-21cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071626Z-16849878b785jsrm4477mv3ezn000000078000000000dqkq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:26 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.10	49835	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:26 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:26 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3e8b3e47-701e-006f-544e-22afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071626Z-16849878b786wvrz321uz1cknn00000007b000000000bn6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:26 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.10	49836	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	868	OUT	GET /assets/6674c18c2e4160ceca2d.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	961	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/javascript Content-Length: 9368 Connection: close CF-Ray: 8d782e756d80b789-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "484b9f4bda963a4ade71a4eb95d2538f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OBgovhwJIEz3vwuS9fdjb6z8Eh%2FmwrkfQj9faUiCXEhm7JHD85oBqy%2FK7Mkl%2BQExJTTfiUz9QIRFkNF9mNfVITKu4RH5Mkn4gwAG7nsxwVMXpbcZ5GQBWXaKRySX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	408	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 38 34 39 35 36 22 5d 2c 7b 39 38 36 31 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 3d 6e 28 39 39 30 35 34 37 29 2c 6f 3d 6e 28 35 34 34 38 39 31 29 2c 61 3d 6e 28 35 37 30 31 34 30 29 2c 73 3d 6e 28 38 38 31 30 35 32 29 2c 72 3d 6e 28 36 32 36 31 33 35 29 2c 75 3d 6e 28 35 37 33 32 36 31 29 2c 6c 3d 6e 28 35 34 35 38 35 31 29 2c 67 3d 6e 28 31 30 39 34 38 38 29 2c 64 3d 6e 28 37 39 34 30 39 39 29 2c 63 3d 6e 28 39 38 31 36 33 31 29 2c 6d 3d 6e 28 36 38 39 39 33 38 29 3b 6e 28 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["84956"],{986197:function(e,t,n){var i=n(990547),o=n(544891),a=n(570140),s=n(881052),r=n(626135),u=n(573261),l=n(545851),g=n(109488),d=n(794099),c=n(981631),m=n(689938);n(
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 31 35 30 30 3b 69 66 28 21 21 28 30 2c 64 2e 76 63 29 28 29 29 7b 61 2e 5a 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 50 4f 4d 45 4c 4f 5f 53 55 47 47 45 53 54 49 4f 4e 53 5f 52 45 53 45 54 22 7d 29 3b 74 72 79 7b 76 61 72 20 6e 3b 6c 65 74 20 69 3d 61 77 61 69 74 20 6f 2e 74 6e 2e 67 65 74 28 7b 75 72 6c 3a 63 2e 41 4e 4d 2e 50 4f 4d 45 4c 4f 5f 53 55 47 47 45 53 54 49 4f 4e 53 5f 55 4e 41 55 54 48 45 44 2c 71 75 65 72 79 3a 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 7b 67 6c 6f 62 61 6c 5f 6e 61 6d 65 3a 65 7d 2c 74 69 6d 65 6f 75 74 3a 74 7d 29 3b 69 66 28 69 2e 6f 6b 26 26 28 6e 75 6c 6c 3d 3d 3d 28 6e 3d 69 2e 62 6f 64 79 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d Data Ascii: ==arguments[1]?arguments[1]:1500;if(!!(0,d.vc)()){a.Z.dispatch({type:"POMELO_SUGGESTIONS_RESET"});try{var n;let i=await o.tn.get({url:c.ANM.POMELO_SUGGESTIONS_UNAUTHED,query:null==e?void 0:{global_name:e},timeout:t});if(i.ok&&(null===(n=i.body)\|\|void 0===
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 4d 50 54 5f 46 41 49 4c 55 52 45 22 2c 75 73 65 72 6e 61 6d 65 3a 65 2c 65 72 72 6f 72 3a 45 7d 29 3b 69 66 28 21 21 28 30 2c 6c 2e 45 29 28 29 29 74 72 79 7b 6c 65 74 20 74 3d 61 77 61 69 74 20 75 2e 5a 2e 70 6f 73 74 28 7b 75 72 6c 3a 67 3f 63 2e 41 4e 4d 2e 50 4f 4d 45 4c 4f 5f 41 54 54 45 4d 50 54 5f 55 4e 41 55 54 48 45 44 3a 63 2e 41 4e 4d 2e 50 4f 4d 45 4c 4f 5f 41 54 54 45 4d 50 54 2c 62 6f 64 79 3a 7b 75 73 65 72 6e 61 6d 65 3a 65 7d 2c 74 72 61 63 6b 65 64 41 63 74 69 6f 6e 44 61 74 61 3a 7b 65 76 65 6e 74 3a 69 2e 4e 65 74 77 6f 72 6b 41 63 74 69 6f 6e 4e 61 6d 65 73 2e 50 4f 4d 45 4c 4f 5f 41 54 54 45 4d 50 54 2c 70 72 6f 70 65 72 74 69 65 73 3a 7b 72 65 71 75 65 73 74 65 64 5f 75 73 65 72 6e 61 6d 65 3a 65 7d 7d 7d 29 3b 74 2e 62 6f 64 79 2e Data Ascii: MPT_FAILURE",username:e,error:E});if(!!(0,l.E)())try{let t=await u.Z.post({url:g?c.ANM.POMELO_ATTEMPT_UNAUTHED:c.ANM.POMELO_ATTEMPT,body:{username:e},trackedActionData:{event:i.NetworkActionNames.POMELO_ATTEMPT,properties:{requested_username:e}}});t.body.
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 45 78 70 6f 73 75 72 65 3a 21 31 7d 29 2e 65 6e 61 62 6c 65 64 7d 2c 36 35 34 33 34 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 63 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 6c 65 74 20 69 3d 28 30 2c 6e 28 38 31 38 30 38 33 29 2e 42 29 28 7b 6b 69 6e 64 3a 22 75 73 65 72 22 2c 6c 61 62 65 6c 3a 22 50 6f 6d 65 6c 6f 20 44 65 62 6f 75 6e 63 65 20 44 65 6c 61 79 22 2c 69 64 3a 22 32 30 32 33 2d 30 33 5f 70 6f 6d 65 6c 6f 5f 64 65 62 6f 75 6e 63 65 5f 64 65 6c 61 79 22 2c 64 65 66 61 75 6c 74 43 6f 6e 66 69 67 3a 7b 64 65 6c 61 79 3a 36 30 30 7d 2c 74 72 65 61 74 6d 65 6e 74 73 3a 5b 7b 69 64 3a 31 2c 6c 61 62 65 6c 3a 22 36 30 30 6d 73 22 2c 63 6f 6e 66 69 67 3a 7b 64 65 6c 61 79 3a 36 30 30 7d 7d Data Ascii: Exposure:!1}).enabled},654344:function(e,t,n){n.d(t,{c:function(){return o}});let i=(0,n(818083).B)({kind:"user",label:"Pomelo Debounce Delay",id:"2023-03_pomelo_debounce_delay",defaultConfig:{delay:600},treatments:[{id:1,label:"600ms",config:{delay:600}}
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 2e 75 73 65 72 6e 61 6d 65 53 75 67 67 65 73 74 69 6f 6e 4c 6f 61 64 69 6e 67 7d 69 73 43 75 72 72 65 6e 74 55 73 65 72 6e 61 6d 65 49 6e 76 61 6c 69 64 28 29 7b 72 65 74 75 72 6e 20 6d 2e 63 75 72 72 65 6e 74 55 73 65 72 6e 61 6d 65 49 6e 76 61 6c 69 64 7d 77 61 73 52 65 67 69 73 74 72 61 74 69 6f 6e 53 75 67 67 65 73 74 69 6f 6e 46 65 74 63 68 65 64 28 65 29 7b 72 65 74 75 72 6e 20 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 2e 73 6f 75 72 63 65 3d 3d 3d 65 26 26 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 2e 66 65 74 63 68 65 64 7d 77 61 73 53 75 67 67 65 73 74 69 6f 6e 73 46 65 74 63 68 65 64 28 29 7b 72 65 74 75 72 6e 20 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 6d 69 67 72 61 74 69 Data Ascii: .usernameSuggestionLoading}isCurrentUsernameInvalid(){return m.currentUsernameInvalid}wasRegistrationSuggestionFetched(e){return m.suggestions.registration.source===e&&m.suggestions.registration.fetched}wasSuggestionsFetched(){return m.suggestions.migrati
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 47 47 45 53 54 49 4f 4e 53 5f 53 55 43 43 45 53 53 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 7b 73 75 67 67 65 73 74 69 6f 6e 3a 74 2c 73 6f 75 72 63 65 3a 6e 7d 3d 65 3b 6d 2e 73 75 67 67 65 73 74 69 6f 6e 73 2e 72 65 67 69 73 74 72 61 74 69 6f 6e 3d 7b 73 75 67 67 65 73 74 69 6f 6e 3a 74 2c 73 6f 75 72 63 65 3a 6e 2c 66 65 74 63 68 65 64 3a 21 30 7d 2c 28 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 75 73 65 72 6e 61 6d 65 29 21 3d 6e 75 6c 6c 26 26 6d 2e 76 61 6c 69 64 61 74 69 6f 6e 73 2e 73 65 74 28 74 2e 75 73 65 72 6e 61 6d 65 2c 7b 74 61 6b 65 6e 3a 21 31 7d 29 7d 7d 29 7d 2c 31 30 39 34 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 Data Ascii: GGESTIONS_SUCCESS:function(e){let{suggestion:t,source:n}=e;m.suggestions.registration={suggestion:t,source:n,fetched:!0},(null==t?void 0:t.username)!=null&&m.validations.set(t.username,{taken:!1})}})},109488:function(e,t,n){n.d(t,{P:function(){return o}})
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 2c 7b 61 75 74 6f 54 72 61 63 6b 45 78 70 6f 73 75 72 65 3a 21 31 7d 29 2e 73 75 67 67 65 73 74 69 6f 6e 73 7d 2c 33 36 33 35 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 4d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 7d 29 3b 76 61 72 20 69 3d 6e 28 31 39 32 33 37 39 29 2c 6f 3d 6e 28 33 39 32 37 31 31 29 2c 61 3d 6e 28 33 39 39 36 30 36 29 2c 73 3d 6e 28 39 38 36 31 39 37 29 2c 72 3d 6e 28 36 35 34 33 34 34 29 2c 75 3d 6e 28 31 33 35 32 30 30 29 2c 6c 3d 6e 28 33 34 36 35 38 35 29 3b 6c 65 74 20 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 3d 21 28 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 31 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 7c 7c 61 72 67 75 Data Ascii: ,{autoTrackExposure:!1}).suggestions},363577:function(e,t,n){n.d(t,{M:function(){return g}});var i=n(192379),o=n(392711),a=n(399606),s=n(986197),r=n(654344),u=n(135200),l=n(346585);let g=function(e){let t=!(arguments.length>1)\|\|void 0===arguments[1]\|\|argu
2024-10-24 07:16:27 UTC	746	IN	Data Raw: 61 79 6f 75 74 45 66 66 65 63 74 28 28 29 3d 3e 28 6e 75 6c 6c 21 3d 65 2e 63 75 72 72 65 6e 74 26 26 69 2e 6f 62 73 65 72 76 65 28 65 2e 63 75 72 72 65 6e 74 29 2c 28 29 3d 3e 69 2e 64 69 73 63 6f 6e 6e 65 63 74 28 29 29 2c 5b 69 5d 29 2c 7b 72 65 66 3a 65 2c 68 65 69 67 68 74 3a 74 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 6c 65 74 7b 73 68 6f 77 3a 74 2c 63 68 69 6c 64 72 65 6e 3a 6e 2c 74 6f 70 3a 6f 3d 30 2c 62 6f 74 74 6f 6d 3a 73 3d 30 7d 3d 65 2c 7b 72 65 66 3a 6c 2c 68 65 69 67 68 74 3a 67 7d 3d 75 28 29 2c 64 3d 28 30 2c 72 2e 75 73 65 53 70 72 69 6e 67 29 28 7b 66 72 6f 6d 3a 7b 68 65 69 67 68 74 3a 30 2c 70 61 64 64 69 6e 67 42 6f 74 74 6f 6d 3a 22 30 70 78 22 2c 6d 61 72 67 69 6e 54 6f 70 3a 22 30 70 78 22 7d 2c 74 6f 3a 7b 68 65 69 Data Ascii: ayoutEffect(()=>(null!=e.current&&i.observe(e.current),()=>i.disconnect()),[i]),{ref:e,height:t}};function l(e){let{show:t,children:n,top:o=0,bottom:s=0}=e,{ref:l,height:g}=u(),d=(0,r.useSpring)({from:{height:0,paddingBottom:"0px",marginTop:"0px"},to:{hei

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.10	49839	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	868	OUT	GET /assets/bd0ab83c61025d7c7000.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	965	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/javascript Content-Length: 168789 Connection: close CF-Ray: 8d782e757896468a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "3b74671903d935a08dc04acef440c188" Last-Modified: Tue, 22 Oct 2024 15:24:31 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2FzyvCoXIgZRYUhhbDzMALfVExBG51qP%2FBKKabxhgJkZl0gyCtP8DD52x%2BuUR4Rx8cez0NQKMQ3GMs8l%2FScHS5DzOgCYl0hdd7ZQPDzbS1HXOtjJh2UvjnBZQHv6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 31 33 31 35 22 5d 2c 7b 38 36 33 39 34 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 73 3d 6e 28 32 32 30 39 32 29 3b 28 30 2c 6e 28 31 39 32 32 39 31 29 2e 65 78 70 6f 72 74 54 79 70 65 64 41 72 72 61 79 53 74 61 74 69 63 4d 65 74 68 6f 64 29 28 22 66 72 6f 6d 22 2c 6e 28 31 32 33 36 37 29 2c 73 29 7d 2c 37 30 35 31 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 2f 61 73 73 65 74 73 2f 37 36 61 34 61 66 35 39 61 61 31 37 33 63 35 31 39 34 36 31 2e 73 76 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["41315"],{863942:function(e,t,n){var s=n(22092);(0,n(192291).exportTypedArrayStaticMethod)("from",n(12367),s)},70519:function(e){e.exports="/assets/76a4af59aa173c519461.sv
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 6e 28 38 32 31 34 32 29 2c 5a 3d 6e 28 37 30 31 31 39 30 29 2c 76 3d 6e 28 36 32 36 31 33 35 29 2c 62 3d 6e 28 38 31 30 36 33 29 2c 4c 3d 6e 28 34 34 39 39 33 34 29 2c 44 3d 6e 28 37 36 38 35 38 31 29 2c 4d 3d 6e 28 36 32 35 30 35 34 29 2c 50 3d 6e 28 36 34 35 34 39 39 29 2c 6a 3d 6e 28 33 32 30 38 33 30 29 2c 79 3d 6e 28 37 32 31 37 35 31 29 2c 55 3d 6e 28 37 31 38 31 38 32 29 2c 47 3d 6e 28 32 32 33 35 34 33 29 2c 42 3d 6e 28 37 33 39 30 36 29 2c 6b 3d 6e 28 32 39 39 38 35 32 29 2c 46 3d 6e 28 33 39 35 31 34 29 2c 77 3d 6e 28 32 33 36 34 34 36 29 2c 56 3d 6e 28 39 33 32 35 29 2c 48 3d 6e 28 33 34 34 32 39 35 29 2c 7a 3d 6e 28 37 38 31 34 32 38 29 2c 4b 3d 6e 28 32 30 39 34 31 31 29 2c 57 3d 6e 28 36 34 39 31 35 36 29 2c 59 3d 6e 28 34 32 33 35 32 37 29 Data Ascii: n(82142),Z=n(701190),v=n(626135),b=n(81063),L=n(449934),D=n(768581),M=n(625054),P=n(645499),j=n(320830),y=n(721751),U=n(718182),G=n(223543),B=n(73906),k=n(299852),F=n(39514),w=n(236446),V=n(9325),H=n(344295),z=n(781428),K=n(209411),W=n(649156),Y=n(423527)
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 21 30 29 2c 76 2e 64 65 66 61 75 6c 74 2e 74 72 61 63 6b 28 24 2e 72 4d 78 2e 49 4e 56 49 54 45 5f 4f 50 45 4e 45 44 2c 7b 69 6e 76 69 74 65 5f 63 6f 64 65 3a 28 30 2c 78 2e 6a 58 29 28 65 29 2c 6c 6f 61 64 5f 74 69 6d 65 3a 4d 2e 5a 2e 67 65 74 54 69 6d 65 53 69 6e 63 65 4e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 28 29 7d 2c 7b 66 6c 75 73 68 3a 21 30 7d 29 29 2c 28 74 7c 7c 65 65 2e 61 29 26 26 74 68 69 73 2e 72 65 73 6f 6c 76 65 49 6e 76 69 74 65 28 29 2c 74 68 69 73 2e 72 65 73 6f 6c 76 65 47 69 66 74 43 6f 64 65 28 29 2c 74 68 69 73 2e 72 65 73 6f 6c 76 65 47 75 69 6c 64 54 65 6d 70 6c 61 74 65 28 29 2c 68 2e 5a 2e 69 6e 69 74 69 61 6c 69 7a 65 28 29 7d 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 55 70 64 61 74 65 28 65 29 7b 76 61 72 20 74 2c 6e 3b 21 65 Data Ascii: !0),v.default.track($.rMx.INVITE_OPENED,{invite_code:(0,x.jX)(e),load_time:M.Z.getTimeSinceNavigationStart()},{flush:!0})),(t\|\|ee.a)&&this.resolveInvite(),this.resolveGiftCode(),this.resolveGuildTemplate(),h.Z.initialize()}componentDidUpdate(e){var t,n;!e
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 6e 4e 61 74 69 76 65 47 69 66 74 43 6f 64 65 4d 6f 64 61 6c 28 65 29 29 7d 29 7d 72 65 6e 64 65 72 28 29 7b 6c 65 74 7b 73 70 6c 61 73 68 3a 65 2c 72 65 64 69 72 65 63 74 54 6f 3a 74 7d 3d 74 68 69 73 2e 73 74 61 74 65 2c 7b 69 6e 76 69 74 65 4b 65 79 3a 6e 7d 3d 74 68 69 73 2e 70 72 6f 70 73 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 73 29 28 79 2e 5a 2c 7b 73 70 6c 61 73 68 3a 65 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 73 2e 6a 73 78 29 28 67 2e 5a 2c 7b 70 61 74 68 3a 24 2e 5a 35 63 2e 4c 4f 47 49 4e 5f 48 41 4e 44 4f 46 46 2c 72 65 6e 64 65 72 3a 65 3d 3e 28 30 2c 73 2e 6a 73 78 29 28 65 73 2c 7b 2e 2e 2e 65 2c 72 65 64 69 72 65 63 74 54 6f 3a 74 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 67 2e 5a 2c 7b 69 6d 70 72 65 73 73 69 6f 6e 4e 61 6d 65 Data Ascii: nNativeGiftCodeModal(e))})}render(){let{splash:e,redirectTo:t}=this.state,{inviteKey:n}=this.props;return(0,s.jsxs)(y.Z,{splash:e,children:[(0,s.jsx)(g.Z,{path:$.Z5c.LOGIN_HANDOFF,render:e=>(0,s.jsx)(es,{...e,redirectTo:t})}),(0,s.jsx)(g.Z,{impressionName
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 63 2e 47 55 49 4c 44 5f 54 45 4d 50 4c 41 54 45 5f 4c 4f 47 49 4e 28 22 3a 67 75 69 6c 64 54 65 6d 70 6c 61 74 65 43 6f 64 65 22 29 7d 29 7d 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 67 2e 5a 2c 7b 70 61 74 68 3a 24 2e 5a 35 63 2e 56 45 52 49 46 59 2c 72 65 6e 64 65 72 3a 65 3d 3e 28 30 2c 73 2e 6a 73 78 29 28 65 64 2c 7b 2e 2e 2e 65 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 67 2e 5a 2c 7b 70 61 74 68 3a 24 2e 5a 35 63 2e 56 45 52 49 46 59 5f 48 55 42 5f 45 4d 41 49 4c 2c 72 65 6e 64 65 72 3a 65 3d 3e 28 30 2c 73 2e 6a 73 78 29 28 65 70 2c 7b 2e 2e 2e 65 7d 29 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 67 2e 5a 2c 7b 70 61 74 68 3a 24 2e 5a 35 63 2e 56 45 52 49 46 59 5f 52 45 51 55 45 53 54 2c 72 65 6e 64 65 72 3a 65 3d 3e 28 30 2c 73 2e 6a 73 78 29 28 65 5f Data Ascii: c.GUILD_TEMPLATE_LOGIN(":guildTemplateCode")})}}),(0,s.jsx)(g.Z,{path:$.Z5c.VERIFY,render:e=>(0,s.jsx)(ed,{...e})}),(0,s.jsx)(g.Z,{path:$.Z5c.VERIFY_HUB_EMAIL,render:e=>(0,s.jsx)(ep,{...e})}),(0,s.jsx)(g.Z,{path:$.Z5c.VERIFY_REQUEST,render:e=>(0,s.jsx)(e_
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 2e 2e 2e 65 29 2c 74 3d 74 68 69 73 2c 73 3d 7b 73 70 6c 61 73 68 3a 6e 75 6c 6c 2c 72 65 64 69 72 65 63 74 54 6f 3a 6e 75 6c 6c 2c 62 61 63 6b 67 72 6f 75 6e 64 49 64 3a 6e 75 6c 6c 7d 2c 28 6e 3d 22 73 74 61 74 65 22 29 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 6e 2c 7b 76 61 6c 75 65 3a 73 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 6e 5d 3d 73 7d 7d 74 2e 64 65 66 61 75 6c 74 3d 6f 2e 5a 50 2e 63 6f 6e 6e 65 63 74 53 74 6f 72 65 73 28 5b 53 2e 64 65 66 61 75 6c 74 2c 5a 2e 5a 2c 4f 2e 5a 2c 49 2e 5a 2c 4e 2e 5a 5d 2c 65 3d 3e 7b 76 61 72 20 74 2c 6e 2c 73 3b 6c 65 74 7b 6d 61 74 63 68 3a 72 2c 6c 6f 63 61 74 69 Data Ascii: ...e),t=this,s={splash:null,redirectTo:null,backgroundId:null},(n="state")in t?Object.defineProperty(t,n,{value:s,enumerable:!0,configurable:!0,writable:!0}):t[n]=s}}t.default=o.ZP.connectStores([S.default,Z.Z,O.Z,I.Z,N.Z],e=>{var t,n,s;let{match:r,locati
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 6d 65 6f 75 74 29 2c 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 44 65 62 6f 75 6e 63 65 64 29 7d 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 41 70 70 65 61 72 28 65 29 7b 74 68 69 73 2e 73 74 61 74 65 2e 73 68 6f 75 6c 64 41 6e 69 6d 61 74 65 3f 74 68 69 73 2e 61 6e 69 6d 61 74 65 54 6f 28 67 2e 45 4e 44 2c 65 29 3a 65 28 29 7d 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 45 6e 74 65 72 28 65 29 7b 74 68 69 73 2e 73 74 61 74 65 2e 73 68 6f 75 6c 64 41 6e 69 6d 61 74 65 3f 28 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 74 68 69 73 2e 74 69 6d 65 6f 75 74 29 2c 74 68 69 73 2e 74 69 6d 65 6f 75 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 29 3d 3e 74 68 69 73 2e Data Ascii: meout),window.removeEventListener("resize",this.handleResizeDebounced)}componentWillAppear(e){this.state.shouldAnimate?this.animateTo(g.END,e):e()}componentWillEnter(e){this.state.shouldAnimate?(clearTimeout(this.timeout),this.timeout=setTimeout(()=>this.
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 6e 28 61 29 2c 6f 3d 6e 28 38 37 33 35 34 36 29 2c 63 3d 6e 28 34 34 32 38 33 37 29 2c 75 3d 6e 28 34 38 31 30 36 30 29 2c 64 3d 6e 28 39 38 30 35 39 31 29 2c 5f 3d 6e 28 36 30 35 37 38 32 29 2c 68 3d 6e 28 31 33 33 38 35 33 29 2c 45 3d 6e 28 35 36 38 31 35 34 29 2c 67 3d 6e 28 33 35 33 39 32 36 29 2c 70 3d 6e 28 37 30 33 36 35 36 29 2c 6d 3d 6e 28 39 38 31 36 33 31 29 2c 66 3d 6e 28 35 30 34 38 37 37 29 3b 6c 65 74 20 49 3d 6e 28 35 37 35 37 30 33 29 2c 4e 3d 6e 28 32 39 38 34 29 2c 54 3d 5b 6d 2e 5a 35 63 2e 4c 4f 47 49 4e 2c 6d 2e 5a 35 63 2e 4c 4f 47 49 4e 5f 48 41 4e 44 4f 46 46 2c 6d 2e 5a 35 63 2e 52 45 47 49 53 54 45 52 2c 6d 2e 5a 35 63 2e 49 4e 56 49 54 45 28 22 22 29 2c 6d 2e 5a 35 63 2e 47 49 46 54 5f 43 4f 44 45 28 22 22 29 2c 6d 2e 5a 35 63 Data Ascii: n(a),o=n(873546),c=n(442837),u=n(481060),d=n(980591),_=n(605782),h=n(133853),E=n(568154),g=n(353926),p=n(703656),m=n(981631),f=n(504877);let I=n(575703),N=n(2984),T=[m.Z5c.LOGIN,m.Z5c.LOGIN_HANDOFF,m.Z5c.REGISTER,m.Z5c.INVITE(""),m.Z5c.GIFT_CODE(""),m.Z5c
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 4d 6f 75 6e 74 28 29 7b 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 29 7d 63 6f 6d 70 6f 6e 65 6e 74 57 69 6c 6c 55 6e 6d 6f 75 6e 74 28 29 7b 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 72 65 73 69 7a 65 22 2c 74 68 69 73 2e 68 61 6e 64 6c 65 52 65 73 69 7a 65 29 7d 6d 6f 62 69 6c 65 54 72 61 6e 73 69 74 69 6f 6e 54 6f 28 65 2c 74 29 7b 69 66 28 41 28 65 29 29 28 30 2c 70 2e 75 4c 29 28 65 2c 74 29 3b 65 6c 73 65 7b 6c 65 74 20 6e 3d 6e 75 6c 6c 21 3d 74 26 26 6e 75 6c 6c 21 3d 74 2e 73 65 61 72 63 68 3f 74 2e 73 65 61 72 63 68 3a 6e 75 6c 6c 3b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3d 6e 75 6c 6c 3d 3d Data Ascii: Mount(){window.addEventListener("resize",this.handleResize)}componentWillUnmount(){window.removeEventListener("resize",this.handleResize)}mobileTransitionTo(e,t){if(A(e))(0,p.uL)(e,t);else{let n=null!=t&&null!=t.search?t.search:null;window.location=null==
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 61 74 65 3d 7b 69 73 4d 6f 62 69 6c 65 57 69 64 74 68 3a 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 3d 34 38 35 7d 7d 7d 74 2e 5a 3d 52 7d 2c 37 31 38 31 38 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 73 2c 72 2c 69 2c 61 2c 6c 3d 6e 28 32 30 30 36 35 31 29 2c 6f 3d 6e 28 31 39 32 33 37 39 29 2c 63 3d 6e 28 35 32 35 36 35 34 29 2c 75 3d 6e 2e 6e 28 63 29 2c 64 3d 6e 28 34 34 32 38 33 37 29 2c 5f 3d 6e 28 38 39 33 37 37 36 29 2c 68 3d 6e 28 31 32 39 32 39 33 29 2c 45 3d 6e 28 33 38 38 39 30 35 29 2c 67 3d 6e 28 31 30 38 34 32 37 29 2c 70 3d 6e 28 33 31 34 38 39 37 29 2c 6d 3d 6e 28 39 38 31 36 33 31 29 2c 66 3d 6e 28 36 38 39 39 33 38 29 2c 49 3d 6e 28 31 31 33 32 30 37 29 3b 64 2e 5a 50 2e 69 6e 69 74 69 61 6c 69 7a 65 28 Data Ascii: ate={isMobileWidth:window.innerWidth<=485}}}t.Z=R},718182:function(e,t,n){var s,r,i,a,l=n(200651),o=n(192379),c=n(525654),u=n.n(c),d=n(442837),_=n(893776),h=n(129293),E=n(388905),g=n(108427),p=n(314897),m=n(981631),f=n(689938),I=n(113207);d.ZP.initialize(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.10	49838	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	868	OUT	GET /assets/b8160243347055e1f278.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	974	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: application/javascript Content-Length: 1019 Connection: close CF-Ray: 8d782e757fb46c81-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "5489024a0568ceb2ccc181b8ba420a0f" Last-Modified: Wed, 05 Jun 2024 19:27:59 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I5hklu6wCh6%2FOzBNGx4nr8HE5JHk4dBwqu46H%2BgptV6Hn%2FkRoyprfzIzpeooM%2BgygyeHd2%2FTxNiNrrGDE0%2BrxvqTU5cpW02OHJDlmmr9jBh5lOQwGTyEy76yGxD9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	395	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 38 39 32 37 33 22 5d 2c 7b 33 36 31 32 30 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 44 57 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 2c 74 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 77 34 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 76 61 72 20 75 3d 69 28 35 32 35 36 35 34 29 2c 65 3d 69 2e 6e 28 75 29 3b 69 28 32 37 31 35 37 39 29 2c 69 28 33 31 34 38 39 37 29 3b 76 61 72 20 6f 3d 69 28 39 38 31 36 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["89273"],{361207:function(n,t,i){i.d(t,{DW:function(){return d},t3:function(){return f},w4:function(){return r}});var u=i(525654),e=i.n(u);i(271579),i(314897);var o=i(9816
2024-10-24 07:16:27 UTC	624	IN	Data Raw: 6e 22 22 2e 63 6f 6e 63 61 74 28 6f 2e 66 7a 54 2e 44 45 53 4b 54 4f 50 29 2e 63 6f 6e 63 61 74 28 74 3f 22 2f 70 74 62 22 3a 22 22 2c 22 3f 70 6c 61 74 66 6f 72 6d 3d 22 29 2e 63 6f 6e 63 61 74 28 6e 29 2e 63 6f 6e 63 61 74 28 6e 75 6c 6c 21 3d 69 3f 22 26 66 6f 72 6d 61 74 3d 22 2e 63 6f 6e 63 61 74 28 69 29 3a 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 76 61 72 20 6e 3b 6c 65 74 20 74 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 30 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 6e 75 6c 6c 3d 3d 3d 28 6e 3d 65 28 29 2e 6f 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 66 61 6d 69 6c 79 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 22 77 69 6e 22 Data Ascii: n"".concat(o.fzT.DESKTOP).concat(t?"/ptb":"","?platform=").concat(n).concat(null!=i?"&format=".concat(i):"")}function a(){var n;let t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:null===(n=e().os)\|\|void 0===n?void 0:n.family;return null==t?"win"

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.10	49837	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f68a3f25-f01e-0052-02bd-259224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071627Z-16849878b78ngdnlw4w0762cms00000007cg00000000cf0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:27 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.10	49840	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	868	OUT	GET /assets/05bd1eb5dea5ee3387f4.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	955	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/javascript Content-Length: 5601 Connection: close CF-Ray: 8d782e7649624798-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "13ff42a071c43fa5521c11eb2f2ea914" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sDMVW2grelLCaDQamGTO7HbntatfeKyPhwaTHkHJzkqflLzjboRl0n8i9MQLz5XB2iikZBRZNt0rWWM06sWXx7v9fUUoXh7oIkZuQ0S1EN3uvDlktcrOuH05Dav6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	414	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 36 33 36 39 22 5d 2c 7b 34 33 38 38 32 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 2c 61 3d 6e 28 34 34 32 38 33 37 29 2c 63 3d 6e 28 35 37 30 31 34 30 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["46369"],{438820:function(e,t,n){var i,a=n(442837),c=n(570140);function o(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 28 73 3d 65 29 2c 73 2e 63 61 6e 50 6c 61 79 57 6f 77 4d 6f 6d 65 6e 74 3d 21 31 2c 73 2e 69 73 46 65 74 63 68 69 6e 67 57 6f 77 4d 6f 6d 65 6e 74 4d 65 64 69 61 3d 21 31 2c 73 2e 77 6f 77 4d 6f 6d 65 6e 74 57 75 6d 70 75 73 4d 65 64 69 61 55 72 6c 3d 6e 75 6c 6c 7d 67 65 74 53 74 61 74 65 28 29 7b 72 65 74 75 72 6e 20 73 7d 67 65 74 20 63 61 6e 50 6c 61 79 57 6f 77 4d 6f 6d 65 6e 74 28 29 7b 72 65 74 75 72 6e 20 73 2e 63 61 6e 50 6c 61 79 57 6f 77 4d 6f 6d 65 6e 74 7d 67 65 74 20 69 73 46 65 74 63 68 69 6e 67 57 6f 77 4d 6f 6d 65 6e 74 4d 65 64 69 61 28 29 7b 72 65 74 75 72 6e 20 73 2e 69 73 46 65 74 63 68 69 6e 67 57 6f 77 4d 6f 6d 65 6e 74 4d 65 64 69 61 7d 67 65 74 20 77 6f 77 4d 6f 6d 65 6e 74 57 75 6d 70 75 73 4d 65 64 69 61 28 29 7b 72 65 74 75 72 Data Ascii: (s=e),s.canPlayWowMoment=!1,s.isFetchingWowMomentMedia=!1,s.wowMomentWumpusMediaUrl=null}getState(){return s}get canPlayWowMoment(){return s.canPlayWowMoment}get isFetchingWowMomentMedia(){return s.isFetchingWowMomentMedia}get wowMomentWumpusMedia(){retur
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 2e 64 69 73 70 61 74 63 68 28 7b 74 79 70 65 3a 22 50 55 52 43 48 41 53 45 44 5f 49 54 45 4d 53 5f 46 45 53 54 49 56 49 54 59 5f 49 53 5f 46 45 54 43 48 49 4e 47 5f 57 4f 57 5f 4d 4f 4d 45 4e 54 5f 4d 45 44 49 41 22 2c 76 61 6c 75 65 3a 21 30 7d 29 3b 6c 65 74 20 74 3d 65 3f 53 2e 5a 3a 62 2e 5a 3b 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 22 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 30 31 32 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 39 38 30 70 78 29 22 29 2e 6d 61 74 63 68 65 73 7c 7c 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 22 28 6d 69 6e 2d 68 65 69 67 68 74 3a 20 37 32 30 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 68 65 69 67 68 74 3a 20 31 34 30 38 70 78 29 22 29 2e 6d 61 74 63 68 65 73 3f 74 3d 65 3f 67 2e 5a Data Ascii: .dispatch({type:"PURCHASED_ITEMS_FESTIVITY_IS_FETCHING_WOW_MOMENT_MEDIA",value:!0});let t=e?S.Z:b.Z;window.matchMedia("(min-width: 1012px) and (max-width: 1980px)").matches\|\|window.matchMedia("(min-height: 720px) and (max-height: 1408px)").matches?t=e?g.Z
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 43 52 49 50 54 49 4f 4e 5f 43 52 45 41 54 45 44 2c 74 29 2c 28 29 3d 3e 7b 66 2e 53 2e 75 6e 73 75 62 73 63 72 69 62 65 28 54 2e 43 6b 4c 2e 50 52 45 4d 49 55 4d 5f 53 55 42 53 43 52 49 50 54 49 4f 4e 5f 43 52 45 41 54 45 44 2c 74 29 7d 7d 2c 5b 65 2c 62 5d 29 3b 6c 65 74 5b 50 2c 79 5d 3d 73 2e 75 73 65 53 74 61 74 65 28 21 31 29 2c 5b 5a 2c 55 5d 3d 73 2e 75 73 65 53 74 61 74 65 28 21 31 29 2c 43 3d 28 30 2c 6d 2e 75 73 65 53 70 72 69 6e 67 29 28 7b 6f 70 61 63 69 74 79 3a 50 3f 2e 32 3a 30 2c 63 6f 6e 66 69 67 3a 7b 64 75 72 61 74 69 6f 6e 3a 31 30 30 7d 7d 29 2c 46 3d 28 30 2c 6d 2e 75 73 65 53 70 72 69 6e 67 29 28 7b 78 3a 5a 3f 22 31 30 30 25 22 3a 22 2d 31 30 30 25 22 2c 63 6f 6e 66 69 67 3a 7b 64 75 72 61 74 69 6f 6e 3a 35 30 30 7d 7d 2c 5a 3f 22 Data Ascii: CRIPTION_CREATED,t),()=>{f.S.unsubscribe(T.CkL.PREMIUM_SUBSCRIPTION_CREATED,t)}},[e,b]);let[P,y]=s.useState(!1),[Z,U]=s.useState(!1),C=(0,m.useSpring)({opacity:P?.2:0,config:{duration:100}}),F=(0,m.useSpring)({x:Z?"100%":"-100%",config:{duration:500}},Z?"
2024-10-24 07:16:27 UTC	1080	IN	Data Raw: 3a 22 77 72 61 70 70 65 72 5f 63 64 32 32 65 37 22 2c 61 63 74 69 76 65 57 72 61 70 70 65 72 3a 22 61 63 74 69 76 65 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 22 2c 76 69 64 65 6f 57 72 61 70 70 65 72 3a 22 76 69 64 65 6f 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 22 2c 67 61 64 69 65 6e 74 48 69 67 68 6c 69 67 68 74 3a 22 67 61 64 69 65 6e 74 48 69 67 68 6c 69 67 68 74 5f 63 64 32 32 65 37 22 2c 73 77 69 70 65 57 72 61 70 70 65 72 3a 22 73 77 69 70 65 57 72 61 70 70 65 72 5f 63 64 32 32 65 37 22 2c 73 77 69 70 65 3a 22 73 77 69 70 65 5f 63 64 32 32 65 37 22 7d 7d 2c 32 33 33 39 37 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 2e 5a 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 63 6f 6e 74 Data Ascii: :"wrapper_cd22e7",activeWrapper:"activeWrapper_cd22e7",videoWrapper:"videoWrapper_cd22e7",gadientHighlight:"gadientHighlight_cd22e7",swipeWrapper:"swipeWrapper_cd22e7",swipe:"swipe_cd22e7"}},233975:function(e,t){t.Z="https://cdn.discordapp.com/assets/cont

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.10	49841	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	929	OUT	GET /assets/2597d11c1e039607373e.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	960	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: image/svg+xml Content-Length: 139 Connection: close CF-Ray: 8d782e76ed7c3aae-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "72a8b168ad2c7eea7b2559b5690c7695" Last-Modified: Wed, 05 Jun 2024 19:27:56 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVJ9TPIHdj1YijHgfIljMho7KcaAnZmzNF7%2FsDUYS8Co1akwvYcxCpXGZLfQjQRYrcLUOzIvBvMIojViEx0D4m0uqYkUKj%2B2zkGQSnCCUtRd%2FX%2BwRiQIWxH6FZeF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	139	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 68 65 69 67 68 74 3d 22 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 20 38 22 20 77 69 64 74 68 3d 22 38 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 63 69 72 63 6c 65 20 63 78 3d 22 34 22 20 63 79 3d 22 34 22 20 72 3d 22 34 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 2f 73 76 67 3e 0a Data Ascii: <svg fill="none" height="8" viewBox="0 0 8 8" width="8" xmlns="http://www.w3.org/2000/svg"><circle cx="4" cy="4" r="4" fill="#fff"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.10	49842	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	929	OUT	GET /assets/a5ec2b74d0cc337d4481.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	971	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: image/svg+xml Content-Length: 2058 Connection: close CF-Ray: 8d782e76f9cee5bd-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "e1349377226366f95f85ab9eac4586d3" Last-Modified: Wed, 05 Jun 2024 19:27:58 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7PxnFG9Ga60BpNpxMY%2BGwYnGLcp%2BEJQXz%2BplKoLK%2FobNIF5TmnZNe%2FRW64YHDkcs0H87jsyedSiSae%2FFURIalhEwhll%2BT%2Bm2czQSCj%2BmYr1n2c0cRd0zui0c6LZ4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	398	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 35 20 34 35 22 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 0a 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 61 22 20 63 6c 69 70 50 61 74 68 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 30 20 33 36 68 33 36 56 30 48 30 76 33 36 5a 22 2f 3e 0a 20 20 20 20 3c 2f 63 6c 69 70 50 61 74 68 3e 0a 20 20 20 20 3c 6d 61 73 6b 20 69 64 3d 22 62 22 3e 0a 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 20 78 3d 22 30 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 45 45" xml:space="preserve"> <defs> <clipPath id="a" clipPathUnits="userSpaceOnUse"> <path d="M0 36h36V0H0v36Z"/> </clipPath> <mask id="b"> <g> <rect x="0" y="0" width=
2024-10-24 07:16:27 UTC	1369	IN	Data Raw: 20 3c 2f 67 3e 0a 20 20 20 20 3c 2f 6d 61 73 6b 3e 0a 20 20 3c 2f 64 65 66 73 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 6d 61 74 72 69 78 28 31 2e 32 35 20 30 20 30 20 2d 31 2e 32 35 20 30 20 34 35 29 22 20 6d 61 73 6b 3d 22 75 72 6c 28 23 62 29 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 32 2e 37 35 20 31 38 2e 32 35 63 31 2e 32 32 36 2d 32 2e 31 39 35 20 31 2e 38 35 35 20 31 2e 33 36 31 20 39 2e 33 31 33 20 32 2e 36 32 35 20 37 2e 34 35 37 20 31 2e 32 36 34 20 31 33 2e 37 32 38 2d 34 2e 34 35 34 20 31 33 2e 38 35 39 2d 35 2e 34 31 33 43 33 36 2e 30 35 33 20 31 34 2e Data Ascii: </g> </mask> </defs> <g> <g> <g clip-path="url(#a)" transform="matrix(1.25 0 0 -1.25 0 45)" mask="url(#b)"> <g> <path d="M12.75 18.25c1.226-2.195 1.855 1.361 9.313 2.625 7.457 1.264 13.728-4.454 13.859-5.413C36.053 14.
2024-10-24 07:16:27 UTC	291	IN	Data Raw: 31 32 2d 33 2e 37 36 38 20 31 2e 35 32 38 2d 33 2e 31 34 20 32 2e 37 34 34 22 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 32 2e 35 30 32 20 31 39 2e 33 37 35 63 2e 30 34 34 2d 2e 36 32 35 2e 35 30 36 2d 31 2e 35 31 31 2e 35 30 36 2d 31 2e 35 31 31 2d 31 2e 30 31 36 2d 31 2e 34 37 33 2d 35 2e 36 34 33 2d 33 2e 30 31 36 2d 37 2e 33 35 34 2d 32 2e 39 32 39 2e 30 39 36 2e 36 32 37 2e 32 38 33 20 31 2e 33 36 32 2e 36 32 37 20 32 2e 30 39 36 20 31 2e 38 34 34 2e 34 37 31 20 34 2e 36 36 20 31 2e 30 37 31 20 36 2e 32 32 31 20 32 2e 33 34 34 22 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 Data Ascii: 12-3.768 1.528-3.14 2.744" fill="white"/> </g> <g> <path d="M12.502 19.375c.044-.625.506-1.511.506-1.511-1.016-1.473-5.643-3.016-7.354-2.929.096.627.283 1.362.627 2.096 1.844.471 4.66 1.071 6.221 2.344" fill="white"/> </g

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.10	49844	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8e096af2-401e-0015-41f3-240e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071627Z-r197bdfb6b4sn8wg20e97vn7ps0000000nwg00000000caqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:27 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.10	49846	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:27 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: aaa69ab3-801e-0047-5050-237265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071627Z-15b8d89586ff5l62quxsfe8ugg0000000dmg0000000085pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:27 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.10	49847	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:27 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d0d0f8e5-601e-000d-298c-212618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071627Z-16849878b78mhkkf6kbvry07q0000000075g00000000gfbq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:27 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.10	49845	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:27 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: aaf6fada-701e-0053-683a-223a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071627Z-16849878b78jfqwd1dsrhqg3aw00000007f00000000060gu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:27 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.10	49831	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=oLccZzNnxRyp9t2&MD=TWwp6veN HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-24 07:16:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: dd8466e6-7bae-4bdf-999e-afe513d3b746 MS-RequestId: b7277983-deea-49cb-80ab-d4b393ab2887 MS-CV: XaeN1+JzykSvKwt2.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 24 Oct 2024 07:16:27 GMT Connection: close Content-Length: 24490
2024-10-24 07:16:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-24 07:16:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.10	49848	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	929	OUT	GET /assets/5430e9964fe8364e084d.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	954	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: image/svg+xml Content-Length: 180 Connection: close CF-Ray: 8d782e7a3c7a46dd-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "b1d4c5e276e3aaa8ec41e6014dd572b2" Last-Modified: Sun, 02 Oct 2022 01:17:50 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zxG905pKqzOz8wBOYxAocBs0YpsYSdTi2iDIDgq7uiEhDKQZ2Wtan1UKClZFkHDpmvaK2rzNbUjZft4TkRMgnZK0NKHcuDyTXLV%2BDkrfZIUQK4SDhbqGFbk78HhS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	180	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 68 65 69 67 68 74 3d 22 39 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 20 39 22 20 77 69 64 74 68 3d 22 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 6d 30 20 32 2e 38 33 39 31 32 76 33 2e 33 32 31 37 36 6c 33 20 32 2e 38 33 39 31 32 20 33 2d 32 2e 38 33 39 31 32 76 2d 33 2e 33 32 31 37 36 6c 2d 33 2d 32 2e 38 33 39 31 32 7a 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill="none" height="9" viewBox="0 0 6 9" width="6" xmlns="http://www.w3.org/2000/svg"><path d="m0 2.83912v3.32176l3 2.83912 3-2.83912v-3.32176l-3-2.83912z" fill="#fff"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.10	49849	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	929	OUT	GET /assets/ab03f7053698d417194c.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:27 UTC	954	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:27 GMT Content-Type: image/svg+xml Content-Length: 137 Connection: close CF-Ray: 8d782e7a5f4c4868-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "7d883ba72b5dbc0229f5d1980205ee34" Last-Modified: Sun, 02 Oct 2022 01:17:54 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EyDSfel0tU5u2afbVeqnQvZJWK4ihvt0vJbV9UVWpJaUtadlITKhuEWz8YiLwoM9lsm7hYPSrfPD6hWiYT820DL9E4cOprr%2BhlMBhXJEhJaAo37dffRVunoEkUOB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:27 UTC	137	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 20 31 32 22 20 77 69 64 74 68 3d 22 31 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 6d 35 20 32 68 32 76 38 68 2d 32 7a 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill="none" height="12" viewBox="0 0 12 12" width="12" xmlns="http://www.w3.org/2000/svg"><path d="m5 2h2v8h-2z" fill="#fff"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.10	49851	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:27 UTC	929	OUT	GET /assets/410a2166a48c9e482e2a.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: image/svg+xml Content-Length: 395 Connection: close CF-Ray: 8d782e7b2e794770-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "e843c51c0eec3801b70cae5c45ad343f" Last-Modified: Sun, 02 Oct 2022 01:17:45 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PQunUs4y4VvnQwRpKTVzUGmyMyNqejW0tGtw5KWY0OSr5o0C%2BJZqDJC8mJceA5YuBEU1xvYij0nGTcyBOBAyLCTe%2BKKfLZaNY2DYt9AntmxzGiBpQM8rfYuDLp6%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	395	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 20 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 32 2e 39 39 33 32 20 37 2e 34 39 37 32 37 43 35 2e 34 38 30 37 33 20 37 2e 34 39 37 32 37 20 37 2e 34 39 37 32 37 20 35 2e 34 38 30 37 33 20 37 2e 34 39 37 32 37 20 32 2e 39 39 33 32 43 37 2e 34 39 37 32 37 20 31 2e 38 34 34 32 31 20 37 2e 30 36 37 30 34 20 30 2e 37 39 35 37 30 38 20 36 2e 33 35 38 38 39 20 30 43 39 2e 35 30 35 39 35 20 30 2e 31 38 38 33 32 33 20 31 32 20 32 2e 38 30 30 31 38 20 31 32 20 35 2e 39 39 34 35 36 43 31 32 20 39 2e Data Ascii: <svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M2.9932 7.49727C5.48073 7.49727 7.49727 5.48073 7.49727 2.9932C7.49727 1.84421 7.06704 0.795708 6.35889 0C9.50595 0.188323 12 2.80018 12 5.99456C12 9.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.10	49852	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	929	OUT	GET /assets/9017b7062734e72bb476.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	954	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: image/svg+xml Content-Length: 688 Connection: close CF-Ray: 8d782e7bbed04757-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "c6ce0010471b65c0faeda6c53ab297bd" Last-Modified: Sun, 02 Oct 2022 01:17:48 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qyfgZXFa9y3hORu4LcdtubhsqVx8DfbBRu8lPnOidIGfl4I10UbiQzCJFRnjL2wY7smxXaLERTaUAjnCZ6Xi%2BKG1o5sQA9Uat7lOWngGeHIoYh9StJfqSoxBvEQt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	415	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 33 20 31 32 22 20 77 69 64 74 68 3d 22 31 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 6d 35 2e 33 39 30 31 31 2e 35 34 30 30 32 37 63 2e 33 35 35 33 36 2d 2e 37 32 30 30 33 37 20 31 2e 33 38 32 31 31 2d 2e 37 32 30 30 33 36 20 31 2e 37 33 37 34 37 2e 30 30 30 30 30 32 6c 31 2e 31 38 33 35 39 20 32 2e 33 39 38 32 30 31 63 2e 31 34 31 31 31 2e 32 38 35 39 33 2e 34 31 33 38 38 2e 34 38 34 31 31 2e 37 32 39 34 32 2e 35 32 39 39 36 6c 32 2e 36 34 36 36 31 2e 33 38 34 35 37 63 2e 37 39 34 36 2e 31 31 35 34 36 20 31 2e 31 31 31 39 20 31 2e Data Ascii: <svg fill="none" height="12" viewBox="0 0 13 12" width="13" xmlns="http://www.w3.org/2000/svg"><path d="m5.39011.540027c.35536-.720037 1.38211-.720036 1.73747.000002l1.18359 2.398201c.14111.28593.41388.48411.72942.52996l2.64661.38457c.7946.11546 1.1119 1.
2024-10-24 07:16:28 UTC	273	IN	Data Raw: 34 2d 2e 31 34 38 34 2d 2e 39 30 31 36 32 20 30 6c 2d 32 2e 33 36 37 31 37 20 31 2e 32 34 34 35 63 2d 2e 37 31 30 37 32 2e 33 37 33 36 2d 31 2e 35 34 31 33 38 2d 2e 32 32 39 39 2d 31 2e 34 30 35 36 35 2d 31 2e 30 32 31 33 6c 2e 34 35 32 30 39 2d 32 2e 36 33 35 38 37 63 2e 30 35 33 39 2d 2e 33 31 34 32 37 2d 2e 30 35 30 32 39 2d 2e 36 33 34 39 33 2d 2e 32 37 38 36 31 2d 2e 38 35 37 35 6c 2d 31 2e 39 31 35 30 38 33 2d 31 2e 38 36 36 37 34 63 2d 2e 35 37 34 39 38 34 2d 2e 35 36 30 34 37 2d 2e 32 35 37 36 39 39 38 2d 31 2e 35 33 36 39 37 2e 35 33 36 39 30 38 2d 31 2e 36 35 32 34 33 6c 32 2e 36 34 36 35 37 35 2d 2e 33 38 34 35 37 63 2e 33 31 35 35 34 2d 2e 30 34 35 38 35 2e 35 38 38 33 31 2d 2e 32 34 34 30 33 2e 37 32 39 34 33 2d 2e 35 32 39 39 36 7a 22 20 66 Data Ascii: 4-.1484-.90162 0l-2.36717 1.2445c-.71072.3736-1.54138-.2299-1.40565-1.0213l.45209-2.63587c.0539-.31427-.05029-.63493-.27861-.8575l-1.915083-1.86674c-.574984-.56047-.2576998-1.53697.536908-1.65243l2.646575-.38457c.31554-.04585.58831-.24403.72943-.52996z" f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.10	49853	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	929	OUT	GET /assets/af5116b1db004acbdb8b.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	956	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: image/svg+xml Content-Length: 137 Connection: close CF-Ray: 8d782e7bbb913acf-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "70275fe3104cf1d3388586ad8ffd478e" Last-Modified: Sun, 02 Oct 2022 01:17:52 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RyNQrpV4WA9EO9JLLhN9sNCh7pZ4HrUAojVRv8%2F6K7aQ7l3yYGjjT55p%2Fsqj0WIx0X7kOInPWGb290kOA5a1rgh62SCrxtHU4LmuYFrzxTtm6UeNBOPuLvQIjDt5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	137	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 68 65 69 67 68 74 3d 22 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 39 20 38 22 20 77 69 64 74 68 3d 22 39 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 6d 34 2e 35 20 30 20 34 2e 35 20 38 68 2d 39 7a 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill="none" height="8" viewBox="0 0 9 8" width="9" xmlns="http://www.w3.org/2000/svg"><path d="m4.5 0 4.5 8h-9z" fill="#fff"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.10	49850	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:28 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 9f3a3312-201e-0096-7bbe-20ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071628Z-16849878b78x6gn56mgecg60qc00000000mg000000000gst x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:28 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.10	49855	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	929	OUT	GET /assets/ba88bbd1342d3f000e33.svg HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://discord.com/invite/privatecommunity Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	955	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: image/svg+xml Content-Length: 3146 Connection: close CF-Ray: 8d782e7cbf5e4779-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "81084ff5a27b6e6ff487e479c37d1660" Last-Modified: Sun, 02 Oct 2022 01:17:42 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mkkLPoWCSGGXfE1oGXDq7gZiiuzG7NOu4ygDL3K%2BjQNyHci2uBUQfhE0wcwngnGGSDuL2bx2rpFzVKh1jTMcLnn4SWnBQ1RWNTW3lrekekTJlQH6xdR5O58t2RaU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	414	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 39 30 20 35 39 2e 31 39 22 3e 0a 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 23 36 61 39 34 66 66 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 61 39 63 37 66 66 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 32 30 32 32 32 35 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 3c 2f 64 65 66 73 3e 0a 20 20 3c 67 20 69 64 3d 22 e5 9b be e5 b1 82 5f 32 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 e5 9b be e5 b1 82 20 32 22 3e 0a 20 20 20 20 3c 67 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 90 59.19"> <defs> <style> .cls-1{fill:#6a94ff}.cls-2{fill:#a9c7ff}.cls-3{fill:#202225} </style> </defs> <g id="_2" data-name=" 2"> <g id="Layer_1" data-name="Layer 1"
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 35 35 20 38 2e 35 35 20 30 20 30 20 31 2d 35 2e 35 31 2d 32 2e 31 33 63 2d 2e 31 32 2d 2e 31 31 2d 2e 32 34 2d 2e 32 32 2d 2e 33 34 2d 2e 33 33 6c 2d 31 32 2e 36 36 20 35 2e 31 33 61 31 32 2e 34 32 20 31 32 2e 34 32 20 30 20 30 20 30 2d 36 2e 39 20 31 36 6c 2d 35 20 32 41 35 2e 35 32 20 35 2e 35 32 20 30 20 30 20 30 20 2e 34 20 34 32 2e 36 31 6c 34 2e 36 37 20 31 31 2e 35 31 61 35 2e 35 31 20 35 2e 35 31 20 30 20 30 20 30 20 37 2e 31 38 20 33 6c 35 2e 36 34 2d 32 2e 32 38 41 31 32 2e 34 33 20 31 32 2e 34 33 20 30 20 30 20 30 20 33 32 20 35 38 2e 32 38 6c 34 30 2e 35 34 2d 31 36 2e 34 34 61 31 32 2e 34 33 20 31 32 2e 34 33 20 30 20 30 20 30 20 37 2e 37 33 2d 31 32 2e 32 32 6c 36 2e 32 38 2d 32 2e 35 34 61 35 2e 35 32 20 35 2e 35 32 20 30 20 30 20 30 20 33 Data Ascii: 55 8.55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33l-12.66 5.13a12.42 12.42 0 0 0-6.9 16l-5 2A5.52 5.52 0 0 0 .4 42.61l4.67 11.51a5.51 5.51 0 0 0 7.18 3l5.64-2.28A12.43 12.43 0 0 0 32 58.28l40.54-16.44a12.43 12.43 0 0 0 7.73-12.22l6.28-2.54a5.52 5.52 0 0 0 3
2024-10-24 07:16:28 UTC	1363	IN	Data Raw: 35 35 20 30 20 30 20 31 2d 35 2e 35 31 2d 32 2e 31 33 63 2d 2e 31 32 2d 2e 31 31 2d 2e 32 34 2d 2e 32 32 2d 2e 33 34 2d 2e 33 33 5a 4d 35 35 2e 36 39 20 33 38 2e 30 35 6c 2d 31 31 2e 37 37 20 34 2e 37 37 41 31 30 2e 36 31 20 31 30 2e 36 31 20 30 20 30 20 31 20 33 30 2e 31 31 20 33 37 6c 2d 33 2e 33 33 2d 38 2e 32 33 41 34 20 34 20 30 20 30 20 31 20 32 39 20 32 33 2e 35 36 6c 32 33 2e 33 31 2d 39 2e 34 34 61 34 20 34 20 30 20 30 20 31 20 35 2e 31 38 20 32 2e 31 39 6c 33 2e 36 33 20 39 61 39 2e 38 20 39 2e 38 20 30 20 30 20 31 2d 35 2e 34 33 20 31 32 2e 37 34 5a 4d 36 37 2e 34 39 20 32 31 61 33 2e 37 33 20 33 2e 37 33 20 30 20 31 20 31 20 32 2e 30 35 2d 34 2e 38 35 41 33 2e 37 32 20 33 2e 37 32 20 30 20 30 20 31 20 36 37 2e 34 39 20 32 31 5a 22 2f 3e 0a 20 Data Ascii: 55 0 0 1-5.51-2.13c-.12-.11-.24-.22-.34-.33ZM55.69 38.05l-11.77 4.77A10.61 10.61 0 0 1 30.11 37l-3.33-8.23A4 4 0 0 1 29 23.56l23.31-9.44a4 4 0 0 1 5.18 2.19l3.63 9a9.8 9.8 0 0 1-5.43 12.74ZM67.49 21a3.73 3.73 0 1 1 2.05-4.85A3.72 3.72 0 0 1 67.49 21Z"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.10	49862	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	673	OUT	GET /assets/5067a2ec1b24a6de868c.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	977	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: application/javascript Content-Length: 13374 Connection: close CF-Ray: 8d782e7dddc74796-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "d0c788b157ff96a2dd902c97bfc889f6" Last-Modified: Fri, 28 Jun 2024 00:43:12 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2FwU2X%2BfDC6JgQIj2mj4ocroCnVbl%2BBtnh1ez2%2FTXWrCwQxmvPp1loi1%2F5TC562qo8waKXZOfA1caQVKC%2FmySxFvAT%2Fmdc3qmh5S9Cku3dYcKwRoDhy2VqThBoDA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 38 31 38 37 22 5d 2c 7b 35 32 36 39 38 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 7d 2c 32 34 30 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["78187"],{526988:function(t,n,r){var e=r(354848),o=r(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a function")}},24033:function(t,n,r){
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 2e 66 28 74 2c 6e 2c 72 29 7d 7d 2c 38 35 39 32 30 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 35 34 38 34 38 29 2c 6f 3d 72 28 39 37 31 33 31 29 2c 69 3d 72 28 32 33 30 33 36 34 29 2c 75 3d 72 28 34 39 32 34 32 34 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 2c 63 29 7b 21 63 26 26 28 63 3d 7b 7d 29 3b 76 61 72 20 66 3d 63 2e 65 6e 75 6d 65 72 61 62 6c 65 2c 61 3d 76 6f 69 64 20 30 21 3d 3d 63 2e 6e 61 6d 65 3f 63 2e 6e 61 6d 65 3a 6e 3b 69 66 28 65 28 72 29 26 26 69 28 72 2c 61 2c 63 29 2c 63 2e 67 6c 6f 62 61 6c 29 66 3f 74 5b 6e 5d 3d 72 3a 75 28 6e 2c 72 29 3b 65 6c 73 65 7b 74 72 79 7b 63 2e 75 6e 73 61 66 65 3f 74 5b 6e 5d 26 26 28 66 3d 21 30 29 3a 64 65 6c 65 74 65 20 74 5b 6e Data Ascii: .f(t,n,r)}},859209:function(t,n,r){var e=r(354848),o=r(97131),i=r(230364),u=r(492424);t.exports=function(t,n,r,c){!c&&(c={});var f=c.enumerable,a=void 0!==c.name?c.name:n;if(e(r)&&i(r,a,c),c.global)f?t[n]=r:u(n,r);else{try{c.unsafe?t[n]&&(f=!0):delete t[n
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 74 79 70 65 4f 66 22 2c 22 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 22 2c 22 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 22 2c 22 74 6f 53 74 72 69 6e 67 22 2c 22 76 61 6c 75 65 4f 66 22 5d 7d 2c 31 34 37 30 31 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 72 28 33 34 37 37 32 32 29 2e 66 2c 69 3d 72 28 32 35 31 30 36 39 29 2c 75 3d 72 28 38 35 39 32 30 39 29 2c 63 3d 72 28 34 39 32 34 32 34 29 2c 66 3d 72 28 33 38 31 37 34 30 29 2c 61 3d 72 28 34 37 34 31 38 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 2c 73 2c 70 2c 6c 2c 76 2c 62 3d 74 2e 74 61 72 67 65 74 2c 79 3d 74 2e 67 6c 6f 62 61 6c 2c 67 3d 74 2e 73 74 61 74 3b 69 66 Data Ascii: typeOf","propertyIsEnumerable","toLocaleString","toString","valueOf"]},147018:function(t,n,r){var e=r(161581),o=r(347722).f,i=r(251069),u=r(859209),c=r(492424),f=r(381740),a=r(474180);t.exports=function(t,n){var r,s,p,l,v,b=t.target,y=t.global,g=t.stat;if
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 68 3c 32 3f 6f 28 72 3d 65 5b 74 5d 29 3f 72 3a 76 6f 69 64 20 30 3a 65 5b 74 5d 26 26 65 5b 74 5d 5b 6e 5d 7d 7d 2c 39 39 35 37 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 32 36 39 38 38 29 2c 6f 3d 72 28 33 35 31 37 39 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 74 5b 6e 5d 3b 72 65 74 75 72 6e 20 6f 28 72 29 3f 76 6f 69 64 20 30 3a 65 28 72 29 7d 7d 2c 31 36 31 35 38 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 4d 61 74 68 3d 3d 3d 4d 61 74 68 26 26 74 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 65 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 Data Ascii: h<2?o(r=e[t])?r:void 0:e[t]&&e[t][n]}},995739:function(t,n,r){var e=r(526988),o=r(35179);t.exports=function(t,n){var r=t[n];return o(r)?void 0:e(r)}},161581:function(t,n,r){var e=function(t){return t&&t.Math===Math&&t};t.exports=e("object"==typeof globalT
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 77 20 67 29 3b 68 2e 67 65 74 3d 68 2e 67 65 74 2c 68 2e 68 61 73 3d 68 2e 68 61 73 2c 68 2e 73 65 74 3d 68 2e 73 65 74 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 68 2e 68 61 73 28 74 29 29 74 68 72 6f 77 20 79 28 62 29 3b 72 65 74 75 72 6e 20 6e 2e 66 61 63 61 64 65 3d 74 2c 68 2e 73 65 74 28 74 2c 6e 29 2c 6e 7d 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 68 2e 67 65 74 28 74 29 7c 7c 7b 7d 7d 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 68 2e 68 61 73 28 74 29 7d 7d 65 6c 73 65 7b 76 61 72 20 6d 3d 6c 28 22 73 74 61 74 65 22 29 3b 76 5b 6d 5d 3d 21 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 69 66 28 73 28 74 2c 6d 29 29 74 68 72 6f 77 20 79 28 62 29 3b 72 65 74 75 72 6e 20 6e 2e 66 Data Ascii: w g);h.get=h.get,h.has=h.has,h.set=h.set,e=function(t,n){if(h.has(t))throw y(b);return n.facade=t,h.set(t,n),n},o=function(t){return h.get(t)\|\|{}},i=function(t){return h.has(t)}}else{var m=l("state");v[m]=!0,e=function(t,n){if(s(t,m))throw y(b);return n.f
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 74 29 7b 72 65 74 75 72 6e 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 65 28 22 53 79 6d 62 6f 6c 22 29 3b 72 65 74 75 72 6e 20 6f 28 6e 29 26 26 69 28 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 28 74 29 29 7d 7d 2c 34 39 36 39 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 35 32 30 32 38 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 65 28 74 2e 6c 65 6e 67 74 68 29 7d 7d 2c 32 33 30 33 36 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 35 38 31 30 33 31 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 2c 69 3d 72 28 33 35 34 38 34 38 29 2c 75 3d 72 28 37 34 30 33 36 32 29 2c 63 3d 72 28 33 Data Ascii: t){return"symbol"==typeof t}:function(t){var n=e("Symbol");return o(n)&&i(n.prototype,c(t))}},49693:function(t,n,r){var e=r(552028);t.exports=function(t){return e(t.length)}},230364:function(t,n,r){var e=r(581031),o=r(936940),i=r(354848),u=r(740362),c=r(3
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 74 6f 72 2c 70 3d 22 65 6e 75 6d 65 72 61 62 6c 65 22 2c 6c 3d 22 63 6f 6e 66 69 67 75 72 61 62 6c 65 22 2c 76 3d 22 77 72 69 74 61 62 6c 65 22 3b 6e 2e 66 3d 65 3f 69 3f 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 69 66 28 75 28 74 29 2c 6e 3d 63 28 6e 29 2c 75 28 72 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 70 72 6f 74 6f 74 79 70 65 22 3d 3d 3d 6e 26 26 22 76 61 6c 75 65 22 69 6e 20 72 26 26 76 20 69 6e 20 72 26 26 21 72 5b 76 5d 29 7b 76 61 72 20 65 3d 73 28 74 2c 6e 29 3b 65 26 26 65 5b 76 5d 26 26 28 74 5b 6e 5d 3d 72 2e 76 61 6c 75 65 2c 72 3d 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 6c 20 69 6e 20 72 3f 72 5b 6c 5d 3a 65 5b 6c 5d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 70 20 69 6e 20 72 3f 72 5b 70 5d 3a 65 5b 70 Data Ascii: tor,p="enumerable",l="configurable",v="writable";n.f=e?i?function(t,n,r){if(u(t),n=c(n),u(r),"function"==typeof t&&"prototype"===n&&"value"in r&&v in r&&!r[v]){var e=s(t,n);e&&e[v]&&(t[n]=r.value,r={configurable:l in r?r[l]:e[l],enumerable:p in r?r[p]:e[p
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 74 29 3b 72 65 74 75 72 6e 21 21 6e 26 26 6e 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 3a 72 7d 2c 33 33 37 38 35 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 32 36 35 31 35 29 2c 6f 3d 72 28 33 35 34 38 34 38 29 2c 69 3d 72 28 36 32 32 32 38 31 29 2c 75 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 2c 63 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 6e 26 26 6f 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 29 26 26 21 69 28 63 3d 65 28 72 2c 74 29 29 7c 7c 6f 28 72 3d 74 2e 76 61 6c 75 65 4f 66 29 26 26 21 69 28 63 3d 65 28 72 2c 74 29 29 7c 7c 22 73 74 72 69 6e 67 22 21 3d 3d 6e 26 26 6f 28 72 3d 74 2e 74 6f 53 74 72 69 6e 67 29 26 26 21 69 28 63 3d 65 28 72 Data Ascii: t);return!!n&&n.enumerable}:r},337856:function(t,n,r){var e=r(926515),o=r(354848),i=r(622281),u=TypeError;t.exports=function(t,n){var r,c;if("string"===n&&o(r=t.toString)&&!i(c=e(r,t))\|\|o(r=t.valueOf)&&!i(c=e(r,t))\|\|"string"!==n&&o(r=t.toString)&&!i(c=e(r
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 28 74 29 7c 7c 21 28 4f 62 6a 65 63 74 28 74 29 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 79 6d 62 6f 6c 29 7c 7c 21 53 79 6d 62 6f 6c 2e 73 68 61 6d 26 26 65 26 26 65 3c 34 31 7d 29 7d 2c 39 38 30 38 35 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 39 35 39 33 31 38 29 2c 6f 3d 4d 61 74 68 2e 6d 61 78 2c 69 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 65 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 6e 2c 30 29 3a 69 28 72 2c 6e 29 7d 7d 2c 32 39 39 36 32 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 34 37 30 35 39 32 29 2c 6f 3d 72 28 36 37 36 31 32 35 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f Data Ascii: (t)\|\|!(Object(t) instanceof Symbol)\|\|!Symbol.sham&&e&&e<41})},980855:function(t,n,r){var e=r(959318),o=Math.max,i=Math.min;t.exports=function(t,n){var r=e(t);return r<0?o(r+n,0):i(r,n)}},299623:function(t,n,r){var e=r(470592),o=r(676125);t.exports=functio
2024-10-24 07:16:28 UTC	1053	IN	Data Raw: 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 7d 2c 37 33 33 36 36 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 33 32 35 30 30 38 29 2c 6f 3d 72 28 39 33 36 39 34 30 29 3b 74 2e 65 78 70 6f 72 74 73 3d 65 26 26 6f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 34 32 21 3d 3d 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 76 61 6c 75 65 3a 34 32 2c 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2e 70 72 6f 74 6f 74 79 70 65 7d 29 7d 2c 31 39 37 30 34 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 31 36 31 35 38 31 29 2c 6f 3d 72 28 33 35 34 38 34 38 29 2c 69 3d 65 2e 57 65 61 6b 4d 61 70 3b 74 2e Data Ascii: Symbol.iterator},733669:function(t,n,r){var e=r(325008),o=r(936940);t.exports=e&&o(function(){return 42!==Object.defineProperty(function(){},"prototype",{value:42,writable:!1}).prototype})},197047:function(t,n,r){var e=r(161581),o=r(354848),i=e.WeakMap;t.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.10	49864	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	673	OUT	GET /assets/d67c5e680608266a1f63.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	970	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: application/javascript Content-Length: 7728 Connection: close CF-Ray: 8d782e7ddb134786-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "1c6b9d0ad743762986197ae0e81874c1" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YuurpguEuWjc%2FrY1qHujTqJaQfT8JzF1q5nN%2Fhwj7zJ0PHWSnCXWFvu23oRo0%2BX2lYLnNyizNTZ8VUKLObq0ptcXXOOhDbNNrP4NRS7tP%2B3mPEgsUktHy6kIwuzh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 35 34 39 32 22 5d 2c 7b 38 34 39 31 34 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4d 61 70 29 72 65 74 75 72 6e 20 4d 61 70 3b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 29 7b 76 61 72 20 6e 3d 2d 31 3b 72 65 74 75 72 6e 20 74 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 72 65 74 75 72 6e 20 74 5b 30 5d 3d 3d 3d 65 26 26 28 6e 3d 72 2c 21 30 29 7d 29 2c 6e 7d Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["75492"],{849146:function(t,e,n){var r=function(){if("undefined"!=typeof Map)return Map;function t(t,e){var n=-1;return t.some(function(t,r){return t[0]===e&&(n=r,!0)}),n}
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 29 29 7d 2c 31 65 33 2f 36 30 29 7d 2c 63 3d 5b 22 74 6f 70 22 2c 22 72 69 67 68 74 22 2c 22 62 6f 74 74 6f 6d 22 2c 22 6c 65 66 74 22 2c 22 77 69 64 74 68 22 2c 22 68 65 69 67 68 74 22 2c 22 73 69 7a 65 22 2c 22 77 65 69 67 68 74 22 5d 2c 61 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 3d 21 31 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 41 64 64 65 64 5f 3d 21 31 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 73 4f 62 73 65 72 76 65 72 5f 3d 6e 75 6c 6c 2c 74 68 69 73 2e 6f 62 73 65 72 76 65 72 73 5f 3d 5b 5d 2c 74 68 69 73 2e 6f 6e 54 72 61 6e 73 69 74 Data Ascii: ))},1e3/60)},c=["top","right","bottom","left","width","height","size","weight"],a="undefined"!=typeof MutationObserver,h=function(){function t(){this.connected_=!1,this.mutationEventsAdded_=!1,this.mutationsObserver_=null,this.observers_=[],this.onTransit
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 72 44 61 74 61 3a 21 30 2c 73 75 62 74 72 65 65 3a 21 30 7d 29 29 3a 28 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 53 75 62 74 72 65 65 4d 6f 64 69 66 69 65 64 22 2c 74 68 69 73 2e 72 65 66 72 65 73 68 29 2c 74 68 69 73 2e 6d 75 74 61 74 69 6f 6e 45 76 65 6e 74 73 41 64 64 65 64 5f 3d 21 30 29 2c 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 3d 21 30 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 64 69 73 63 6f 6e 6e 65 63 74 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 21 69 26 26 21 21 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 5f 29 64 6f 63 75 6d 65 6e 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 74 68 69 73 2e 6f 6e 54 72 61 6e 73 69 74 Data Ascii: rData:!0,subtree:!0})):(document.addEventListener("DOMSubtreeModified",this.refresh),this.mutationEventsAdded_=!0),this.connected_=!0},t.prototype.disconnect_=function(){if(!!i&&!!this.connected_)document.removeEventListener("transitionend",this.onTransit
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 6c 65 6d 65 6e 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 42 42 6f 78 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 74 2c 65 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 7b 78 3a 74 2c 79 3a 65 2c 77 69 64 74 68 3a 6e 2c 68 65 69 67 68 74 3a 72 7d 7d 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 74 68 69 73 2e 62 72 6f 61 64 63 61 73 74 57 69 64 74 68 3d 30 2c 74 68 69 73 2e 62 72 6f 61 64 63 61 73 74 48 65 69 67 68 74 3d 30 2c 74 68 69 73 2e 63 6f 6e 74 65 6e 74 52 65 63 74 5f 3d 6c 28 30 2c 30 2c 30 2c 30 29 2c 74 68 69 73 2e 74 61 72 67 65 74 3d 74 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 69 73 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d Data Ascii: lement&&"function"==typeof t.getBBox};function l(t,e,n,r){return{x:t,y:e,width:n,height:r}}var b=function(){function t(t){this.broadcastWidth=0,this.broadcastHeight=0,this.contentRect_=l(0,0,0,0),this.target=t}return t.prototype.isActive=function(){var t=
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 6f 2c 68 65 69 67 68 74 3a 73 2c 74 6f 70 3a 69 2c 72 69 67 68 74 3a 72 2b 6f 2c 62 6f 74 74 6f 6d 3a 73 2b 69 2c 6c 65 66 74 3a 72 7d 29 2c 63 29 3b 75 28 74 68 69 73 2c 7b 74 61 72 67 65 74 3a 74 2c 63 6f 6e 74 65 6e 74 52 65 63 74 3a 61 7d 29 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 6e 29 7b 69 66 28 74 68 69 73 2e 61 63 74 69 76 65 4f 62 73 65 72 76 61 74 69 6f 6e 73 5f 3d 5b 5d 2c 74 68 69 73 2e 6f 62 73 65 72 76 61 74 69 6f 6e 73 5f 3d 6e 65 77 20 72 2c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 63 61 6c 6c 62 61 63 6b 20 70 72 6f 76 69 64 65 64 20 61 73 20 70 61 72 61 6d 65 74 65 72 20 31 20 69 73 20 6e 6f 74 20 61 20 Data Ascii: o,height:s,top:i,right:r+o,bottom:s+i,left:r}),c);u(this,{target:t,contentRect:a})},y=function(){function t(t,e,n){if(this.activeObservations_=[],this.observations_=new r,"function"!=typeof t)throw TypeError("The callback provided as parameter 1 is not a
2024-10-24 07:16:28 UTC	883	IN	Data Raw: 79 70 65 2e 62 72 6f 61 64 63 61 73 74 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 21 74 68 69 73 2e 68 61 73 41 63 74 69 76 65 28 29 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 63 61 6c 6c 62 61 63 6b 43 74 78 5f 2c 65 3d 74 68 69 73 2e 61 63 74 69 76 65 4f 62 73 65 72 76 61 74 69 6f 6e 73 5f 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 6d 28 74 2e 74 61 72 67 65 74 2c 74 2e 62 72 6f 61 64 63 61 73 74 52 65 63 74 28 29 29 7d 29 3b 74 68 69 73 2e 63 61 6c 6c 62 61 63 6b 5f 2e 63 61 6c 6c 28 74 2c 65 2c 74 29 2c 74 68 69 73 2e 63 6c 65 61 72 41 63 74 69 76 65 28 29 7d 7d 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 41 63 74 69 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 61 63 74 Data Ascii: ype.broadcastActive=function(){if(!!this.hasActive()){var t=this.callbackCtx_,e=this.activeObservations_.map(function(t){return new m(t.target,t.broadcastRect())});this.callback_.call(t,e,t),this.clearActive()}},t.prototype.clearActive=function(){this.act

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.10	49865	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	673	OUT	GET /assets/1f7f046253c197b5a419.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/javascript Content-Length: 17462 Connection: close CF-Ray: 8d782e7dee03485e-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "3b98c1ef9293d482a5099fdb6984946f" Last-Modified: Tue, 15 Oct 2024 21:50:02 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pSquzaLlT2X%2Fn6FqUfqJMzXg8Wq5AEvCBr19inYfo3z1lla40ht6KtGnOuJFoFclpcb6Wboaf9NshQEdFp0Ll0LBoMagYfkwk21%2B2qCirrg2KRE%2B8J0Oj3rg7iW9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 35 38 31 32 22 5d 2c 7b 38 38 34 38 33 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6f 3d 72 28 33 31 31 35 39 36 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 7d 69 2e 72 65 73 65 74 57 61 72 6e 69 6e 67 43 61 63 68 65 3d 6e 2c 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 2c 65 2c 72 2c 6e 2c 69 2c 61 29 7b 69 66 28 61 21 3d 3d 6f 29 7b 76 61 72 20 75 3d 45 72 72 6f 72 28 22 43 61 6c 6c Data Ascii: (this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["15812"],{884835:function(t,e,r){"use strict";var o=r(311596);function n(){}function i(){}i.resetWarningCache=n,t.exports=function(){function t(t,e,r,n,i,a){if(a!==o){var u=Error("Call
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6c 65 6e 67 74 68 7d 2c 70 75 74 42 69 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 68 69 73 2e 6c 65 6e 67 74 68 2f 38 29 3b 74 68 69 73 2e 62 75 66 66 65 72 2e 6c 65 6e 67 74 68 3c 3d 65 26 26 74 68 69 73 2e 62 75 66 66 65 72 2e 70 75 73 68 28 30 29 2c 74 26 26 28 74 68 69 73 2e 62 75 66 66 65 72 5b 65 5d 7c 3d 31 32 38 3e 3e 3e 74 68 69 73 2e 6c 65 6e 67 74 68 25 38 29 2c 74 68 69 73 2e 6c 65 6e 67 74 68 2b 2b 7d 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 65 7d 2c 39 33 33 39 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 7b 4c 3a 31 2c 4d 3a 30 2c 51 3a 33 2c 48 3a 32 7d 7d 2c 36 36 39 30 31 33 3a 66 75 6e 63 Data Ascii: :function(){return this.length},putBit:function(t){var e=Math.floor(this.length/8);this.buffer.length<=e&&this.buffer.push(0),t&&(this.buffer[e]\|=128>>>this.length%8),this.length++}},t.exports=e},933982:function(t){t.exports={L:1,M:0,Q:3,H:2}},669013:func
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 74 7c 7c 65 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 65 29 74 68 72 6f 77 20 45 72 72 6f 72 28 74 2b 22 2c 22 2b 65 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 5d 5b 65 5d 7d 2c 6c 2e 67 65 74 4d 6f 64 75 6c 65 43 6f 75 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 7d 2c 6c 2e 6d 61 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 74 79 70 65 4e 75 6d 62 65 72 3c 31 29 7b 76 61 72 20 74 3d 31 3b 66 6f 72 28 74 3d 31 3b 74 3c 34 30 3b 74 2b 2b 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 67 65 74 52 53 42 6c 6f Data Ascii: function(t,e){if(t<0\|\|this.moduleCount<=t\|\|e<0\|\|this.moduleCount<=e)throw Error(t+","+e);return this.modules[t][e]},l.getModuleCount=function(){return this.moduleCount},l.make=function(){if(this.typeNumber<1){var t=1;for(t=1;t<40;t++){for(var e=n.getRSBlo
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 3c 3d 65 2b 6f 29 26 26 28 30 3c 3d 72 26 26 72 3c 3d 36 26 26 28 30 3d 3d 6f 7c 7c 36 3d 3d 6f 29 7c 7c 30 3c 3d 6f 26 26 6f 3c 3d 36 26 26 28 30 3d 3d 72 7c 7c 36 3d 3d 72 29 7c 7c 32 3c 3d 72 26 26 72 3c 3d 34 26 26 32 3c 3d 6f 26 26 6f 3c 3d 34 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 30 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 2b 72 5d 5b 65 2b 6f 5d 3d 21 31 29 7d 2c 6c 2e 67 65 74 42 65 73 74 4d 61 73 6b 50 61 74 74 65 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 2c 65 3d 30 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 74 68 69 73 2e 6d 61 6b 65 49 6d 70 6c 28 21 30 2c 72 29 3b 76 61 72 20 6f 3d 61 2e 67 65 74 4c 6f 73 74 50 6f 69 6e 74 28 74 68 69 73 29 3b 28 30 3d 3d 72 7c 7c 74 3e Data Ascii: <=e+o)&&(0<=r&&r<=6&&(0==o\|\|6==o)\|\|0<=o&&o<=6&&(0==r\|\|6==r)\|\|2<=r&&r<=4&&2<=o&&o<=4?this.modules[t+r][e+o]=!0:this.modules[t+r][e+o]=!1)},l.getBestMaskPattern=function(){for(var t=0,e=0,r=0;r<8;r++){this.makeImpl(!0,r);var o=a.getLostPoint(this);(0==r\|\|t>
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 5d 5b 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 33 29 5d 3d 6f 7d 7d 2c 6c 2e 73 65 74 75 70 54 79 70 65 49 6e 66 6f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 68 69 73 2e 65 72 72 6f 72 43 6f 72 72 65 63 74 4c 65 76 65 6c 3c 3c 33 7c 65 2c 6f 3d 61 2e 67 65 74 42 43 48 54 79 70 65 49 6e 66 6f 28 72 29 2c 6e 3d 30 3b 6e 3c 31 35 3b 6e 2b 2b 29 7b 76 61 72 20 69 3d 21 74 26 26 28 6f 3e 3e 6e 26 31 29 3d 3d 31 3b 6e 3c 36 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 38 5d 3d 69 3a 6e 3c 38 3f 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 2b 31 5d 5b 38 5d 3d 69 3a 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 2d 31 35 2b 6e 5d 5b 38 5d 3d 69 7d 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e Data Ascii: ][Math.floor(r/3)]=o}},l.setupTypeInfo=function(t,e){for(var r=this.errorCorrectLevel<<3\|e,o=a.getBCHTypeInfo(r),n=0;n<15;n++){var i=!t&&(o>>n&1)==1;n<6?this.modules[n][8]=i:n<8?this.modules[n+1][8]=i:this.modules[this.moduleCount-15+n][8]=i}for(var n=0;n
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 74 68 29 2c 73 3d 41 72 72 61 79 28 65 2e 6c 65 6e 67 74 68 29 2c 6c 3d 30 3b 6c 3c 65 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 66 3d 65 5b 6c 5d 2e 64 61 74 61 43 6f 75 6e 74 2c 68 3d 65 5b 6c 5d 2e 74 6f 74 61 6c 43 6f 75 6e 74 2d 66 3b 6f 3d 4d 61 74 68 2e 6d 61 78 28 6f 2c 66 29 2c 6e 3d 4d 61 74 68 2e 6d 61 78 28 6e 2c 68 29 2c 69 5b 6c 5d 3d 41 72 72 61 79 28 66 29 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 67 3c 69 5b 6c 5d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 69 5b 6c 5d 5b 67 5d 3d 32 35 35 26 74 2e 62 75 66 66 65 72 5b 67 2b 72 5d 3b 72 2b 3d 66 3b 76 61 72 20 63 3d 61 2e 67 65 74 45 72 72 6f 72 43 6f 72 72 65 63 74 50 6f 6c 79 6e 6f 6d 69 61 6c 28 68 29 2c 64 3d 6e 65 77 20 75 28 69 5b 6c 5d 2c 63 2e 67 65 74 4c 65 6e 67 74 68 28 29 2d 31 Data Ascii: th),s=Array(e.length),l=0;l<e.length;l++){var f=e[l].dataCount,h=e[l].totalCount-f;o=Math.max(o,f),n=Math.max(n,h),i[l]=Array(f);for(var g=0;g<i[l].length;g++)i[l][g]=255&t.buffer[g+r];r+=f;var c=a.getErrorCorrectPolynomial(h),d=new u(i[l],c.getLength()-1
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 32 31 5d 2c 5b 37 2c 34 32 2c 31 34 2c 34 2c 34 33 2c 31 35 5d 2c 5b 34 2c 31 33 33 2c 31 30 37 5d 2c 5b 38 2c 35 39 2c 33 37 2c 31 2c 36 30 2c 33 38 5d 2c 5b 38 2c 34 34 2c 32 30 2c 34 2c 34 35 2c 32 31 5d 2c 5b 31 32 2c 33 33 2c 31 31 2c 34 2c 33 34 2c 31 32 5d 2c 5b 33 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 34 2c 36 34 2c 34 30 2c 35 2c 36 35 2c 34 31 5d 2c 5b 31 31 2c 33 36 2c 31 36 2c 35 2c 33 37 2c 31 37 5d 2c 5b 31 31 2c 33 36 2c 31 32 2c 35 2c 33 37 2c 31 33 5d 2c 5b 35 2c 31 30 39 2c 38 37 2c 31 2c 31 31 30 2c 38 38 5d 2c 5b 35 2c 36 35 2c 34 31 2c 35 2c 36 36 2c 34 32 5d 2c 5b 35 2c 35 34 2c 32 34 2c 37 2c 35 35 2c 32 35 5d 2c 5b 31 31 2c 33 36 2c 31 32 5d 2c 5b 35 2c 31 32 32 2c 39 38 2c 31 2c 31 32 33 2c 39 39 5d 2c 5b Data Ascii: 21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12],[5,122,98,1,123,99],[
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 35 34 2c 32 34 2c 32 35 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 35 2c 34 36 2c 31 36 5d 2c 5b 31 33 2c 31 34 35 2c 31 31 35 2c 33 2c 31 34 36 2c 31 31 36 5d 2c 5b 32 2c 37 34 2c 34 36 2c 32 39 2c 37 35 2c 34 37 5d 2c 5b 34 32 2c 35 34 2c 32 34 2c 31 2c 35 35 2c 32 35 5d 2c 5b 32 33 2c 34 35 2c 31 35 2c 32 38 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 5d 2c 5b 31 30 2c 37 34 2c 34 36 2c 32 33 2c 37 35 2c 34 37 5d 2c 5b 31 30 2c 35 34 2c 32 34 2c 33 35 2c 35 35 2c 32 35 5d 2c 5b 31 39 2c 34 35 2c 31 35 2c 33 35 2c 34 36 2c 31 36 5d 2c 5b 31 37 2c 31 34 35 2c 31 31 35 2c 31 2c 31 34 36 2c 31 31 36 5d 2c 5b 31 34 2c 37 34 2c 34 36 2c 32 31 2c 37 35 2c 34 37 5d 2c 5b 32 39 2c 35 34 2c 32 34 2c 31 39 2c 35 35 2c 32 35 5d 2c 5b 31 Data Ascii: 54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,55,25],[1
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 7b 67 6c 6f 67 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 3c 31 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 6c 6f 67 28 22 2b 74 2b 22 29 22 29 3b 72 65 74 75 72 6e 20 65 2e 4c 4f 47 5f 54 41 42 4c 45 5b 74 5d 7d 2c 67 65 78 70 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 3b 74 3c 30 3b 29 74 2b 3d 32 35 35 3b 66 6f 72 28 3b 74 3e 3d 32 35 36 3b 29 74 2d 3d 32 35 35 3b 72 65 74 75 72 6e 20 65 2e 45 58 50 5f 54 41 42 4c 45 5b 74 5d 7d 2c 45 58 50 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 2c 4c 4f 47 5f 54 41 42 4c 45 3a 41 72 72 61 79 28 32 35 36 29 7d 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 65 2e 45 58 50 5f 54 41 42 4c 45 5b 72 5d 3d 31 3c 3c 72 3b 66 6f 72 28 76 61 72 20 72 3d 38 Data Ascii: ion(t){for(var e={glog:function(t){if(t<1)throw Error("glog("+t+")");return e.LOG_TABLE[t]},gexp:function(t){for(;t<0;)t+=255;for(;t>=256;)t-=255;return e.EXP_TABLE[t]},EXP_TABLE:Array(256),LOG_TABLE:Array(256)},r=0;r<8;r++)e.EXP_TABLE[r]=1<<r;for(var r=8
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 30 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 35 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 35 29 3b 72 65 74 75 72 6e 28 74 3c 3c 31 30 7c 65 29 5e 75 2e 47 31 35 5f 4d 41 53 4b 7d 2c 67 65 74 42 43 48 54 79 70 65 4e 75 6d 62 65 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 3c 3c 31 32 3b 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 29 2d 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 75 2e 47 31 38 29 3e 3d 30 3b 29 65 5e 3d 75 2e 47 31 38 3c 3c 75 2e 67 65 74 42 43 48 44 69 67 69 74 28 65 Data Ascii: ction(t){for(var e=t<<10;u.getBCHDigit(e)-u.getBCHDigit(u.G15)>=0;)e^=u.G15<<u.getBCHDigit(e)-u.getBCHDigit(u.G15);return(t<<10\|e)^u.G15_MASK},getBCHTypeNumber:function(t){for(var e=t<<12;u.getBCHDigit(e)-u.getBCHDigit(u.G18)>=0;)e^=u.G18<<u.getBCHDigit(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.10	49863	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	673	OUT	GET /assets/a6f6204cd40c3c5f5c14.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	975	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: application/javascript Content-Length: 21811 Connection: close CF-Ray: 8d782e7dedafe76a-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "0fbb77d1b69f18df0fdcf836de1c4106" Last-Modified: Fri, 28 Jun 2024 00:43:11 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6SpFz68oEkB%2F6Fc2sbCp1q%2F%2Fxx5Rl1JF7cqEoWCW9l8ogZpmFnZcTL0tTM6fd2Elz8JTG6SQ%2B5QKq%2B3IMBMzsa3ef9ftSMFiC6e%2BE9F4I0RwWf8zD7pGSXMO9U1u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	394	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 31 39 38 34 22 5d 2c 7b 37 37 32 34 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 39 33 33 36 37 36 29 2c 6f 3d 6e 28 39 33 38 35 30 37 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 65 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 69 28 6f 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 7d 7d 2c 36 30 33 35 32 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["71984"],{772425:function(t,r,n){var e=n(933676),o=n(938507),i=TypeError;t.exports=function(t){if(e(t))return t;throw i(o(t)+" is not a constructor")}},603528:function(t,r
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 44 61 74 61 56 69 65 77 7d 2c 31 39 32 32 39 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 6f 2c 69 2c 75 3d 6e 28 32 31 32 30 33 36 29 2c 66 3d 6e 28 33 32 35 30 30 38 29 2c 61 3d 6e 28 31 36 31 35 38 31 29 2c 63 3d 6e 28 33 35 34 38 34 38 29 2c 73 3d 6e 28 36 32 32 32 38 31 29 2c 79 3d 6e 28 37 34 30 33 36 32 29 2c 70 3d 6e 28 39 37 34 39 37 31 29 2c 68 3d 6e 28 39 33 38 35 30 37 29 2c 76 3d 6e 28 32 35 31 30 36 39 29 2c 64 3d 6e 28 38 35 39 32 30 39 29 2c 67 3d 6e 28 34 33 34 30 29 2c 6c 3d 6e 28 38 33 38 39 35 37 29 2c 41 3d 6e 28 31 34 34 37 34 38 29 2c 77 3d 6e 28 32 37 Data Ascii: undefined"!=typeof ArrayBuffer&&"undefined"!=typeof DataView},192291:function(t,r,n){var e,o,i,u=n(212036),f=n(325008),a=n(161581),c=n(354848),s=n(622281),y=n(740362),p=n(974971),h=n(938507),v=n(251069),d=n(859209),g=n(4340),l=n(838957),A=n(144748),w=n(27
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 29 7b 69 66 28 59 28 74 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 4c 28 22 54 61 72 67 65 74 20 69 73 20 6e 6f 74 20 61 20 74 79 70 65 64 20 61 72 72 61 79 22 29 7d 2c 61 54 79 70 65 64 41 72 72 61 79 43 6f 6e 73 74 72 75 63 74 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 63 28 74 29 26 26 28 21 77 7c 7c 6c 28 46 2c 74 29 29 29 72 65 74 75 72 6e 20 74 3b 74 68 72 6f 77 20 4c 28 68 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 74 79 70 65 64 20 61 72 72 61 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 7d 2c 65 78 70 6f 72 74 54 79 70 65 64 41 72 72 61 79 4d 65 74 68 6f 64 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 65 29 7b 69 66 28 66 29 7b 69 66 28 6e 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 4e 29 7b 76 61 72 20 69 3d 61 5b 6f 5d 3b Data Ascii: ){if(Y(t))return t;throw L("Target is not a typed array")},aTypedArrayConstructor:function(t){if(c(t)&&(!w\|\|l(F,t)))return t;throw L(h(t)+" is not a typed array constructor")},exportTypedArrayMethod:function(t,r,n,e){if(f){if(n)for(var o in N){var i=a[o];
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 35 26 74 2c 74 3e 3e 38 26 32 35 35 5d 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 5b 32 35 35 26 74 2c 74 3e 3e 38 26 32 35 35 2c 74 3e 3e 31 36 26 32 35 35 2c 74 3e 3e 32 34 26 32 35 35 5d 7d 2c 48 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 5b 33 5d 3c 3c 32 34 7c 74 5b 32 5d 3c 3c 31 36 7c 74 5b 31 5d 3c 3c 38 7c 74 5b 30 5d 7d 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 44 28 74 2c 32 33 2c 34 29 7d 2c 51 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 44 28 74 2c 35 32 2c 38 29 7d 2c 58 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 63 28 74 5b 4d 5d 2c 72 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e Data Ascii: 5&t,t>>8&255]},q=function(t){return[255&t,t>>8&255,t>>16&255,t>>24&255]},H=function(t){return t[3]<<24\|t[2]<<16\|t[1]<<8\|t[0]},J=function(t){return D(t,23,4)},Q=function(t){return D(t,52,8)},X=function(t,r,n){c(t[M],r,{configurable:!0,get:function(){return
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 6e 3d 76 6f 69 64 20 30 3d 3d 3d 6e 3f 6f 2d 75 3a 76 28 6e 29 2c 75 2b 6e 3e 6f 29 74 68 72 6f 77 20 6a 28 22 57 72 6f 6e 67 20 6c 65 6e 67 74 68 22 29 3b 4c 28 74 68 69 73 2c 7b 74 79 70 65 3a 4f 2c 62 75 66 66 65 72 3a 74 2c 62 79 74 65 4c 65 6e 67 74 68 3a 6e 2c 62 79 74 65 4f 66 66 73 65 74 3a 75 2c 62 79 74 65 73 3a 65 2e 62 79 74 65 73 7d 29 2c 21 69 26 26 28 74 68 69 73 2e 62 75 66 66 65 72 3d 74 2c 74 68 69 73 2e 62 79 74 65 4c 65 6e 67 74 68 3d 6e 2c 74 68 69 73 2e 62 79 74 65 4f 66 66 73 65 74 3d 75 29 7d 29 5b 4d 5d 2c 69 26 26 28 58 28 43 2c 22 62 79 74 65 4c 65 6e 67 74 68 22 2c 55 29 2c 58 28 50 2c 22 62 75 66 66 65 72 22 2c 5f 29 2c 58 28 50 2c 22 62 79 74 65 4c 65 6e 67 74 68 22 2c 5f 29 2c 58 28 50 2c 22 62 79 74 65 4f 66 66 73 65 74 22 Data Ascii: n=void 0===n?o-u:v(n),u+n>o)throw j("Wrong length");L(this,{type:O,buffer:t,byteLength:n,byteOffset:u,bytes:e.bytes}),!i&&(this.buffer=t,this.byteLength=n,this.byteOffset=u)})[M],i&&(X(C,"byteLength",U),X(P,"buffer",_),X(P,"byteLength",_),X(P,"byteOffset"
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3e 32 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 29 7d 7d 29 3b 54 28 43 2c 6d 29 2c 54 28 50 2c 4f 29 2c 74 2e 65 78 70 6f 72 74 73 3d 7b 41 72 72 61 79 42 75 66 66 65 72 3a 43 2c 44 61 74 61 56 69 65 77 3a 50 7d 7d 2c 36 39 32 39 39 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 33 33 39 37 31 38 29 2c 6f 3d 6e 28 39 38 30 38 35 35 29 2c 69 3d 6e 28 34 39 36 39 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 65 28 74 68 69 73 29 2c 6e 3d 69 28 72 29 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 66 3d 6f 28 75 3e 31 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 2c 6e 29 2c 61 3d 75 3e 32 3f 61 72 67 Data Ascii: guments.length>2&&arguments[2])}});T(C,m),T(P,O),t.exports={ArrayBuffer:C,DataView:P}},692994:function(t,r,n){var e=n(339718),o=n(980855),i=n(49693);t.exports=function(t){for(var r=e(this),n=i(r),u=arguments.length,f=o(u>1?arguments[1]:void 0,n),a=u>2?arg
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 6e 29 7b 76 61 72 20 65 3d 6e 28 33 32 35 30 30 38 29 2c 6f 3d 6e 28 34 39 38 35 37 36 29 2c 69 3d 54 79 70 65 45 72 72 6f 72 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 2c 66 3d 65 26 26 21 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 68 69 73 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 5b 5d 2c 22 6c 65 6e 67 74 68 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2e 6c 65 6e 67 74 68 3d 31 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 54 79 70 65 45 72 72 6f 72 7d 7d 28 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 3f 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 69 66 28 6f Data Ascii: n){var e=n(325008),o=n(498576),i=TypeError,u=Object.getOwnPropertyDescriptor,f=e&&!function(){if(void 0!==this)return!0;try{Object.defineProperty([],"length",{writable:!1}).length=1}catch(t){return t instanceof TypeError}}();t.exports=f?function(t,r){if(o
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 29 7b 76 61 72 20 65 3d 6e 28 34 39 36 39 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 6e 3d 65 28 74 29 2c 6f 3d 6e 65 77 20 72 28 6e 29 2c 69 3d 30 3b 69 3c 6e 3b 69 2b 2b 29 6f 5b 69 5d 3d 74 5b 6e 2d 69 2d 31 5d 3b 72 65 74 75 72 6e 20 6f 7d 7d 2c 37 31 37 34 34 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 34 39 36 39 33 29 2c 6f 3d 6e 28 39 35 39 33 31 38 29 2c 69 3d 52 61 6e 67 65 45 72 72 6f 72 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 75 29 7b 76 61 72 20 66 3d 65 28 74 29 2c 61 3d 6f 28 6e 29 2c 63 3d 61 3c 30 3f 66 2b 61 3a 61 3b 69 66 28 63 3e 3d 66 7c 7c 63 3c 30 29 74 68 72 6f 77 20 69 28 22 49 6e 63 6f 72 72 65 63 Data Ascii: ){var e=n(49693);t.exports=function(t,r){for(var n=e(t),o=new r(n),i=0;i<n;i++)o[i]=t[n-i-1];return o}},717441:function(t,r,n){var e=n(49693),o=n(959318),i=RangeError;t.exports=function(t,r,n,u){var f=e(t),a=o(n),c=a<0?f+a:a;if(c>=f\|\|c<0)throw i("Incorrec
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 35 34 37 34 30 39 39 31 29 74 68 72 6f 77 20 72 28 22 4d 61 78 69 6d 75 6d 20 61 6c 6c 6f 77 65 64 20 69 6e 64 65 78 20 65 78 63 65 65 64 65 64 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 36 37 39 36 32 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 36 32 36 35 34 34 29 2e 6d 61 74 63 68 28 2f 66 69 72 65 66 6f 78 5c 2f 28 5c 64 2b 29 2f 69 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 21 65 26 26 2b 65 5b 31 5d 7d 2c 33 31 30 37 33 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 36 32 36 35 34 34 29 3b 74 2e 65 78 70 6f 72 74 73 3d 2f 4d 53 49 45 7c 54 72 69 64 65 6e 74 2f 2e 74 65 73 74 28 65 29 7d 2c 33 36 31 32 37 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 3d 6e 28 36 32 36 Data Ascii: 54740991)throw r("Maximum allowed index exceeded");return t}},679622:function(t,r,n){var e=n(626544).match(/firefox\/(\d+)/i);t.exports=!!e&&+e[1]},310731:function(t,r,n){var e=n(626544);t.exports=/MSIE\|Trident/.test(e)},361270:function(t,r,n){var e=n(626
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 6e 3e 2e 35 7c 7c 2e 35 3d 3d 3d 6e 26 26 72 25 32 21 3d 30 3f 72 2b 65 28 74 29 3a 72 7d 3b 74 2e 65 78 70 6f 72 74 73 3d 7b 70 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 29 7b 76 61 72 20 65 2c 6f 2c 70 2c 68 3d 69 28 6e 29 2c 76 3d 38 2a 6e 2d 72 2d 31 2c 64 3d 28 31 3c 3c 76 29 2d 31 2c 67 3d 64 3e 3e 31 2c 6c 3d 32 33 3d 3d 3d 72 3f 66 28 32 2c 2d 32 34 29 2d 66 28 32 2c 2d 37 37 29 3a 30 2c 41 3d 74 3c 30 7c 7c 30 3d 3d 3d 74 26 26 31 2f 74 3c 30 3f 31 3a 30 2c 77 3d 30 3b 66 6f 72 28 28 74 3d 75 28 74 29 29 21 3d 74 7c 7c 74 3d 3d 3d 31 2f 30 3f 28 6f 3d 74 21 3d 74 3f 31 3a 30 2c 65 3d 64 29 3a 28 70 3d 66 28 32 2c 2d 28 65 3d 61 28 63 28 74 29 2f 73 29 29 29 2c 74 2a 70 3c 31 26 26 28 65 2d 2d 2c 70 2a 3d 32 29 2c 65 2b 67 3e 3d 31 3f Data Ascii: n>.5\|\|.5===n&&r%2!=0?r+e(t):r};t.exports={pack:function(t,r,n){var e,o,p,h=i(n),v=8n-r-1,d=(1<<v)-1,g=d>>1,l=23===r?f(2,-24)-f(2,-77):0,A=t<0\|\|0===t&&1/t<0?1:0,w=0;for((t=u(t))!=t\|\|t===1/0?(o=t!=t?1:0,e=d):(p=f(2,-(e=a(c(t)/s))),tp<1&&(e--,p*=2),e+g>=1?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.10	49866	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	673	OUT	GET /assets/1bab9b095996b8d024ce.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	972	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: application/javascript Content-Length: 7078 Connection: close CF-Ray: 8d782e7dfc446b14-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "45a3ee5ff96bdb2dd7fbb2846b5ea494" Last-Modified: Tue, 18 Jun 2024 19:13:27 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uUAcMSQhvSAQQpnDX3OBGQLxDHYr%2BOduQMA%2B4x1HStYZ6Bb1VBDFrmyHZrOalZ%2BW0iRJopKOAT0uG5rdI1GTFjkVpgHMwc7jqUg4E%2B9Paulk%2Bk9ojkljEkfMGyCR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	397	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 33 32 32 32 22 5d 2c 7b 33 34 30 36 31 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 33 35 34 38 34 38 29 2c 6e 3d 53 74 72 69 6e 67 2c 63 3d 54 79 70 65 45 72 72 6f 72 3b 72 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 72 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 72 7c 7c 65 28 72 29 29 72 65 74 75 72 6e 20 72 3b 74 68 72 6f 77 20 63 28 22 43 61 6e 27 74 20 73 65 74 20 22 2b 6e 28 72 29 2b 22 20 61 73 20 61 20 70 72 6f 74 6f 74 79 70 65 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["43222"],{340618:function(r,t,o){var e=o(354848),n=String,c=TypeError;r.exports=function(r){if("object"==typeof r\|\|e(r))return r;throw c("Can't set "+n(r)+" as a prototype
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 77 20 72 29 21 3d 3d 72 2e 70 72 6f 74 6f 74 79 70 65 7d 29 7d 2c 33 33 39 39 35 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 49 6e 64 65 78 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 49 4e 44 45 58 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 31 2c 6d 3a 31 7d 2c 44 4f 4d 53 74 72 69 6e 67 53 69 7a 65 45 72 72 6f 72 3a 7b 73 3a 22 44 4f 4d 53 54 52 49 4e 47 5f 53 49 5a 45 5f 45 52 52 22 2c 63 3a 32 2c 6d 3a 30 7d 2c 48 69 65 72 61 72 63 68 79 52 65 71 75 65 73 74 45 72 72 6f 72 3a 7b 73 3a 22 48 49 45 52 41 52 43 48 59 5f 52 45 51 55 45 53 54 5f 45 52 52 22 2c 63 3a 33 2c 6d 3a 31 7d 2c 57 72 6f 6e 67 44 6f 63 75 6d 65 6e 74 45 72 72 6f 72 3a 7b 73 3a 22 57 52 4f 4e 47 5f 44 4f 43 55 4d 45 4e 54 5f 45 52 52 22 2c 63 3a 34 2c 6d 3a 31 Data Ascii: w r)!==r.prototype})},33995:function(r){r.exports={IndexSizeError:{s:"INDEX_SIZE_ERR",c:1,m:1},DOMStringSizeError:{s:"DOMSTRING_SIZE_ERR",c:2,m:0},HierarchyRequestError:{s:"HIERARCHY_REQUEST_ERR",c:3,m:1},WrongDocumentError:{s:"WRONG_DOCUMENT_ERR",c:4,m:1
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 74 2c 6f 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 65 28 6e 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 72 2c 74 29 5b 6f 5d 29 29 7d 63 61 74 63 68 28 72 29 7b 7d 7d 7d 2c 36 32 30 36 32 33 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 35 34 35 35 37 36 29 3b 72 2e 65 78 70 6f 72 74 73 3d 65 28 22 64 6f 63 75 6d 65 6e 74 22 2c 22 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 22 29 7d 2c 38 37 34 36 35 32 3a 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 38 30 33 39 33 38 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 2c 6e 3d 6f 28 32 34 30 33 33 29 2c 63 3d 6f 28 39 34 35 36 37 29 2c 69 3d 6f 28 32 30 32 32 33 34 29 2c 75 3d Data Ascii: t,o){try{return e(n(Object.getOwnPropertyDescriptor(r,t)[o]))}catch(r){}}},620623:function(r,t,o){var e=o(545576);r.exports=e("document","documentElement")},874652:function(r){r.exports={}},803938:function(r,t,o){var e,n=o(24033),c=o(94567),i=o(202234),u=
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 74 3d 63 28 72 29 3b 69 66 28 65 28 74 2c 61 29 29 72 65 74 75 72 6e 20 74 5b 61 5d 3b 76 61 72 20 6f 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 72 65 74 75 72 6e 20 6e 28 6f 29 26 26 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 3f 6f 2e 70 72 6f 74 6f 74 79 70 65 3a 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 66 3f 45 3a 6e 75 6c 6c 7d 7d 2c 38 33 35 38 38 34 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 72 20 65 3d 6f 28 32 32 32 35 33 31 29 2c 6e 3d 6f 28 32 30 32 32 33 34 29 3b 72 2e 65 78 70 6f 72 74 73 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 7c 7c 66 75 6e 63 74 69 6f 6e 28 72 29 7b 72 65 74 75 72 6e 20 65 28 72 2c 6e 29 7d 7d 2c 32 37 36 33 32 31 3a 66 75 6e 63 74 69 6f 6e 28 72 2c 74 2c 6f 29 7b 76 61 Data Ascii: unction(r){var t=c(r);if(e(t,a))return t[a];var o=t.constructor;return n(o)&&t instanceof o?o.prototype:t instanceof f?E:null}},835884:function(r,t,o){var e=o(222531),n=o(202234);r.exports=Object.keys\|\|function(r){return e(r,n)}},276321:function(r,t,o){va
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 20 6e 65 77 20 6d 28 31 2c 32 29 2c 79 3d 6d 26 26 6c 26 26 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6e 2c 64 29 2c 4e 3d 21 21 79 26 26 21 28 79 2e 77 72 69 74 61 62 6c 65 26 26 79 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 29 2c 68 3d 76 26 26 21 4e 26 26 21 54 3b 65 28 7b 67 6c 6f 62 61 6c 3a 21 30 2c 63 6f 6e 73 74 72 75 63 74 6f 72 3a 21 30 2c 66 6f 72 63 65 64 3a 5f 7c 7c 68 7d 2c 7b 44 4f 4d 45 78 63 65 70 74 69 6f 6e 3a 68 3f 49 3a 6d 7d 29 3b 76 61 72 20 44 3d 63 28 64 29 2c 53 3d 44 2e 70 72 6f 74 6f 74 79 70 65 3b 69 66 28 53 2e 63 6f 6e 73 74 72 75 63 74 6f 72 21 3d 3d 44 29 7b 66 6f 72 28 76 61 72 20 62 20 69 6e 21 5f 26 26 75 28 53 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 2c 69 28 31 2c 44 Data Ascii: new m(1,2),y=m&&l&&Object.getOwnPropertyDescriptor(n,d),N=!!y&&!(y.writable&&y.configurable),h=v&&!N&&!T;e({global:!0,constructor:!0,forced:_\|\|h},{DOMException:h?I:m});var D=c(d),S=D.prototype;if(S.constructor!==D){for(var b in!_&&u(S,"constructor",i(1,D
2024-10-24 07:16:28 UTC	1205	IN	Data Raw: 28 72 29 7b 6c 65 74 7b 50 49 3a 74 2c 6d 69 6e 3a 6f 2c 6d 61 78 3a 6e 2c 63 6f 73 3a 63 2c 72 6f 75 6e 64 3a 69 7d 3d 4d 61 74 68 2c 75 3d 72 5b 30 5d 7c 72 5b 31 5d 3c 3c 38 7c 72 5b 32 5d 3c 3c 31 36 2c 61 3d 72 5b 33 5d 7c 72 5b 34 5d 3c 3c 38 2c 66 3d 28 36 33 26 75 29 2f 36 33 2c 45 3d 28 75 3e 3e 36 26 36 33 29 2f 33 31 2e 35 2d 31 2c 73 3d 28 75 3e 3e 31 32 26 36 33 29 2f 33 31 2e 35 2d 31 2c 70 3d 75 3e 3e 32 33 2c 52 3d 61 3e 3e 31 35 2c 6c 3d 6e 28 33 2c 52 3f 70 3f 35 3a 37 3a 37 26 61 29 2c 5f 3d 6e 28 33 2c 52 3f 37 26 61 3a 70 3f 35 3a 37 29 2c 64 3d 70 3f 28 31 35 26 72 5b 35 5d 29 2f 31 35 3a 31 2c 4f 3d 28 72 5b 35 5d 3e 3e 34 29 2f 31 35 2c 6d 3d 70 3f 36 3a 35 2c 49 3d 30 2c 41 3d 28 74 2c 6f 2c 65 29 3d 3e 7b 6c 65 74 20 6e 3d 5b 5d Data Ascii: (r){let{PI:t,min:o,max:n,cos:c,round:i}=Math,u=r[0]\|r[1]<<8\|r[2]<<16,a=r[3]\|r[4]<<8,f=(63&u)/63,E=(u>>6&63)/31.5-1,s=(u>>12&63)/31.5-1,p=u>>23,R=a>>15,l=n(3,R?p?5:7:7&a),_=n(3,R?7&a:p?5:7),d=p?(15&r[5])/15:1,O=(r[5]>>4)/15,m=p?6:5,I=0,A=(t,o,e)=>{let n=[]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.10	49867	162.159.135.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	673	OUT	GET /assets/d86788be99e870993214.js HTTP/1.1 Host: discord.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	963	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/javascript Content-Length: 8761 Connection: close CF-Ray: 8d782e7dfa9045ee-DFW CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: https://discord.com Cache-Control: public, max-age=2592000 ETag: "102fe4fdec4447c9891c9f3faeae0474" Last-Modified: Tue, 15 Oct 2024 21:50:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Origin Permissions-Policy: interest-cohort=() X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJ0D4tXcUXDDaRu2T9l%2F1LsU06LP9Hnplwh7seTp1vcKLxkiyUTi9tdA8zpwHUKBUOswmfGcUZTlxj%2Fy%2BII7uWWuyM1a0e77kVCJkl8yfx4d7ted9ECBuns%2FsS3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 3d 74 68 69 73 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 64 69 73 63 6f 72 64 5f 61 70 70 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 38 35 34 33 22 5d 2c 7b 37 32 35 34 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 6d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 7d 29 3b 76 61 72 20 73 3d 6e 28 34 35 34 35 38 35 29 2c 61 3d 6e 28 35 35 31 34 35 32 29 2c 6c 3d 6e 28 35 33 32 39 30 31 29 3b 6c 65 74 20 72 3d 7b 2e 2e 2e 73 2e 5a 2e 67 75 69 6c 64 45 76 65 6e 74 52 75 6c 65 73 2e 6c 69 6e 6b 2c 72 65 61 63 74 3a 28 30 2c 6c 2e 5a 29 28 7b 65 6e 61 62 6c 65 42 75 69 6c 64 4f 76 65 72 72 Data Ascii: "use strict";(this.webpackChunkdiscord_app=this.webpackChunkdiscord_app\|\|[]).push([["18543"],{725436:function(e,t,n){n.d(t,{m:function(){return u}});var s=n(454585),a=n(551452),l=n(532901);let r={...s.Z.guildEventRules.link,react:(0,l.Z)({enableBuildOverr
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 28 6c 29 2c 69 3d 6e 28 37 32 35 34 33 36 29 2c 75 3d 6e 28 37 33 37 36 30 32 29 2c 63 3d 6e 28 35 35 34 30 33 34 29 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 6c 65 74 7b 64 65 73 63 72 69 70 74 69 6f 6e 3a 74 2c 63 6c 61 73 73 4e 61 6d 65 3a 6e 2c 67 75 69 6c 64 49 64 3a 6c 2c 74 72 75 6e 63 61 74 65 3a 6f 3d 21 30 7d 3d 65 2c 45 3d 61 2e 75 73 65 4d 65 6d 6f 28 28 29 3d 3e 28 30 2c 69 2e 6d 29 28 74 2c 21 30 2c 7b 67 75 69 6c 64 49 64 3a 6c 2c 61 6c 6c 6f 77 4c 69 6e 6b 73 3a 21 30 2c 61 6c 6c 6f 77 48 65 61 64 69 6e 67 3a 21 30 2c 61 6c 6c 6f 77 4c 69 73 74 3a 21 30 7d 29 2c 5b 74 2c 6c 5d 29 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 72 28 29 28 75 2e 64 65 73 63 72 69 70 74 69 6f 6e 54 65 Data Ascii: (l),i=n(725436),u=n(737602),c=n(554034);function o(e){let{description:t,className:n,guildId:l,truncate:o=!0}=e,E=a.useMemo(()=>(0,i.m)(t,!0,{guildId:l,allowLinks:!0,allowHeading:!0,allowList:!0}),[t,l]);return(0,s.jsx)("div",{className:r()(u.descriptionTe
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 7d 3d 53 3b 72 65 74 75 72 6e 28 30 2c 73 2e 6a 73 78 73 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 28 29 28 78 2e 73 74 61 74 75 73 43 6f 6e 74 61 69 6e 65 72 2c 74 29 2c 63 68 69 6c 64 72 65 6e 3a 5b 28 30 2c 73 2e 6a 73 78 29 28 44 2e 7a 2c 7b 73 74 61 72 74 54 69 6d 65 3a 49 2e 74 6f 49 53 4f 53 74 72 69 6e 67 28 29 2c 73 74 61 74 75 73 3a 6e 75 6c 6c 21 3d 43 3f 43 3a 70 2c 65 76 65 6e 74 54 79 70 65 3a 52 2c 69 73 4e 65 77 3a 54 2c 72 65 63 75 72 72 65 6e 63 65 52 75 6c 65 3a 28 30 2c 4e 2e 4b 56 29 28 6a 29 2c 67 75 69 6c 64 45 76 65 6e 74 49 64 3a 68 2e 69 64 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 66 7d 29 2c 28 30 2c 73 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 73 70 61 63 65 72 7d 29 2c 21 6d Data Ascii: }=S;return(0,s.jsxs)("div",{className:l()(x.statusContainer,t),children:[(0,s.jsx)(D.z,{startTime:I.toISOString(),status:null!=C?C:p,eventType:R,isNew:T,recurrenceRule:(0,N.KV)(j),guildEventId:h.id,recurrenceId:f}),(0,s.jsx)("div",{className:x.spacer}),!m
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 69 6c 64 72 65 6e 3a 28 30 2c 73 2e 6a 73 78 29 28 6d 2e 5a 2c 7b 73 6f 75 72 63 65 3a 6f 2c 63 6c 61 73 73 4e 61 6d 65 3a 78 2e 74 68 75 6d 62 6e 61 69 6c 7d 29 7d 29 5d 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 29 7b 6c 65 74 7b 68 65 61 64 65 72 56 61 72 69 61 6e 74 3a 74 2c 64 65 73 63 72 69 70 74 69 6f 6e 43 6c 61 73 73 4e 61 6d 65 3a 6e 2c 63 72 65 61 74 6f 72 3a 61 2c 6e 61 6d 65 3a 6c 2c 64 65 73 63 72 69 70 74 69 6f 6e 3a 72 2c 69 6d 61 67 65 53 6f 75 72 63 65 3a 69 2c 69 73 48 75 62 3a 75 3d 21 31 2c 74 72 75 6e 63 61 74 65 3a 63 2c 67 75 69 6c 64 49 64 3a 6f 2c 69 73 4e 65 77 3a 45 2c 67 75 69 6c 64 45 76 65 6e 74 3a 64 2c 65 76 65 6e 74 50 72 65 76 69 65 77 3a 4e 2c 72 65 63 75 72 72 65 6e 63 65 49 64 3a 5f 7d 3d 65 3b 72 65 74 75 72 6e 28 Data Ascii: ildren:(0,s.jsx)(m.Z,{source:o,className:x.thumbnail})})]})}function f(e){let{headerVariant:t,descriptionClassName:n,creator:a,name:l,description:r,imageSource:i,isHub:u=!1,truncate:c,guildId:o,isNew:E,guildEvent:d,eventPreview:N,recurrenceId:_}=e;return(
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 3a 6e 75 6c 6c 21 3d 73 2c 63 68 69 6c 64 72 65 6e 3a 65 3d 3e 28 30 2c 6c 2e 6a 73 78 29 28 22 64 69 76 22 2c 7b 2e 2e 2e 65 2c 63 6c 61 73 73 4e 61 6d 65 3a 75 28 29 28 68 2e 65 76 65 6e 74 53 74 61 74 75 73 43 6f 6e 74 61 69 6e 65 72 2c 6e 29 2c 63 68 69 6c 64 72 65 6e 3a 74 7d 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 29 7b 6c 65 74 7b 73 74 61 72 74 54 69 6d 65 3a 74 2c 73 74 61 74 75 73 3a 6e 2c 65 76 65 6e 74 54 79 70 65 3a 73 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 2c 65 6e 64 54 69 6d 65 3a 69 2c 6c 69 76 65 54 65 78 74 3a 63 2c 74 65 78 74 56 61 72 69 61 6e 74 3a 45 3d 22 74 65 78 74 2d 73 6d 2f 73 65 6d 69 62 6f 6c 64 22 2c 69 73 4e 65 77 3a 4c 2c 72 65 63 75 72 72 65 6e 63 65 52 75 6c 65 3a 53 2c 67 75 69 6c 64 45 76 65 6e 74 49 64 3a Data Ascii: :null!=s,children:e=>(0,l.jsx)("div",{...e,className:u()(h.eventStatusContainer,n),children:t})})})}function L(e){let{startTime:t,status:n,eventType:s,className:a,endTime:i,liveText:c,textVariant:E="text-sm/semibold",isNew:L,recurrenceRule:S,guildEventId:
2024-10-24 07:16:28 UTC	1369	IN	Data Raw: 21 3d 6e 3f 6e 3a 22 22 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 74 7d 7d 28 62 2c 50 2c 63 2c 4f 2c 77 29 2c 7b 49 63 6f 6e 3a 56 2c 69 63 6f 6e 43 6f 6c 6f 72 3a 59 2c 74 65 78 74 43 6f 6c 6f 72 3a 6b 2c 74 6f 6f 6c 74 69 70 54 65 78 74 3a 7a 7d 3d 72 2e 75 73 65 4d 65 6d 6f 28 28 29 3d 3e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 2c 7b 74 69 6d 65 53 74 61 74 75 73 3a 6e 2c 74 65 78 74 42 72 61 6e 64 3a 73 2c 74 65 78 74 50 6f 73 69 74 69 76 65 3a 61 2c 74 65 78 74 44 61 6e 67 65 72 3a 6c 2c 65 6e 64 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 72 2c 73 74 61 72 74 44 61 74 65 54 69 6d 65 53 74 72 69 6e 67 3a 69 7d 3d 65 2c 75 3d 64 2e 43 61 6c 65 6e 64 61 72 49 63 6f 6e 2c 63 3d 73 2c 6f 3d 22 68 65 61 64 65 72 2d 73 65 63 6f 6e 64 Data Ascii: !=n?n:"";default:return t}}(b,P,c,O,w),{Icon:V,iconColor:Y,textColor:k,tooltipText:z}=r.useMemo(()=>(function(e){let t,{timeStatus:n,textBrand:s,textPositive:a,textDanger:l,endDateTimeString:r,startDateTimeString:i}=e,u=d.CalendarIcon,c=s,o="header-second
2024-10-24 07:16:28 UTC	547	IN	Data Raw: 45 45 4b 45 4e 44 5f 4f 4e 4c 59 3a 72 65 74 75 72 6e 20 78 2e 5a 2e 4d 65 73 73 61 67 65 73 2e 47 55 49 4c 44 5f 53 43 48 45 44 55 4c 45 44 5f 45 56 45 4e 54 5f 52 45 50 45 41 54 53 5f 57 45 45 4b 45 4e 44 53 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 7d 28 28 30 2c 54 2e 7a 69 29 28 6e 2c 53 29 2c 6e 29 7d 72 65 74 75 72 6e 28 30 2c 6c 2e 6a 73 78 73 29 28 66 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 75 28 29 28 61 2c 7b 5b 68 2e 69 73 52 65 63 75 72 72 69 6e 67 5d 3a 6e 75 6c 6c 21 3d 57 7d 29 2c 74 6f 6f 6c 74 69 70 54 65 78 74 3a 7a 2c 63 68 69 6c 64 72 65 6e 3a 5b 4c 26 26 6e 3d 3d 3d 44 2e 70 31 2e 53 43 48 45 44 55 4c 45 44 3f 28 30 2c 6c 2e 6a 73 78 29 28 67 2c 7b 7d 29 3a 28 30 2c 6c 2e 6a 73 78 29 28 56 2c 7b 63 6f 6c 6f 72 3a 59 Data Ascii: EEKEND_ONLY:return x.Z.Messages.GUILD_SCHEDULED_EVENT_REPEATS_WEEKENDS;default:return null}}((0,T.zi)(n,S),n)}return(0,l.jsxs)(f,{className:u()(a,{[h.isRecurring]:null!=W}),tooltipText:z,children:[L&&n===D.p1.SCHEDULED?(0,l.jsx)(g,{}):(0,l.jsx)(V,{color:Y

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.10	49859	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 33ffbe2f-201e-0085-3800-2534e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071628Z-15b8d89586fst84k5f3z220tec0000000dzg00000000c926 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:28 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.10	49858	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:28 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ef146494-c01e-00a1-274d-227e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071628Z-16849878b78lhh9t0fb3392enw00000007b0000000001rpv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-24 07:16:28 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.10	49860	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: e3e5e386-001e-0014-4ffc-245151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071628Z-r197bdfb6b4lkrtc7na2dkay2800000002p000000000e0vz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:28 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.10	49861	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-24 07:16:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 20049dc1-d01e-0014-1b33-22ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241024T071628Z-16849878b78c5zx4gw8tcga1b4000000076000000000dn4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-24 07:16:28 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.10	49868	162.159.138.232	443	7452	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 07:16:28 UTC	830	OUT	GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1 Host: discord.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __dcfduid=dc70f08091d711efb298db8715914584; __sdcfduid=dc70f08191d711efb298db871591458479e477b5445869d0a87a82899ef053dd4566e0d28190c7d0274c969b871713af; __cfruid=7b1065857530a91699af1e181fe726a4c28d80f7-1729754177; _cfuvid=5K8jYo_OmgUcSSJbFLZ2hCuzmiefur2EccNfrjNy9mE-1729754177420-0.0.1.1-604800000
2024-10-24 07:16:28 UTC	803	IN	HTTP/1.1 302 Found Date: Thu, 24 Oct 2024 07:16:28 GMT Content-Length: 0 Connection: close location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js? cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public access-control-allow-origin: * Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FnHCAKvjSfe0geVkK%2Bqhf3eZxvJB9P0Jh%2FXQHUdx7cIViaTJ%2F9A0brNaFP3RGV3y0X4iE0qzgaVthnIjxmLJ9cNOHK0duiTGOyTdc8wL%2BasP9ETQIjfm%2F6Yp6y%2BN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8d782e80c9c6e599-DFW alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	03:16:07
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\LDlanZur0i.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\LDlanZur0i.exe"
Imagebase:	0x7ff7a91f0000
File size:	506'368 bytes
MD5 hash:	3B58529670CC2C98FB964A9A2C36FA9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:16:07
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:16:07
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:16:07
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6bd310000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6bd310000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 6468, Parent PID: 768

General

Target ID:	15
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7860, Parent PID: 5884

General

Target ID:	17
Start time:	03:16:08
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 5904, Parent PID: 6036

General

Target ID:	19
Start time:	03:16:09
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5668, Parent PID: 6812

General

Target ID:	21
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6bd310000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 5420, Parent PID: 6060

General

Target ID:	23
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6bd310000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:16:10
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7184, Parent PID: 8112

General

Target ID:	25
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7348, Parent PID: 7184

General

Target ID:	26
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq fiddler" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: taskkill.exePID: 7416, Parent PID: 3600

General

Target ID:	28
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq wireshark" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /FI "IMAGENAME eq httpdebugger" /IM /F /T
Imagebase:	0x7ff675f20000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerPro
Imagebase:	0x7ff6bd310000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 7896, Parent PID: 7532

General

Target ID:	34
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop HTTPDebuggerProSdk
Imagebase:	0x7ff6bd310000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:16:11
Start date:	24/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
Imagebase:	0x7ff6a9820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: chrome.exePID: 7860, Parent PID: 8112

General

Target ID:	37
Start time:	03:16:13
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://discord.gg/privatecommunity
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	03:16:13
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	03:16:20
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	03:16:20
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=2012,i,3424306222819750287,13754184672418381483,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	97

Executed Functions

Function 00007FF7A921F5C0 Relevance: 178.5, APIs: 31, Strings: 70, Instructions: 1702stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921F698
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921F6A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921F778
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921F7FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921F8A3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921F93A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921FA05
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921FA3D
strchr.VCRUNTIME140 ref: 00007FF7A921FBB7
strchr.VCRUNTIME140 ref: 00007FF7A921FBCA
strchr.VCRUNTIME140 ref: 00007FF7A921FBDC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921FCE3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921FD53
memcpy.VCRUNTIME140 ref: 00007FF7A921FD7A
strchr.VCRUNTIME140 ref: 00007FF7A921FD8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921FDA2
strstr.VCRUNTIME140 ref: 00007FF7A921FFD8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9220111
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9220289

Part of subcall function 00007FF7A9218DE0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9218E53

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922033C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92203C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922061A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9220630
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922063F

Part of subcall function 00007FF7A9221990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92219EA

strchr.VCRUNTIME140 ref: 00007FF7A9220BF7
strchr.VCRUNTIME140 ref: 00007FF7A9220C0A
strchr.VCRUNTIME140 ref: 00007FF7A9220C1C

Part of subcall function 00007FF7A9221990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221A0A
Part of subcall function 00007FF7A9221990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221A13

strchr.VCRUNTIME140 ref: 00007FF7A9220E6F
strchr.VCRUNTIME140 ref: 00007FF7A9220E82
strchr.VCRUNTIME140 ref: 00007FF7A9220E94

Part of subcall function 00007FF7A9223FC0: strchr.VCRUNTIME140 ref: 00007FF7A92240A6
Part of subcall function 00007FF7A9223FC0: strchr.VCRUNTIME140 ref: 00007FF7A92240B9
Part of subcall function 00007FF7A9223FC0: strchr.VCRUNTIME140 ref: 00007FF7A92240CB

Strings

1.1, xrefs: 00007FF7A922032E
Content-Length: 0, xrefs: 00007FF7A9220A90
100-continue, xrefs: 00007FF7A9220C36, 00007FF7A9220EB6
%s%s, xrefs: 00007FF7A92207D0
Accept, xrefs: 00007FF7A9220093
Transfer-Encoding, xrefs: 00007FF7A921FB4D
Accept: */*, xrefs: 00007FF7A92200A5
http, xrefs: 00007FF7A921FF3B
Failed sending HTTP POST request, xrefs: 00007FF7A922109B
Accept-Encoding, xrefs: 00007FF7A921F9E1
HEAD, xrefs: 00007FF7A921F701
ftp://%s:%s@%s, xrefs: 00007FF7A92203EB
If-Unmodified-Since, xrefs: 00007FF7A9220884
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00007FF7A92202A4
Cookie: , xrefs: 00007FF7A922072E, 00007FF7A92207A4
Content-Type: application/x-www-form-urlencoded, xrefs: 00007FF7A9220DF1
Content-Range, xrefs: 00007FF7A922026E
Failed sending PUT request, xrefs: 00007FF7A9220A69
Range, xrefs: 00007FF7A92200F2
Failed sending POST request, xrefs: 00007FF7A9220AC9, 00007FF7A9220D0D
Host: %s%s%s, xrefs: 00007FF7A921FE5D
%x, xrefs: 00007FF7A9220F95
Could not seek stream, xrefs: 00007FF7A9220188
Could only read %I64d bytes from the input, xrefs: 00007FF7A9220245
%s , xrefs: 00007FF7A9220353
;type=%c, xrefs: 00007FF7A9220041
Accept-Encoding: %s, xrefs: 00007FF7A921FA12
Content-Range: bytes %s/%I64d, xrefs: 00007FF7A92202D6
Expect:, xrefs: 00007FF7A9220BB5, 00007FF7A9220E2A
Chunky upload is not supported by HTTP 1.0, xrefs: 00007FF7A921FCBC
Host:, xrefs: 00007FF7A921FDB1
If-Modified-Since, xrefs: 00007FF7A922088D
ftp, xrefs: 00007FF7A921FFA9
Host, xrefs: 00007FF7A921FCE9
Expect, xrefs: 00007FF7A9220B94, 00007FF7A9220E09
%s, xrefs: 00007FF7A9220B73
OPTIONS, xrefs: 00007FF7A921F72B
upload completely sent off: %I64d out of %I64d bytes, xrefs: 00007FF7A922119E
POST, xrefs: 00007FF7A921F745
Referer: %s, xrefs: 00007FF7A921F96E
File already completely uploaded, xrefs: 00007FF7A9220229
%s%s=%s, xrefs: 00007FF7A9220749
Failed sending HTTP request, xrefs: 00007FF7A9220D66
Invalid TIMEVALUE, xrefs: 00007FF7A9220843
Content-Length: %I64d, xrefs: 00007FF7A92209EB, 00007FF7A9220B40, 00007FF7A9220DC5
PUT, xrefs: 00007FF7A921F738
Content-Range: bytes %s%I64d/%I64d, xrefs: 00007FF7A92202C8
Proxy-Connection, xrefs: 00007FF7A9220493
Proxy-Connection: Keep-Alive, xrefs: 00007FF7A92204BF, 00007FF7A92204D4
Range: bytes=%s, xrefs: 00007FF7A922011E
chunked, xrefs: 00007FF7A921FBF6
multipart/form-data, xrefs: 00007FF7A921FAEA
Referer, xrefs: 00007FF7A921F953
Transfer-Encoding:, xrefs: 00007FF7A921FB6E
Content-Length, xrefs: 00007FF7A92209D4, 00007FF7A9220B29, 00007FF7A9220DAE
GET, xrefs: 00007FF7A921F752
User-Agent, xrefs: 00007FF7A921F75D
%s?%s, xrefs: 00007FF7A921F795
;type=, xrefs: 00007FF7A921FFCE
1.0, xrefs: 00007FF7A9220320
Cookie, xrefs: 00007FF7A921F9C2
%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00007FF7A92205FB
Transfer-Encoding: chunked, xrefs: 00007FF7A921FCAF
?%s, xrefs: 00007FF7A922042B
Host:%s, xrefs: 00007FF7A921FDE6
Host: %s%s%s:%d, xrefs: 00007FF7A921FEA2
Last-Modified, xrefs: 00007FF7A922087B
0, xrefs: 00007FF7A9220FE6, 00007FF7A92210E5
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FF7A9220914
Content-Type, xrefs: 00007FF7A921FAA7, 00007FF7A9220DDD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$strchr$_strdup$callocmemcpystrstr
String ID: %s$%s $%s HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s%s$%s%s=%s$%s: %s, %02d %s %4d %02d:%02d:%02d GMT$%s?%s$%x$0$1.0$1.1$100-continue$;type=$;type=%c$?%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Chunky upload is not supported by HTTP 1.0$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Content-Type$Content-Type: application/x-www-form-urlencoded$Cookie$Cookie: $Could not seek stream$Could only read %I64d bytes from the input$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request$File already completely uploaded$GET$HEAD$Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified$OPTIONS$POST$PUT$Proxy-Connection$Proxy-Connection: Keep-Alive$Range$Range: bytes=%s$Referer$Referer: %s$Transfer-Encoding$Transfer-Encoding:$Transfer-Encoding: chunked$User-Agent$chunked$ftp$ftp://%s:%s@%s$http$multipart/form-data$upload completely sent off: %I64d out of %I64d bytes
API String ID: 2045874074-4264080130
Opcode ID: 7fcc85cf125542c48788320bd09f508ae4f6ff97455a94ff2b67270cadd80f53
Instruction ID: 261d76cfd6d0387be40887e07d002bd42714a5d442400e807ec20d2f9ebd17e6
Opcode Fuzzy Hash: 7fcc85cf125542c48788320bd09f508ae4f6ff97455a94ff2b67270cadd80f53
Instruction Fuzzy Hash: 1203AF31A0A69295FB54AF2198402F9A7B0EF44B88F964031CE1D976EDEF3DE475C360

Function 00007FF7A9229F6D Relevance: 116.1, APIs: 43, Strings: 23, Instructions: 552stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A922A0C8
strchr.VCRUNTIME140 ref: 00007FF7A922A0F4
strchr.VCRUNTIME140 ref: 00007FF7A922A12E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922A152
strchr.VCRUNTIME140 ref: 00007FF7A922A262
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922A27A

Strings

schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 00007FF7A922A2E0
schannel: Failed to read cert file %s, xrefs: 00007FF7A922A629
CurrentService, xrefs: 00007FF7A922A1A5
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 00007FF7A922A57F
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 00007FF7A922A534
LocalMachine, xrefs: 00007FF7A922A183
schannel: ALPN, offering %s, xrefs: 00007FF7A922A7A5
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FF7A922A6E5
CurrentUser, xrefs: 00007FF7A922A142
CurrentUserGroupPolicy, xrefs: 00007FF7A922A1FD
http/1.1, xrefs: 00007FF7A922A797
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7A922A509
LocalMachineEnterprise, xrefs: 00007FF7A922A23B
schannel: unable to allocate memory, xrefs: 00007FF7A922A5EC, 00007FF7A922A877
Users, xrefs: 00007FF7A922A1E6
http/1.1, xrefs: 00007FF7A922A783
LocalMachineGroupPolicy, xrefs: 00007FF7A922A21C
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00007FF7A922A167
schannel: Failed to get certificate location or file for %s, xrefs: 00007FF7A922A652
Microsoft Unified Security Protocol Provider, xrefs: 00007FF7A922A66F
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7A922A763
Services, xrefs: 00007FF7A922A1C7
schannel: TLS 1.3 is not yet supported, xrefs: 00007FF7A9229FFB

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$_strdupstrncmpstrtol
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Users$http/1.1$http/1.1$schannel: ALPN, offering %s$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: TLS 1.3 is not yet supported$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.
API String ID: 707411602-3372543188
Opcode ID: 21b52c5c3ed39c5d236377478f24753a69b12ee4d5596d5d20ea4b8476e8c510
Instruction ID: b6b7532cfa4d7be64f02eb2012254ff5b57b1a93abc96ace5636fe37f10e91a4
Opcode Fuzzy Hash: 21b52c5c3ed39c5d236377478f24753a69b12ee4d5596d5d20ea4b8476e8c510
Instruction Fuzzy Hash: 21428F31A0AB4286FB14AF15A8506B9A7B4FF44794F824135DA1E87BF8DF3CE564C720

Function 00007FF7A9201560 Relevance: 114.1, APIs: 51, Strings: 14, Instructions: 304
processsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7A920158A
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7A92015C6
rand.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7A92015F2
SetConsoleTitleA.KERNEL32 ref: 00007FF7A9201670
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92016A9
GetConsoleWindow.KERNEL32 ref: 00007FF7A92016B5
GetWindowLongPtrA.USER32 ref: 00007FF7A92016C6
SetWindowLongPtrA.USER32 ref: 00007FF7A92016DC
SetLayeredWindowAttributes.USER32 ref: 00007FF7A92016F0
GetStdHandle.KERNEL32 ref: 00007FF7A9201700
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A920170C
GetStdHandle.KERNEL32 ref: 00007FF7A9201717
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201723
GetStdHandle.KERNEL32 ref: 00007FF7A920173A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201746

Part of subcall function 00007FF7A92006B0: memcpy.VCRUNTIME140(?,?,?,?,?,?,0000006E00000006,?,FFFFFFFF,00007FF7A91F11FC), ref: 00007FF7A920078F

Part of subcall function 00007FF7A9201AA0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF7A9201758), ref: 00007FF7A9201AC4
Part of subcall function 00007FF7A9201AA0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,0000000B,00007FF7A9201758), ref: 00007FF7A9201AE5

GetStdHandle.KERNEL32 ref: 00007FF7A9201769
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201775
GetStdHandle.KERNEL32 ref: 00007FF7A920178C
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201798
GetStdHandle.KERNEL32 ref: 00007FF7A92017AF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A92017BB
GetStdHandle.KERNEL32 ref: 00007FF7A92017D2
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A92017DE
GetStdHandle.KERNEL32 ref: 00007FF7A92017F5
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201801
GetStdHandle.KERNEL32 ref: 00007FF7A9201818
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201824
GetStdHandle.KERNEL32 ref: 00007FF7A9201847
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201853
GetStdHandle.KERNEL32 ref: 00007FF7A920186A
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201876
GetStdHandle.KERNEL32 ref: 00007FF7A920188D
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A9201899
GetStdHandle.KERNEL32 ref: 00007FF7A92018BC
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A92018C8
GetStdHandle.KERNEL32 ref: 00007FF7A92018DF
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A92018EB
GetStdHandle.KERNEL32 ref: 00007FF7A9201902
SetConsoleTextAttribute.KERNEL32 ref: 00007FF7A920190E
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z.MSVCP140 ref: 00007FF7A920192B
URLDownloadToFileA.URLMON ref: 00007FF7A920197F
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A920198B
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9201998
Sleep.KERNEL32 ref: 00007FF7A92019A3
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92019AB
URLDownloadToFileA.URLMON ref: 00007FF7A92019FD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9201A09
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9201A16
Sleep.KERNEL32 ref: 00007FF7A9201A21
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9201A29
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9201A62

Strings

[ Selecione uma opcao: ], xrefs: 00007FF7A920177B
##########################################################, xrefs: 00007FF7A920179E
C:\Windows\System32\ServceHubeinssDialog.exe, xrefs: 00007FF7A92019C8
C:\Windows\System32\SerHuStinsHostDialog.exe, xrefs: 00007FF7A920194A
start C:\Windows\System32\SerHuStinsHostDialog.exe, xrefs: 00007FF7A9201991
##########################################################, xrefs: 00007FF7A9201758
Iniciar Valorant Plus (HVCI DESLIGADO): , xrefs: 00007FF7A920182A
http://185.101.104.122/plussemhvibronkz.exe, xrefs: 00007FF7A9201939
cd C:\, xrefs: 00007FF7A9201984, 00007FF7A9201A02
Iniciar Valorant Plus (HVCI HABILITADO): , xrefs: 00007FF7A920189F
start C:\Windows\System32\ServceHubeinssDialog.exe, xrefs: 00007FF7A9201A0F
.exe, xrefs: 00007FF7A9201593
Selecione a opcao: , xrefs: 00007FF7A9201914
http://185.101.104.122/plushvibronkz.exe, xrefs: 00007FF7A92019B7

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Console$AttributeHandleText$Windowsystem$rand$DownloadFileLongSleep_invalid_parameter_noinfo_noreturnexit$??5?$basic_istream@AttributesD@std@@@std@@LayeredTitleU?$char_traits@V01@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: Iniciar Valorant Plus (HVCI DESLIGADO): $ Iniciar Valorant Plus (HVCI HABILITADO): $ Selecione a opcao: $##########################################################$##########################################################$.exe$C:\Windows\System32\SerHuStinsHostDialog.exe$C:\Windows\System32\ServceHubeinssDialog.exe$[ Selecione uma opcao: ]$cd C:\$http://185.101.104.122/plushvibronkz.exe$http://185.101.104.122/plussemhvibronkz.exe$start C:\Windows\System32\SerHuStinsHostDialog.exe$start C:\Windows\System32\ServceHubeinssDialog.exe
API String ID: 2233566951-910443057
Opcode ID: f75e39c6e98b094dcf34f70e158c08bc34ec598912aa3742359fa14b7c986674
Instruction ID: 4b297f015ef91bc0b46d88cf825c4cc590ad01a53f448e7a7475ac40a2d30dd2
Opcode Fuzzy Hash: f75e39c6e98b094dcf34f70e158c08bc34ec598912aa3742359fa14b7c986674
Instruction Fuzzy Hash: 6BE13521E1A64795FB00FF61D8941B8A371AF84798FC24235D51FC6AFADE2CE959C320

Function 00007FF7A92189B0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 191
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FF7A92189D8
WSACleanup.WS2_32 ref: 00007FF7A92189F3
GetModuleHandleA.KERNEL32 ref: 00007FF7A9218A44
GetProcAddress.KERNEL32 ref: 00007FF7A9218A70
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9218A8A
LoadLibraryA.KERNEL32 ref: 00007FF7A9218AAD
GetProcAddress.KERNEL32 ref: 00007FF7A9218ACA
LoadLibraryExA.KERNEL32 ref: 00007FF7A9218AE0
GetSystemDirectoryA.KERNEL32 ref: 00007FF7A9218AF6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9218B0E
GetSystemDirectoryA.KERNEL32 ref: 00007FF7A9218B22
LoadLibraryA.KERNEL32 ref: 00007FF7A9218B90
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9218B9C
GetProcAddress.KERNEL32 ref: 00007FF7A9218BC8
VerSetConditionMask.KERNEL32 ref: 00007FF7A9218C51
VerSetConditionMask.KERNEL32 ref: 00007FF7A9218C64
VerSetConditionMask.KERNEL32 ref: 00007FF7A9218C73
VerSetConditionMask.KERNEL32 ref: 00007FF7A9218C82
VerSetConditionMask.KERNEL32 ref: 00007FF7A9218C92
VerifyVersionInfoA.KERNEL32 ref: 00007FF7A9218CA3
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7A9218CBF

Strings

LoadLibraryExA, xrefs: 00007FF7A9218A5E
iphlpapi.dll, xrefs: 00007FF7A9218A76
kernel32, xrefs: 00007FF7A9218A2B
AddDllDirectory, xrefs: 00007FF7A9218AC0
if_nametoindex, xrefs: 00007FF7A9218BBE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ConditionMask$AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleInfoModulePerformanceQueryStartupVerifyVersionfreemallocstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2612373469-2794540096
Opcode ID: 28af2935f0a2dbe3f7279b343cf25cafc2cc8a8b74e6f953f38c42f3705a454d
Instruction ID: 41da635ca62bfcaecd8b03caed0190db726ae5a2764e6d3fc7167a9697c273c4
Opcode Fuzzy Hash: 28af2935f0a2dbe3f7279b343cf25cafc2cc8a8b74e6f953f38c42f3705a454d
Instruction Fuzzy Hash: 65917735A0A78285F760AF21A8543B9F3B1FB85B80F854135C94EC67E9EF3CE5658720

Function 00007FF7A9217CF0 Relevance: 38.9, APIs: 15, Strings: 7, Instructions: 357
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A9217D8C
socket.WS2_32 ref: 00007FF7A9217DD5
htons.WS2_32 ref: 00007FF7A9217E61
setsockopt.WS2_32 ref: 00007FF7A9217EC3
WSAGetLastError.WS2_32 ref: 00007FF7A9217ECD
getsockopt.WS2_32 ref: 00007FF7A9217F6F
setsockopt.WS2_32 ref: 00007FF7A9217F9E
setsockopt.WS2_32 ref: 00007FF7A9217FDD
WSAIoctl.WS2_32 ref: 00007FF7A921806A
WSAGetLastError.WS2_32 ref: 00007FF7A9218074

Part of subcall function 00007FF7A9224CC0: ioctlsocket.WS2_32 ref: 00007FF7A9224CD9

Part of subcall function 00007FF7A921D7E0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7A920585F), ref: 00007FF7A921D7F7

connect.WS2_32 ref: 00007FF7A921819B
WSAGetLastError.WS2_32 ref: 00007FF7A92181B8

Part of subcall function 00007FF7A9202530: GetLastError.KERNEL32 ref: 00007FF7A9202552
Part of subcall function 00007FF7A9202530: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A920255A

Part of subcall function 00007FF7A9215B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C45
Part of subcall function 00007FF7A9215B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C60

Part of subcall function 00007FF7A9216600: closesocket.WS2_32 ref: 00007FF7A9216643

Strings

sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FF7A921825E
Could not set TCP_NODELAY: %s, xrefs: 00007FF7A9217EEA
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00007FF7A921807D
@, xrefs: 00007FF7A9217F07
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00007FF7A9217FEA
Trying %s:%ld..., xrefs: 00007FF7A9217E6F
Immediate connect fail for %s: %s, xrefs: 00007FF7A92181E8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast$setsockopt$fwrite$CounterIoctlPerformanceQuery_errnoclosesocketconnectgetsockopthtonsioctlsocketmemcpysocket
String ID: Trying %s:%ld...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 3453287622-3868455274
Opcode ID: 1327e9dbb07cab6e1ad96aeca4305e686792bcb240602505a1d5da1c35415d30
Instruction ID: ec57b861ac13e075f2532ae430cd7302b014d19ce20c34c689d9ca60c2659c45
Opcode Fuzzy Hash: 1327e9dbb07cab6e1ad96aeca4305e686792bcb240602505a1d5da1c35415d30
Instruction Fuzzy Hash: B8F1C471A0A282C6F750AF2598806BDE3B1FB45744FA24135DA4DC76E9DF3CE564CB10

Function 00007FF7A9224A90 Relevance: 24.1, APIs: 16, Instructions: 127
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00007FF7A9224AD1
htonl.WS2_32 ref: 00007FF7A9224AFE
setsockopt.WS2_32 ref: 00007FF7A9224B35
bind.WS2_32 ref: 00007FF7A9224B50
getsockname.WS2_32 ref: 00007FF7A9224B6C
listen.WS2_32 ref: 00007FF7A9224B81
socket.WS2_32 ref: 00007FF7A9224B98
connect.WS2_32 ref: 00007FF7A9224BB7
accept.WS2_32 ref: 00007FF7A9224BCE
send.WS2_32 ref: 00007FF7A9224C1C
recv.WS2_32 ref: 00007FF7A9224C3A
memcmp.VCRUNTIME140 ref: 00007FF7A9224C55
closesocket.WS2_32 ref: 00007FF7A9224C61

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: socket$acceptbindclosesocketconnectgetsocknamehtonllistenmemcmprecvsendsetsockopt
String ID:
API String ID: 3699910901-0
Opcode ID: 7829425468b8dcf593125accf8351d2c2041e13510d2fa8dba2ad3344df61a01
Instruction ID: 7b9bcadbc7bb22c7f5173605f40ccaca99d351022683810da423a606bf0c8d2b
Opcode Fuzzy Hash: 7829425468b8dcf593125accf8351d2c2041e13510d2fa8dba2ad3344df61a01
Instruction Fuzzy Hash: 8E517131609A4292E710AF29E4841A9B371EB85BB4F915730EA7F876F8DF3CD8598710

Function 00007FF7A92169B0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %I64dms connect time, move on!, xrefs: 00007FF7A9216B75
Connection time-out, xrefs: 00007FF7A9216A99
Failed to connect to %s port %ld: %s, xrefs: 00007FF7A9216EDE
connect to %s port %ld failed: %s, xrefs: 00007FF7A9216C2D
Connection failed, xrefs: 00007FF7A9216D96

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-3307081561
Opcode ID: fb37f2d3a010cfa04dd5871ca4f0cd49a8520569bcdb5f6fad92baf4f98c5b3a
Instruction ID: 3ba67b84bc524b24d45f12dfab53e18b7394c7d0dde80772b8822bc086c288ce
Opcode Fuzzy Hash: fb37f2d3a010cfa04dd5871ca4f0cd49a8520569bcdb5f6fad92baf4f98c5b3a
Instruction Fuzzy Hash: 53E1D031A0A682C2FB14AF2498442BDA7B1FB84794F964235DB5E877E9CF3CE5718710

Function 00007FF7A91F2AD0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 402
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F28D7
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2947
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F29A7
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F29F7
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2A47

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2C78

Part of subcall function 00007FF7A91F48F0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F49B0

Part of subcall function 00007FF7A924F220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7A91F441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A924F23A

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2CC8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2D07
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2D55
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2D94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2E48
memcpy.VCRUNTIME140 ref: 00007FF7A91F2E6D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2F43
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2F8A
ShellExecuteA.SHELL32 ref: 00007FF7A91F3082
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F308A
MessageBoxA.USER32 ref: 00007FF7A91F30C0
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F30D1
Sleep.KERNEL32 ref: 00007FF7A91F3139
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F3141
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91F3148

Part of subcall function 00007FF7A91F3190: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F329F
Part of subcall function 00007FF7A91F3190: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F32E0

Part of subcall function 00007FF7A91F3C60: memcpy.VCRUNTIME140 ref: 00007FF7A91F3CB3

Part of subcall function 00007FF7A91F3300: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F33E0

Part of subcall function 00007FF7A91F3400: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F34E0

Strings

message, xrefs: 00007FF7A91F2FD3, 00007FF7A91F3091
Failure, xrefs: 00007FF7A91F30B7
success, xrefs: 00007FF7A91F2EA6
download, xrefs: 00007FF7A91F3045
open, xrefs: 00007FF7A91F3079
sessionid, xrefs: 00007FF7A91F2ECE
invalidver, xrefs: 00007FF7A91F3009

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$system$exitmemcpy$Concurrency::cancel_current_taskExecuteMessageShellSleepmalloc
String ID: Failure$download$invalidver$message$open$sessionid$success
API String ID: 3283070336-3881042241
Opcode ID: be88c1e78ead1f10bce8d805c34b01ed8d52a3b293ca933ebbfeaead7719d254
Instruction ID: abed3a9728eaf6930aca165ef5b670fc7bfb31f100bacd14f19fbbbcfeeb6596
Opcode Fuzzy Hash: be88c1e78ead1f10bce8d805c34b01ed8d52a3b293ca933ebbfeaead7719d254
Instruction Fuzzy Hash: 5102F763A0A74545FB01EF24E4443ADA771EB81794F825636DB6D87AEAEF3CD090C310

Function 00007FF7A922B5F0 Relevance: 38.9, APIs: 6, Strings: 16, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A922BC31
memcpy.VCRUNTIME140 ref: 00007FF7A922BC4D

Strings

schannel: failed to read data from server: %s, xrefs: 00007FF7A922BB82
schannel: unable to re-allocate memory, xrefs: 00007FF7A922B72D, 00007FF7A922BB96
schannel: Curl_read_plain returned error %d, xrefs: 00007FF7A922B991
schannel: can't renogotiate, an error is pending, xrefs: 00007FF7A922BBB2
schannel: enough decrypted data is already available, xrefs: 00007FF7A922B675
schannel: renegotiation failed, xrefs: 00007FF7A922BBBE
schannel: SSL/TLS connection renegotiated, xrefs: 00007FF7A922BA8F
schannel: server closed the connection, xrefs: 00007FF7A922BAC4
schannel: server closed abruptly (missing close_notify), xrefs: 00007FF7A922BBDE
schannel: failed to decrypt data, need more data, xrefs: 00007FF7A922BB5A
schannel: can't renogotiate, encrypted data available, xrefs: 00007FF7A922BBD2
schannel: renegotiating SSL/TLS connection, xrefs: 00007FF7A922BA48
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00007FF7A922B7BD
schannel: remote party requests renegotiation, xrefs: 00007FF7A922BA12
schannel: an unrecoverable error occurred in a prior call, xrefs: 00007FF7A922B695
schannel: server indicated shutdown in a prior call, xrefs: 00007FF7A922B6B8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3510742995-857957974
Opcode ID: ba7f24123d59b6499d0344eb465d83ac0638cd9cd8cf85a1f2bf3ee27dff848c
Instruction ID: 7eb1eeedae6fe315052b99bfecc82c4a628a574eda90246b1ed16264bd4edfd9
Opcode Fuzzy Hash: ba7f24123d59b6499d0344eb465d83ac0638cd9cd8cf85a1f2bf3ee27dff848c
Instruction Fuzzy Hash: 9C02DF32A0AA4685FB60EF09D8447AAA7B4FB45B90FA20535DE4D877F8DF78D460C710

Function 00007FF7A922AA80 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 415
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922AB70
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922ABC1
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922AC04
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922ACE7
memcpy.VCRUNTIME140 ref: 00007FF7A922AD89
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922ADF2
memcpy.VCRUNTIME140 ref: 00007FF7A922AECA
memset.VCRUNTIME140 ref: 00007FF7A922B097
CertFreeCertificateContext.CRYPT32 ref: 00007FF7A922B0FA

Strings

schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FF7A922AEF6
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FF7A922AF8E, 00007FF7A922B1A2
schannel: SNI or certificate check failed: %s, xrefs: 00007FF7A922AF5B
SSL: failed retrieving public key from server certificate, xrefs: 00007FF7A922B11A
schannel: unable to re-allocate memory, xrefs: 00007FF7A922AC12
SSL: public key does not match pinned public key!, xrefs: 00007FF7A922B0DC, 00007FF7A922B104
schannel: unable to allocate memory, xrefs: 00007FF7A922B1EF
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FF7A922AFA4
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7A922B13A

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: malloc$memcpy$CertCertificateContextFreefreememsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key!$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 860210379-3059304359
Opcode ID: f4d0da3d63ebdaa82449d88aa98880e8aa011fc26f3a344ad4b9f464b810a81e
Instruction ID: 6d6f61aa4fee058f752ba4fee2e37ce7c37c5f7a25084575745b7990938811ba
Opcode Fuzzy Hash: f4d0da3d63ebdaa82449d88aa98880e8aa011fc26f3a344ad4b9f464b810a81e
Instruction Fuzzy Hash: 60128D72A0AA8186FB60AF19D8443EAB3B4FB84B84F910135DA5D877E8DF7CD551C710

Function 00007FF7A9229CA0 Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 348
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7A9229D71
GetProcAddress.KERNEL32 ref: 00007FF7A9229D81

Strings

schannel: SNI or certificate check failed: %s, xrefs: 00007FF7A922A95D
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7A9229E12
wine_get_version, xrefs: 00007FF7A9229D7A
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FF7A922AA19
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00007FF7A922A71F
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FF7A9229D52
schannel: ALPN, offering %s, xrefs: 00007FF7A922A7A5
http/1.1, xrefs: 00007FF7A922A797
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FF7A922A93C, 00007FF7A922A983
schannel: unable to allocate memory, xrefs: 00007FF7A922A877
ntdll, xrefs: 00007FF7A9229D6A
http/1.1, xrefs: 00007FF7A922A783
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FF7A922A763

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Unrecognized parameter passed via CURLOPT_SSLVERSION$http/1.1$http/1.1$ntdll$schannel: ALPN, offering %s$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1646373207-2477831187
Opcode ID: f07d225b01c93977025fbbed9552e4b6ba4f9b2bc308e35e43da8db05c67e7e5
Instruction ID: ea17dc65099608a9e1560b30f4080bbb226f4c7577d8fb203f02ab42d9e19239
Opcode Fuzzy Hash: f07d225b01c93977025fbbed9552e4b6ba4f9b2bc308e35e43da8db05c67e7e5
Instruction Fuzzy Hash: E5029D32A09B8186FB50AF25D9402EAB7B4FB44784F924136DA4D8B7E9DF3CE564C710

Function 00007FF7A920B2E0 Relevance: 28.7, APIs: 19, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B312
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B3AD
InitializeCriticalSectionEx.KERNEL32 ref: 00007FF7A920B3C6

Part of subcall function 00007FF7A9224A90: socket.WS2_32 ref: 00007FF7A9224AD1

DeleteCriticalSection.KERNEL32 ref: 00007FF7A920B400
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B40A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B414
closesocket.WS2_32 ref: 00007FF7A920B432
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B468
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A920B46E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920B49D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B4B7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920B4C0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A920B4F5
EnterCriticalSection.KERNEL32 ref: 00007FF7A920B516
LeaveCriticalSection.KERNEL32 ref: 00007FF7A920B52A
CloseHandle.KERNEL32 ref: 00007FF7A920B537
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B562
closesocket.WS2_32 ref: 00007FF7A920B57B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B58F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$CriticalSection$_errno_strdupclosesocket$CloseDeleteEnterHandleInitializeLeavecallocmallocsocket
String ID:
API String ID: 259767416-0
Opcode ID: 87cc11fe0e0785d85db3f179a472836734951a463cdd3ff13fb2f56dcd5c7b0f
Instruction ID: 7553347d1358de5aac70d175409f9087d43d467eefe0e8d0ec4a3887c8749505
Opcode Fuzzy Hash: 87cc11fe0e0785d85db3f179a472836734951a463cdd3ff13fb2f56dcd5c7b0f
Instruction Fuzzy Hash: 8B812B22D0AB8182F664EF21E450279B370FB98B54F465235DB9E427AADF7CE5E48310

Function 00007FF7A9212950 Relevance: 28.6, APIs: 6, Strings: 10, Instructions: 557COMMON

Download Yara Rule

Strings

host, xrefs: 00007FF7A9213020
No connections available., xrefs: 00007FF7A92130F1
Re-using existing connection! (#%ld) with %s %s, xrefs: 00007FF7A9213033
No more connections allowed to host %s: %zu, xrefs: 00007FF7A92130E2
No connections available in cache, xrefs: 00007FF7A921334B
NTLM picked AND auth done set, clear picked!, xrefs: 00007FF7A92131A2
anonymous, xrefs: 00007FF7A9212B08
proxy, xrefs: 00007FF7A9213012
NTLM-proxy picked AND auth done set, clear picked!, xrefs: 00007FF7A92131D0
ftp@example.com, xrefs: 00007FF7A9212B0F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: NTLM picked AND auth done set, clear picked!$NTLM-proxy picked AND auth done set, clear picked!$No connections available in cache$No connections available.$No more connections allowed to host %s: %zu$Re-using existing connection! (#%ld) with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-760484938
Opcode ID: 4ee72a835bbdafdf8d9c517c66cfc8a0568c85ff2563768febafdc9e935a6688
Instruction ID: 64e220cf857d2957e1b17eb4cf76b29d5e92db9c473db0e186c22fa45f898b71
Opcode Fuzzy Hash: 4ee72a835bbdafdf8d9c517c66cfc8a0568c85ff2563768febafdc9e935a6688
Instruction Fuzzy Hash: 8542953260ABC2D1FB69AF2599403B9A3B1FB45B84F590135DE5D877E9DF28E4708320

Function 00007FF7A92118E0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9201B91,?,?,?,?,00007FF7A91F35C1), ref: 00007FF7A92118F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211941

Strings

<, xrefs: 00007FF7A9211B88
`, xrefs: 00007FF7A9211BDA
v, xrefs: 00007FF7A9211BEF
<, xrefs: 00007FF7A9211B7E
<, xrefs: 00007FF7A9211A57

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: callocfree
String ID: <$<$<$`$v
API String ID: 306872129-2056843887
Opcode ID: d5865803d173832087f16c44c88db72d39735fe1916e991f553bb21f94318156
Instruction ID: 2c7d35d90f5672b6b43c0145b996172c505d32225c9ef59970b155bda8021729
Opcode Fuzzy Hash: d5865803d173832087f16c44c88db72d39735fe1916e991f553bb21f94318156
Instruction Fuzzy Hash: 99916C32909BC186E3009F24D4443E877A0FB55B5CF595238CF994B7EADFBAA0A5C720

Function 00007FF7A9218690 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 128
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF7A92424EA,?,?,?,?,00007FF7A9218A1B), ref: 00007FF7A92186A4
GetProcAddress.KERNEL32(?,?,00007FF7A92424EA,?,?,?,?,00007FF7A9218A1B), ref: 00007FF7A92186C9
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00007FF7A92424EA,?,?,?,?,00007FF7A9218A1B), ref: 00007FF7A92186DC

Strings

LoadLibraryExA, xrefs: 00007FF7A92186BA
kernel32, xrefs: 00007FF7A921869D
AddDllDirectory, xrefs: 00007FF7A9218723

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: AddressHandleModuleProcstrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 27745253-3327535076
Opcode ID: 3e9f05ced0c156ad279fa13b4a495bb75bade13cde70a92ba6415d4d03f7d27f
Instruction ID: 3992952f46357262337e131aef425b922e53c77940606bfa6259e665a2a90750
Opcode Fuzzy Hash: 3e9f05ced0c156ad279fa13b4a495bb75bade13cde70a92ba6415d4d03f7d27f
Instruction Fuzzy Hash: 9841BA26B0B64286FB15AF16A840139E7B1EF45BD1F994130CE1D877E8DE3DD4A6C720

Function 00007FF7A9217330 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 161
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getpeername.WS2_32 ref: 00007FF7A921739C
WSAGetLastError.WS2_32 ref: 00007FF7A92173A6

Part of subcall function 00007FF7A9202530: GetLastError.KERNEL32 ref: 00007FF7A9202552
Part of subcall function 00007FF7A9202530: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A920255A

getsockname.WS2_32 ref: 00007FF7A9217426
WSAGetLastError.WS2_32 ref: 00007FF7A9217430

Strings

getpeername() failed with errno %d: %s, xrefs: 00007FF7A92173C6
getsockname() failed with errno %d: %s, xrefs: 00007FF7A9217450
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00007FF7A92174B6
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FF7A921754C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast$_errnogetpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2911674258-670633250
Opcode ID: 5a5a47f37dd8fd52bc30b7f8a440376d2134b245cc3786458ef526cfe7c651a9
Instruction ID: f20c2c91591d07b1e690806b118c0d04e05b3a9fb3dd4319ecf4ad5484427fda
Opcode Fuzzy Hash: 5a5a47f37dd8fd52bc30b7f8a440376d2134b245cc3786458ef526cfe7c651a9
Instruction Fuzzy Hash: F891C536A1ABC182E710DF25D4402E97370FB88B88F955231EE4C876A9EF38D1A5C720

Function 00007FF7A9228700 Relevance: 19.6, APIs: 13, Instructions: 128
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00007FF7A9228722
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922878E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A92287C8
memcpy.VCRUNTIME140(?,?,?,00007FF7A920B225), ref: 00007FF7A92287E1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A92287EF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922882A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A9228833
freeaddrinfo.WS2_32(?,?,?,00007FF7A920B225), ref: 00007FF7A9228861
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A9228875
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922887F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922888C
WSASetLastError.WS2_32(?,?,?,00007FF7A920B225), ref: 00007FF7A92288AD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc$ErrorLast_strdupfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 2364279375-0
Opcode ID: 42d7141a613dc9572e64f13324ecbd4a7e0aee728688f79990fc275f81ffd6e6
Instruction ID: 9990de733dd34e7c400b68caabb8a4b5245a77b79a0328e969d224c3400d09a9
Opcode Fuzzy Hash: 42d7141a613dc9572e64f13324ecbd4a7e0aee728688f79990fc275f81ffd6e6
Instruction Fuzzy Hash: 85514136A0A74582FA25AF11A540179F7B0FB44B90F464435CE8E8BBE8DF3CE464C761

Function 00007FF7A9226010 Relevance: 16.7, APIs: 11, Instructions: 241
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32 ref: 00007FF7A922606D
Sleep.KERNEL32 ref: 00007FF7A922607E
WSASetLastError.WS2_32 ref: 00007FF7A92261E8
Sleep.KERNEL32 ref: 00007FF7A92261F9
__WSAFDIsSet.WS2_32 ref: 00007FF7A92262AC
__WSAFDIsSet.WS2_32 ref: 00007FF7A92262C3
__WSAFDIsSet.WS2_32 ref: 00007FF7A92262DE
__WSAFDIsSet.WS2_32 ref: 00007FF7A92262F2
__WSAFDIsSet.WS2_32 ref: 00007FF7A922630D
__WSAFDIsSet.WS2_32 ref: 00007FF7A9226321

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 7c5aa9f4e4614d3925a22558fcb9daf37743cbcc01d227aca2766e4b0f08baea
Instruction ID: fc3b3e11bfddbad85b53af8030b88b1751b5f81850cd4e9dd4d900f8de337f3f
Opcode Fuzzy Hash: 7c5aa9f4e4614d3925a22558fcb9daf37743cbcc01d227aca2766e4b0f08baea
Instruction Fuzzy Hash: 5A91EB22B0E68286FF699F2498402F9A2B1BB54754FD14236D91EC6BDCDE3CE9618710

Function 00007FF7A9214F20 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 153COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214F6F

Strings

Couldn't resolve host '%s', xrefs: 00007FF7A92150A1
Unix socket path too long: '%s', xrefs: 00007FF7A9214FC6
Couldn't resolve proxy '%s', xrefs: 00007FF7A921514C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: calloc
String ID: Couldn't resolve host '%s'$Couldn't resolve proxy '%s'$Unix socket path too long: '%s'
API String ID: 2635317215-3812100122
Opcode ID: bde8f9bb82c721d20d4e1ac09b38267372a468e27ee3c6296fd962a3ccd7a8fc
Instruction ID: a00c7878dce0b5d6d61a6986bf98db86dd2ed656751d4561f348768d62424dcb
Opcode Fuzzy Hash: bde8f9bb82c721d20d4e1ac09b38267372a468e27ee3c6296fd962a3ccd7a8fc
Instruction Fuzzy Hash: AC51B635A0E682C2F61AAF299850779A7A0EB84790FA50031DB4D877F8DF3DE4718760

Function 00007FF7A91F2870 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121processCOMMON

Download Yara Rule

APIs

system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F28D7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2947
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F29A7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F29F7
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2A47
system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2AB8

Strings

.8, xrefs: 00007FF7A91F2A95
h%49, xrefs: 00007FF7A91F2A8E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: system
String ID: .8$h%49
API String ID: 3377271179-4206735779
Opcode ID: 791f77835353ba399b6ea75e6fd8ad2191e144a68b9e8952c00929a924e094ee
Instruction ID: 890208d525c2b4dfb9820e5098043c24a5089307571ceae547ea283893d5215d
Opcode Fuzzy Hash: 791f77835353ba399b6ea75e6fd8ad2191e144a68b9e8952c00929a924e094ee
Instruction Fuzzy Hash: A2616E22E297D689F301DF78E8452BCB770BB89748F415239CF896696AEB6C5108C354

Function 00007FF7A920B1D0 Relevance: 12.1, APIs: 8, Instructions: 67networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9228700: getaddrinfo.WS2_32 ref: 00007FF7A9228722
Part of subcall function 00007FF7A9228700: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922878E
Part of subcall function 00007FF7A9228700: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A92287C8
Part of subcall function 00007FF7A9228700: memcpy.VCRUNTIME140(?,?,?,00007FF7A920B225), ref: 00007FF7A92287E1
Part of subcall function 00007FF7A9228700: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A92287EF
Part of subcall function 00007FF7A9228700: freeaddrinfo.WS2_32(?,?,?,00007FF7A920B225), ref: 00007FF7A9228861
Part of subcall function 00007FF7A9228700: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A9228875
Part of subcall function 00007FF7A9228700: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922887F
Part of subcall function 00007FF7A9228700: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B225), ref: 00007FF7A922888C

WSAGetLastError.WS2_32 ref: 00007FF7A920B22B
WSAGetLastError.WS2_32 ref: 00007FF7A920B235
EnterCriticalSection.KERNEL32 ref: 00007FF7A920B250
LeaveCriticalSection.KERNEL32 ref: 00007FF7A920B25F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920B270
send.WS2_32 ref: 00007FF7A920B293
WSAGetLastError.WS2_32 ref: 00007FF7A920B29D
LeaveCriticalSection.KERNEL32 ref: 00007FF7A920B2B0

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$CriticalErrorLastSection$Leavemalloc$Enter_strdupfreeaddrinfogetaddrinfomemcpysend
String ID:
API String ID: 506363382-0
Opcode ID: 234b813171f725a71a02c3faaf024e3691faac4b6228bf96baf85f9252392565
Instruction ID: f9a0a08495cce771139b639e21af814bec0b14950a382913e8bc998ed7b8371b
Opcode Fuzzy Hash: 234b813171f725a71a02c3faaf024e3691faac4b6228bf96baf85f9252392565
Instruction Fuzzy Hash: 3E316F72A09A4286FB50AF25E490269B3B0FB84B98F854131DA0EC76FDDF3CD855C760

Function 00007FF7A9225C70 Relevance: 10.7, APIs: 7, Instructions: 242sleepnetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FF7A9225CD6
WSASetLastError.WS2_32 ref: 00007FF7A9225E96
Sleep.KERNEL32 ref: 00007FF7A9225EA6
__WSAFDIsSet.WS2_32 ref: 00007FF7A9225FBA
__WSAFDIsSet.WS2_32 ref: 00007FF7A9225FD2
Sleep.KERNEL32 ref: 00007FF7A9225FFD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 4116f599514ff819491a0c6321ec9d98ae0476f0d776607fa3851598fe814462
Instruction ID: 2dc4afff9b00c26cd983078d96f51e868afb2fe4b984df51cd57a9fd926888c1
Opcode Fuzzy Hash: 4116f599514ff819491a0c6321ec9d98ae0476f0d776607fa3851598fe814462
Instruction Fuzzy Hash: B4A11A35A2A75286FB696F1494006F9A2B5FF45B94F918234E91ECB7ECDF3DD8208310

Function 00007FF7A9228EE0 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922910A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922914F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9229177
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92291B9

Strings

schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 00007FF7A9228F5E
schannel: ApplyControlToken failure: %s, xrefs: 00007FF7A9228FE8
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 00007FF7A92290D3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-116363806
Opcode ID: d61f285efd15131c723e73b3fa2624c5cae4ce5e9472c5ee998b08f3db55ae1e
Instruction ID: cc79239cd8c8196a55387c5d520a8bb077f94de58de30c78a4cd750c16fd5460
Opcode Fuzzy Hash: d61f285efd15131c723e73b3fa2624c5cae4ce5e9472c5ee998b08f3db55ae1e
Instruction Fuzzy Hash: 58916B3660AF8586EB10DF26D8506AE77B4FB84B84F850535DE4D87BA8DF38D464CB10

Function 00007FF7A922BCC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922BD5E
memcpy.VCRUNTIME140 ref: 00007FF7A922BDF6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922BF2C

Strings

schannel: timed out sending data (bytes sent: %zd), xrefs: 00007FF7A922BEF4
select/poll on SSL socket, errno: %d, xrefs: 00007FF7A922BED4

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemallocmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 3056473165-3891197721
Opcode ID: fe64dc58e9d566957f7ddf1ff9396dbc0eaa0d098db69556b8514e0e7d67cf71
Instruction ID: 805ad038a8e4b6a69e31de9ed10cbb8fd9a24b003572a4c28a652efc25c71883
Opcode Fuzzy Hash: fe64dc58e9d566957f7ddf1ff9396dbc0eaa0d098db69556b8514e0e7d67cf71
Instruction Fuzzy Hash: 73718B72B0AB418AFB10DF65D4506AD73B1FB48BA8F814235DE2D877E8EE38D4168750

Function 00007FF7A924F88C Relevance: 10.6, APIs: 7, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_release_startup_lock.LIBCMT ref: 00007FF7A924F923
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A924F971
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A924F976
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A924F97E
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A924F986
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A924F9A8
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A924FA02

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1328870896-0
Opcode ID: 8681d64b6f63a8cf741ba538a4bfbd02181691d6bd283dc0c8483ad5752d088a
Instruction ID: 9d2078576f54b437baf4f42b8ca1882623496797447dd2786eec8b96add0211b
Opcode Fuzzy Hash: 8681d64b6f63a8cf741ba538a4bfbd02181691d6bd283dc0c8483ad5752d088a
Instruction Fuzzy Hash: A8315D21A0A65392FA50BF2494513F9A3B1AFC5784FC64035D64DCB6FFDE2CA864C361

Function 00007FF7A9206D30 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206D7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206D95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206EC2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206EEE

Strings

Connection #%ld to host %s left intact, xrefs: 00007FF7A9206FAB
%s, xrefs: 00007FF7A9206FF7

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 86b338d7c6ded9595a958c94f5b8e66c59b345d9af5d1c7fea7cf535c0277ad1
Instruction ID: 45f45f93b052ce295a37627a9841abd4d1067c99cb7de0d123dd09c6050141ce
Opcode Fuzzy Hash: 86b338d7c6ded9595a958c94f5b8e66c59b345d9af5d1c7fea7cf535c0277ad1
Instruction Fuzzy Hash: DE916771A0A68181FB58BF2595547B9A3B1FB44B84F854531DE4E876EDCF38E8708360

Function 00007FF7A92111C0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92111EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211201

Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921101D
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921103A
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921104E
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921106A
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A9211087
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110AA
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110BE
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110D2
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110F8
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921110C
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A9211120
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921116F
Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921117C

Part of subcall function 00007FF7A9210FA0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92111A5

memset.VCRUNTIME140 ref: 00007FF7A9211235

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7A9211411
User-Agent: %s, xrefs: 00007FF7A92112CF

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$memset
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 2717317152-3248832348
Opcode ID: 0dc487639d59e41329cc2ba3575b4034a67e7ce1569116459d4d07a13a25f3db
Instruction ID: e65d1f0a7096b6b467f8952536c5dd56f20f9cc20c8ff353abcf8b6419afe40f
Opcode Fuzzy Hash: 0dc487639d59e41329cc2ba3575b4034a67e7ce1569116459d4d07a13a25f3db
Instruction Fuzzy Hash: C1718132909BC2C1F751EF2598502BDA760EB85B84FA94131DB5D8B6EECF38E5718320

Function 00007FF7A9221740 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92217D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92217E1
memcpy.VCRUNTIME140 ref: 00007FF7A92217FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922195C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221965

Strings

1.1, xrefs: 00007FF7A922174F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$memcpy
String ID: 1.1
API String ID: 4107583993-2150719395
Opcode ID: bb9a4a286311b79879c11090a50217305a453a35136b00152bbd92c0348052f2
Instruction ID: f24c140ecab2408fe8f27641be0858df3dc0e1aec7ed305c5ce7018c6526fbc7
Opcode Fuzzy Hash: bb9a4a286311b79879c11090a50217305a453a35136b00152bbd92c0348052f2
Instruction Fuzzy Hash: 1F51607260AAC586E6649F22E8807E9A3B0FB44B84F454031DF9D877A9DF3CE065C350

Function 00007FF7A9215F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215FC6
recv.WS2_32 ref: 00007FF7A9215FF0
send.WS2_32 ref: 00007FF7A9216013
WSAGetLastError.WS2_32 ref: 00007FF7A9216025

Strings

Send failure: %s, xrefs: 00007FF7A9216055

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastmallocrecvsend
String ID: Send failure: %s
API String ID: 25851408-857917747
Opcode ID: de703741799f350baa78c412bbe72cc443ef18094551bb55672a06f380bc08a2
Instruction ID: 42a2027e0dc846297a3a6637a42d1ce455e0f8a28c4fc121b5a20c14462c3bad
Opcode Fuzzy Hash: de703741799f350baa78c412bbe72cc443ef18094551bb55672a06f380bc08a2
Instruction Fuzzy Hash: 89417F72607B8185FB65AF25E840779A6A0BB48BE8F964135CE5D877E8DE3CD460C310

Function 00007FF7A9207E28 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9207F78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9207FBF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9207FEA

Part of subcall function 00007FF7A9206D30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206D7E
Part of subcall function 00007FF7A9206D30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206D95

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920801F

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7A9207366

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %I64d milliseconds
API String ID: 1294909896-3343404259
Opcode ID: d93e4074a541cf920ccf8d5d57e247a0490fba269d519255360e7ae0db164b1e
Instruction ID: 485ba987cb19c9be522b6e9957bdc365f4c22de125f21901f8ef7e7854a1aa9c
Opcode Fuzzy Hash: d93e4074a541cf920ccf8d5d57e247a0490fba269d519255360e7ae0db164b1e
Instruction Fuzzy Hash: 7CD1B421A0A64685FBA4AF25D4443BDA3B1FF44B88F854431CE0D9B6EDDF39E865C360

Function 00007FF7A91F3580 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F28D7
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2947
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F29A7
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F29F7
Part of subcall function 00007FF7A91F2870: system.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2A47

MessageBoxA.USER32 ref: 00007FF7A91F3757

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F37BA

Strings

keyauth.win, xrefs: 00007FF7A91F36E3
null, xrefs: 00007FF7A91F35E2

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: system$Message_invalid_parameter_noinfo_noreturnmemcpy
String ID: keyauth.win$null
API String ID: 3545939226-2841560827
Opcode ID: c623bbfbf38d71464ebb7f1728a2a4f3fd65a4ff34d273a061fca285fe5b4df8
Instruction ID: d63c9ce63ea9e79e0e42b711be86fabbb9b831f15891c3813e1131593cfc072f
Opcode Fuzzy Hash: c623bbfbf38d71464ebb7f1728a2a4f3fd65a4ff34d273a061fca285fe5b4df8
Instruction Fuzzy Hash: 9151F022B0AB5586FB08EF75E4443AC6371AB44B98F814135CF4D57FAAEF3C91A28350

Function 00007FF7A92424B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9218690: GetModuleHandleA.KERNEL32(?,?,?,00007FF7A92424EA,?,?,?,?,00007FF7A9218A1B), ref: 00007FF7A92186A4

GetProcAddressForCaller.KERNELBASE(?,?,?,?,00007FF7A9218A1B), ref: 00007FF7A9242500

Strings

secur32.dll, xrefs: 00007FF7A92424D3
security.dll, xrefs: 00007FF7A92424DA
InitSecurityInterfaceA, xrefs: 00007FF7A92424F6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: AddressCallerHandleModuleProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2084706301-3788156360
Opcode ID: 541ddddf1e715039dc83873a8714642faf286eec286cebb9bbec507132882b9b
Instruction ID: b54ef67e8a72c92a724d859ce2e9bdd50255113af63bdbed25b777a862b7df3a
Opcode Fuzzy Hash: 541ddddf1e715039dc83873a8714642faf286eec286cebb9bbec507132882b9b
Instruction Fuzzy Hash: 30F01964E0BA0290FE1AFF12A891770A2F0AF94744FC64434C50CCA6F9EE3CE1B58721

Function 00007FF7A920795B Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

Resolving timed out after %I64d milliseconds, xrefs: 00007FF7A9207366

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: Resolving timed out after %I64d milliseconds
API String ID: 0-3343404259
Opcode ID: 3757414087b1ac234bfe42b917fc111d866b8cca7aac2e0ae3ac548344d2722b
Instruction ID: b44c4850bd9ae4087114b262a36d9de6281063fe61dab7463c97ca7da0a5b11f
Opcode Fuzzy Hash: 3757414087b1ac234bfe42b917fc111d866b8cca7aac2e0ae3ac548344d2722b
Instruction Fuzzy Hash: 3AB1BC21A0A64285FBA4BF25885037DA374FF41B49F964531CA1E8B6EDDF39EC64C360

Function 00007FF7A9221300 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221400

Part of subcall function 00007FF7A9221990: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92219EA

Part of subcall function 00007FF7A9221740: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92217D8
Part of subcall function 00007FF7A9221740: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92217E1

Strings

PROXY %s %s %s %li %li, xrefs: 00007FF7A92213D4
TCP4, xrefs: 00007FF7A922139A
TCP6, xrefs: 00007FF7A9221387

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$calloc
String ID: PROXY %s %s %s %li %li$TCP4$TCP6
API String ID: 3095843317-1242256665
Opcode ID: 4d2fd3a2b27951b79ce04f69713765d1803f814975f18fe8ad590a9e5f1a19ab
Instruction ID: 7900763f5e3b9a4b595f0d24e4a8e4a351e0f7e1a066decf3b9a549436e4c66f
Opcode Fuzzy Hash: 4d2fd3a2b27951b79ce04f69713765d1803f814975f18fe8ad590a9e5f1a19ab
Instruction Fuzzy Hash: 2E418A31A0E68246FB60EF25A4417F9A7B1EB85784F954032DA4CC76EEDE3DD528C710

Function 00007FF7A9205BF0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00007FF7A9201C26,?,?,?,?,00000000,?,00007FF7A91F373E), ref: 00007FF7A9205C0D
closesocket.WS2_32 ref: 00007FF7A9205D19
closesocket.WS2_32 ref: 00007FF7A9205D26

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: closesocket$calloc
String ID:
API String ID: 2958813939-0
Opcode ID: 4615a6c988a44658c8e012836cd2d3db9b8b32d9688f13d08ebd1a8dacda641f
Instruction ID: 7bd4968fe07e91e048db255a75fa72123852d13f646f7525ad8335b684198d67
Opcode Fuzzy Hash: 4615a6c988a44658c8e012836cd2d3db9b8b32d9688f13d08ebd1a8dacda641f
Instruction Fuzzy Hash: 34418035A0964282F740BF35E8402E9A371EB88724FD64231DE5DCA2EAEF38D5658720

Function 00007FF7A9229AB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FF7A9229BF3
SSL/TLS connection timeout, xrefs: 00007FF7A9229C0C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 52b3aa311b18e8d5337ba8a52f30bd3e5c0977559e730d9f34ac1422c1834b28
Instruction ID: 81d89f8c861d674c36bf5c904d059f4eac757c5f848ca4e68563a1662cd3bdff
Opcode Fuzzy Hash: 52b3aa311b18e8d5337ba8a52f30bd3e5c0977559e730d9f34ac1422c1834b28
Instruction Fuzzy Hash: B851C836A4A64685FB14EF1196402F9E3A4EF457A4F954231DA1EC73F8DE3DE021C320

Function 00007FF7A9205DF0 Relevance: 4.8, APIs: 3, Instructions: 309networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7A92061E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9206207

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freerecv
String ID:
API String ID: 2032557106-0
Opcode ID: 81f4947644d7e6db7ba1a0ba613955ad08392ab83e8f1e0e04aa399c574340be
Instruction ID: 957901694bf6b12aa1da94545b3cf3d10976eecc9b16d9e25563c4e668eb70ef
Opcode Fuzzy Hash: 81f4947644d7e6db7ba1a0ba613955ad08392ab83e8f1e0e04aa399c574340be
Instruction Fuzzy Hash: 46C11936A0A68246FBA59F2594407BAA2B0FF447A4F854335DE9E837E8DF3CDC518710

Function 00007FF7A9211EC0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211F25

Strings

Connected to %s (%s) port %ld (#%ld), xrefs: 00007FF7A9212064
User-Agent: %s, xrefs: 00007FF7A9211F36

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Connected to %s (%s) port %ld (#%ld)$User-Agent: %s
API String ID: 1294909896-3248832348
Opcode ID: a81e5bd9ebe635560ca87f9a31cb99526eb176e371e61cfbcb59ed0a648c36d2
Instruction ID: 5d4a6ea2d975047ac6cff1d7ba1bbc3c384f2f71cb1972c378c80db9122af01f
Opcode Fuzzy Hash: a81e5bd9ebe635560ca87f9a31cb99526eb176e371e61cfbcb59ed0a648c36d2
Instruction Fuzzy Hash: C2517122A096C1C1F7519F25D8403ADA760E785B98F994135EF4C8B2EECF7DE5A5C320

Function 00007FF7A9215D20 Relevance: 3.0, APIs: 2, Instructions: 23networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7A9215D2C
WSAGetLastError.WS2_32 ref: 00007FF7A9215D3B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 6d4567ff3aa502f88ada590c756d0eb288cb95ffc4202f14a5fdaaef775206c0
Instruction ID: 699512ee264750f3e08099e8d00051a865444ef7df80742c7c872ce7fc69dde1
Opcode Fuzzy Hash: 6d4567ff3aa502f88ada590c756d0eb288cb95ffc4202f14a5fdaaef775206c0
Instruction Fuzzy Hash: 78E0DF61F0550582FF296BB0A89473812A09B44772F884734CA3BC63D4EA2C84E24310

Function 00007FF7A9216600 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF7A9216643

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 2b5c975b708db0323598e77894310fd802802d33fc7982a2593b17f64747decf
Instruction ID: d5c34a63af620fa2e30dd4a33d7ab58d872f2175d859e99951eaae1812bbaac3
Opcode Fuzzy Hash: 2b5c975b708db0323598e77894310fd802802d33fc7982a2593b17f64747decf
Instruction Fuzzy Hash: 5F01842170658181FF54EF2AE59836DA270AF88B84F994131D70D872EACE2DD8B58710

Function 00007FF7A921E120 Relevance: 1.5, APIs: 1, Instructions: 23networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7A921E149

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b4e157f0ea3729fd2451a725240f6685635a2e81fc13405dfae886e1aa9083b4
Instruction ID: 1c4fdfda890b6e1a89eb151318e31344d7faa2c35d492a038fe5e9f688a7ac3f
Opcode Fuzzy Hash: b4e157f0ea3729fd2451a725240f6685635a2e81fc13405dfae886e1aa9083b4
Instruction Fuzzy Hash: EEE06D3AE0764182EE4CAF2588912A92360AB45734FD54371C63D423E5CE2CA6BA9B10

Function 00007FF7A9228D80 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9228D9B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 80df5e46377be0dfdc9ade07f9fde7078ec2923909fe9ee7aacebf4f60ad1458
Instruction ID: 75909cd97d63ca6d528924becc7ecbfe937e0094527ecd34d72d5d2963551018
Opcode Fuzzy Hash: 80df5e46377be0dfdc9ade07f9fde7078ec2923909fe9ee7aacebf4f60ad1458
Instruction Fuzzy Hash: 5ED02B63B19A0083DF10DF71A840029E351B788774B884338AE7D827F4DB3CD1554600

Function 00007FF7A9224CC0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF7A9224CD9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: d496c00e39af1d0d70f2dffec5ba97bf9070f7f7a4cf54263a3064c61f677488
Instruction ID: 9a30ca01407cad5d20d717526108000231ebd01441de9dd602b760f3a6747016
Opcode Fuzzy Hash: d496c00e39af1d0d70f2dffec5ba97bf9070f7f7a4cf54263a3064c61f677488
Instruction Fuzzy Hash: ACC08026F15581C2D3446F7154C5087A771AFC4204FD56435D24782138DD3CD6F98B50

Non-executed Functions

Function 00007FF7A92089C0 Relevance: 105.7, APIs: 41, Strings: 19, Instructions: 745stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,?,00000000,?,?,00007FF7A920A217), ref: 00007FF7A9208A30
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9208A4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9208A84
strchr.VCRUNTIME140 ref: 00007FF7A9208A97
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9208C17
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9208C38
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9208C5B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9208C68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9208D01
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9208D0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9208D22
strchr.VCRUNTIME140 ref: 00007FF7A9208F0F
strchr.VCRUNTIME140 ref: 00007FF7A9208F29
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920901C
strchr.VCRUNTIME140 ref: 00007FF7A9209048
strrchr.VCRUNTIME140 ref: 00007FF7A920905A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920907B
memcpy.VCRUNTIME140 ref: 00007FF7A9209094
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209108
strchr.VCRUNTIME140 ref: 00007FF7A920912B
strchr.VCRUNTIME140 ref: 00007FF7A9209140

Strings

Replaced, xrefs: 00007FF7A9209631
domain, xrefs: 00007FF7A9208D41
secure, xrefs: 00007FF7A9208C8E
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
max-age, xrefs: 00007FF7A9208E78
__Host-, xrefs: 00007FF7A9208C31
__Secure-, xrefs: 00007FF7A9208C10
path, xrefs: 00007FF7A9208CED
version, xrefs: 00007FF7A9208E4B
%4095[^;=] =%4095[^;], xrefs: 00007FF7A9208AD6
TRUE, xrefs: 00007FF7A9209177
expires, xrefs: 00007FF7A9208EA5
Added, xrefs: 00007FF7A920963D
localhost, xrefs: 00007FF7A9208D6F
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00007FF7A9208F9F
FALSE, xrefs: 00007FF7A920917E, 00007FF7A920937B
#HttpOnly_, xrefs: 00007FF7A92090FE
httponly, xrefs: 00007FF7A9208CC6
skipped cookie with bad tailmatch domain: %s, xrefs: 00007FF7A9208E2E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$_strdup$freestrncmp$_time64callocmallocmemcpystrrchr
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2059720140-3844637060
Opcode ID: 2f4c6a10e3fc7912e861c4595b446466d0bfeda85607a935bdca782531e830d4
Instruction ID: 62f536e8d1c8636740b8f0165b582b6723e642980aacd19db40fcb3f12fab2e0
Opcode Fuzzy Hash: 2f4c6a10e3fc7912e861c4595b446466d0bfeda85607a935bdca782531e830d4
Instruction Fuzzy Hash: AD72A421A0B78285FBA1AF25D444379A7B1EF45754F864131CA8E86AF9DF3DEC64C320

Function 00007FF7A923D250 Relevance: 102.1, APIs: 45, Strings: 13, Instructions: 581COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9215B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C45
Part of subcall function 00007FF7A9215B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C60

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923D2DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923D312
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923D31C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923D339
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923D34C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923D355
#22.WLDAP32 ref: 00007FF7A923D366
#211.WLDAP32 ref: 00007FF7A923D400
#217.WLDAP32 ref: 00007FF7A923D41C
#211.WLDAP32 ref: 00007FF7A923D435
#211.WLDAP32 ref: 00007FF7A923D447
#60.WLDAP32 ref: 00007FF7A923D477
#211.WLDAP32 ref: 00007FF7A923D592
#60.WLDAP32 ref: 00007FF7A923D5B7
#22.WLDAP32 ref: 00007FF7A923D65A
#41.WLDAP32 ref: 00007FF7A923DA76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DA9E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DAA8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DAC8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DADB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DAE4
#46.WLDAP32 ref: 00007FF7A923DAF6

Strings

LDAP local: Cannot connect to %s:%ld, xrefs: 00007FF7A923D49B
;binary, xrefs: 00007FF7A923D8E0
LDAP local: %s, xrefs: 00007FF7A923D36C
LDAP local: bind via ldap_win_bind %s, xrefs: 00007FF7A923D664
LDAP local: %s, xrefs: 00007FF7A923D2C7
encrypted, xrefs: 00007FF7A923D3AE
DN: , xrefs: 00007FF7A923D752
There are more than %d entries, xrefs: 00007FF7A923DA86
LDAP local: LDAP Vendor = %s ; LDAP Version = %d, xrefs: 00007FF7A923D284
cleartext, xrefs: 00007FF7A923D38F
LDAP remote: %s, xrefs: 00007FF7A923D6D7
Microsoft Corporation., xrefs: 00007FF7A923D270
LDAP local: trying to establish %s connection, xrefs: 00007FF7A923D399

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$#211$fwrite$#217calloc
String ID: ;binary$DN: $LDAP local: %s$LDAP local: %s$LDAP local: Cannot connect to %s:%ld$LDAP local: LDAP Vendor = %s ; LDAP Version = %d$LDAP local: bind via ldap_win_bind %s$LDAP local: trying to establish %s connection$LDAP remote: %s$Microsoft Corporation.$There are more than %d entries$cleartext$encrypted
API String ID: 2742731861-78870445
Opcode ID: 16220367b3450cccf0e2ebe54351cc3bcb34b2cf1641bd728ee888ee9050e42d
Instruction ID: c65af6fc6caab61f351f4b2055641691377ce543f26214efbd6e026b0b0e61e7
Opcode Fuzzy Hash: 16220367b3450cccf0e2ebe54351cc3bcb34b2cf1641bd728ee888ee9050e42d
Instruction Fuzzy Hash: 2E427375B0A64286F714EF6294502BA63F1FB45B88F824531CE0E977E9DE3CE469C350

Function 00007FF7A91FAC2D Relevance: 74.4, APIs: 37, Strings: 5, Instructions: 925COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB5C4
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FB5F2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FB600
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB63A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB697
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB750
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FB77E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FB78C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB7C6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB823

Part of subcall function 00007FF7A91FEFE0: memcmp.VCRUNTIME140 ref: 00007FF7A91FF06D
Part of subcall function 00007FF7A91FEFE0: memcmp.VCRUNTIME140 ref: 00007FF7A91FF0F1

Strings

array, xrefs: 00007FF7A91FBA39
object separator, xrefs: 00007FF7A91FB530, 00007FF7A91FBD59
number overflow parsing ', xrefs: 00007FF7A91FB83F
object key, xrefs: 00007FF7A91FB6BC, 00007FF7A91FBEE8
object, xrefs: 00007FF7A91FBBC8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcmp
String ID: array$number overflow parsing '$object$object key$object separator
API String ID: 969624648-85532522
Opcode ID: ddaaeabe2d4a9afca3618ef1a4aa73e233afcd4577d2dc36e2f0cd18f79aa579
Instruction ID: b4365bd6fba0dd30e9fb2cf808daad04eb9bda775517504e892878c9a5a5b594
Opcode Fuzzy Hash: ddaaeabe2d4a9afca3618ef1a4aa73e233afcd4577d2dc36e2f0cd18f79aa579
Instruction Fuzzy Hash: 1492A663A19B8981FB11EF64E4843ADA371FB457A4F810232DB6D46AE9EF7CD095C310

Function 00007FF7A9245B00 Relevance: 72.3, APIs: 17, Strings: 24, Instructions: 549encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF7A9245C6F
GetLastError.KERNEL32 ref: 00007FF7A9245C82
CertCreateCertificateChainEngine.CRYPT32 ref: 00007FF7A9245D34
GetLastError.KERNEL32 ref: 00007FF7A9245D3E
CertGetCertificateChain.CRYPT32 ref: 00007FF7A9245DCB
GetLastError.KERNEL32 ref: 00007FF7A9245DD5
CertGetNameStringA.CRYPT32 ref: 00007FF7A9245F43
CertFreeCertificateChainEngine.CRYPT32 ref: 00007FF7A92463BB
CertCloseStore.CRYPT32 ref: 00007FF7A92463D0
CertFreeCertificateChain.CRYPT32 ref: 00007FF7A92463E0
CertFreeCertificateContext.CRYPT32 ref: 00007FF7A92463F0

Strings

schannel: Null certificate info., xrefs: 00007FF7A9245F93, 00007FF7A9246124
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FF7A9245C41
schannel: Not enough memory to list all host names., xrefs: 00007FF7A924626C
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00007FF7A9245E3D
schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 00007FF7A9245EAA
schannel: server certificate name verification failed, xrefs: 00007FF7A924632E
schannel: failed to create certificate chain engine: %s, xrefs: 00007FF7A9245D58
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 00007FF7A9246283
schannel: failed to create certificate store: %s, xrefs: 00007FF7A9245C9C
schannel: CertGetCertificateChain failed: %s, xrefs: 00007FF7A9245DEF
schannel: Failed to read remote certificate context: %s, xrefs: 00007FF7A924636D
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 00007FF7A92462F9
schannel: CertFindExtension() returned no extension., xrefs: 00007FF7A9245FBB, 00007FF7A9246157
schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 00007FF7A9246346
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00007FF7A9245E55
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00007FF7A9245E6C
2.5.29.17, xrefs: 00007FF7A9245FA3, 00007FF7A9245FD4, 00007FF7A924613F, 00007FF7A924617B
schannel: CertGetNameString() returned no certificate name information, xrefs: 00007FF7A924608D
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 00007FF7A92462E9
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00007FF7A9245E82
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00007FF7A9245E99
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FF7A924600E, 00007FF7A92461B5
schannel: Null certificate context., xrefs: 00007FF7A9245F58, 00007FF7A9246107
schannel: Empty DNS name., xrefs: 00007FF7A924604A, 00007FF7A92461F8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$EngineStore$CloseContextCreateNameOpenString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Failed to read remote certificate context: %s$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: server certificate name verification failed$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 561913010-2037819326
Opcode ID: 8d47dd5a153cb71e182490dd5e18f2fbc4435ac9112289b6b2ab232f689ae353
Instruction ID: 76d4c3b65b0e4d4345ca663f4003d5a4763cc4038626cfc0938f9da4a4209ed6
Opcode Fuzzy Hash: 8d47dd5a153cb71e182490dd5e18f2fbc4435ac9112289b6b2ab232f689ae353
Instruction Fuzzy Hash: 4D42A035A0AA8282FB10AF15E4406A9A7B1FB84B94FD24131DA4D877ECDF3CE564C760

Function 00007FF7A9234A20 Relevance: 67.0, APIs: 25, Strings: 13, Instructions: 515networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9234B01
getsockname.WS2_32 ref: 00007FF7A9234CFA
WSAGetLastError.WS2_32 ref: 00007FF7A9234D04
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923523B

Strings

,%d,%d, xrefs: 00007FF7A9235119
bind() failed, we ran out of ports!, xrefs: 00007FF7A9234EF6
Failure sending EPRT command: %s, xrefs: 00007FF7A92351EF
Failure sending PORT command: %s, xrefs: 00007FF7A923516C
%s %s, xrefs: 00007FF7A9235149
%s |%d|%s|%hu|, xrefs: 00007FF7A92351C9
failed to resolve the address provided to PORT: %s, xrefs: 00007FF7A9235229
EPRT, xrefs: 00007FF7A92351B2
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FF7A9234E94
bind(port=%hu) failed: %s, xrefs: 00007FF7A9234F65
getsockname() failed: %s, xrefs: 00007FF7A9234D1E, 00007FF7A9234F2E
socket failure: %s, xrefs: 00007FF7A9234DFF, 00007FF7A9235006
PORT, xrefs: 00007FF7A9235142

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastcallocfreegetsockname
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2454324209-2383553807
Opcode ID: 01a81dac457a2be8f57acb4c1884cf30419707a4b21e9d9f219c7f8c6a294454
Instruction ID: eaf04e74201041b971ea4dde95a03887e236036f30edf0e8f272fca57bc56278
Opcode Fuzzy Hash: 01a81dac457a2be8f57acb4c1884cf30419707a4b21e9d9f219c7f8c6a294454
Instruction Fuzzy Hash: EC22D465B0A78281FB54AF25A4402BAA771FB85784FC14032EA4EC76EDDF3DE564C720

Function 00007FF7A920F110 Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 254stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F176
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F19D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F1F8

Strings

sha256//, xrefs: 00007FF7A920F16C, 00007FF7A920F2BE
-----END PUBLIC KEY-----, xrefs: 00007FF7A920F3FE
;sha256//, xrefs: 00007FF7A920F270
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF7A920F3CA
public key hash: sha256//%s, xrefs: 00007FF7A920F20E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemallocstrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1436789207-471711153
Opcode ID: fe2336728e9f437f07992f6205e72225464b5552939138919260a5ee91473524
Instruction ID: 8db1c39947cefa232a0caa1e762ba81553c709fa954dc5c86d37c8a58f2a40d0
Opcode Fuzzy Hash: fe2336728e9f437f07992f6205e72225464b5552939138919260a5ee91473524
Instruction Fuzzy Hash: 93A16215A4B65241FA94EF2694542B9E6B0AF44BD0FCA4431DE0E877FDDF3CE8698320

Function 00007FF7A9246420 Relevance: 52.8, APIs: 17, Strings: 13, Instructions: 253fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7A9246466

Part of subcall function 00007FF7A9202670: GetLastError.KERNEL32 ref: 00007FF7A920268C
Part of subcall function 00007FF7A9202670: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9202694

CreateFileA.KERNEL32 ref: 00007FF7A92464C0
GetLastError.KERNEL32 ref: 00007FF7A92464D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924680D

Strings

schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 00007FF7A9246746
schannel: failed to open CA file '%s': %s, xrefs: 00007FF7A92464EB
schannel: CA file '%s' is not correctly formatted, xrefs: 00007FF7A92467B1
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FF7A9246480
schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FF7A9246532
schannel: failed to read from CA file '%s': %s, xrefs: 00007FF7A9246710
schannel: added %d certificate(s) from CA file '%s', xrefs: 00007FF7A92467E3
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 00007FF7A9246765
-----END CERTIFICATE-----, xrefs: 00007FF7A9246639
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 00007FF7A9246795
schannel: did not add any certificates from CA file '%s', xrefs: 00007FF7A92467D2
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FF7A9246569
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7A924660E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast$CreateFile_errnofree
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: CA file exceeds max size of %u bytes$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to determine size of CA file '%s': %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 1377488173-902404565
Opcode ID: 76774bd0929614677fcbdd63a95865735495a60c09f72ce255b59b36d24e3cab
Instruction ID: 7fbbe032bd1d2acb061713bdb5020b730c887b7e8256f0bc493782aee5dce909
Opcode Fuzzy Hash: 76774bd0929614677fcbdd63a95865735495a60c09f72ce255b59b36d24e3cab
Instruction Fuzzy Hash: 6DB1C175A0A74292FB10AF25E8406A9A2B1BB84784FC20135DD4DC7BFDDE3CE564C760

Function 00007FF7A9213360 Relevance: 51.2, APIs: 21, Strings: 8, Instructions: 401stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7A92133BA
memset.VCRUNTIME140 ref: 00007FF7A92133CF
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92133EB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213412
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213489
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92134BC
strchr.VCRUNTIME140 ref: 00007FF7A92135A6
strchr.VCRUNTIME140 ref: 00007FF7A92135EB
strchr.VCRUNTIME140 ref: 00007FF7A921361B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92136C3

Part of subcall function 00007FF7A922BF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BF98
Part of subcall function 00007FF7A922BF70: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFBE
Part of subcall function 00007FF7A922BF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFDF
Part of subcall function 00007FF7A922BF70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFF0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213796
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92137C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92137EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213817
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213825
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92139DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92139E3

Strings

ALL_PROXY, xrefs: 00007FF7A9213760
Uses proxy env variable %s == '%s', xrefs: 00007FF7A921351C, 00007FF7A921377A
all_proxy, xrefs: 00007FF7A9213749
_proxy, xrefs: 00007FF7A92136D9
memory shortage, xrefs: 00007FF7A9213497
http_proxy, xrefs: 00007FF7A921370D
no_proxy, xrefs: 00007FF7A92134E1
NO_PROXY, xrefs: 00007FF7A92134FD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$strchr$_strdupmemsetreallocstrncpy$EnvironmentVariabletolower
String ID: ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 1339443121-1021110354
Opcode ID: 4556a8dc681f6dfed80c0f7d071dc3384185194aad1043f8249eda87f22455b0
Instruction ID: 5a9918034aa30546c7c8dda3726195b41570206cfcce3bda1409ad82944f4471
Opcode Fuzzy Hash: 4556a8dc681f6dfed80c0f7d071dc3384185194aad1043f8249eda87f22455b0
Instruction Fuzzy Hash: 8602A371A0A7C181FA61EF15A8543A9A7B5EF45B84F9A0035DA8D877E9DF3CE074C320

Function 00007FF7A922A02C Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 203stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A922A0C8
strchr.VCRUNTIME140 ref: 00007FF7A922A0F4
strchr.VCRUNTIME140 ref: 00007FF7A922A12E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922A152
strchr.VCRUNTIME140 ref: 00007FF7A922A262
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922A27A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A922A3A5
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A922A3D1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7A922A509
, xrefs: 00007FF7A922A02C
CurrentUser, xrefs: 00007FF7A922A142

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: $CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-4282655970
Opcode ID: 534a15c3799700887d802ee3cdba13f396efd95c9dc6529577008c0f480de84e
Instruction ID: 42dc0c634cc5c31dfa052205022ffa51473bfd7c4748d42802c2826118965cb7
Opcode Fuzzy Hash: 534a15c3799700887d802ee3cdba13f396efd95c9dc6529577008c0f480de84e
Instruction Fuzzy Hash: 26817521B0B64282FB55AF2598503B9A7B0BF45B94F864135CA1EC6BF8DF3CE564C320

Function 00007FF7A922A035 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202stringfileCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A922A0C8
strchr.VCRUNTIME140 ref: 00007FF7A922A0F4
strchr.VCRUNTIME140 ref: 00007FF7A922A12E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922A152
strchr.VCRUNTIME140 ref: 00007FF7A922A262
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922A27A
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A922A3A5
fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A922A3D1

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00007FF7A922A509
CurrentUser, xrefs: 00007FF7A922A142

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$_strdupfopenfseekstrncmpstrtol
String ID: CurrentUser$schannel: Failed to import cert file %s, password is bad
API String ID: 4221717217-1887299029
Opcode ID: 46b447e90a85677a344c472be2f2b41cdc201bb637b4b60ac57683f4d3470ce2
Instruction ID: e4d937dfb81e0b15cb9634a69bf79a29ae8562b4bedf2949f8ec7b22318abbd9
Opcode Fuzzy Hash: 46b447e90a85677a344c472be2f2b41cdc201bb637b4b60ac57683f4d3470ce2
Instruction Fuzzy Hash: 68816521B0B64286FB55AF2598503B9A7B0BF45B54F864135CA1E86BF8DF3CE564C320

Function 00007FF7A9227CF0 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 422stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9227F6E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9227F76
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A9227F8C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9227F95
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9227F9D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9227FA7

Strings

GMT, xrefs: 00007FF7A9227E67
%02d:%02d%n, xrefs: 00007FF7A9227F4D
%02d:%02d:%02d%n, xrefs: 00007FF7A9227F19
%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00007FF7A9227DAE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$GMT
API String ID: 3596500743-988243589
Opcode ID: 91a5f93331cd121433664eff766babe08dc5e3928e2869f9a4e6d50c265d7e14
Instruction ID: 678a67b3d84b46e7a3481e3565241a467f3b25974da5943e9a46cabfc8961387
Opcode Fuzzy Hash: 91a5f93331cd121433664eff766babe08dc5e3928e2869f9a4e6d50c265d7e14
Instruction Fuzzy Hash: D1F1D5B2F0A5118AFB24AF6494001FCB7B5BB44758F914235DE1A9B7E8DE3CE8258760

Function 00007FF7A9229330 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7A9229370
CryptAcquireContextA.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A922938F
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A92293B9
CryptHashData.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A92293D1
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A92293F6
CryptGetHashParam.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A9229422
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A9229432
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7A92292F9), ref: 00007FF7A9229444

Strings

@, xrefs: 00007FF7A9229385

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: 035e510839b57ee73c6c2cba4a4435af7923e6ab64538681f40ec1597c466301
Instruction ID: 2c49938ccbe13747fc3d0ac24b390324d8905274e158a5421f16b31353e86f31
Opcode Fuzzy Hash: 035e510839b57ee73c6c2cba4a4435af7923e6ab64538681f40ec1597c466301
Instruction Fuzzy Hash: DA316036A0A68186F760DF11E584AAAB770FBC4B80F855035DE8E93B68CF3CD415CB10

Function 00007FF7A9201E7E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9
SEC_E_BAD_PKGID, xrefs: 00007FF7A9201E7E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_PKGID
API String ID: 600764987-1052566392
Opcode ID: f6f0278d85aa505063c2966c61074cf7bcf1735345065e99c48bc1c6c1facb29
Instruction ID: 44407919561edd3003fa90e1a9d73cc129f8ef00c1faf246d2c71a60711574dd
Opcode Fuzzy Hash: f6f0278d85aa505063c2966c61074cf7bcf1735345065e99c48bc1c6c1facb29
Instruction Fuzzy Hash: 59316462A0E68199F771AF60A4543AEF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9210630 Relevance: 14.3, Strings: 11, Instructions: 540COMMON

Download Yara Rule

Strings

Server doesn't support multiplex yet, wait, xrefs: 00007FF7A921077B
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00007FF7A9210EFA
Connection #%ld isn't open enough, can't reuse, xrefs: 00007FF7A9210896
Server doesn't support multiplex (yet), xrefs: 00007FF7A921079F
Could multiplex, but not asked to!, xrefs: 00007FF7A92107CC
can multiplex, xrefs: 00007FF7A9210732
serially, xrefs: 00007FF7A921073E
Can not multiplex, even if we wanted to!, xrefs: 00007FF7A92107EA
Connection #%ld is still name resolving, can't reuse, xrefs: 00007FF7A9210871
Multiplexed connection found!, xrefs: 00007FF7A9210EA1
Found bundle for host %s: %p [%s], xrefs: 00007FF7A9210749

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to!$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to!$Found bundle for host %s: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found!$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-2774518510
Opcode ID: eb6dd6413f3a24834a9603e4e9be2d05391c36e49aa0956beced66b4f643969c
Instruction ID: b7902866f53d346e030bccc6688f2ea2f7d6152c82b21be4637b031ae2e4c24a
Opcode Fuzzy Hash: eb6dd6413f3a24834a9603e4e9be2d05391c36e49aa0956beced66b4f643969c
Instruction Fuzzy Hash: 6642B631A8E6C6C5FB65AE2599103F9B7B1AB41784FA64035CB5C872EDDF28A470C720

Function 00007FF7A924EF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7A924EFA6
CryptCreateHash.ADVAPI32 ref: 00007FF7A924EFCA
CryptHashData.ADVAPI32 ref: 00007FF7A924EFE6
CryptGetHashParam.ADVAPI32 ref: 00007FF7A924F005
CryptGetHashParam.ADVAPI32 ref: 00007FF7A924F028
CryptDestroyHash.ADVAPI32 ref: 00007FF7A924F038
CryptReleaseContext.ADVAPI32 ref: 00007FF7A924F04A

Strings

@, xrefs: 00007FF7A924EF7D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID: @
API String ID: 3606780921-2766056989
Opcode ID: 28552d40a6436a6ccb822c60e86453ca9e499da612cb9183ff47a701bb5e09dc
Instruction ID: 4c2e1f7cba73923eaff32afd61b003a3483cf02aad05b70142955416ca72ff42
Opcode Fuzzy Hash: 28552d40a6436a6ccb822c60e86453ca9e499da612cb9183ff47a701bb5e09dc
Instruction Fuzzy Hash: A4214D3261E68187FB609F11E45066AB770FBC9B84F855135EE8E87AACCF3CD4158B10

Function 00007FF7A924FD7C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7A924FD98
memset.VCRUNTIME140 ref: 00007FF7A924FDBC
RtlCaptureContext.KERNEL32 ref: 00007FF7A924FDC5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A924FDDF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A924FE20
memset.VCRUNTIME140 ref: 00007FF7A924FE53
IsDebuggerPresent.KERNEL32 ref: 00007FF7A924FE74
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A924FE91
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A924FE9C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: a2a83a655cd25f36edffe731577b8a7a31e3c5f3faee8c05d41c20a1b32baffd
Instruction ID: df881db3467cd7e1c33f4725a62101ba2cfd356c9a2a5c0933e03aaa10a081da
Opcode Fuzzy Hash: a2a83a655cd25f36edffe731577b8a7a31e3c5f3faee8c05d41c20a1b32baffd
Instruction Fuzzy Hash: A8311272609B8196FB609F60E8403E97374FB84744F45403ADA4E877A9DF3CD558C710

Function 00007FF7A924CE70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7A924CEB7
CryptImportKey.ADVAPI32 ref: 00007FF7A924CF89
CryptReleaseContext.ADVAPI32 ref: 00007FF7A924CFA1
CryptEncrypt.ADVAPI32 ref: 00007FF7A924CFD2
CryptDestroyKey.ADVAPI32 ref: 00007FF7A924CFDC
CryptReleaseContext.ADVAPI32 ref: 00007FF7A924CFE8

Strings

@, xrefs: 00007FF7A924CE9D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireDestroyEncryptImport
String ID: @
API String ID: 3016261861-2766056989
Opcode ID: fb5250dee4fa009458d5a7279edbdf3bf57f8c2a8baf79eab047645ae9fe2af9
Instruction ID: 5c022fbe1fa7339327b8b825bfcee3eda4007fbac6e841d644098883add129ea
Opcode Fuzzy Hash: fb5250dee4fa009458d5a7279edbdf3bf57f8c2a8baf79eab047645ae9fe2af9
Instruction Fuzzy Hash: AA419D22A096A08EF710DFB5E4513EE7BB0E78A348F454026DF8D57A9ACB3CC11AD750

Function 00007FF7A9225410 Relevance: 10.1, Strings: 8, Instructions: 72COMMON

Download Yara Rule

Strings

%4I64dG, xrefs: 00007FF7A9225504
%2I64d.%0I64dM, xrefs: 00007FF7A9225459
%4I64dk, xrefs: 00007FF7A922543E
%4I64dM, xrefs: 00007FF7A92254AC
%4I64dT, xrefs: 00007FF7A9225520
%5I64d, xrefs: 00007FF7A9225425
%4I64dP, xrefs: 00007FF7A922552D
%2I64d.%0I64dG, xrefs: 00007FF7A92254CA

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 0-2102732564
Opcode ID: 1ce13e47532ff293a798baae3fe9aeee75f9354e9d79d4dccacd7f10ae2e1000
Instruction ID: f3a46578adedf7fa32381b9d5c377823217d092fd44d92bc8915001a38e549f1
Opcode Fuzzy Hash: 1ce13e47532ff293a798baae3fe9aeee75f9354e9d79d4dccacd7f10ae2e1000
Instruction Fuzzy Hash: 9B219C99A0FA4A93FF14AF95B410BF4D2325B44780EC18032E90E8A7F9DEAC6575C260

Function 00007FF7A9250118 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF7A91F18A0), ref: 00007FF7A925012E
GetLastError.KERNEL32 ref: 00007FF7A9250179
IsDebuggerPresent.KERNEL32 ref: 00007FF7A9250191
OutputDebugStringW.KERNEL32 ref: 00007FF7A92501A2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7A925019B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentStringmemset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 1848478996-631824599
Opcode ID: 6027d125f2bde840407e6c5b6704eb6b1a4161c77d4006832e5621a0b3a413e4
Instruction ID: 589004e2cd43740e62f2dab105e1d58a4eaeae9dd4121d82ac64766d63b211ea
Opcode Fuzzy Hash: 6027d125f2bde840407e6c5b6704eb6b1a4161c77d4006832e5621a0b3a413e4
Instruction Fuzzy Hash: 81113D32A15B42A6F744AF22E9553B972B0FF44345F818139C64DC2AA8EF3CE474C761

Function 00007FF7A9229260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7A9229291
CryptGenRandom.ADVAPI32 ref: 00007FF7A92292A5
CryptReleaseContext.ADVAPI32 ref: 00007FF7A92292B6
CryptReleaseContext.ADVAPI32 ref: 00007FF7A92292CC

Strings

@, xrefs: 00007FF7A9229279

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID: @
API String ID: 2916321625-2766056989
Opcode ID: 05ef13bf38d768d66cbb7790796ddf4c0520a150bd0b7259f405025335dab679
Instruction ID: be975b77d250e54245fd021f24776ecb70343c3212da3387ea96b8fa5e4d866a
Opcode Fuzzy Hash: 05ef13bf38d768d66cbb7790796ddf4c0520a150bd0b7259f405025335dab679
Instruction Fuzzy Hash: FDF08165B09A8282F7109F65F84436AF370EF88BE4F854031DE8D866BDDE7CC0958B10

Function 00007FF7A924FF94 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7A924FFC0
GetCurrentThreadId.KERNEL32 ref: 00007FF7A924FFCE
GetCurrentProcessId.KERNEL32 ref: 00007FF7A924FFDA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7A924FFEA

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0aad18dbfdb508db56cf0c9c6b5be5f623d3476396975a0bb4a02755be6cb192
Instruction ID: ad062cc0905d2e5188e8ba56dedd9838115eb52fd543173a52ff021eece3004a
Opcode Fuzzy Hash: 0aad18dbfdb508db56cf0c9c6b5be5f623d3476396975a0bb4a02755be6cb192
Instruction Fuzzy Hash: B8111C26B56B018AFB00EF60E8552B873B4F719758F850E31DA6DC6BA8DF7CD1648350

Function 00007FF7A922C250 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FF7A922C280
CryptGetHashParam.ADVAPI32 ref: 00007FF7A922C2A6
CryptDestroyHash.ADVAPI32 ref: 00007FF7A922C2B5
CryptReleaseContext.ADVAPI32 ref: 00007FF7A922C2C5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 5513e9ce3c3bb6d5be74e2924c61227fada66d2b867e71bf52cd24ceed5c1bd1
Instruction ID: 43fb74f668da81b4b3e195c7c9517568643f740a68ddcb988fc07226008e977e
Opcode Fuzzy Hash: 5513e9ce3c3bb6d5be74e2924c61227fada66d2b867e71bf52cd24ceed5c1bd1
Instruction Fuzzy Hash: D6015A3660A68182FB10DF60E49436AB330FBC4BC8F958532DA4A46AADCF3DD4588B10

Function 00007FF7A922C1F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 00007FF7A922C20C
CryptCreateHash.ADVAPI32 ref: 00007FF7A922C22D

Strings

@, xrefs: 00007FF7A922C1FC

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID: @
API String ID: 1914063823-2766056989
Opcode ID: d8ebe4e987efff2a7b71ba957b1518562946fab41be5a3812e730348d283fed2
Instruction ID: 5edc43cdfb9dd6fe5c688bc869f9be0ca5a89bfc6e35122879f24de7830dae8c
Opcode Fuzzy Hash: d8ebe4e987efff2a7b71ba957b1518562946fab41be5a3812e730348d283fed2
Instruction Fuzzy Hash: 95E04861B1569243F7609F65E401B66A360FB94788F854130CE4D4BA6DDF3DC1568B14

Function 00007FF7A9238B30 Relevance: 3.0, APIs: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FF7A9238B6B
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9238B9F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _getpidhtons
String ID:
API String ID: 3416910171-0
Opcode ID: 17be246c6b9ce08b79939b91fdd45e7b100c7123979d3745743588953030ca0c
Instruction ID: d0bb8a951105cbf792f837071c3be9701478c9c1cdef076c0955d072b4efdce2
Opcode Fuzzy Hash: 17be246c6b9ce08b79939b91fdd45e7b100c7123979d3745743588953030ca0c
Instruction Fuzzy Hash: 05115A22A247D0DAD304CF35E4401AD77B0FB58B88F44962AFB8987B19EB78C6A0C704

Function 00007FF7A91FDE10 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7A91FDF14

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: f99147766ee616fdcbf3a4d05a35752d2dc8d0a099bbea99737b00b8b2f232dd
Instruction ID: ea08f866b90f8df5146185bcefd9e2f1fa8c8ee04a9b7f2ce99c45bc240b0458
Opcode Fuzzy Hash: f99147766ee616fdcbf3a4d05a35752d2dc8d0a099bbea99737b00b8b2f232dd
Instruction Fuzzy Hash: 7B81CC23B1AB9988EB01CF69E4807BC67B0E715B88F964426DF4D877A5EF38D051C360

Function 00007FF7A91FEBA0 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00007FF7A91FEC80

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Xbad_function_call@std@@
String ID:
API String ID: 1029415015-0
Opcode ID: 14973adebc5437691580ebe63d17496663c69ac8811f739b30f26fd181c27c9d
Instruction ID: 9ac70ca47f6fc9acf34743500a34c31be208f836b36b18bec80d7d64c80bd1b8
Opcode Fuzzy Hash: 14973adebc5437691580ebe63d17496663c69ac8811f739b30f26fd181c27c9d
Instruction Fuzzy Hash: C581CE23B1AB9988EB01DF69E0847AC6B70E755B88F994422CF4D877A5EF39D051C360

Function 00007FF7A91FD280 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction ID: 5ffcb13c30ba012240edd2c4dbd6d1d5d3039dd45d565c72d1ddaa9ca4ccbecd
Opcode Fuzzy Hash: 25ca6de128e55fb6ce216344201d591ed70013569d8b0f4d9d2315b49ebf49f1
Instruction Fuzzy Hash: 2B61F367B0AA8842DB129F29E444279A3A1E7497D4F929632DB5D87B98FF3CE051C310

Function 00007FF7A924EEF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction ID: bdef5283fa42f5f2488352a6ace451477961d08c52c2ad558b4c2b2cc35739a6
Opcode Fuzzy Hash: a9bc956564b332abba12e54d0044448655734ddf9d44365f360b093ba55ae5c6
Instruction Fuzzy Hash: 32F08C25325767BEFE00893B4624FBD5E509BD0700FA368748C84420CB869E54A3D714

Function 00007FF7A922C240 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbc81eeac69b129650ffbabaef16724ba72c03feca7b0af32eb80f6d28ec6ea
Instruction ID: 3ba1d2fc3badbdbb7349c63344f2d26fc8290a590facc8604c487f002ca86c31
Opcode Fuzzy Hash: cbbc81eeac69b129650ffbabaef16724ba72c03feca7b0af32eb80f6d28ec6ea
Instruction Fuzzy Hash: 0FA01122A0B88A80E3008B00E2A0E20A2A0EB88B283828032880E82820CE28C0828200

Function 00007FF7A924FF24 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a97a82cb8662cdd754cc8a3263182945b392a35f889419186618274a0510f6
Instruction ID: b5802817a43a411b3b9515c8eb8fdf09ddf3951c07d95c736a98c60351f1dcd9
Opcode Fuzzy Hash: d1a97a82cb8662cdd754cc8a3263182945b392a35f889419186618274a0510f6
Instruction Fuzzy Hash: C5A0012191A812A1F604AF50A990071A234AB95340B834071D11EC50F99E6CA5218220

Function 00007FF7A9229460 Relevance: 145.9, APIs: 50, Strings: 47, Instructions: 399stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A9229493
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92294E3
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9229504
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922951A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9229538
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9229556
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9229574
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922958C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92295A4

Strings

CALG_RC5, xrefs: 00007FF7A92298C7
CALG_NO_SIGN, xrefs: 00007FF7A92295F7
CALG_SSL2_MASTER, xrefs: 00007FF7A922988B
CALG_MD4, xrefs: 00007FF7A9229531
CALG_DH_SF, xrefs: 00007FF7A9229705
CALG_ECDH_EPHEM, xrefs: 00007FF7A9229A5F
CALG_DESX, xrefs: 00007FF7A922968D
CALG_SCHANNEL_MASTER_HASH, xrefs: 00007FF7A9229813
CALG_SHA1, xrefs: 00007FF7A9229585
CALG_HUGHES_MD5, xrefs: 00007FF7A922975F
CALG_ECDSA, xrefs: 00007FF7A9229A44
CALG_SCHANNEL_ENC_KEY, xrefs: 00007FF7A922984F
CALG_HASH_REPLACE_OWF, xrefs: 00007FF7A9229921
CALG_DH_EPHEM, xrefs: 00007FF7A9229723
CALG_SKIPJACK, xrefs: 00007FF7A922977D
CALG_ECDH, xrefs: 00007FF7A9229A0E
CALG_SHA_512, xrefs: 00007FF7A92299F3
CALG_TLS1PRF, xrefs: 00007FF7A9229903
CALG_TLS1_MASTER, xrefs: 00007FF7A92298A9
CALG_MD2, xrefs: 00007FF7A9229513
CALG_DES, xrefs: 00007FF7A9229633
CALG_SEAL, xrefs: 00007FF7A92296E7
CALG_TEK, xrefs: 00007FF7A922979B
CALG_AES, xrefs: 00007FF7A9229999
CALG_SHA_256, xrefs: 00007FF7A92299B7
CALG_RSA_KEYX, xrefs: 00007FF7A9229615
CALG_3DES_112, xrefs: 00007FF7A9229651
CALG_RC4, xrefs: 00007FF7A92296C9
CALG_RSA_SIGN, xrefs: 00007FF7A92295BB
CALG_RC2, xrefs: 00007FF7A92296AB
CALG_SHA_384, xrefs: 00007FF7A92299D5
CALG_HMAC, xrefs: 00007FF7A92298E5
CALG_SSL3_MASTER, xrefs: 00007FF7A92297F5
CALG_SSL3_SHAMD5, xrefs: 00007FF7A92297D7
CALG_SCHANNEL_MAC_KEY, xrefs: 00007FF7A9229831
CALG_DSS_SIGN, xrefs: 00007FF7A92295D9
CALG_AGREEDKEY_ANY, xrefs: 00007FF7A9229741
CALG_MAC, xrefs: 00007FF7A922959D
CALG_3DES, xrefs: 00007FF7A922966F
CALG_MD5, xrefs: 00007FF7A922954F
CALG_AES_192, xrefs: 00007FF7A922995D
CALG_PCT1_MASTER, xrefs: 00007FF7A922986D
CALG_AES_128, xrefs: 00007FF7A922993F
CALG_AES_256, xrefs: 00007FF7A922997B
CALG_ECMQV, xrefs: 00007FF7A9229A29
CALG_CYLINK_MEK, xrefs: 00007FF7A92297B9
CALG_SHA, xrefs: 00007FF7A922956D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strcmp$strncpy$strchr
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER
API String ID: 1395212091-3550120021
Opcode ID: c4bcdeaf9153f2df2101845b7f77a5711f2350fb9a9daf4f7110a25724a7c103
Instruction ID: c83290dc87925a9bcbdb0269597c877a57c09b1f83e4688d0cc50933e46c581b
Opcode Fuzzy Hash: c4bcdeaf9153f2df2101845b7f77a5711f2350fb9a9daf4f7110a25724a7c103
Instruction Fuzzy Hash: B402E718A5E613A1FB10BF64DA511F9A275AF50388FC24132E90ECA5FDEE5CE925C360

Function 00007FF7A9214A80 Relevance: 52.7, APIs: 34, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A921D7E0: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FF7A920585F), ref: 00007FF7A921D7F7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C0D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C35
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C5D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C85
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214C99
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214CAD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214CC1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214CD5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214CE9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214CFD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D39

Part of subcall function 00007FF7A921EF10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921EF4E

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D61
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D75
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D89
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214D9D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214DB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214DC5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214DD9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214DED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214E01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214E15
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214E29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214E3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214E51

Part of subcall function 00007FF7A92128D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212858), ref: 00007FF7A92128EB
Part of subcall function 00007FF7A92128D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212858), ref: 00007FF7A9212919

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214E7B

Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F091
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0A1
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0AF
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0BD
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0CB
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0D9
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0E7
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0F5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214EA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214EBB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214ECB

Strings

Closing connection %ld, xrefs: 00007FF7A9214B79

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$CounterPerformanceQuery
String ID: Closing connection %ld
API String ID: 3490100708-2599090834
Opcode ID: 45e8050b826a09a216ea8eaecffced0df53ef6fbbcd18d6b80f358bfdfaf422b
Instruction ID: c027e4567d7164b71b7727f1e7550ec1a58edde3b5f0eccc5fa498ebabe96bca
Opcode Fuzzy Hash: 45e8050b826a09a216ea8eaecffced0df53ef6fbbcd18d6b80f358bfdfaf422b
Instruction Fuzzy Hash: D9C1E03554AB81C2F740AF21E8502AD7374FB85F98F494235DE9D8B7ADCF3891A68321

Function 00007FF7A9236EC0 Relevance: 49.9, APIs: 6, Strings: 27, Instructions: 385COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9236FBD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92370BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9237131
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92371AB

Strings

Refusing to issue an RTSP request [%s] without a session ID., xrefs: 00007FF7A9236F43
Accept, xrefs: 00007FF7A9237018
OPTIONS, xrefs: 00007FF7A9236EC0
Accept: application/sdp, xrefs: 00007FF7A923702A
Referer: %s, xrefs: 00007FF7A9237162
Range: %s, xrefs: 00007FF7A92371B3
Accept-Encoding, xrefs: 00007FF7A9237034
Content-Length: %I64d, xrefs: 00007FF7A9237417
Session ID cannot be set as a custom header., xrefs: 00007FF7A923721D
Transport, xrefs: 00007FF7A9236F6E
Content-Type: text/parameters, xrefs: 00007FF7A9237457
Transport: %s, xrefs: 00007FF7A9236FCA
Referer, xrefs: 00007FF7A9237147
Refusing to issue an RTSP SETUP without a Transport: header., xrefs: 00007FF7A9236FF5
Content-Type: application/sdp, xrefs: 00007FF7A923748D
Content-Length, xrefs: 00007FF7A92373FC
Failed sending RTSP request, xrefs: 00007FF7A9237521
User-Agent, xrefs: 00007FF7A923709E, 00007FF7A92370CD
Range, xrefs: 00007FF7A9237187
CSeq cannot be set as a custom header., xrefs: 00007FF7A92371F0
Session: %s, xrefs: 00007FF7A923728D
%s %s RTSP/1.0CSeq: %ld, xrefs: 00007FF7A9237257
%s%s%s%s%s%s%s%s, xrefs: 00007FF7A9237316
Accept-Encoding: %s, xrefs: 00007FF7A9237069
CSeq, xrefs: 00007FF7A92371DC
Session, xrefs: 00007FF7A9237209
Content-Type, xrefs: 00007FF7A9237443, 00007FF7A9237479

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %s %s RTSP/1.0CSeq: %ld$%s%s%s%s%s%s%s%s$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: application/sdp$CSeq$CSeq cannot be set as a custom header.$Content-Length$Content-Length: %I64d$Content-Type$Content-Type: application/sdp$Content-Type: text/parameters$Failed sending RTSP request$OPTIONS$Range$Range: %s$Referer$Referer: %s$Refusing to issue an RTSP SETUP without a Transport: header.$Refusing to issue an RTSP request [%s] without a session ID.$Session$Session ID cannot be set as a custom header.$Session: %s$Transport$Transport: %s$User-Agent
API String ID: 1294909896-2200874227
Opcode ID: 9a61e4d06f65215e4b08aedde10a21872e1b39852192f1e380fe340d7aa28618
Instruction ID: 8b3469ef66d03fc6064f3de5baad5657deb349248ad4dfad89b9a7c2c14d2e99
Opcode Fuzzy Hash: 9a61e4d06f65215e4b08aedde10a21872e1b39852192f1e380fe340d7aa28618
Instruction Fuzzy Hash: 12027261A0B78291FE68AF11A8403BAA3B4EF44794F850035DE4DC67EDEF3CE5658720

Function 00007FF7A9230960 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92309BE
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92309F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9230A71
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9230A8B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9230A9A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9230AE7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9230AF8

Strings

Mime-Version: 1.0, xrefs: 00007FF7A9230C54
<%s@%s>, xrefs: 00007FF7A9230A56, 00007FF7A9230B9A
Mime-Version, xrefs: 00007FF7A9230C39
MAIL FROM:%s%s%s%s%s%s, xrefs: 00007FF7A9230D8C
%I64d, xrefs: 00007FF7A9230CAE
AUTH=, xrefs: 00007FF7A9230D55
SIZE=, xrefs: 00007FF7A9230D61
<%s>, xrefs: 00007FF7A9230A79, 00007FF7A9230BBD
SMTPUTF8, xrefs: 00007FF7A9230D4A

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree$strpbrk
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 2737852498-2994854565
Opcode ID: b01e2374800b80dac8c10f188a687d0a7cd1e240d842033154a20ef95edfe518
Instruction ID: 72f4063ae243001f44f35b78b0295938a9dd935141edc594bc867490e190ba6b
Opcode Fuzzy Hash: b01e2374800b80dac8c10f188a687d0a7cd1e240d842033154a20ef95edfe518
Instruction Fuzzy Hash: 1DD18321A8B79281FA15EF2198502FAA3B0BF45B84FC64431DE4D977E9DF3CA465C320

Function 00007FF7A924DE40 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 250COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924DF26
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924DFCB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E022
htonl.WS2_32 ref: 00007FF7A924E04F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E061
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E090
htonl.WS2_32 ref: 00007FF7A924E0A5
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E0D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E159
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E162
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E16B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E191
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E1A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E1AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E1B4
memcpy.VCRUNTIME140 ref: 00007FF7A924E1CF
memcpy.VCRUNTIME140 ref: 00007FF7A924E1E3
memcpy.VCRUNTIME140 ref: 00007FF7A924E1F9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E220
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E229
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E232
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E23B

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 00007FF7A924E036
GSSAPI handshake failure (invalid security data), xrefs: 00007FF7A924DFB7
GSSAPI handshake failure (empty security message), xrefs: 00007FF7A924DFA7, 00007FF7A924E248

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc$memcpy$htonl
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 82385936-242323837
Opcode ID: 6ff0e590a550c37f47dcb2ed1cb0c7a9594935b1ecf0db1d7d7fe1457593c717
Instruction ID: 218a2d22a8dd7b87d88bdb011e10151d75365163ce820ce474acd969cc70c793
Opcode Fuzzy Hash: 6ff0e590a550c37f47dcb2ed1cb0c7a9594935b1ecf0db1d7d7fe1457593c717
Instruction Fuzzy Hash: B1C13E36A0AA4286F710EF65E8502ADB7B0FB84B94F854435DE4E87BA8DF3CE454C711

Function 00007FF7A91FAE3F Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 459COMMON

Download Yara Rule

APIs

_dclass.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7A91FAE47
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB903
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FB931
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FB93F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB97A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FB9B9

Strings

array, xrefs: 00007FF7A91FBA39
number overflow parsing ', xrefs: 00007FF7A91FB83F
object, xrefs: 00007FF7A91FBBC8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$_dclass
String ID: array$number overflow parsing '$object
API String ID: 1391767211-579821726
Opcode ID: adf8d632b7a0f47282dd7c64472646fd33685c7b5c8c0df271187f430ebcdbfe
Instruction ID: d8eb80711c25dd1c9fc96544902336da7b4c2a88603979c6201b2880c0a88c31
Opcode Fuzzy Hash: adf8d632b7a0f47282dd7c64472646fd33685c7b5c8c0df271187f430ebcdbfe
Instruction Fuzzy Hash: 0E22D563A19B8985FB11DF68E4843ADA371FB457A4F810232DB6D46AE9EF3CD095C310

Function 00007FF7A9242BE0 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 312networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7A9242CC9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242D10
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242F66
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9242F7D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242F98
htons.WS2_32 ref: 00007FF7A9242FF7

Strings

DOH AAAA: , xrefs: 00007FF7A9242E12
DOH: %s type %s for %s, xrefs: 00007FF7A9242D44
TTL: %u seconds, xrefs: 00007FF7A9242DA5
AAAA, xrefs: 00007FF7A9242D36
%s%02x%02x, xrefs: 00007FF7A9242E5E
CNAME: %s, xrefs: 00007FF7A9242EF3
DOH A: %u.%u.%u.%u, xrefs: 00007FF7A9242DDE
DOH Host name: %s, xrefs: 00007FF7A9242D91
%s, xrefs: 00007FF7A9242EB3
Could not DOH-resolve: %s, xrefs: 00007FF7A9242C36
bad error code, xrefs: 00007FF7A9242D28

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: calloc$_strdupfreehtonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 130798683-4053692942
Opcode ID: 38705de37dd0ea9a8c175a7eabe07bf54b043cccbfc28395b50400cf60d9e6a8
Instruction ID: e1ce5e9dc3ea4511f772e142c7d8b85db53b128b7249817bab2646ee115c9b8f
Opcode Fuzzy Hash: 38705de37dd0ea9a8c175a7eabe07bf54b043cccbfc28395b50400cf60d9e6a8
Instruction Fuzzy Hash: 85E1A136A1A68686FB60EF11E5403ADB770FB84B84F864131DA4D876ACDF3CE564C720

Function 00007FF7A91F9918 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 423COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FA074
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FA0A2
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FA0B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FA0EB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FA12A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FAB1E

Strings

array, xrefs: 00007FF7A91FA1AA
number overflow parsing ', xrefs: 00007FF7A91F9FB0
object, xrefs: 00007FF7A91FA339

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: array$number overflow parsing '$object
API String ID: 1346393832-579821726
Opcode ID: 4b676f9266cdbf90aa6022472a11fb8ddc74ba001f3d2221694c7604cfab201c
Instruction ID: f14bd0e57bf7d24c8138ec38b93a7ddfc998b515d406e5f0852a0b820fdc3084
Opcode Fuzzy Hash: 4b676f9266cdbf90aa6022472a11fb8ddc74ba001f3d2221694c7604cfab201c
Instruction Fuzzy Hash: FD12A663A19B8995FB01EF68E4443AD6371EB417A4F814232DB6D82AE9FF7CD095C310

Function 00007FF7A923DB40 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 257stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DBC6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DBEC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DBFD
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DC6B
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DC9C
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DCBC
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DCCE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DD30
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DDA1
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DDB8
strchr.VCRUNTIME140(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DE73
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DEE7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000,00000000,00007FF7A923D2FF), ref: 00007FF7A923DEF0

Strings

LDAP, xrefs: 00007FF7A923DB86
base, xrefs: 00007FF7A923DDF9
onetree, xrefs: 00007FF7A923DDE6
subtree, xrefs: 00007FF7A923DE37
sub, xrefs: 00007FF7A923DE24
one, xrefs: 00007FF7A923DDD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$free$_strdupcalloc
String ID: LDAP$base$one$onetree$sub$subtree
API String ID: 112326314-884163498
Opcode ID: 938ab317eca9d3be76c48f165362acacdf94004cdc37a8c47e44613640dbad5e
Instruction ID: b6ac0481c675a654b53bcecaff96201a11e78fabc3dda310d2fd93abc7c443ec
Opcode Fuzzy Hash: 938ab317eca9d3be76c48f165362acacdf94004cdc37a8c47e44613640dbad5e
Instruction Fuzzy Hash: 68B18022A0B74282FA59EF15A45027AA6F0FF94780F864535DE4D877E8EF3CE465C720

Function 00007FF7A923BD10 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 175stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00007FF7A923BD71
memchr.VCRUNTIME140 ref: 00007FF7A923BDA7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A923BE2B
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A923BEBB

Strings

Malformed ACK packet, rejecting, xrefs: 00007FF7A923BFAA
blksize is smaller than min supported, xrefs: 00007FF7A923BF3E
tsize parsed from OACK, xrefs: 00007FF7A923BEC4
%s (%d) %s (%d), xrefs: 00007FF7A923BE7D
blksize parsed from OACK, xrefs: 00007FF7A923BE63
server requested blksize larger than allocated, xrefs: 00007FF7A923BF18
blksize, xrefs: 00007FF7A923BE0F
%s (%d), xrefs: 00007FF7A923BF45, 00007FF7A923BF68
got option=(%s) value=(%s), xrefs: 00007FF7A923BDEC
invalid blocksize value in OACK packet, xrefs: 00007FF7A923BF7E
tsize, xrefs: 00007FF7A923BE9F
invalid tsize -:%s:- value in OACK packet, xrefs: 00007FF7A923BF97
%s (%ld), xrefs: 00007FF7A923BECB
blksize is larger than max supported, xrefs: 00007FF7A923BF61
requested, xrefs: 00007FF7A923BE6A
%s (%ld), xrefs: 00007FF7A923BF22

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-895336422
Opcode ID: bf90a83ba5fb77e92efa886c2ed14c58b30b22ef3f8ceca22efbd8bf44fefde8
Instruction ID: 5200fdb3ff1a45fe2351ec7356ed99ce26684df0c775f7f58e34119a928ba73c
Opcode Fuzzy Hash: bf90a83ba5fb77e92efa886c2ed14c58b30b22ef3f8ceca22efbd8bf44fefde8
Instruction Fuzzy Hash: E761C460F0A64691FA14EF15A8042BAA370AF847E0FD25231E91DC76FDDE3CE165C720

Function 00007FF7A920BE30 Relevance: 34.9, APIs: 6, Strings: 17, Instructions: 352COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205787
Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205793

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920C0C4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920C0CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920C0F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920C0FC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920C180
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920C189

Strings

Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00007FF7A920C149
multipart/mixed, xrefs: 00007FF7A920BF25
; boundary=, xrefs: 00007FF7A920C1A3
form-data, xrefs: 00007FF7A920C336
; name=", xrefs: 00007FF7A920C11F
Content-Transfer-Encoding: %s, xrefs: 00007FF7A920C311
attachment, xrefs: 00007FF7A920C07B, 00007FF7A920C082
8bit, xrefs: 00007FF7A920C30A
Content-Type: %s%s%s, xrefs: 00007FF7A920C1AD
; filename=", xrefs: 00007FF7A920C111
Content-Transfer-Encoding, xrefs: 00007FF7A920C1F1
application/octet-stream, xrefs: 00007FF7A920BF56
multipart/, xrefs: 00007FF7A920C067
text/plain, xrefs: 00007FF7A920BF9C
multipart/form-data, xrefs: 00007FF7A920C287
Content-Disposition, xrefs: 00007FF7A920BFF1
Content-Type, xrefs: 00007FF7A920BEB8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: fcbca61f5482e64dd04d43d950b6f6ed0dbf272a9b111d8b4dcd9faa5991a31d
Instruction ID: cded72a01585af23287ccaa055adaa0a448d05a9ade82cc14aeac979a8d4f17a
Opcode Fuzzy Hash: fcbca61f5482e64dd04d43d950b6f6ed0dbf272a9b111d8b4dcd9faa5991a31d
Instruction Fuzzy Hash: 2BE18061A0A65296FAA5EF1195402B9F7B0BF40B84FCA4035DE4D876E9DF3CE974C320

Function 00007FF7A92244B0 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 206COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9224627

Strings

Server, xrefs: 00007FF7A92247BC
Proxy-, xrefs: 00007FF7A9224736
Authorization:, xrefs: 00007FF7A9224601
Negotiate, xrefs: 00007FF7A92244EA
%s:%s, xrefs: 00007FF7A92246B9
%sAuthorization: Basic %s, xrefs: 00007FF7A9224740
Authorization, xrefs: 00007FF7A922466A
Basic, xrefs: 00007FF7A9224787
CONNECT, xrefs: 00007FF7A92244BE
Proxy-authorization, xrefs: 00007FF7A9224593
Digest, xrefs: 00007FF7A922452E
Authorization: Bearer %s, xrefs: 00007FF7A9224630
NTLM, xrefs: 00007FF7A922450C
Bearer, xrefs: 00007FF7A9224620
Proxy, xrefs: 00007FF7A92247D4
%s auth using %s with user '%s', xrefs: 00007FF7A92247C6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$CONNECT$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 1294909896-115817326
Opcode ID: e1ba4b0023ee6aec99e8aedd193a03e4e5b1e6aaea91670b07a3330588ee9ddd
Instruction ID: f3d9aac84240c1780eecb92f547cf8a779ca5547b094431f35360319a0fa1e30
Opcode Fuzzy Hash: e1ba4b0023ee6aec99e8aedd193a03e4e5b1e6aaea91670b07a3330588ee9ddd
Instruction Fuzzy Hash: F7918F21E0FA9291FA60AF1994403F9A3B1EF45B94F964131DA5C876F9DF2CE875C320

Function 00007FF7A91F6340 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

memcpy.VCRUNTIME140 ref: 00007FF7A91F64B6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7A91F6548
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7A91F6589
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F66D3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F6712
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F6760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F67A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F67FE
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F68B8

Part of subcall function 00007FF7A924F220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7A91F441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A924F23A

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F68F9
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F69C6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F6A07
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91F6A2A

Strings

syntax error , xrefs: 00007FF7A91F638D
; expected , xrefs: 00007FF7A91F6950
; last read: ', xrefs: 00007FF7A91F660C
unexpected , xrefs: 00007FF7A91F6843
rsing , xrefs: 00007FF7A91F6498

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$Concurrency::cancel_current_taskmalloc
String ID: ; expected $; last read: '$rsing $syntax error $unexpected
API String ID: 264867259-3075834232
Opcode ID: 28b160690b0daea7822e46477c388e52ebb77330501a133229203d38375fb69f
Instruction ID: aa2ebbf14ed0537184e46edef93d97609d1ac5e9c978722c1784bd62aeeddb9d
Opcode Fuzzy Hash: 28b160690b0daea7822e46477c388e52ebb77330501a133229203d38375fb69f
Instruction Fuzzy Hash: 9D12C263B09A4A45FB11AF64F44436DA371EB847E8F814236DB6D936E9EE7CE0948310

Function 00007FF7A9209A50 Relevance: 31.8, APIs: 21, Instructions: 269stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A920A9A0: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF7A920A41E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9), ref: 00007FF7A920A9C3
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA19
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA23
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA2D
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA37
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA41
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA4B
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA55
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA5F
Part of subcall function 00007FF7A920A9A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA68

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209B47
strchr.VCRUNTIME140 ref: 00007FF7A9209B61
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209B8B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209B98
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209BC2
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209BD6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209BE3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209BFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209C0A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209C18
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209C33
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209C4F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209C6B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209C87
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209CA3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209CBF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209CDB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209CF3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209D8B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7A9209DC2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209E03

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup$_time64callocmallocqsortstrchrstrncmp
String ID:
API String ID: 1087521380-0
Opcode ID: f0b18d3131465d6ca3cb115d8c57d8fbbd756eb704f2251be5535fa89dab383d
Instruction ID: 01df110426d6f45c5038ba41f8c68752b0763ca5ed482633d0f60f1e5ff2da3f
Opcode Fuzzy Hash: f0b18d3131465d6ca3cb115d8c57d8fbbd756eb704f2251be5535fa89dab383d
Instruction Fuzzy Hash: EBB1A329A8B74241FA95BF159550339A6B0AF45B90F8A0530CE5E877E8DF3CEC64C330

Function 00007FF7A923E270 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923E280
strstr.VCRUNTIME140 ref: 00007FF7A923E2AF
strchr.VCRUNTIME140 ref: 00007FF7A923E2DB
strrchr.VCRUNTIME140 ref: 00007FF7A923E2F5
strchr.VCRUNTIME140 ref: 00007FF7A923E30A
strrchr.VCRUNTIME140 ref: 00007FF7A923E36A

Strings

/, xrefs: 00007FF7A923E2C5
., xrefs: 00007FF7A923E34A
/, xrefs: 00007FF7A923E33E
?, xrefs: 00007FF7A923E2E8
/, xrefs: 00007FF7A923E383

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchrstrrchr$_strdupstrstr
String ID: .$/$/$/$?
API String ID: 2325335452-1821401756
Opcode ID: d2911d261ca19f8bb922bf6170dba20685ea1da3e761703afe8d7abbd8c2e0b2
Instruction ID: 51f7ca545ef2fcaf3578db45d364344ca83662ecaf719f22dfcf72ceae3e3c13
Opcode Fuzzy Hash: d2911d261ca19f8bb922bf6170dba20685ea1da3e761703afe8d7abbd8c2e0b2
Instruction Fuzzy Hash: 3E81B612A0E38646FB697F11950137ADAB1AF45784FCA4031DE8D877EADE3CE469C321

Function 00007FF7A9239170 Relevance: 31.7, APIs: 9, Strings: 12, Instructions: 208stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A9239243
strchr.VCRUNTIME140 ref: 00007FF7A923929A
strchr.VCRUNTIME140 ref: 00007FF7A92392B2
strchr.VCRUNTIME140 ref: 00007FF7A92392CD
strchr.VCRUNTIME140 ref: 00007FF7A9239349
strchr.VCRUNTIME140 ref: 00007FF7A9239361
strchr.VCRUNTIME140 ref: 00007FF7A923937C
strchr.VCRUNTIME140 ref: 00007FF7A9239397
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9239424

Strings

/FIND:, xrefs: 00007FF7A92391E0
/D:, xrefs: 00007FF7A9239216
CLIENT libcurl 7.70.0%sQUIT, xrefs: 00007FF7A923927A
lookup word is missing, xrefs: 00007FF7A92392E4, 00007FF7A92393AE
/M:, xrefs: 00007FF7A92391C5
CLIENT libcurl 7.70.0DEFINE %s %sQUIT, xrefs: 00007FF7A923932A
CLIENT libcurl 7.70.0MATCH %s %s %sQUIT, xrefs: 00007FF7A9239405
/MATCH:, xrefs: 00007FF7A92391AA
Failed sending DICT request, xrefs: 00007FF7A9239431
/LOOKUP:, xrefs: 00007FF7A923922D
/DEFINE:, xrefs: 00007FF7A92391FB
default, xrefs: 00007FF7A92392F3, 00007FF7A92393BD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.70.0%sQUIT$CLIENT libcurl 7.70.0DEFINE %s %sQUIT$CLIENT libcurl 7.70.0MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3578582447-31095704
Opcode ID: b17d951df01d6e17bebdb9146d561b563f8a8a5bfa5088d6caff3adeea77d055
Instruction ID: 3112d92684df672f0c5d999de180861370270787b8f2708e60069acd2949b911
Opcode Fuzzy Hash: b17d951df01d6e17bebdb9146d561b563f8a8a5bfa5088d6caff3adeea77d055
Instruction Fuzzy Hash: 7F81C325A4F64690FB19AF1299502B6E2B1AF46BC4FCA4031D94D877EDDE2CE925C330

Function 00007FF7A92151A0 Relevance: 30.1, APIs: 24, Instructions: 137COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92151BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92151D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92151E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92151F3

Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F091
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0A1
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0AF
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0BD
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0CB
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0D9
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0E7
Part of subcall function 00007FF7A920F080: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0F5

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921522F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215243
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215296
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92152AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92152BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92152D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921533A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921534E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215362
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215376
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92153DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921541A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921542E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215442
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215456
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921546A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921547E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215492
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92154A6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92154C8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1a51e7440e4e295c9a9ff19624615fac48ce2bced439325f57758b62f034ad1e
Instruction ID: ada13f0ad7281c26d8578cdf59189a3e44fa49361893f44fabce7552f91a3b23
Opcode Fuzzy Hash: 1a51e7440e4e295c9a9ff19624615fac48ce2bced439325f57758b62f034ad1e
Instruction Fuzzy Hash: 8891B43661ABC193E7499F21D9902ACB368F749F48F450135EF9D4B7A8CF34A2B58321

Function 00007FF7A92339E0 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 284stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9233A2D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9233B1F
strchr.VCRUNTIME140 ref: 00007FF7A9233A61

Part of subcall function 00007FF7A920AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920AB94

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9233C87
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9233E51
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9233E73

Part of subcall function 00007FF7A921EF10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921EF4E

Strings

%u.%u.%u.%u, xrefs: 00007FF7A9233C93
Weirdly formatted EPSV reply, xrefs: 00007FF7A9233B3F
%c%c%c%u%c, xrefs: 00007FF7A9233A9B
Illegal port number in EPSV reply, xrefs: 00007FF7A9233ADF
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 00007FF7A9233C5B
Can't resolve proxy host %s:%hu, xrefs: 00007FF7A9233D33
Connecting to %s (%s) port %d, xrefs: 00007FF7A9233E2A
%u,%u,%u,%u,%u,%u, xrefs: 00007FF7A9233BAB
Can't resolve new host %s:%hu, xrefs: 00007FF7A9233D9E
Couldn't interpret the 227-response, xrefs: 00007FF7A9233BCE
Bad PASV/EPSV response: %03d, xrefs: 00007FF7A9233E9E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree$__stdio_common_vsscanfstrchr
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 3103143820-2414412286
Opcode ID: 8b3e6fd472e79ccf5932183be2ca13d11980acfee772a9d28dc8d5f5432e4239
Instruction ID: f8349404e552f9da6ae9df877bd375546691cca35490fc5d96d14d5c8f4fa0ee
Opcode Fuzzy Hash: 8b3e6fd472e79ccf5932183be2ca13d11980acfee772a9d28dc8d5f5432e4239
Instruction Fuzzy Hash: 05D1A92160968292FA68AF21E5402BAE7B1FB45784FD11031EB4D87AF9CF3CE675C711

Function 00007FF7A9214270 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 219COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9214592

Strings

socks5h, xrefs: 00007FF7A9214312
Unsupported proxy syntax in '%s', xrefs: 00007FF7A921457A
socks5, xrefs: 00007FF7A9214330
socks4, xrefs: 00007FF7A9214366
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00007FF7A92143D4
https, xrefs: 00007FF7A92142F4
Unsupported proxy scheme for '%s', xrefs: 00007FF7A92143A1
socks, xrefs: 00007FF7A921437A
http, xrefs: 00007FF7A921438E
socks4a, xrefs: 00007FF7A921434B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 1294909896-874090715
Opcode ID: bad67b79693219899bf0ef37fb57eaee9927f99e28ae88e9e3739e4caff60ca7
Instruction ID: 96bd113d104448c73d16b66e80c543c37507d072227318fd202cfd992593622b
Opcode Fuzzy Hash: bad67b79693219899bf0ef37fb57eaee9927f99e28ae88e9e3739e4caff60ca7
Instruction Fuzzy Hash: A5A19A32A0A642C5FB50FF26E8406BDA7B4AB44794FA64431CE0D976E9DF3CE564C360

Function 00007FF7A9232E90 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 208stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A922C0B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7A921343F), ref: 00007FF7A922C0DE

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9232F66
strchr.VCRUNTIME140 ref: 00007FF7A9232F84
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9232FB4
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9232FCF
strchr.VCRUNTIME140 ref: 00007FF7A9232FF9
strrchr.VCRUNTIME140 ref: 00007FF7A9233015
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923303F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923305A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923307E
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9233096
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92330D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9233110
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92331AC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92331D1

Strings

Uploading to a URL without a file name!, xrefs: 00007FF7A92330FC
Request has same path as previous transfer, xrefs: 00007FF7A92331B6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: calloc$free$strchrstrncpy$_strdupmallocstrncmpstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!
API String ID: 2243338858-131330169
Opcode ID: b26d1270f139990ae3311ecf677a73256b555da0fa6c9084cf6daf9982836789
Instruction ID: 383da10b09afc34eca03372c41b38f416a55f8b1c8e6eca51e1f357bbe3e781a
Opcode Fuzzy Hash: b26d1270f139990ae3311ecf677a73256b555da0fa6c9084cf6daf9982836789
Instruction Fuzzy Hash: D291D421B0A78292FA68AF25945027AA3F0FB45B80FC55035DA8D877ECDF3DE5648711

Function 00007FF7A920A3D0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A433
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A4AD
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A4D1
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A520
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A55A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A56C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A57F
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A59A
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A5B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9,?,?,00000000,00007FF7A9211625), ref: 00007FF7A920A5B9

Strings

## Fatal libcurl error, xrefs: 00007FF7A920A5E7
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00007FF7A920A4A6
%s.%s.tmp, xrefs: 00007FF7A920A46A
%s, xrefs: 00007FF7A920A54B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$fclose$__acrt_iob_func_unlinkcallocfputsqsort
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 1368378007-4087121635
Opcode ID: 6f20c3617cad093c66bf02bea179c96cd2341ae06f86e3c95d9e11afb7ad0074
Instruction ID: 447afe0c26ecfe5862fba60ab1dcf1a80337e11c856d14cd7213f430bd67e2a0
Opcode Fuzzy Hash: 6f20c3617cad093c66bf02bea179c96cd2341ae06f86e3c95d9e11afb7ad0074
Instruction Fuzzy Hash: F3518665E1B64245FEA4BF219858279A6B0BF45BC4FC64430CD0E867F9EE3CE8658220

Function 00007FF7A9201D40 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7A9201D68
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A9201D70

Strings

%s (0x%08X), xrefs: 00007FF7A9201DC5
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FF7A9202279
%s - %s, xrefs: 00007FF7A92022C9
No error, xrefs: 00007FF7A92021C0
SEC_I_CONTINUE_NEEDED, xrefs: 00007FF7A92021CC
CRYPT_E_REVOKED, xrefs: 00007FF7A92021A2
Unknown error, xrefs: 00007FF7A9202260

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-1752685260
Opcode ID: 3c10da94ced2b4ebbc8f60a0f90817964a3d344a439290b4ed83999207dfc5c1
Instruction ID: 66df9d23ada092a9945cd211ab1f250b86a9b2f9f5958ed04b9d1cd0df9a6968
Opcode Fuzzy Hash: 3c10da94ced2b4ebbc8f60a0f90817964a3d344a439290b4ed83999207dfc5c1
Instruction Fuzzy Hash: B5519362A0E68295F761AF60A4843B9E7B0FB44740FC54536DA4D826FEDF3CE9648720

Function 00007FF7A9226470 Relevance: 27.3, APIs: 1, Strings: 17, Instructions: 341COMMON

Download Yara Rule

Strings

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00007FF7A92269DD
SOCKS4 connection to %s not supported, xrefs: 00007FF7A922673C
[, xrefs: 00007FF7A9226A04
SOCKS4: Failed receiving connect request ack: %s, xrefs: 00007FF7A92268CA
SOCKS4: too long host name, xrefs: 00007FF7A9226836
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00007FF7A92269A3
SOCKS4 reply has wrong version, version should be 0., xrefs: 00007FF7A9226911
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00007FF7A922675B
Failed to send SOCKS4 connect request., xrefs: 00007FF7A922681D
SOCKS4 non-blocking resolve of %s, xrefs: 00007FF7A92265DB
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00007FF7A9226A14
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00007FF7A9226536
Too long SOCKS proxy name, can't use!, xrefs: 00007FF7A9226637
SOCKS4%s request granted., xrefs: 00007FF7A9226A36
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00007FF7A9226976
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00007FF7A92266DA
SOCKS4 communication to %s:%d, xrefs: 00007FF7A922654F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 non-blocking resolve of %s$SOCKS4 reply has wrong version, version should be 0.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$SOCKS4: Failed receiving connect request ack: %s$SOCKS4: too long host name$Too long SOCKS proxy name, can't use!$[
API String ID: 0-3760664348
Opcode ID: 393c6e79398c4c10ba23416ff6716bc227372562a4e015229d3904667c6edf62
Instruction ID: bdb501c1ed3f3e02d639a0974dd8ebb28f59362cdb242e88e32544582fb76e41
Opcode Fuzzy Hash: 393c6e79398c4c10ba23416ff6716bc227372562a4e015229d3904667c6edf62
Instruction Fuzzy Hash: 9DE1CF72A0E2818AFB54AF1595403B9B7B0EB55784F958036DA4D877EDCF3CE464C720

Function 00007FF7A91F54A0 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 364COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F55FE
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91F562C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91F563A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F5674
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F56C5
memset.VCRUNTIME140 ref: 00007FF7A91F54F3

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

Part of subcall function 00007FF7A91F6340: memcpy.VCRUNTIME140 ref: 00007FF7A91F64B6

Part of subcall function 00007FF7A91F1FE0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2151

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F5832
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91F585E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91F586C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F58A7
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F58FA
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F59E1
?uncaught_exception@std@@YA_NXZ.MSVCP140 ref: 00007FF7A91F59F9
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140 ref: 00007FF7A91F5A06

Strings

value, xrefs: 00007FF7A91F5566, 00007FF7A91F579E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy$?uncaught_exception@std@@D@std@@@std@@Osfx@?$basic_ostream@U?$char_traits@memset
String ID: value
API String ID: 2102519606-494360628
Opcode ID: 879d5438f16e1bc2d536b4e27af56739de01cd1b39aaae4cd5a85b49abb1db26
Instruction ID: 2601f592fad285b205ac96e5f9e5c99a16a2f5f341f4dc9caa28c94ff7a1a0f7
Opcode Fuzzy Hash: 879d5438f16e1bc2d536b4e27af56739de01cd1b39aaae4cd5a85b49abb1db26
Instruction Fuzzy Hash: 0FF1C723A09A8545FB11EF64E4443BDA770EB857A8F815232E7AD42AF9EF3CD095C710

Function 00007FF7A922B210 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 241encryptionCOMMON

Download Yara Rule

APIs

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7A922B4F7
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF7A922B567
CertFreeCertificateContext.CRYPT32 ref: 00007FF7A922B5A5
CertFreeCertificateContext.CRYPT32 ref: 00007FF7A922B5B8

Strings

ALPN, server did not agree to a protocol, xrefs: 00007FF7A922B385
http/1.1, xrefs: 00007FF7A922B36B
schannel: failed to setup sequence detection, xrefs: 00007FF7A922B26A
schannel: failed to store credential handle, xrefs: 00007FF7A922B45C
schannel: failed to setup replay detection, xrefs: 00007FF7A922B286
schannel: failed to retrieve remote cert context, xrefs: 00007FF7A922B5D7
schannel: failed to retrieve ALPN result, xrefs: 00007FF7A922B32B
schannel: ALPN, server accepted to use %.*s, xrefs: 00007FF7A922B358
schannel: failed to setup confidentiality, xrefs: 00007FF7A922B2A2
schannel: failed to setup stream orientation, xrefs: 00007FF7A922B2E0
schannel: failed to setup memory allocation, xrefs: 00007FF7A922B2C1

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Cert$CertificateCertificatesContextEnumFreeStore
String ID: ALPN, server did not agree to a protocol$http/1.1$schannel: ALPN, server accepted to use %.*s$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 2572311694-3353508759
Opcode ID: 9615669fdad9213174bfa95c4caccfa9bab89a141ce3108430745ec7b6b85c3e
Instruction ID: 5f4437f42a0e6496900917096794242c7980875d0f58082efee52cd12d27b555
Opcode Fuzzy Hash: 9615669fdad9213174bfa95c4caccfa9bab89a141ce3108430745ec7b6b85c3e
Instruction Fuzzy Hash: 6CB1A431A0AA8281FB60AF15D8503F9A3B1EB85B84FD64131D94DCB6E9DF7CE465C720

Function 00007FF7A9221A30 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 218stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A9221AE8
strchr.VCRUNTIME140 ref: 00007FF7A9221AFF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9221B4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221D17
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221D66
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221D6F

Strings

1.1, xrefs: 00007FF7A9221A4B
Host:, xrefs: 00007FF7A9221BC9
Transfer-Encoding:, xrefs: 00007FF7A9221C88
Authorization:, xrefs: 00007FF7A9221CA1
%s, xrefs: 00007FF7A9221CFC
Content-Type:, xrefs: 00007FF7A9221BEF, 00007FF7A9221C15
Connection:, xrefs: 00007FF7A9221C61
Content-Length:, xrefs: 00007FF7A9221C3B
Cookie:, xrefs: 00007FF7A9221CBB

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$strchr$_strdup
String ID: %s$1.1$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 1922034842-2519073162
Opcode ID: 74a7b7d4dbef01fd058baaa96c1da6585731fd9fbf49eaf7f058283f9381154e
Instruction ID: ccb4c058cdafaa5dc90b9cb95f2964d0a45842efd2295cd04e0657d482824d9b
Opcode Fuzzy Hash: 74a7b7d4dbef01fd058baaa96c1da6585731fd9fbf49eaf7f058283f9381154e
Instruction Fuzzy Hash: 34918321A0A68285FB61BF1194847F9A7B0AF44BC4FC64031CE4DC66FEEE2DE565C321

Function 00007FF7A924D030 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7A923FD5F), ref: 00007FF7A924D05D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,0000000100000000,?,00007FF7A923FD5F), ref: 00007FF7A924D07F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7A923FD5F), ref: 00007FF7A924D090
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0000000100000000,?,00007FF7A923FD5F), ref: 00007FF7A924D0BE

Strings

/../, xrefs: 00007FF7A924D18B
/.., xrefs: 00007FF7A924D1C2
/./, xrefs: 00007FF7A924D14C
../, xrefs: 00007FF7A924D129

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: ../$/..$/../$/./
API String ID: 111713529-456519384
Opcode ID: 7f8a6cd7bdac2ee96531ff7347ec4625da6b2b78d0d67ac4258ea2d37f66d1a5
Instruction ID: a358b3761fbeca1b813e45cf1e64ece4a28aeafdd81a4532acd7497ac646c229
Opcode Fuzzy Hash: 7f8a6cd7bdac2ee96531ff7347ec4625da6b2b78d0d67ac4258ea2d37f66d1a5
Instruction Fuzzy Hash: CF71B821A0F68251FB22AF219510279EBF0AB96B94F854131DA5D876E9DE2CF472C321

Function 00007FF7A920F500 Relevance: 25.7, APIs: 17, Instructions: 236COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F564
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F598
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F5A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F67F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F68C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F6C7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F6D1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F74F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F770
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F791
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920F7B2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F849
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920F852

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup
String ID:
API String ID: 2653869212-0
Opcode ID: 9380430da2d47361279ed07955a7a1d3f2428018cb9ebdc78f4957e134170792
Instruction ID: 55f582c2b88550c4956420326bced2183a51b87277acafc42cbeb20ec686591b
Opcode Fuzzy Hash: 9380430da2d47361279ed07955a7a1d3f2428018cb9ebdc78f4957e134170792
Instruction Fuzzy Hash: FCB15A22A4BB9186FA95EF15E5403B8B3B0FB44B54F850535CB8D87BA4DF38E8758360

Function 00007FF7A9247C31 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9247C62
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92482DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248318

Strings

Cert, xrefs: 00007FF7A92482EE
Signature, xrefs: 00007FF7A92480FF
FALSE, xrefs: 00007FF7A9247C4D
Signature: %s, xrefs: 00007FF7A9248117
-----END CERTIFICATE-----, xrefs: 00007FF7A9248267
%s, xrefs: 00007FF7A9248306
-----BEGIN CERTIFICATE-----, xrefs: 00007FF7A92481BC
TRUE, xrefs: 00007FF7A9247C54

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Signature: %s$%s$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$FALSE$Signature$TRUE
API String ID: 111713529-3006446216
Opcode ID: 15e5a2d4ce7b212763ce67ac022bcb64a427eb3053dbf19af071390c73e2582b
Instruction ID: fe0ad530ebe2e8815dfb75b39a68f21dd30dfd9307bc2994957e2b558eabb6d5
Opcode Fuzzy Hash: 15e5a2d4ce7b212763ce67ac022bcb64a427eb3053dbf19af071390c73e2582b
Instruction Fuzzy Hash: FA71F962D1E6C195FB11EF2594042B9BBB0EB85748F9A4032CA5D8B3F9DE2CD169C321

Function 00007FF7A9241CA0 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241D62
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241D9A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241DAD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241DE1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241DEC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241EA2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241EAB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241EB6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241FA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241FAA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9241FB5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924202B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242034
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924203F

Part of subcall function 00007FF7A9242430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A924431A,?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9242440
Part of subcall function 00007FF7A9242430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A924431A,?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9242451
Part of subcall function 00007FF7A9242430: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A924431A,?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9242463

Strings

WDigest, xrefs: 00007FF7A9241D4C, 00007FF7A9241E64
DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00007FF7A924204C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: DIGEST-MD5 handshake failure (empty challenge message)$WDigest
API String ID: 2190258309-1086287758
Opcode ID: b4e0b89a086b8e553c744628248fd08880b36094836bf01df6a09769be57004b
Instruction ID: 42ec78315bb1e78fecb2693dd78e76a7f63c3faef608592c741d902ad07bae9c
Opcode Fuzzy Hash: b4e0b89a086b8e553c744628248fd08880b36094836bf01df6a09769be57004b
Instruction Fuzzy Hash: 2BB14276A0AB4186FB10AF55E8802ADB7B0FB88B98F810035DE4D87BA8DF3CD555C750

Function 00007FF7A92489F5 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 178COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248B03

Strings

RSA Public Key, xrefs: 00007FF7A9248AEF
RSA Public Key (%lu bits), xrefs: 00007FF7A9248ABE
dsa(q), xrefs: 00007FF7A9248BCC
dh(g), xrefs: 00007FF7A9248C90
rsaEncryption, xrefs: 00007FF7A9248A35
dsa(pub_key), xrefs: 00007FF7A9248C12
dsa(g), xrefs: 00007FF7A9248BFC
rsa(e), xrefs: 00007FF7A9248B3B
dsa, xrefs: 00007FF7A9248B65
dh(pub_key), xrefs: 00007FF7A9248CA6
rsa(n), xrefs: 00007FF7A9248B10
%lu, xrefs: 00007FF7A9248AD8
dh(p), xrefs: 00007FF7A9248C5F
dhpublicnumber, xrefs: 00007FF7A9248C26
dsa(p), xrefs: 00007FF7A9248B9D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: RSA Public Key (%lu bits)$%lu$RSA Public Key$dh(g)$dh(p)$dh(pub_key)$dhpublicnumber$dsa$dsa(g)$dsa(p)$dsa(pub_key)$dsa(q)$rsa(e)$rsa(n)$rsaEncryption
API String ID: 1294909896-1220118048
Opcode ID: fdd2363b80f16fded24328cf078ad9d07f04165a7e98b9fb6beb16c217db624a
Instruction ID: a0c8e65c66feada182abd0fc386975d563174a20a5171f34b8fca414deb25943
Opcode Fuzzy Hash: fdd2363b80f16fded24328cf078ad9d07f04165a7e98b9fb6beb16c217db624a
Instruction Fuzzy Hash: 5E717CA1A0E78691FA14BF11A5401F9A3B0EF88B80F854432DE5D877EDEE3CE525C760

Function 00007FF7A923EDCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923F038
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923F090
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923F09D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F191
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F19F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F1EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F206

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdupmalloctolower
String ID: %%%02x
API String ID: 1244608590-4020994737
Opcode ID: 9e0bf0cd68cdf140eb670f3305c81956986f7a0a3b105025ac45e8cb1c8a5b32
Instruction ID: 728702e9b47e4599213c4172bf9aa6a05b2ddcf0c8c9a9e71a1a764503b6a4fb
Opcode Fuzzy Hash: 9e0bf0cd68cdf140eb670f3305c81956986f7a0a3b105025ac45e8cb1c8a5b32
Instruction Fuzzy Hash: 65A1E61190FBD245FF696F25A4103BAABF0AF45B44F8A4031DA8D862EDDE2DE4648331

Function 00007FF7A922D0B0 Relevance: 22.8, APIs: 1, Strings: 14, Instructions: 321COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF7A922D108

Strings

SELECT, xrefs: 00007FF7A922D3BF
EXAMINE, xrefs: 00007FF7A922D3D7
STORE, xrefs: 00007FF7A922D33A
CAPABILITY, xrefs: 00007FF7A922D4D0
UID, xrefs: 00007FF7A922D437
SEARCH, xrefs: 00007FF7A922D21C, 00007FF7A922D3EF
PREA, xrefs: 00007FF7A922D144
, xrefs: 00007FF7A922D111
FETCH, xrefs: 00007FF7A922D27C, 00007FF7A922D392
LIST, xrefs: 00007FF7A922D2EC
NOOP, xrefs: 00007FF7A922D44F
LSUB, xrefs: 00007FF7A922D41F
EXPUNGE, xrefs: 00007FF7A922D407
Unexpected continuation response, xrefs: 00007FF7A922D54E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcmp
String ID: $CAPABILITY$EXAMINE$EXPUNGE$FETCH$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-555813803
Opcode ID: 98191308b99e8c1177c5659528783c317e5747f9426fecea6066c7a29c40b077
Instruction ID: 575632bb56a8033b27c83bf88060adf8499278609620b2ffb2f6534f7ccdbc2d
Opcode Fuzzy Hash: 98191308b99e8c1177c5659528783c317e5747f9426fecea6066c7a29c40b077
Instruction Fuzzy Hash: 9FD15C35A0E38291FB24AF15D5442F8A6F0AB01794FCA4032DA5DC65FDEE6CF865C361

Function 00007FF7A9231A00 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 279COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9231B20

Strings

Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 00007FF7A9231DF6
ABOR, xrefs: 00007FF7A9231C1B
control connection looks dead, xrefs: 00007FF7A9231D12
Remembering we are in dir "%s", xrefs: 00007FF7A9231BB8
partial download completed, closing connection, xrefs: 00007FF7A9231D53
server did not report OK, got %d, xrefs: 00007FF7A9231D8E
Received only partial file: %I64d bytes, xrefs: 00007FF7A9231E2E
No data was received!, xrefs: 00007FF7A9231E5C
Failure sending ABOR command: %s, xrefs: 00007FF7A9231C41

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$No data was received!$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-2312071747
Opcode ID: 072e3a805a0de6ca66165d63e1e3eccb604c2dafd817939ff4d116858c1b8cce
Instruction ID: 52413be6c1106f8cf8c8093983031cf32c6fedaaa34b7bd16e0682d93e408c51
Opcode Fuzzy Hash: 072e3a805a0de6ca66165d63e1e3eccb604c2dafd817939ff4d116858c1b8cce
Instruction Fuzzy Hash: 4AD1AB21A0E68645FA68BF2095803BAA271FF41794FC54231CB6D876EADF3CE4658361

Function 00007FF7A91FC061 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

Part of subcall function 00007FF7A91F6340: memcpy.VCRUNTIME140 ref: 00007FF7A91F64B6

Part of subcall function 00007FF7A91F1FE0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2151

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC110
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FC13E
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FC14C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC186
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC1E3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC29C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FC2CA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FC2D8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC312
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC363
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC3AD

Strings

value, xrefs: 00007FF7A91FC07F, 00007FF7A91FC208

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$memcpy
String ID: value
API String ID: 3212548336-494360628
Opcode ID: dce44f3b6453a877245091c3676368a6b27b6d4160367b02eaea64c90edf12e5
Instruction ID: 0f2a3bbf17de478f5ec74a17b0b16ea4b451bf20678284463639b189b91e09a5
Opcode Fuzzy Hash: dce44f3b6453a877245091c3676368a6b27b6d4160367b02eaea64c90edf12e5
Instruction Fuzzy Hash: A8A1A122B19A8591FB01EF68E4443ADB371FB817E4F810232DB6D42AE9EF7CD0959310

Function 00007FF7A920A040 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 161fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920A0AD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920A0CD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920A101
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920A122
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920A145
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920A156
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920A178
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920A22F
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920A244

Strings

none, xrefs: 00007FF7A920A0C2
ignoring failed cookie_init for %s, xrefs: 00007FF7A920A182
Set-Cookie:, xrefs: 00007FF7A920A1B6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$ignoring failed cookie_init for %s$none
API String ID: 4109794434-4095489131
Opcode ID: c306abe707b9db383740bb0abc465b4f33943e43bb8c4626f32ede5951e60d38
Instruction ID: 97cb6fcf9669cee17ce85ca3afc02b0354981f96234d77e5486551d12b8f8f72
Opcode Fuzzy Hash: c306abe707b9db383740bb0abc465b4f33943e43bb8c4626f32ede5951e60d38
Instruction Fuzzy Hash: 1F61A821A0F78281FA91AF159518279A7B4BF45B84FC64034DE8D877E9DF3DE825C360

Function 00007FF7A9244960 Relevance: 19.8, APIs: 8, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92449D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92449F6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244A11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244A1F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244AA6
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244AF5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244B56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244CDC

Strings

CompleteAuthToken failed: %s, xrefs: 00007FF7A9244D37
HTTP, xrefs: 00007FF7A9244960
SPNEGO handshake failure (empty challenge message), xrefs: 00007FF7A9244BA6
Negotiate, xrefs: 00007FF7A9244964, 00007FF7A9244A6C, 00007FF7A9244B13
InitializeSecurityContext failed: %s, xrefs: 00007FF7A9244CFA

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)
API String ID: 3103867982-1477229593
Opcode ID: bdae508bbae7a105c8cae25c756d6211fc918fedbcab43cc01b81b34f93cbacf
Instruction ID: 33aef76261c85d5558f69900a85c2c9847f66ed70afe0ea092009d7d5f835e99
Opcode Fuzzy Hash: bdae508bbae7a105c8cae25c756d6211fc918fedbcab43cc01b81b34f93cbacf
Instruction Fuzzy Hash: 01C12D36A06B5186FB10EF65E8502ADB7B4FB84B88F910036DE4D87BA8DF38D465C750

Function 00007FF7A9239D50 Relevance: 19.7, APIs: 4, Strings: 9, Instructions: 151stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF7A9239DBB
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9239EE5

Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205787
Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205793

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9239E9F

Part of subcall function 00007FF7A92056C0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92056D0

Strings

BINARY, xrefs: 00007FF7A9239F8E
USER,%s, xrefs: 00007FF7A9239DE0
%127[^= ]%*[ =]%255s, xrefs: 00007FF7A9239E60
TTYPE, xrefs: 00007FF7A9239E75
Syntax error in telnet option: %s, xrefs: 00007FF7A9239FF6
Unknown telnet option %s, xrefs: 00007FF7A9239FDD
%hu%*[xX]%hu, xrefs: 00007FF7A9239F69
NEW_ENV, xrefs: 00007FF7A9239F01
XDISPLOC, xrefs: 00007FF7A9239EBB

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freestrncpy$_strdupmemset
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 3826632026-748038847
Opcode ID: 0ec8ff1fca36eef91bc2258b6a0d8bc6288fc7a31fddeb11454182c313fab1e3
Instruction ID: 76a89c7ff2593345dcb1f2194ed28c0e2da4d823ecaa144fc2edbc7aaec39496
Opcode Fuzzy Hash: 0ec8ff1fca36eef91bc2258b6a0d8bc6288fc7a31fddeb11454182c313fab1e3
Instruction Fuzzy Hash: B6715A32A0AA8294FB20AF14D4417EAA370FB85784FC54032DA8D872EDEF7DD565C760

Function 00007FF7A923CE50 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 222networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7A923CFC3
sendto.WS2_32 ref: 00007FF7A923D07C
WSAGetLastError.WS2_32 ref: 00007FF7A923D08A

Strings

Received ACK for block %d, expecting %d, xrefs: 00007FF7A923D015
tftp_tx: giving up waiting for block %d ack, xrefs: 00007FF7A923D034
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7A923CEBD
tftp_tx: internal error, event: %i, xrefs: 00007FF7A923CEA8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-4197595102
Opcode ID: 00e3ef0f17c7df4bf5d4804f360dff86014e3a3b0f497353ce6cb91454f6493f
Instruction ID: 4db00d9d9b1000483f19d5a69105cb4bbfc17677e3b934e27d06b604407e07ba
Opcode Fuzzy Hash: 00e3ef0f17c7df4bf5d4804f360dff86014e3a3b0f497353ce6cb91454f6493f
Instruction Fuzzy Hash: 02B19D72619682C2E765DF29D4407A977B0FB88B88F864032DE4D8B7ADDF38D451C720

Function 00007FF7A923C230 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00007FF7A923C3A8
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A923C3C3
sendto.WS2_32 ref: 00007FF7A923C42A
sendto.WS2_32 ref: 00007FF7A923C4E1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A923C519

Strings

tftp_rx: internal error, xrefs: 00007FF7A923C27E
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00007FF7A923C2A2
Received last DATA packet block %d again., xrefs: 00007FF7A923C475
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00007FF7A923C521

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: sendto$_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 2327272419-1785996722
Opcode ID: cb3c9a81a11f0a4f659b522f7feb64d5d23adb6d92e7b90381f1717324c16966
Instruction ID: 391f5479cbba18a78cf1382b5dfa4c06c9cfad1dd3feef26702ea3c9cf8eebf7
Opcode Fuzzy Hash: cb3c9a81a11f0a4f659b522f7feb64d5d23adb6d92e7b90381f1717324c16966
Instruction Fuzzy Hash: 74917972619681C6E715DF29D4403AA7BB0FB88F88F858132DE4D8B7A8DF39D416C720

Function 00007FF7A9213E20 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213E5D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213EDF
strchr.VCRUNTIME140 ref: 00007FF7A9213F5E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A9213F8C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213FAD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213FBF

Strings

%25, xrefs: 00007FF7A9213ED5
No valid port number in connect to host string (%s), xrefs: 00007FF7A9213FEB
Invalid IPv6 address format, xrefs: 00007FF7A9213F47
Please URL encode %% as %%25, see RFC 6874., xrefs: 00007FF7A9213EE9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup$freestrchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 2070079882-2404041592
Opcode ID: 06e36c574d1c81caecd6c17ef543241f101f1d668da61c18ebaf62103c1cc0ec
Instruction ID: 37ce4ad24a2910f285d9aed325d2b0a9cac9fa29213ef8b31c0a1c7a98832ab5
Opcode Fuzzy Hash: 06e36c574d1c81caecd6c17ef543241f101f1d668da61c18ebaf62103c1cc0ec
Instruction Fuzzy Hash: EE51D631E0A68685FB71AF159C60375E7F29F41794FDA4031DA4D862E9DE3CE4798320

Function 00007FF7A9209E30 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209E6E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9209E8E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9209EC0
fopen.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9209EDD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209EFB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209F0C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9209F2C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A9204080), ref: 00007FF7A9209FDF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A9204080), ref: 00007FF7A9209FF5

Strings

none, xrefs: 00007FF7A9209E83
Set-Cookie:, xrefs: 00007FF7A9209F66

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: fclosefree$__acrt_iob_func_strdupcallocfopenmalloc
String ID: Set-Cookie:$none
API String ID: 4109794434-3629594122
Opcode ID: e53fbab00c7f65d80d330fa080a1065249a2c3699925d6c5bef6b444103da820
Instruction ID: 1416d884b170bd4913af15dbd1e8943e1c27ae745e5d8ad5db479e4aa517e402
Opcode Fuzzy Hash: e53fbab00c7f65d80d330fa080a1065249a2c3699925d6c5bef6b444103da820
Instruction Fuzzy Hash: B951F92594FB8281FA95AF11645427996B0AF45780FDA4030DE8F867F9DF3DEC25C321

Function 00007FF7A921BA00 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A921BD96

Strings

operation aborted by trailing headers callback, xrefs: 00007FF7A921BB8D
%zx%s, xrefs: 00007FF7A921BCB7
Moving trailers state machine from initialized to sending., xrefs: 00007FF7A921BA41
Signaling end of chunked upload after trailers., xrefs: 00007FF7A921BDE0
Unable to allocate trailing headers buffer !, xrefs: 00007FF7A921BA73
Read callback asked for PAUSE when not supported!, xrefs: 00007FF7A921BBF9
Signaling end of chunked upload via terminating chunk., xrefs: 00007FF7A921BD2A
Successfully compiled trailers., xrefs: 00007FF7A921BADA
operation aborted by callback, xrefs: 00007FF7A921BB6D
read function returned funny value, xrefs: 00007FF7A921BC3B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy
String ID: %zx%s$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported!$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$Unable to allocate trailing headers buffer !$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 3510742995-1652449680
Opcode ID: 42568f42cd83dcab1d20d6cc9d0f39682d763f3bf218a01859016bd7f70bf9e3
Instruction ID: bbd75c4d6e2dcccd3025c75be1bc60fc46b73a7452d9b4c5e5f7dadbb3d5fa1c
Opcode Fuzzy Hash: 42568f42cd83dcab1d20d6cc9d0f39682d763f3bf218a01859016bd7f70bf9e3
Instruction Fuzzy Hash: 59A18231A0AA82C1FB50BF21D8507F9A3B1EB85B94FD60131DD0D8A6EDDE3DE4658360

Function 00007FF7A922DA10 Relevance: 18.2, APIs: 4, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922DB40
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922DB56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922DBB9

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_, xrefs: 00007FF7A922DA28
Cannot SELECT without a mailbox., xrefs: 00007FF7A922DB6F
Mime-Version: 1.0, xrefs: 00007FF7A922DC61
Mime-Version, xrefs: 00007FF7A922DC46
Cannot APPEND with unknown input file size, xrefs: 00007FF7A922DCB7
SELECT %s, xrefs: 00007FF7A922DBA5
APPEND %s (\Seen) {%I64d}, xrefs: 00007FF7A922DCED
Cannot APPEND without a mailbox., xrefs: 00007FF7A922DBE4

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_$APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Cannot SELECT without a mailbox.$Mime-Version$Mime-Version: 1.0$SELECT %s
API String ID: 1294909896-3146291949
Opcode ID: 2590b4d2cedbe6155db040585863be740bc22f028b0fa8674d1faa64ffad8e36
Instruction ID: c30301186dac8e4162ad7ad74c232429ddd347a8452398700bdf693e96b7e84e
Opcode Fuzzy Hash: 2590b4d2cedbe6155db040585863be740bc22f028b0fa8674d1faa64ffad8e36
Instruction Fuzzy Hash: B0917031A0EB8286FB64BF2194503F9A2F0EF45784FD64435DA4D8B6E9DF2CE4648360

Function 00007FF7A91F1FE0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91F23A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2499
Part of subcall function 00007FF7A91F23A0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F24D8

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

Part of subcall function 00007FF7A91F3BE0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F3C26

Part of subcall function 00007FF7A91F5E00: memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5E91

Part of subcall function 00007FF7A91F3C60: memcpy.VCRUNTIME140 ref: 00007FF7A91F3CB3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2151
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F21A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F21F2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2232
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2284
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F22C3
__std_exception_copy.VCRUNTIME140 ref: 00007FF7A91F2316
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2367

Strings

parse error, xrefs: 00007FF7A91F206B
parse_error, xrefs: 00007FF7A91F2041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: parse error$parse_error
API String ID: 2484256320-1820534363
Opcode ID: 827d620483f11cf4b77341efc519a7c290418bf3d0d261d90155e50eadd1a1cc
Instruction ID: e60530aeef79287f91e9253715522349d654e3bd77df45fd06f88c3a78d3d4f4
Opcode Fuzzy Hash: 827d620483f11cf4b77341efc519a7c290418bf3d0d261d90155e50eadd1a1cc
Instruction Fuzzy Hash: C6B1AF63A09B4695FB00EF64E4443AD6771EB847A8F915631DBAD42AE9EF3CE0D0C310

Function 00007FF7A921E190 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921E221
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921E268
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921E304
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921E31A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921E33B
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921E38A
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A921E3DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921E40F

Strings

:%u, xrefs: 00007FF7A921E39E
Shuffling %i addresses, xrefs: 00007FF7A921E20A

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc$_time64calloctolower
String ID: :%u$Shuffling %i addresses
API String ID: 133842801-338667637
Opcode ID: b14e552ff794d88b93831853508e7689c5b03102e3c67103ace523b921075310
Instruction ID: 26298892b69e663bcb7d858a7e12a538648baedcd1b7c74f43002d8fe845113f
Opcode Fuzzy Hash: b14e552ff794d88b93831853508e7689c5b03102e3c67103ace523b921075310
Instruction Fuzzy Hash: E0716E71A1AA82C1FB14AF11ED507B9A6B0FB48B94F964531CE4E877A8DF3CE4658310

Function 00007FF7A921BE00 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 162COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921BE7A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921BE95
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921BF12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921BF9C

Strings

Switch from POST to GET, xrefs: 00007FF7A921C066
HEAD, xrefs: 00007FF7A921C007
GET, xrefs: 00007FF7A921C00E
Issue another request to this URL: '%s', xrefs: 00007FF7A921BFA7
Maximum (%ld) redirects followed, xrefs: 00007FF7A921BF67
Switch to %s, xrefs: 00007FF7A921C027

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 1865132094-1312055526
Opcode ID: 568bd8e41cf2bfe266e673786810f5dd733273cb5920a7246e29b30bb5a8eb61
Instruction ID: 02919cc46e74957d57712094ad7201c5c552ca4b0ada411c077a700cadfe812d
Opcode Fuzzy Hash: 568bd8e41cf2bfe266e673786810f5dd733273cb5920a7246e29b30bb5a8eb61
Instruction Fuzzy Hash: DF719035A0A682C0F760EF2498403BDB7B1EB85B94FA90431DA4D866FDCE3DD4B18761

Function 00007FF7A9210FA0 Relevance: 17.6, APIs: 14, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921101D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921103A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921104E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921106A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A9211087
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110AA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110BE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110D2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92110F8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921110C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A9211120
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921116F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A921117C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9211625), ref: 00007FF7A92111A5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 14a14ca4d5d2d03476cfb74fe5c9eb44b63091b429813415caa14acfa0b307e4
Instruction ID: c2b347c7797905431fa759e2e139f01ef12a54811344f9896881731a6b4351c9
Opcode Fuzzy Hash: 14a14ca4d5d2d03476cfb74fe5c9eb44b63091b429813415caa14acfa0b307e4
Instruction Fuzzy Hash: 8451D03594A68281FB44AF21D9912FDA3B0FF84F94F990431DE4E8B6A9CF3994658331

Function 00007FF7A923F221 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F191
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F19F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F29D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F306
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F31E

Part of subcall function 00007FF7A923E270: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923E280

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F346
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F35D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F3CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F3E4

Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F52C
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F536
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F540
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F54A
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F554
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F55E
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F568
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F572
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F57C
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F586
Part of subcall function 00007FF7A923F520: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A923E552,?,?,00000000,00007FF7A921565B,?,?,00000000,00007FF7A92110A3,?,?,00000000,00007FF7A9211625), ref: 00007FF7A923F590

Strings

,, xrefs: 00007FF7A923F264
:, xrefs: 00007FF7A923F247

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$calloc$_strdup
String ID: ,$:
API String ID: 2460172880-4193410690
Opcode ID: ab7cf525d048fa14623e063d400a5f34e0d2eb12631cc4848d5bb2d9c8bf81f1
Instruction ID: 0423be59439621a312c35cb8622039add025624e662dec86fc67bd98060d5e52
Opcode Fuzzy Hash: ab7cf525d048fa14623e063d400a5f34e0d2eb12631cc4848d5bb2d9c8bf81f1
Instruction Fuzzy Hash: A1518512E0EB9682F615AF35A5102BAA370FB55B84F855230CE8D456AAEF2CF1E58310

Function 00007FF7A920C960 Relevance: 16.6, APIs: 11, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_stat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7A920C9A7
_access.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7A920C9B7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920C9CE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920CA4A
strrchr.VCRUNTIME140 ref: 00007FF7A920CA67
strrchr.VCRUNTIME140 ref: 00007FF7A920CA77
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920CAA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920CAB3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920CAC2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920CAD3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920CAE9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup$free$strrchr$_access_stat64
String ID:
API String ID: 2557200964-0
Opcode ID: 02d0ca63fde20aae63bd8b5aab88cfca85a1dbff93ed1b69c37c8004dc00e462
Instruction ID: 22613d3b69a09386819a7cb379eeb08725672e598e0994659ba655d90004e2b4
Opcode Fuzzy Hash: 02d0ca63fde20aae63bd8b5aab88cfca85a1dbff93ed1b69c37c8004dc00e462
Instruction Fuzzy Hash: D241766160BB4685FA54FF11A490279B2B0FF88B90F954534DE4D87BE8EF3CE8658220

Function 00007FF7A9211C90 Relevance: 16.4, APIs: 13, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A9211CC8
strchr.VCRUNTIME140 ref: 00007FF7A9211CEF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211DA4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211DCA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211DEB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211DFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211E05
memcpy.VCRUNTIME140 ref: 00007FF7A9211E23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211E37
memcpy.VCRUNTIME140 ref: 00007FF7A9211E54
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211E69
memcpy.VCRUNTIME140 ref: 00007FF7A9211E81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9211E96

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy$strchr
String ID:
API String ID: 1615377186-0
Opcode ID: b640f6529230601bcac7f0afbe2668f86e12438bfad648e636857a6ab1cb28e0
Instruction ID: efd8b37c8e11977d1f48ae17677d893132441c546c42f25fca56e51d679b7c81
Opcode Fuzzy Hash: b640f6529230601bcac7f0afbe2668f86e12438bfad648e636857a6ab1cb28e0
Instruction Fuzzy Hash: 40518F35B0BB8581FA65AF15A944279E2A1BF44BC0F994430DE8D87BADDF3CE4358320

Function 00007FF7A9213BB0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213BF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213C08
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213C2C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213C39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213C62
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213C6F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213CA0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213CAD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF7A9213D39

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: de09e81e03be8bb503fcc2b72a308f053f9cb13b277845fe25a4b0581b237129
Instruction ID: 10aafe88bdb1d270fdad399cf587af3e7859edfcd97d26d4c81b2d7bc3b2154a
Opcode Fuzzy Hash: de09e81e03be8bb503fcc2b72a308f053f9cb13b277845fe25a4b0581b237129
Instruction Fuzzy Hash: C0717D36A0AA82C2FB75BF2598543A9A6B1FB44744F560031DB4D876E8DF3DE474C320

Function 00007FF7A9213B58 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213BF4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213C08
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213C2C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213C39
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213C62
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213C6F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9213CA0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9213CAD

Strings

Couldn't find host %s in the .netrc file; using defaults, xrefs: 00007FF7A9213D39

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup
String ID: Couldn't find host %s in the .netrc file; using defaults
API String ID: 2653869212-3983049644
Opcode ID: 9efbde4b89d71fbd5319724e84248cf83810f791a20dcb892d2dde47bded82ab
Instruction ID: b8220462d61fd169d09b18bca10d17f7954689ed582ab15d120f8bf07d99a791
Opcode Fuzzy Hash: 9efbde4b89d71fbd5319724e84248cf83810f791a20dcb892d2dde47bded82ab
Instruction Fuzzy Hash: 76619232A0AA82C6F725AF25D8543A9A7B1FB44744F960031CB8D877A9DF3CE475C321

Function 00007FF7A92184D0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7A922453A), ref: 00007FF7A921854F
strchr.VCRUNTIME140(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7A922453A), ref: 00007FF7A92185A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7A922453A), ref: 00007FF7A92185C5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7A922453A), ref: 00007FF7A9218615
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,Digest,?,00007FF7A922453A), ref: 00007FF7A9218658

Strings

%.*s, xrefs: 00007FF7A92185AE
%sAuthorization: Digest %s, xrefs: 00007FF7A9218635
Digest, xrefs: 00007FF7A92184DB
Proxy-, xrefs: 00007FF7A921862B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdupstrchr
String ID: %.*s$%sAuthorization: Digest %s$Digest$Proxy-
API String ID: 153040452-3976116069
Opcode ID: 2363e1180429dc59b83858172e463b84396bb85f940152d31d4b9ba0507a1232
Instruction ID: ec1998c5ab49e49039db81a5bcf1c248e90a94669e69f4eb79f3a39cf5483d37
Opcode Fuzzy Hash: 2363e1180429dc59b83858172e463b84396bb85f940152d31d4b9ba0507a1232
Instruction Fuzzy Hash: 4C416F3260AB85D2F610AF11E8803AAB7B0FB45B84F950435DE8D8B7A8DF3CD566C310

Function 00007FF7A9201E96 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9
SEC_E_CANNOT_INSTALL, xrefs: 00007FF7A9201E96

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_INSTALL
API String ID: 600764987-2628789574
Opcode ID: 9dbee1b567bf46da89022ae3b819dd6e728a75aa1346bfeeccd2e7e3d062bfd7
Instruction ID: 76747c29c13d900a567bbd9c6c8cd61c1acbc71bfe201ef1286cf25daf14375c
Opcode Fuzzy Hash: 9dbee1b567bf46da89022ae3b819dd6e728a75aa1346bfeeccd2e7e3d062bfd7
Instruction Fuzzy Hash: C4316262A0E68199F771AF60A4543AAF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9201E8A Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

SEC_E_BUFFER_TOO_SMALL, xrefs: 00007FF7A9201E8A
%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 600764987-1965992168
Opcode ID: 24662e390e7bd026ea85ac0bb8615d54ae6aa21152864c20fee3456be78d66eb
Instruction ID: cb4d467d127fa58f9c52193a1c4c2be3496bfe4ea20034ae8813cb440041b41d
Opcode Fuzzy Hash: 24662e390e7bd026ea85ac0bb8615d54ae6aa21152864c20fee3456be78d66eb
Instruction Fuzzy Hash: 55316262A0E68199F771AF60A4543AEF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9201E72 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

SEC_E_BAD_BINDINGS, xrefs: 00007FF7A9201E72
%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_BAD_BINDINGS
API String ID: 600764987-2710416593
Opcode ID: 966927f63f2698106f29232bbd22592cde3b42964276244cea86f3b1029630bb
Instruction ID: 9151e1bca9514b991016e3743cd5043a7438e26cd64fae34beda2541b49313c0
Opcode Fuzzy Hash: 966927f63f2698106f29232bbd22592cde3b42964276244cea86f3b1029630bb
Instruction Fuzzy Hash: 6F316462A0E68199F771AF60A4543AAF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9201EBA Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

SEC_E_CERT_UNKNOWN, xrefs: 00007FF7A9201EBA
%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_UNKNOWN
API String ID: 600764987-1381340633
Opcode ID: 21666a6ec9fc03c8ef4569fb3faec504eed4211ff1d7d1142320b310b7742f74
Instruction ID: ae0b125a23ba8f216c272ace3feb48dabd3f38c0c8cd390636c6364966855026
Opcode Fuzzy Hash: 21666a6ec9fc03c8ef4569fb3faec504eed4211ff1d7d1142320b310b7742f74
Instruction Fuzzy Hash: B5316262A0E68199F771AF60A4543AEF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9201EA2 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9
SEC_E_CANNOT_PACK, xrefs: 00007FF7A9201EA2

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CANNOT_PACK
API String ID: 600764987-1502336670
Opcode ID: 9283005fe9c4f192ba965f1246884340571f7ed869174eb052983e585ce99a23
Instruction ID: 6785832f0ecf6532eca06fa05542d95e746f0cd73397a0a08a02db531dae1d5b
Opcode Fuzzy Hash: 9283005fe9c4f192ba965f1246884340571f7ed869174eb052983e585ce99a23
Instruction Fuzzy Hash: 8A316262A0E68199F771AF60A4543AEF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9201EAE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9
SEC_E_CERT_EXPIRED, xrefs: 00007FF7A9201EAE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_CERT_EXPIRED
API String ID: 600764987-3862749013
Opcode ID: b5b5333167fb0420a6371e43e7bb40f3dd40942df59b6178bb5704dd16e07836
Instruction ID: ad8a2130767c450d7f7ed84ead2eed59bcbc56e935e3db3d6596947acceaf6dd
Opcode Fuzzy Hash: b5b5333167fb0420a6371e43e7bb40f3dd40942df59b6178bb5704dd16e07836
Instruction Fuzzy Hash: F6316262A0E68199F771AF60A4543AAF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A9201DBE Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 69stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7A9201E19
strchr.VCRUNTIME140 ref: 00007FF7A9201E40
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92022DF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92022F5
GetLastError.KERNEL32 ref: 00007FF7A92022FE
SetLastError.KERNEL32 ref: 00007FF7A920230A

Strings

%s (0x%08X), xrefs: 00007FF7A9201DC5
%s - %s, xrefs: 00007FF7A92022C9
SEC_E_ALGORITHM_MISMATCH, xrefs: 00007FF7A9201DBE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessagestrchrstrncpy
String ID: %s (0x%08X)$%s - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 600764987-618797061
Opcode ID: dafda7a93182504875bb10ae2033e823e3e41f2cf847b1e14f5137938d9c7867
Instruction ID: fbecedc615d7f43430bcca9e53f581b6159e0f681ef809cf3c34bc2352225dfe
Opcode Fuzzy Hash: dafda7a93182504875bb10ae2033e823e3e41f2cf847b1e14f5137938d9c7867
Instruction Fuzzy Hash: FB314262A0E68199F761AF60A4543AAF7B0FB84740F850536DA8D82AE9DF3CD564C720

Function 00007FF7A920A9A0 Relevance: 15.1, APIs: 10, Instructions: 67COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,00007FF7A920A41E,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A92110E9), ref: 00007FF7A920A9C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA19
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA2D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA41
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA5F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920AA68

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_time64
String ID:
API String ID: 3087401894-0
Opcode ID: 7d0639c7a6b5ea817b2713a306598321ba490f172ceec9c2b792b3fcaebe51c4
Instruction ID: 55ed452a1b8e9faca387209488d6fb0bcd687c978461cab025ca3d9eca96aa8f
Opcode Fuzzy Hash: 7d0639c7a6b5ea817b2713a306598321ba490f172ceec9c2b792b3fcaebe51c4
Instruction Fuzzy Hash: FA21EF36A4AA5181EB50AF11E954129A370FB48F94F864431DE8E87BA8DF3CD895C350

Function 00007FF7A924E270 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E33A
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E388
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E3EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924E529

Part of subcall function 00007FF7A92422D0: strchr.VCRUNTIME140(00000000,?,?,00007FF7A924188F), ref: 00007FF7A9242316
Part of subcall function 00007FF7A92422D0: strchr.VCRUNTIME140(00000000,?,?,00007FF7A924188F), ref: 00007FF7A9242326
Part of subcall function 00007FF7A92422D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7A924188F), ref: 00007FF7A9242350
Part of subcall function 00007FF7A92422D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242385
Part of subcall function 00007FF7A92422D0: strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92423AA
Part of subcall function 00007FF7A92422D0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92423CC

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A924E5B4

Strings

Kerberos, xrefs: 00007FF7A924E303, 00007FF7A924E3A5
GSSAPI handshake failure (empty challenge message), xrefs: 00007FF7A924E433
GSSAPI, xrefs: 00007FF7A924E273

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup$callocmallocstrchr$freestrncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos
API String ID: 370574955-353107822
Opcode ID: 306495248802049ee0c9768fc68aa42cec5c8f08e35f6ff7c47088835676f70b
Instruction ID: 76174bc3f6c7b8d749c44cb26823bfdcf9470bd8c917b61caf7b2e298458debf
Opcode Fuzzy Hash: 306495248802049ee0c9768fc68aa42cec5c8f08e35f6ff7c47088835676f70b
Instruction Fuzzy Hash: C8A16E32A0AB418AFB51DF25E4502ADB3B5FB84B88F850035DE4D97BA8EF38D465C750

Function 00007FF7A91F7429 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

invalid number; expected '+', '-', or digit after exponent, xrefs: 00007FF7A91F7977
invalid number; expected digit after '.', xrefs: 00007FF7A91F77C7

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: invalid number; expected '+', '-', or digit after exponent$invalid number; expected digit after '.'
API String ID: 0-808606891
Opcode ID: 866089ab65d709bb41d348f4b19256ba4c42fda55350e6a5bf4f1628c466a19f
Instruction ID: de640aec5a14d0fdbd6dff8ab9bf962ddde4be374abdd4200941943ba0c661bc
Opcode Fuzzy Hash: 866089ab65d709bb41d348f4b19256ba4c42fda55350e6a5bf4f1628c466a19f
Instruction Fuzzy Hash: 43B1926350AA4581E7269F28E44423CB7B1F715B48FE54636C74E822F8EF3ED8A5C360

Function 00007FF7A92091E5 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920922A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920924A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920929B

Part of subcall function 00007FF7A920AAB0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920AAB6

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92093A1

Strings

Replaced, xrefs: 00007FF7A9209631
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
Added, xrefs: 00007FF7A920963D
FALSE, xrefs: 00007FF7A920937B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: 4623609147e8d61389c3a4ce75ca2f158efa140334add4fd4005ea28aa9873b2
Instruction ID: aaf83ff8a64b82985a23e1e97eadd5d79b77f18f03c1836ed3224cabdf5e1b99
Opcode Fuzzy Hash: 4623609147e8d61389c3a4ce75ca2f158efa140334add4fd4005ea28aa9873b2
Instruction Fuzzy Hash: 5C916F2594A78285FFB1AF219444379A7B4AF45744F864035CA8F826F9DF2CECA4C320

Function 00007FF7A92224E0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92225AC

Strings

Ignoring duplicate digest auth header., xrefs: 00007FF7A922265D
Basic, xrefs: 00007FF7A92226A1
Authentication problem. Ignoring this., xrefs: 00007FF7A92226ED
Digest, xrefs: 00007FF7A9222644
Negotiate, xrefs: 00007FF7A9222556
NTLM, xrefs: 00007FF7A92225DC
Bearer, xrefs: 00007FF7A92226C8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup
String ID: Authentication problem. Ignoring this.$Basic$Bearer$Digest$Ignoring duplicate digest auth header.$NTLM$Negotiate
API String ID: 1169197092-907567932
Opcode ID: 89c51c11d617f77e78503d1ee36cb63797e54f7add22bc074780569a5fb9515d
Instruction ID: c14c5770b0c645b7ed7009143fac54356b57d6e9259db436a7b8aaa086b1cdbf
Opcode Fuzzy Hash: 89c51c11d617f77e78503d1ee36cb63797e54f7add22bc074780569a5fb9515d
Instruction Fuzzy Hash: 8D71D73190E28256FB18AF1199512F9FAF1AF41784FC64034DE5ACA2E9DF2DE578C320

Function 00007FF7A92092F3 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92092F6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92093A1

Strings

Replaced, xrefs: 00007FF7A9209631
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
Added, xrefs: 00007FF7A920963D
__Host-, xrefs: 00007FF7A920932D
FALSE, xrefs: 00007FF7A920937B
__Secure-, xrefs: 00007FF7A9209310

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced$__Host-$__Secure-
API String ID: 1169197092-978722393
Opcode ID: 6f633422d962adaae0421333c21171063c793df82f62b1f54baf4de059429a6f
Instruction ID: 55fca02a5aaafc3f9b1ebaada8d34191c00436f1db8c3fa11df6fcc31bf90645
Opcode Fuzzy Hash: 6f633422d962adaae0421333c21171063c793df82f62b1f54baf4de059429a6f
Instruction Fuzzy Hash: 11715125A4A68285FFB1AF159444379A7B1AF44794F864036CA8E826F9DF2CEC64C320

Function 00007FF7A9214020 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92140FC
strchr.VCRUNTIME140 ref: 00007FF7A9214130
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A9214150
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92141D4

Strings

%s%s%s, xrefs: 00007FF7A92140BF
Connecting to port: %d, xrefs: 00007FF7A92141F0
Connecting to hostname: %s, xrefs: 00007FF7A92141AB
anonymous, xrefs: 00007FF7A9214030

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$strchrstrtol
String ID: %s%s%s$Connecting to hostname: %s$Connecting to port: %d$anonymous
API String ID: 137861075-1224060940
Opcode ID: 95e1deee7015a151de51a75bfd325989f97f623d0ae6eb82049f2a29df3a92ae
Instruction ID: e5763535cede1ae6625287ae6fb9812c0770934d5826a015a737d2e5cd12d0c2
Opcode Fuzzy Hash: 95e1deee7015a151de51a75bfd325989f97f623d0ae6eb82049f2a29df3a92ae
Instruction Fuzzy Hash: 0651C43260AB8294FB25AF19AC403A9A7A0FB41B94F954135DE5D8B7E8CF3CD575C310

Function 00007FF7A9204097 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

RELOAD, xrefs: 00007FF7A9204145
FLUSH, xrefs: 00007FF7A9204123
ALL, xrefs: 00007FF7A92040A3
SESS, xrefs: 00007FF7A92040E3
Set-Cookie:, xrefs: 00007FF7A92041B8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 3a37ca4d0a303ad2c27b76f89f808bcd55178f90cb8f9111dd184b81a83c6ab1
Instruction ID: 5987ff9faa631daa49ffa081d259f892b78d024ad0667303e4bfb3bc6566eba8
Opcode Fuzzy Hash: 3a37ca4d0a303ad2c27b76f89f808bcd55178f90cb8f9111dd184b81a83c6ab1
Instruction Fuzzy Hash: EA417520B1E50292F964BF159A10279D2B1AF84BD0FD65031DE0EC76FAEE2DF8318361

Function 00007FF7A92363A1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00007FF7A92363B3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92363CE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92363FA
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923641F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92364FC

Strings

Wildcard - Parsing started, xrefs: 00007FF7A9236497

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2274641867
Opcode ID: 4541b901390b43eead9b8b0a5b08f3a65ec9d2870dea7fafeac777e054c68588
Instruction ID: da61fb307bba357d82f8f6576970e1c8debef02b6a434ca22a0bc8bdc3628151
Opcode Fuzzy Hash: 4541b901390b43eead9b8b0a5b08f3a65ec9d2870dea7fafeac777e054c68588
Instruction Fuzzy Hash: 59515032A0AB4285FB19EF11E4551B9B7B5EB84B44F8A4435CA4D8B7A8DF3CE465C320

Function 00007FF7A9246ACC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9246AF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

FALSE, xrefs: 00007FF7A9246AE8
Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup
String ID: Serial Number: %s$ Signature Algorithm: %s$FALSE$Serial Number$Signature Algorithm
API String ID: 2653869212-3672398475
Opcode ID: 469db554fb4d0e99cc146f78efcdb65800e6dfa713be0ba636b651e646532704
Instruction ID: fd1037958a55f39284f69b4938312a61bb96b7fdfde772fe8d6a89d3d3286035
Opcode Fuzzy Hash: 469db554fb4d0e99cc146f78efcdb65800e6dfa713be0ba636b651e646532704
Instruction Fuzzy Hash: 7E41A365A0A78294FF11AF6194441F9A771BF45788F8A0432CE4E8B7EDDF3CE1648320

Function 00007FF7A924797C Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92479BF
memcpy.VCRUNTIME140 ref: 00007FF7A92479E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247AB8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247BF2

Strings

Public Key Algorithm: %s, xrefs: 00007FF7A9247BC2
Expire Date, xrefs: 00007FF7A9247AFD
Public Key Algorithm, xrefs: 00007FF7A9247BA8
Expire Date: %s, xrefs: 00007FF7A9247B17

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 47889115a9a8db161692ccb80d0eaae554a74d5fad327d5faa49ac117c4a2d5c
Instruction ID: 291aefb7d01acccc9369f55bc4eaf6773a6530dcb17d0171c64d6d1a62257e0d
Opcode Fuzzy Hash: 47889115a9a8db161692ccb80d0eaae554a74d5fad327d5faa49ac117c4a2d5c
Instruction Fuzzy Hash: D2614821A0B29245FF19AF2184141B9A7B5FF85784F894535CE2E8B7EDDE3CE1648320

Function 00007FF7A9246E06 Relevance: 13.7, APIs: 5, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246E3F
memcpy.VCRUNTIME140 ref: 00007FF7A9246E6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: b8168bff1f9de26515736f79533cefcfa8ad852943784f370f3326a3d9ca335f
Instruction ID: 087004073a689a0f1d6fbbca216b0c5a2ea5f65b932f32c242d083da54b09d29
Opcode Fuzzy Hash: b8168bff1f9de26515736f79533cefcfa8ad852943784f370f3326a3d9ca335f
Instruction Fuzzy Hash: CA614951B0B78245FF19AF1184142B8A7B1BF957C4F8A0436CA5F8BBEDDE3CA1658320

Function 00007FF7A9240EB0 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7A9224518), ref: 00007FF7A9241040
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7A9224518), ref: 00007FF7A9241077
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00000000,?,NTLM,?,00007FF7A9224518), ref: 00007FF7A924109E

Strings

%sAuthorization: NTLM %s, xrefs: 00007FF7A9241058, 00007FF7A9241104
HTTP, xrefs: 00007FF7A9240EC6
Proxy-, xrefs: 00007FF7A924104E, 00007FF7A92410FA
NTLM, xrefs: 00007FF7A9240EB6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1294909896-3948863929
Opcode ID: 6aced261b076f9cafae6c0f6facb1f7982e795d22a3d459d342c7f3c521fafa0
Instruction ID: ac8a96c36145b1e7c4ae3e4fb423de80e94356f22fcce7916fc598fc16f64372
Opcode Fuzzy Hash: 6aced261b076f9cafae6c0f6facb1f7982e795d22a3d459d342c7f3c521fafa0
Instruction Fuzzy Hash: F3615E3660AB8585FB60EF15E8843AAB3B5FB84B84F810036DA4D877A8DF3CD565C711

Function 00007FF7A9237B40 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 111stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A920AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920AB94

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9237C5D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9237CB5
memcpy.VCRUNTIME140 ref: 00007FF7A9237CDA

Strings

CSeq:, xrefs: 00007FF7A9237B5D
Got a blank Session ID, xrefs: 00007FF7A9237C07
: %ld, xrefs: 00007FF7A9237B81
Got RTSP Session ID Line [%s], but wanted ID [%s], xrefs: 00007FF7A9237C6E
Unable to read the CSeq header: [%s], xrefs: 00007FF7A9237BB2
Session:, xrefs: 00007FF7A9237BCE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: __stdio_common_vsscanfmallocmemcpystrncmp
String ID: : %ld$CSeq:$Got RTSP Session ID Line [%s], but wanted ID [%s]$Got a blank Session ID$Session:$Unable to read the CSeq header: [%s]
API String ID: 1392894463-1168109407
Opcode ID: 54b1a264a620c0592573caf8f8ce064ee2f62087bb9b72579c848fd018ae4708
Instruction ID: c013d3ea0b102a1ba523698f33f76572398f5698d1b761891c2a4e87c52920d1
Opcode Fuzzy Hash: 54b1a264a620c0592573caf8f8ce064ee2f62087bb9b72579c848fd018ae4708
Instruction Fuzzy Hash: EA41E521A0E68282FF54AF3194403BAA7B4AF45B94FC54431EA5DC72E9DF2CE061C720

Function 00007FF7A924BC50 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 252stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924BCE8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924BD44
strchr.VCRUNTIME140 ref: 00007FF7A924BF2C
strchr.VCRUNTIME140 ref: 00007FF7A924BF9A

Strings

<DIR>, xrefs: 00007FF7A924BE70
APM0123456789:, xrefs: 00007FF7A924BF25
0123456789-, xrefs: 00007FF7A924BF93

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$mallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:
API String ID: 359134164-4291660576
Opcode ID: 235ffc9e2f2b415b36738cf14e7ff6ef8e4f120db3c737a7183d48dc6d553dde
Instruction ID: 4c477273e54852fb891fd35b40e837a88c6c3b506520e7fcb04805e9cf4f7079
Opcode Fuzzy Hash: 235ffc9e2f2b415b36738cf14e7ff6ef8e4f120db3c737a7183d48dc6d553dde
Instruction Fuzzy Hash: 95B14F36A0A60186FB64AF29D05037DB7B4FB84B48F964035DA4E867E9CF38E461C760

Function 00007FF7A921D3A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921D3FA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921D4FE
WSAIoctl.WS2_32 ref: 00007FF7A921D657
setsockopt.WS2_32 ref: 00007FF7A921D67F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A921D776

Strings

We are completely uploaded and fine, xrefs: 00007FF7A921D6EA
Failed to alloc scratch buffer!, xrefs: 00007FF7A921D510

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: malloc$Ioctlsetsockopt
String ID: Failed to alloc scratch buffer!$We are completely uploaded and fine
API String ID: 3352517165-607151321
Opcode ID: d628cba9ac1b012eb4e0138fa760c47a4a62752c26bec938c8b666daaba98f5c
Instruction ID: fec49b3385750e821b13a1f757d68c89d1bd65ddee4986f2b8451e227ef9b676
Opcode Fuzzy Hash: d628cba9ac1b012eb4e0138fa760c47a4a62752c26bec938c8b666daaba98f5c
Instruction Fuzzy Hash: ABB17332A0AAC6C5FB65AF2498043F963E0EB44B58F990135CE4D867EDDF3894B58720

Function 00007FF7A923DF20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923DF67
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DFCB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923E0FF

Part of subcall function 00007FF7A922C0B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7A921343F), ref: 00007FF7A922C0DE

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923DFFE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923E13D

Strings

%s?%s, xrefs: 00007FF7A923DF59
Failed sending Gopher request, xrefs: 00007FF7A923E105

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 167f2ddee1322817aafd3bb8cd9edc69d6c50086e866bf1f721eb1af8b6fa46e
Instruction ID: 491e49ba687e19b09e61c9d9d9e13b706e1d3597dbc8958fd5a3da8bedb29e2d
Opcode Fuzzy Hash: 167f2ddee1322817aafd3bb8cd9edc69d6c50086e866bf1f721eb1af8b6fa46e
Instruction Fuzzy Hash: 1D518722A0EA8282F615AF2568401BAE3A0BB857E4F950231DE5D877F9DF3CD5668710

Function 00007FF7A91FABA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC29C
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FC2CA
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FC2D8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC312
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC363

Strings

value, xrefs: 00007FF7A91FC208

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 3600dfdb1e7c43a2cea5d2236ddf5ffdf550a749eae16b7d9cdecc5ba99c0ce3
Instruction ID: d3271e4e7522772796b316ad5356f626e1cd86e7a946114f277633471c5e616b
Opcode Fuzzy Hash: 3600dfdb1e7c43a2cea5d2236ddf5ffdf550a749eae16b7d9cdecc5ba99c0ce3
Instruction Fuzzy Hash: 1F61A022B19A8585FB11DF78E4453ADB371FB853A4F810332DA6D82AE9EF3CD0959310

Function 00007FF7A91F9500 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FAA0D
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FAA3B
__std_exception_destroy.VCRUNTIME140 ref: 00007FF7A91FAA49
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FAA83
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FAAD4

Strings

value, xrefs: 00007FF7A91FA979

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: cffba1fa8c4fa3b98d13d4edaddc15fffbe2a52744c1f546e1a74d683e671c24
Instruction ID: 22d1f15cca5cf3e117ebe93cfe9a01ec57229b2c137cdf6cd2d00dce52020891
Opcode Fuzzy Hash: cffba1fa8c4fa3b98d13d4edaddc15fffbe2a52744c1f546e1a74d683e671c24
Instruction Fuzzy Hash: 0E61A132A19A8595FB11EF74E4443EDA371EB853A4F814332DBAD46AE9EF3CD0958310

Function 00007FF7A9236BF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A9236C26
_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9236C7B
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF7A9236CEC
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9236CF9
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9236E0B

Strings

Can't open %s for writing, xrefs: 00007FF7A9236C8B
Can't get the size of %s, xrefs: 00007FF7A9236D02

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _close$_fstat64_openstrchr
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 423814720-3544860555
Opcode ID: db19477bb72ec7b2c76437051e82c2d8adb1305719674f7673263d6c6e8b9d80
Instruction ID: 7938e974e7eb11e06323fc2134e93ea5c41bef50113f71c9486db26248b24d0a
Opcode Fuzzy Hash: db19477bb72ec7b2c76437051e82c2d8adb1305719674f7673263d6c6e8b9d80
Instruction Fuzzy Hash: E751A76270AA4681FE18AF25E4017BAA3B5FB84BD0FD64435DA4EC73E9DE3CE4558310

Function 00007FF7A923EE60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF7A923EE70
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdupstrtol
String ID: %%%02x
API String ID: 2999891020-4020994737
Opcode ID: ff7910c3f5757aa76a3c56f326e35c9d5f775c796302f2572dbd96cbfd4e7748
Instruction ID: 2fee7a59b46317f741591c45eef652e4a0b9a93ea8c94d28868947948556d8b0
Opcode Fuzzy Hash: ff7910c3f5757aa76a3c56f326e35c9d5f775c796302f2572dbd96cbfd4e7748
Instruction Fuzzy Hash: D551E81190F7D245FB2AAF14B0103BAABA19F41754F8A0131DA9E867EDDE2DE469C321

Function 00007FF7A923EE36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EE43
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc$_strdup
String ID: %%%02x
API String ID: 1496848336-4020994737
Opcode ID: 1babb462f64dddbb0a2a41df42a8fd7d609f562ceff48c21b7d2cbe50c639a36
Instruction ID: 32278ba4eb736ff4cad9b3f2f6539e6201b71a01c5171550a4ea6ca9913e09b1
Opcode Fuzzy Hash: 1babb462f64dddbb0a2a41df42a8fd7d609f562ceff48c21b7d2cbe50c639a36
Instruction Fuzzy Hash: 3C41091190F7D245FA26AF15B0103BAABA09F45754F8A0131DADE867E9DE3DE425C321

Function 00007FF7A9246B9E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9246BA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 111713529-517259162
Opcode ID: 9cb120ece2b8616c2c5cc8c5bfaccd4e96a0bd7081e05c3406b4677323da47a5
Instruction ID: 73b6e68127ae5c1db3b8074424174ba6426593867eaae3de284e9af16cab8aca
Opcode Fuzzy Hash: 9cb120ece2b8616c2c5cc8c5bfaccd4e96a0bd7081e05c3406b4677323da47a5
Instruction Fuzzy Hash: 1C31A465A0B78254FF15AF6198001F9A771AF45788F8A0435CE4E8B7EDDF3CA1648320

Function 00007FF7A91F1BD0 Relevance: 12.3, APIs: 8, Instructions: 277COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A91F1D9A
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F1E5D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F1EAB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F1EEB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F1F3A

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy
String ID:
API String ID: 3063020102-0
Opcode ID: b63d2026981374fc21c131e2b6775b756a0f4163aab2e2972f3eaaaedcccd29c
Instruction ID: 07416514bd0f4a8ad8ceb5dcc7c22875049b1d3086a9be9ebe80f6045d25177d
Opcode Fuzzy Hash: b63d2026981374fc21c131e2b6775b756a0f4163aab2e2972f3eaaaedcccd29c
Instruction Fuzzy Hash: 88B1C122B1AB4585FB01EF64E5443ADA370EB447A4F814631DB6C43AEAEF3CE0A58310

Function 00007FF7A9246C8D Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7A9246DB1
GMT, xrefs: 00007FF7A9246D3E
Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Serial Number$Signature Algorithm
API String ID: 1294909896-599393795
Opcode ID: 22ba73ba734bc8db4352debf2b035113a3ea712c82fe52b4aaec68273e1c43dc
Instruction ID: d2e573d5d36b47d904cfe4a3d9a3b699cd04447b97450ecd31d24dc74ef45306
Opcode Fuzzy Hash: 22ba73ba734bc8db4352debf2b035113a3ea712c82fe52b4aaec68273e1c43dc
Instruction Fuzzy Hash: B961C161A0B79294FF11AF2098041B8A7B5BB85784FCA4436DA4D87BEDDF3CE564C320

Function 00007FF7A9247F85 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247FC8
memcpy.VCRUNTIME140 ref: 00007FF7A9247FEE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92480C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: Signature: %s$Signature
API String ID: 901724546-1663925961
Opcode ID: 69a76e465b063611c1620d382e4e47df24657b40de87f78682f1ac628d696677
Instruction ID: 6861336a0fde5490223af52bc10cd62992ce11752352db20f533ec494b85b351
Opcode Fuzzy Hash: 69a76e465b063611c1620d382e4e47df24657b40de87f78682f1ac628d696677
Instruction Fuzzy Hash: DB513911A1B6C241FE19AF1594142B9A7B1FF857D0F850136CA6F8BBE9EE3CE0658320

Function 00007FF7A920EED0 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920EF16
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920EF42
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920EF6E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup
String ID:
API String ID: 1169197092-0
Opcode ID: ccf8521611f964fc930ababa875afe9b49262a3c081c1762472953d0c6f83fc9
Instruction ID: 7a83d5d83cd9a3a1eb18f1f293665383e9d72bd7b33b380021e82eca1f0b313e
Opcode Fuzzy Hash: ccf8521611f964fc930ababa875afe9b49262a3c081c1762472953d0c6f83fc9
Instruction Fuzzy Hash: 15515C22A1BB9182FB95DF65B040128B7B4FB48B84B491535EF9D43B99EF38D8F18710

Function 00007FF7A9246BC7 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 123COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7A9246C79
GMT, xrefs: 00007FF7A9246C26
Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Serial Number$Signature Algorithm
API String ID: 1294909896-3876350232
Opcode ID: 5fe6e25064bda39082ba77543102f67a2d7a4a23a0afa096ea93b712b597e937
Instruction ID: 0ff2709b8e549be8e9a3a4f2529bc1998cbcf71c37a9a04fcdbae487da164708
Opcode Fuzzy Hash: 5fe6e25064bda39082ba77543102f67a2d7a4a23a0afa096ea93b712b597e937
Instruction Fuzzy Hash: 71517161A0AB8294FF11AF6194041F9E771BB45B84FCA0436DA4E9B2EDDF3CE564C320

Function 00007FF7A9247984 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92479BF
memcpy.VCRUNTIME140 ref: 00007FF7A92479E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247BF2

Strings

Public Key Algorithm: %s, xrefs: 00007FF7A9247BC2
Expire Date, xrefs: 00007FF7A9247AFD
Public Key Algorithm, xrefs: 00007FF7A9247BA8
Expire Date: %s, xrefs: 00007FF7A9247B17

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 3401966785-2901970132
Opcode ID: 89c673d65171f0269890ceab3c22ca76a5b59e34b2a3d3c4915578bec45c5a2a
Instruction ID: 2d6e623cd0583a7c513aa0b9ccf49ecba24df8398382841fb3052228856b9f6f
Opcode Fuzzy Hash: 89c673d65171f0269890ceab3c22ca76a5b59e34b2a3d3c4915578bec45c5a2a
Instruction Fuzzy Hash: 8841C365A0A78255FF15AF6198041F9A376BF457C8F8A0532CE1D8B7EDEF3CA1648320

Function 00007FF7A922C960 Relevance: 11.3, APIs: 9, Instructions: 89COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA2C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA48
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA56
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA64
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA72
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA80
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922CA9C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4c6c76d143353014f35ea796b12b14956d7f3cd761f0572a72c187997cf0972e
Instruction ID: 5f26c2f0dd3cb540e81aced7bfff863df82315409e45acb92616b3934ddb5a11
Opcode Fuzzy Hash: 4c6c76d143353014f35ea796b12b14956d7f3cd761f0572a72c187997cf0972e
Instruction Fuzzy Hash: B9411F3290AB8282F761EF21D44027973B4FB89B54F964575DA4D936ACCF38D8A0C391

Function 00007FF7A92099C0 Relevance: 11.3, APIs: 9, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92099D9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92099E3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92099ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92099F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209A01
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209A0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209A15
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209A1F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9209A28

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a301b36d456e24db524119d8642cbca10183247d752d742f16f73bf9139d7298
Instruction ID: 1e8f27ae316fdfa2a7ad8783a3df73e4ed5dd1e853196a2deaf50a2a16316e40
Opcode Fuzzy Hash: a301b36d456e24db524119d8642cbca10183247d752d742f16f73bf9139d7298
Instruction Fuzzy Hash: 20013965657A4182EB54AF22ED54028A330FF88F95B451431DE8E87BB8CF3CD8A9C351

Function 00007FF7A9243F50 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A920BC30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920BC66
Part of subcall function 00007FF7A920BC30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920BC76
Part of subcall function 00007FF7A920BC30: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920BC84
Part of subcall function 00007FF7A920BC30: memset.VCRUNTIME140 ref: 00007FF7A920BCBF

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9244019
memcpy.VCRUNTIME140 ref: 00007FF7A9244034
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924404E

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpymemset
String ID:
API String ID: 1579693990-0
Opcode ID: e9281cf51f1936906a8f78dc414cc2d3dd9d8dd825ce001034dd440aaeecf8cc
Instruction ID: 676a397d5aa2855f631bc4e50c961626bf522eb1c0f9978dd6961d26ef1b5cbc
Opcode Fuzzy Hash: e9281cf51f1936906a8f78dc414cc2d3dd9d8dd825ce001034dd440aaeecf8cc
Instruction Fuzzy Hash: 5B914F51B0E74242FA55FE5A949437AA2E0AFC5F84F864134DE5E877E9DF2CE8218320

Function 00007FF7A9219010 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 217stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A9219125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A921913F

Strings

I32, xrefs: 00007FF7A9219115, 00007FF7A9219175
Internal error removing splay node = %d, xrefs: 00007FF7A9219022
I64, xrefs: 00007FF7A9219135, 00007FF7A921919F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strncmp
String ID: I32$I64$Internal error removing splay node = %d
API String ID: 1114863663-13178787
Opcode ID: 3f3a1650232d5731b32076d2dff0fc66f8e13c7ad36f17a2693074226836c4a4
Instruction ID: b322d3746047fd6f794793b4166352da6f7f01ffe6e377ee48fb3b1e244ea55d
Opcode Fuzzy Hash: 3f3a1650232d5731b32076d2dff0fc66f8e13c7ad36f17a2693074226836c4a4
Instruction Fuzzy Hash: A9A1B637A0A646D5E7209F14E84477DBBB4F748B88F964135DA4D832A8DF3CD268C710

Function 00007FF7A9227930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 165stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7A920A95A,?,?,?,?,?,?,?,00007FF7A920A727), ref: 00007FF7A9227941
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7A9227AE3
strchr.VCRUNTIME140(?,?,?,00000000,TRUE,?,00000000,00000000,00000000,?), ref: 00007FF7A9227B00

Strings

0123456789abcdef, xrefs: 00007FF7A9227AD2, 00007FF7A9227ADC
0123456789ABCDEF, xrefs: 00007FF7A9227AF2, 00007FF7A9227AF9
TRUE, xrefs: 00007FF7A9227A6C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$_errno
String ID: 0123456789ABCDEF$0123456789abcdef$TRUE
API String ID: 2644425738-1191287149
Opcode ID: 5549bad4f116a5e64051d0cc84459e954ffe11c0be2338ad59cd4e5d56e76a61
Instruction ID: 5d7eb9ca343a2ad212009a0968a556ab8bd7ea39d1d76fca21cc8b5f682aa0e6
Opcode Fuzzy Hash: 5549bad4f116a5e64051d0cc84459e954ffe11c0be2338ad59cd4e5d56e76a61
Instruction Fuzzy Hash: F9510892A0F78641FE21AF25A4401FAE3B4AB95B84FD64131DA4D867EDDE3CF551C320

Function 00007FF7A92091AC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92091B2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92093A1

Strings

Replaced, xrefs: 00007FF7A9209631
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
Added, xrefs: 00007FF7A920963D
FALSE, xrefs: 00007FF7A920937B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 1169197092-2292467869
Opcode ID: f2d720a1373084c125e97ba130ff2d73f2d1944f8ba98d7214c3fb4c10f7c7ea
Instruction ID: 8f34740a3f0cc2558625c597e3cf2261d86e3e7bef41b0ae839d5012392d25dc
Opcode Fuzzy Hash: f2d720a1373084c125e97ba130ff2d73f2d1944f8ba98d7214c3fb4c10f7c7ea
Instruction Fuzzy Hash: EA61516594B78245FFB1AF159444379A7B1AF44794F864036CB8E826F9DF2CECA48320

Function 00007FF7A9209349 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A920934C

Part of subcall function 00007FF7A9227720: strchr.VCRUNTIME140 ref: 00007FF7A9227756

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92093A1

Strings

Replaced, xrefs: 00007FF7A9209631
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
Added, xrefs: 00007FF7A920963D
FALSE, xrefs: 00007FF7A920937B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdup$strchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3404610657-2292467869
Opcode ID: e02c0fb956acbf4fcf5e70f59e0e1e0d8173182c33c57751ba727fe8520e7d2f
Instruction ID: 92f05318aa322ded0700c21547eadc73bfcba8ded5bd4af8373fb22a45ea4928
Opcode Fuzzy Hash: e02c0fb956acbf4fcf5e70f59e0e1e0d8173182c33c57751ba727fe8520e7d2f
Instruction Fuzzy Hash: 9061616594A78245FFB1AF159444379A7B1AF44754F864036CB8E826F9DF2CECA4C320

Function 00007FF7A91F5E00 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5E91
memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5ED5
memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5EED
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5F72

Part of subcall function 00007FF7A924F220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7A91F441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A924F23A

memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5FA4
memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5FBF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91F5FDC

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 3c62182fa7f3149e0eca771132885244bfbf27e241d20ee8b84aa0ba51fc9a5e
Instruction ID: 355cca99ee1f6879581d7ba04a2e797619884dbbe3d75ebc265e7dad087bb4c5
Opcode Fuzzy Hash: 3c62182fa7f3149e0eca771132885244bfbf27e241d20ee8b84aa0ba51fc9a5e
Instruction Fuzzy Hash: 8B51D127A05B8591FA05EF25E6041B8A370EB04B98F950632DF2D873E6DF38E1A1D350

Function 00007FF7A92302F0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923033A
memcpy.VCRUNTIME140 ref: 00007FF7A9230451
memcpy.VCRUNTIME140 ref: 00007FF7A92304C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92304EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9230500

Strings

Failed to alloc scratch buffer!, xrefs: 00007FF7A9230350

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freememcpy$malloc
String ID: Failed to alloc scratch buffer!
API String ID: 169112436-1446904845
Opcode ID: 0b6dbac02970cdac6a4af78e8c3ef323aeab044d49a2ee4c9ee351fa1a38fdf2
Instruction ID: ac9e7d016911429665b81faefec022b02ea947ad96740937d9df74b5005bd98e
Opcode Fuzzy Hash: 0b6dbac02970cdac6a4af78e8c3ef323aeab044d49a2ee4c9ee351fa1a38fdf2
Instruction Fuzzy Hash: 3751B13261A7C196E629EF65E4406EAB7A4FB08784F850135DF8D877A9DF3CE164C320

Function 00007FF7A9233430 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 146stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00007FF7A92334F3

Strings

Maxdownload = %I64d, xrefs: 00007FF7A923358C, 00007FF7A923362B
RETR response: %03d, xrefs: 00007FF7A9233488
, xrefs: 00007FF7A9233497
Getting file with size: %I64d, xrefs: 00007FF7A92335A5
bytes, xrefs: 00007FF7A92334E9
Data conn was not available immediately, xrefs: 00007FF7A92335E7

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strstr
String ID: $ bytes$Data conn was not available immediately$Getting file with size: %I64d$Maxdownload = %I64d$RETR response: %03d
API String ID: 1392478783-2096918210
Opcode ID: c5e58dd9e7afcab8f0b6298344d4bfce5e751406334d07677d7b514b61f200c7
Instruction ID: ecd29668ea53f2adcf31d915077ae3a8745451bf7c4b4d4ea631cfe6bb65515d
Opcode Fuzzy Hash: c5e58dd9e7afcab8f0b6298344d4bfce5e751406334d07677d7b514b61f200c7
Instruction Fuzzy Hash: 3D512D63B0A74541FA38AF14A4442BAE3B1EB45774FC61231CA5C82AFDDF7CE5A68710

Function 00007FF7A9247DFB Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7A9247F1F
Signature, xrefs: 00007FF7A92480FF
GMT, xrefs: 00007FF7A9247EAE
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Signature
API String ID: 2190258309-3231818857
Opcode ID: b72d7c38827bf92b41d33a828297fa60a18b657ac82ac003ade50adcb9a4c4a8
Instruction ID: 30e6fec1d84063052629f6b34ee5636bae53ac827072f33e39121525863b3747
Opcode Fuzzy Hash: b72d7c38827bf92b41d33a828297fa60a18b657ac82ac003ade50adcb9a4c4a8
Instruction Fuzzy Hash: 8551D262B1E6C295FB119F24A4041B9E7B9FB85790F860532CA5D87BACCF3CD925C310

Function 00007FF7A9233200 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FF7A92333A6

Part of subcall function 00007FF7A924A530: memcpy.VCRUNTIME140 ref: 00007FF7A924A5D8
Part of subcall function 00007FF7A924A530: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924A5E9

Strings

We got a 421 - timeout!, xrefs: 00007FF7A92333E5
FTP response timeout, xrefs: 00007FF7A9233413
*, xrefs: 00007FF7A9233374
FTP response aborted due to select/poll error: %d, xrefs: 00007FF7A92333B4
QUOT string not accepted: %s, xrefs: 00007FF7A92333CF

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastfreememcpy
String ID: *$FTP response aborted due to select/poll error: %d$FTP response timeout$QUOT string not accepted: %s$We got a 421 - timeout!
API String ID: 1248052217-2335292235
Opcode ID: 3c5d61346607b2cfe2d6704de4e1beeed17656a0b20aaff6d20451b7392af3ee
Instruction ID: f5d59e100d98f75a9b52ae716f888a2637ca842d11fa7d5b5af4175d0cb541a6
Opcode Fuzzy Hash: 3c5d61346607b2cfe2d6704de4e1beeed17656a0b20aaff6d20451b7392af3ee
Instruction Fuzzy Hash: A651C521A0E68381FB78BE1595043BA93B0BF45794FC69131DE4DC72E9EF2CE5658360

Function 00007FF7A9218450 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242174
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924219A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92421A8

Strings

true, xrefs: 00007FF7A9242114
Digest, xrefs: 00007FF7A9218478
stale, xrefs: 00007FF7A92420FF

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: d7fad02d156605e7829970b9a499979fa611a030b5f317b32ee4a858768fa657
Instruction ID: b5b83aeb1248b94cbf4c5d47d0100a9fec0904596f97eba6821591f757740a1f
Opcode Fuzzy Hash: d7fad02d156605e7829970b9a499979fa611a030b5f317b32ee4a858768fa657
Instruction Fuzzy Hash: 51518625A0AA8281FF20AF26A850379A3B0FF84784F954031DB9D876E9DF2CD575C720

Function 00007FF7A923BFE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

recvfrom.WS2_32 ref: 00007FF7A923C040
memcpy.VCRUNTIME140 ref: 00007FF7A923C066
memchr.VCRUNTIME140 ref: 00007FF7A923C163

Strings

Internal error: Unexpected packet, xrefs: 00007FF7A923C108
TFTP error: %s, xrefs: 00007FF7A923C180
Received too short packet, xrefs: 00007FF7A923C092

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memchrmemcpyrecvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 3107918033-477593554
Opcode ID: 154bf1fc1e9909c086d6bb85d64bf2d59784c378e1277550652629e62d41362e
Instruction ID: 0955a8c76f71b4a2164bba50f692edc46e99beb7647f57c89afdd9fc5541e02e
Opcode Fuzzy Hash: 154bf1fc1e9909c086d6bb85d64bf2d59784c378e1277550652629e62d41362e
Instruction Fuzzy Hash: 5451A271A0A59285FB68EF2594103BAB3A0EB84B44F864132DE4DC76EDDE3CE465D720

Function 00007FF7A91F23A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91F6E00: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7A91F23FB), ref: 00007FF7A91F6E7E
Part of subcall function 00007FF7A91F6E00: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7A91F23FB), ref: 00007FF7A91F6E8C
Part of subcall function 00007FF7A91F6E00: memcpy.VCRUNTIME140(?,?,?,?,00000000,00007FF7A91F23FB), ref: 00007FF7A91F6EA2

Part of subcall function 00007FF7A91F3BE0: memcpy.VCRUNTIME140(?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F3C26

Part of subcall function 00007FF7A91F5E00: memcpy.VCRUNTIME140(?,?,?,00007FF7A91F1DEA), ref: 00007FF7A91F5E91

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2499
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F24D8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2526
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2574

Strings

, column , xrefs: 00007FF7A91F2429
at line , xrefs: 00007FF7A91F23EC

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 2665656946-191570568
Opcode ID: d56ce6ae8cc1123b73d64aff316a4b7a3c4c260b1b6b93e29a35305d100a47e4
Instruction ID: 011db51de584abc2138c8665b6878f88b8627fc50aed130366a31d06f75dd8ce
Opcode Fuzzy Hash: d56ce6ae8cc1123b73d64aff316a4b7a3c4c260b1b6b93e29a35305d100a47e4
Instruction Fuzzy Hash: 6451C063B05A4685FB01EFB4E4503AC6331EB847E8F815231DB6D52AEAEE38D4A58350

Function 00007FF7A91F4A30 Relevance: 10.6, APIs: 7, Instructions: 133COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4AC3
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4B17
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4B3E
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4B66
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4BAC
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4BB3
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ.MSVCP140(?,?,00000000,?,?,00007FF7A91F317B,?,?,?,00007FF7A91F3134), ref: 00007FF7A91F4BC0

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: 8d1e933b32d01b2dd2de9809d640aa598a1230861a3adeee3272f4e38bd4e7ba
Instruction ID: 8bd26624502bc350cc23210481f9cfdbb070036f237e454d6c7ffa189937c075
Opcode Fuzzy Hash: 8d1e933b32d01b2dd2de9809d640aa598a1230861a3adeee3272f4e38bd4e7ba
Instruction Fuzzy Hash: EC513D3260AA4582EB229F1DE494238A7B0EB85B95F56C632CB5F837F1DF39D4528314

Function 00007FF7A9240B60 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF7A92244F6), ref: 00007FF7A9240CBD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,Negotiate,?,00007FF7A92244F6), ref: 00007FF7A9240CD3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9240CE5

Strings

%sAuthorization: Negotiate %s, xrefs: 00007FF7A9240C9E
Proxy-, xrefs: 00007FF7A9240C8D
Negotiate, xrefs: 00007FF7A9240B66, 00007FF7A9240C42
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 00007FF7A9240C11

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 1294909896-1255959952
Opcode ID: 3b4d6e5d942a98ed503fd4b19b467e919738348e5f15bfdc0c184e4bdef6fa1e
Instruction ID: 1384507444543fe8f8ea81e40bd5df39148da234ff8b2a8322a1fa465d9bf7ef
Opcode Fuzzy Hash: 3b4d6e5d942a98ed503fd4b19b467e919738348e5f15bfdc0c184e4bdef6fa1e
Instruction Fuzzy Hash: 0A51932294A64695FB11EF15D4802FDA7A0FB81794F860031DA4DC76E9DF3CE4B5C360

Function 00007FF7A923EEB7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: b26be98f3b04a493c222c2dc3a6284fda6e614ab30455a762ba14e6f0bdd13db
Instruction ID: 9f2a2f0f43b82988f214ca606fd21482c0665228da949d6c48261a71fc3ca418
Opcode Fuzzy Hash: b26be98f3b04a493c222c2dc3a6284fda6e614ab30455a762ba14e6f0bdd13db
Instruction Fuzzy Hash: 4341091190F7D245FA26AF14B0103BAABA0AF41754F8A0171DADE867EDDE3DE429C321

Function 00007FF7A923EEA7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: c5591d34e970a98c4b1a18b475ea922a9db7b3792a51ded2557ed2dc591e812b
Instruction ID: e0060f6b41af21d7f29a3701bc516949cb72f57b1541b4b1dc750580b2ce7461
Opcode Fuzzy Hash: c5591d34e970a98c4b1a18b475ea922a9db7b3792a51ded2557ed2dc591e812b
Instruction Fuzzy Hash: F741181190F7D245FB2AAF14B0103BAABA09F41754F8A0171DADE867EDDE2DE425C331

Function 00007FF7A923EE52 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 9a0517d7fde81c11bf06f05799196e9fd3dd96fb4786c18feb1be134c4bceeea
Instruction ID: e9573cdb6fc8a583d21b922c185ead1c2b0a1da431beff47b52dcc8abde72e2f
Opcode Fuzzy Hash: 9a0517d7fde81c11bf06f05799196e9fd3dd96fb4786c18feb1be134c4bceeea
Instruction Fuzzy Hash: BA41281190F7E245FA2AAF14B0103BAABA09F41754F8A0131DADE867EDDE2DE425C331

Function 00007FF7A923EE28 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 721fe799d9a29ebde491a5d9c436c414e583d41fc243939a5b078ff5b5985533
Instruction ID: c01e4cf572cb04c1f991388242e7b4347e1e8aa39a40b7a15d3e813185cb6cbe
Opcode Fuzzy Hash: 721fe799d9a29ebde491a5d9c436c414e583d41fc243939a5b078ff5b5985533
Instruction Fuzzy Hash: 4041171190F7E245FA2AAF14B0103BAABA09F41754F8A0131DADE867EDDE2DE425C331

Function 00007FF7A923EE1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: 0adec23de5e971b3332ffe28d64b7c9634d7a77ad24de8e8a046ed291ddf9d60
Instruction ID: 8219c899f9c7d71c50c17460b24819746e623890d5b8617b01dd875eafa54f4d
Opcode Fuzzy Hash: 0adec23de5e971b3332ffe28d64b7c9634d7a77ad24de8e8a046ed291ddf9d60
Instruction Fuzzy Hash: 6A41F71190F7E245FA2AAF14B0103BAABA19F41754F8A0171DADE867EDDE2DE425C331

Function 00007FF7A923EE0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: d7ded3accfc8e54ae43779aea1be6aba381d310a300e90985818a2f032487762
Instruction ID: 2aa0cc9202cdd0b3d7e3f3a535222e29b6259b203b3ae2df772ffa104c47bf67
Opcode Fuzzy Hash: d7ded3accfc8e54ae43779aea1be6aba381d310a300e90985818a2f032487762
Instruction Fuzzy Hash: DC41281190F7E245FA2AAF14B0103BAABA09F41754F8A0131DADE867EDDE3DE425C331

Function 00007FF7A923EEDD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923EF1D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A923EF6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F02A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F11A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923F12B

Strings

%%%02x, xrefs: 00007FF7A923EFD3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: %%%02x
API String ID: 1941130848-4020994737
Opcode ID: cab9ca6da7bb84c60a2648360818501fe9982f5b96704d66280a42d433bc575e
Instruction ID: 043c22d557a2f9ccef31020518caed2d738dbf660e59cf3c7743e6217e1f3f0a
Opcode Fuzzy Hash: cab9ca6da7bb84c60a2648360818501fe9982f5b96704d66280a42d433bc575e
Instruction Fuzzy Hash: D741281190FBE245FA2AAF14B0103BAABA09F41754F8A0131DADD867EDDE2DE425C321

Function 00007FF7A923CB30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A923CB48
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A923CCB1

Strings

set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00007FF7A923CC8C
Connection time-out, xrefs: 00007FF7A923CB6B
gfff, xrefs: 00007FF7A923CBBC
gfff, xrefs: 00007FF7A923CC28

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 1670930206-870032562
Opcode ID: 2d4d3c76094cbb75ffe4efdb33bc7ae2673dc4b9ea8ffb513cee310a1dde5e03
Instruction ID: f38559f65453b7b2abd95ca1ac280315071f127e71a27bb906476eb4adbdb4b9
Opcode Fuzzy Hash: 2d4d3c76094cbb75ffe4efdb33bc7ae2673dc4b9ea8ffb513cee310a1dde5e03
Instruction Fuzzy Hash: 2B41E376B2561982EB24DF3AE040669B7B4F798F88F915031DE0CC7BA8DE39E561C740

Function 00007FF7A9223FC0 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A92240A6
strchr.VCRUNTIME140 ref: 00007FF7A92240B9
strchr.VCRUNTIME140 ref: 00007FF7A92240CB

Strings

Expect:, xrefs: 00007FF7A922404E
Expect, xrefs: 00007FF7A9224027
Expect: 100-continue, xrefs: 00007FF7A9224128
100-continue, xrefs: 00007FF7A92240E6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr
String ID: 100-continue$Expect$Expect:$Expect: 100-continue
API String ID: 2830005266-711804848
Opcode ID: 8ccee74113bc77341829491bab89accbb0b29dee8c8f49939b969105067bb22e
Instruction ID: 55e636ba543f4a3be80af258955ae8a178c3c1f4714052205a58ab91b6a987d3
Opcode Fuzzy Hash: 8ccee74113bc77341829491bab89accbb0b29dee8c8f49939b969105067bb22e
Instruction Fuzzy Hash: 9C41F721A0E68285FA54AF1DA4401F8F3B09F55B84FC95034DA4D877EEDE1DE4618B20

Function 00007FF7A921C390 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A921C4DA

Strings

seek callback returned error %d, xrefs: 00007FF7A921C42E
Cannot rewind mime/post data, xrefs: 00007FF7A921C510
ioctl callback returned error %d, xrefs: 00007FF7A921C49F
the ioctl callback returned %d, xrefs: 00007FF7A921C485
necessary data rewind wasn't possible, xrefs: 00007FF7A921C4E5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-959247533
Opcode ID: 336ccf8625a558e2c4dd1ed9a0a4141312b8350e6505903281c01f6c9cf4d4be
Instruction ID: 71346f1c6d00b4d190174c9c90e3633ced51766dc3e0a88b23b0fa2690126bcf
Opcode Fuzzy Hash: 336ccf8625a558e2c4dd1ed9a0a4141312b8350e6505903281c01f6c9cf4d4be
Instruction Fuzzy Hash: AD41C575A1664281FB50EF25A8407B963A1EBC4B94FD92131DD0E8B2EDCF3DE4B08320

Function 00007FF7A9247640 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 106COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247BF2

Strings

%s%lx, xrefs: 00007FF7A924769D
Public Key Algorithm: %s, xrefs: 00007FF7A9247BC2
Expire Date, xrefs: 00007FF7A9247AFD
Public Key Algorithm, xrefs: 00007FF7A9247BA8
Expire Date: %s, xrefs: 00007FF7A9247B17

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$%s%lx$Expire Date$Public Key Algorithm
API String ID: 1294909896-3155708153
Opcode ID: 8a3e3e4c7b035e0613b41750a12c335ec93a4cfb382cb79f62a15f4182b50b85
Instruction ID: 8204d101ac2b44f802d76c854f19a306d400650bb3b3d5e4392e2385f19aeb8a
Opcode Fuzzy Hash: 8a3e3e4c7b035e0613b41750a12c335ec93a4cfb382cb79f62a15f4182b50b85
Instruction Fuzzy Hash: D5419161A0A68255FB11AF6198041F9A776AB45788FCA0831CE5D8B7EEDF3CE1648320

Function 00007FF7A9247D3E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

Signature, xrefs: 00007FF7A92480FF
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7A9247DD4
GMT, xrefs: 00007FF7A9247D94
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Signature
API String ID: 2190258309-3662781045
Opcode ID: 5f21ae4624343d64661809e204a58d92171b4063f62ab7bae819daf4e02a48c4
Instruction ID: 4f37aec325b784116be9b4b897bfdff2e3deb05f6e89e5dd20015f58f0368692
Opcode Fuzzy Hash: 5f21ae4624343d64661809e204a58d92171b4063f62ab7bae819daf4e02a48c4
Instruction Fuzzy Hash: 4641A522A1AB8291FB10AF25E8401FAE374FB84B84F990032DA5D9B7ADDF3CD555C310

Function 00007FF7A9246B01 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

%s%lx, xrefs: 00007FF7A9246B56
Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$%s%lx$Serial Number$Signature Algorithm
API String ID: 1294909896-659367561
Opcode ID: 04b2bbedee71d1dced75f14afd4ae25275a50d19cb05f227ed67dbe08b18f66b
Instruction ID: 8fa674822b07c59299caedc2b90f372b575634552050ae94009ec8623d24ede4
Opcode Fuzzy Hash: 04b2bbedee71d1dced75f14afd4ae25275a50d19cb05f227ed67dbe08b18f66b
Instruction Fuzzy Hash: B641A465A0B68254FF11AF2194041F9A7B1AF457C8FCA0431DE4E8B7EEDE3DE1648320

Function 00007FF7A922FE40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922FE7D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922FEEE

Strings

., xrefs: 00007FF7A922FEE7

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: .
API String ID: 1865132094-916926321
Opcode ID: 0522f5d3c35b4eec440fcd00adfc90331390eb8f02890d073388c559953df257
Instruction ID: a282af61b12e4a067150cf3cdcd417f5b7d74500c99d857698def767107987e6
Opcode Fuzzy Hash: 0522f5d3c35b4eec440fcd00adfc90331390eb8f02890d073388c559953df257
Instruction Fuzzy Hash: E1417922A0AB9582F751EF11D9002F9F2B0FB49B90F964031DA4D877E9DF3CE4618B50

Function 00007FF7A9246E0E Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246E3F
memcpy.VCRUNTIME140 ref: 00007FF7A9246E6A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3401966785-517259162
Opcode ID: 5acebbd12d4d97ce6921b8d387ce1cd50fb391301fd6ade95dace15593790dc8
Instruction ID: cbc4b35f51841cdbe55eb713da544d74c1c81437286cde88059b5a11db162334
Opcode Fuzzy Hash: 5acebbd12d4d97ce6921b8d387ce1cd50fb391301fd6ade95dace15593790dc8
Instruction Fuzzy Hash: BB418065A0A78254FF15AF2198041B9A3B1BF457C8F8A4436CE0E9B7EDDF3CA5648320

Function 00007FF7A9240460 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A922BF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BF98
Part of subcall function 00007FF7A922BF70: GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFBE
Part of subcall function 00007FF7A922BF70: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFDF
Part of subcall function 00007FF7A922BF70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFF0

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92404FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9240548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9240551

Strings

%s%s.netrc, xrefs: 00007FF7A92404BF
HOME, xrefs: 00007FF7A9240499
%s%s_netrc, xrefs: 00007FF7A9240514

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$realloc$EnvironmentVariable
String ID: %s%s.netrc$%s%s_netrc$HOME
API String ID: 4174189579-3384076093
Opcode ID: 183c7dea5a7a14b78e00f8b98717bbe35468f702674c4abe9cc66e8b483eebbf
Instruction ID: 9be33f1b6c976d50fe049d3dbfce24d7d777a259f382f3ac13194fa7ea5b3df7
Opcode Fuzzy Hash: 183c7dea5a7a14b78e00f8b98717bbe35468f702674c4abe9cc66e8b483eebbf
Instruction Fuzzy Hash: 7A312F21A0AB4181FA11EF16B8041AAF2B0FB84BD4F954431ED8D87BBDEF3CE5658754

Function 00007FF7A9247F8D Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247FC8
memcpy.VCRUNTIME140 ref: 00007FF7A9247FEE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$memcpy
String ID: Signature: %s$Signature
API String ID: 3519880569-1663925961
Opcode ID: cb0d4ea2a7050a2b1650e01b59649295566e8533d6446b6619e8b8b6d09c5561
Instruction ID: c842e8484fb139a7a8feb75402ef5c00fdf9d046e68371a9a76f70ad6650127e
Opcode Fuzzy Hash: cb0d4ea2a7050a2b1650e01b59649295566e8533d6446b6619e8b8b6d09c5561
Instruction Fuzzy Hash: D5319225B1A78241FE15AF16A4042B9A3B1BF85BD4F850532CE5D9B7E9EF3CE0258310

Function 00007FF7A922E966 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A920AB50: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A920AB94

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922E9A4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A922E9B6

Strings

Select failed, xrefs: 00007FF7A922EA48
OK [UIDVALIDITY %19[0123456789]], xrefs: 00007FF7A922E988
Mailbox UIDVALIDITY has changed, xrefs: 00007FF7A922E9EE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: __stdio_common_vsscanf_strdupfree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 860312144-3309259123
Opcode ID: 235c9773d9c3f4447a378acb8e1d41f541a97c0b740dbcc249094d7f197414f8
Instruction ID: 929d464fd7471ce3db7806845dc97bc14fb1e0a24efe01e453ee1674f7f81c29
Opcode Fuzzy Hash: 235c9773d9c3f4447a378acb8e1d41f541a97c0b740dbcc249094d7f197414f8
Instruction Fuzzy Hash: 4F313D62E0A64281FA64BF11E4401F9A374BB84794FD60431DA4E876F9DF2CE8759362

Function 00007FF7A9247098 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92470CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Strings

Start Date: %s, xrefs: 00007FF7A92475A7
FALSE, xrefs: 00007FF7A92470C1
TRUE, xrefs: 00007FF7A92470BA
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: Start Date: %s$FALSE$Start Date$TRUE
API String ID: 1865132094-176635895
Opcode ID: 94564cdf23b3c4c0c2f253074c127455bac0f26047c861915be888eff69a368d
Instruction ID: 63445f45e72f73c9e86aa940840b1bda08f2e97015a366bd59db680a5cfbfd5b
Opcode Fuzzy Hash: 94564cdf23b3c4c0c2f253074c127455bac0f26047c861915be888eff69a368d
Instruction Fuzzy Hash: 7121A462A0A6C295FA219F10A4442B5A775BB45784FC90432CE4D8B7BDDF3CE164C320

Function 00007FF7A9247D15 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9247D18
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc$_strdup
String ID: Signature: %s$Signature
API String ID: 1941130848-1663925961
Opcode ID: ca2cf2f3998b32dfefa195ad26401292febcb097f13e839a725804ea39ca33d1
Instruction ID: 77e71f214c1a0873e0d3171cbfa2d63de7955b3d36e7c2d9a4a25bac1bff4e9d
Opcode Fuzzy Hash: ca2cf2f3998b32dfefa195ad26401292febcb097f13e839a725804ea39ca33d1
Instruction Fuzzy Hash: 3321A466A0AA8282FA10EF15A8442FAA370FF84784F850432CE4D9B7B9DF3CD155C710

Function 00007FF7A920F080 Relevance: 10.0, APIs: 8, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F091
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0A1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0AF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0BD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0CB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0D9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0E7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9212886), ref: 00007FF7A920F0F5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f483a9809256ab1cf9d6a0bc373d10a98d2bf4a22c8ed6b14dbd54092e32da5c
Instruction ID: c56e482ff352736043b29bdb38ab1bec01c6f9a7c413beec6f459d9ba744fef0
Opcode Fuzzy Hash: f483a9809256ab1cf9d6a0bc373d10a98d2bf4a22c8ed6b14dbd54092e32da5c
Instruction Fuzzy Hash: 8A01A93654AB41C2E704AF21E99413CB3B4FB88F997511525CF8E87B68CF38D4A9C351

Function 00007FF7A9212150 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7A92129CB), ref: 00007FF7A9212167
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7A92129CB), ref: 00007FF7A9212198

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-0
Opcode ID: 6b7e603c4e87d9412e508be15f775146f324da046c8951ac164a71ca50280b66
Instruction ID: 399e9a0750651e80af71d08ecb2ebb7547408928f3feeafa1841322c8d782331
Opcode Fuzzy Hash: 6b7e603c4e87d9412e508be15f775146f324da046c8951ac164a71ca50280b66
Instruction Fuzzy Hash: 84917B2260ABC18AE7559F3498403AD77A0F755B28F580235DBAC4B3EACF2991B4C721

Function 00007FF7A924740C Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924744F
memcpy.VCRUNTIME140 ref: 00007FF7A9247475
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247548
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Strings

Start Date: %s, xrefs: 00007FF7A92475A7
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3401966785-2389359183
Opcode ID: e1455ee6bc3e7891fa22a97040ea1fb82da9937df63542e9ea2e8d33c58bccb8
Instruction ID: 87e6193764b2e4a8b96ce8ebd5eaf69df0f47b50eef94ad7df4e796805320c4e
Opcode Fuzzy Hash: e1455ee6bc3e7891fa22a97040ea1fb82da9937df63542e9ea2e8d33c58bccb8
Instruction Fuzzy Hash: AF415B51A0B2C241FB196F2544142B8AB72EB45790F894635CA3F8B7FDDE2CE0698320

Function 00007FF7A91FC630 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A91FC71A
memcpy.VCRUNTIME140 ref: 00007FF7A91FC729
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FC75D
memcpy.VCRUNTIME140 ref: 00007FF7A91FC764
memcpy.VCRUNTIME140 ref: 00007FF7A91FC773
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91FC798

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 78c2b8e93ec47cdde9f1bc7ef5506b44f8f4ae7c003568ea7a19bcbb7900a274
Instruction ID: 496e92d5f32e0719a1c0a1453fa71c488d00a6639a49aaafe1fc3a0c2e960ca9
Opcode Fuzzy Hash: 78c2b8e93ec47cdde9f1bc7ef5506b44f8f4ae7c003568ea7a19bcbb7900a274
Instruction Fuzzy Hash: 7231B02270AB4591EA15AF16E5041E8E265AB44BE0FC50B32DF6D877E9EF2CE062D310

Function 00007FF7A91F4EE0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7A91F3C55,?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F4FD3
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7A91F3C55,?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F4FE1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,0000000F,00007FF7A91F3C55,?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F501A
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7A91F3C55,?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F5024
memcpy.VCRUNTIME140(?,?,00000000,?,?,0000000F,00007FF7A91F3C55,?,?,?,?,?,00007FF7A91F1DBB), ref: 00007FF7A91F5032
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91F5061

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 2691628e1f1264e63b37d251493361a6eea00277962d40671c48dcaa7a9b8ef9
Instruction ID: 2d44364a7bc6b3e50fb87cc226567a34c2a8a911ac7833e856767a5e889c88f7
Opcode Fuzzy Hash: 2691628e1f1264e63b37d251493361a6eea00277962d40671c48dcaa7a9b8ef9
Instruction Fuzzy Hash: A041072770A64545FA11AF15F5042B9E361EB44BE4FC54632DF6D877E9EE3CD0618320

Function 00007FF7A924793F Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 98COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247B29
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247BF2

Strings

Public Key Algorithm: %s, xrefs: 00007FF7A9247BC2
Expire Date, xrefs: 00007FF7A9247AFD
Public Key Algorithm, xrefs: 00007FF7A9247BA8
Expire Date: %s, xrefs: 00007FF7A9247B17

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Public Key Algorithm: %s$Expire Date$Public Key Algorithm
API String ID: 1294909896-2901970132
Opcode ID: 554380663984b8a85f3f15902b26f9bd5831056c7f3383207606f5b56c7b72a6
Instruction ID: 4fad8711cea219a1f8a3cabc73480e59fcb45f1d96e66a74fabb0f773918eed0
Opcode Fuzzy Hash: 554380663984b8a85f3f15902b26f9bd5831056c7f3383207606f5b56c7b72a6
Instruction Fuzzy Hash: 4941DE61A0A78255FB11AF6198001F9A772BB447C8F890532CE1D8B7EEDF3CE2648320

Function 00007FF7A92422D0 Relevance: 9.1, APIs: 6, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,?,?,00007FF7A924188F), ref: 00007FF7A9242316
strchr.VCRUNTIME140(00000000,?,?,00007FF7A924188F), ref: 00007FF7A9242326
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,00007FF7A924188F), ref: 00007FF7A9242350
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9242385
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92423AA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92423CC

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupstrchr$mallocstrncpy
String ID:
API String ID: 2121287944-0
Opcode ID: 153e97552d8942813f09d1aa813a3be213e026c70ad98cfeaebf2c60a192b218
Instruction ID: a4b7e0cbd3d0c91159c0701be1ccaf2b5ed2dd61be76aa50143626b2dac89168
Opcode Fuzzy Hash: 153e97552d8942813f09d1aa813a3be213e026c70ad98cfeaebf2c60a192b218
Instruction Fuzzy Hash: BC31AA31A0AB8186FA55FF166940379BAB0EF85790F4A4634DE4E877E9DF3CE0618710

Function 00007FF7A9246DCF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: 6f18cbeb7746a8b786df44d694cb8e8322c35f1cb9ab480a38ea9d90cc4cf49a
Instruction ID: 8ce7fae56e7adfd03fa25368699070cbe5c4506e53ef1eb6ae13fa64346bfc6f
Opcode Fuzzy Hash: 6f18cbeb7746a8b786df44d694cb8e8322c35f1cb9ab480a38ea9d90cc4cf49a
Instruction Fuzzy Hash: 1941C565A0A78154FF15AF2198041F9A771BB45BC8F890436DE4E8B7EDDF3CE2648320

Function 00007FF7A922F961 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922F9E6
memcpy.VCRUNTIME140 ref: 00007FF7A922FA01
strchr.VCRUNTIME140 ref: 00007FF7A922FA1D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922FA2E

Strings

CAPA, xrefs: 00007FF7A922FA44
Got unexpected pop3-server response, xrefs: 00007FF7A922F981

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: callocfreememcpystrchr
String ID: CAPA$Got unexpected pop3-server response
API String ID: 2887963327-1591402739
Opcode ID: b3ed6b6e2d1323aae1021fb81b21293cef24c4dafde7975687db6a0798cbfde1
Instruction ID: dae4f8189feea74e0ea567f9cbee2f5cecab67e75b4b31e490e0da63d52aa633
Opcode Fuzzy Hash: b3ed6b6e2d1323aae1021fb81b21293cef24c4dafde7975687db6a0798cbfde1
Instruction Fuzzy Hash: DF319C61B0E79291FA19AF2191502F9A2B4BB41790FC20536CF1E836F9CF3CA4758722

Function 00007FF7A9247C70 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

%s%lx, xrefs: 00007FF7A9247CCD
Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$%s%lx$Signature
API String ID: 2190258309-1406629954
Opcode ID: 4e4d09047b3cdbb947732d8811f315ea27631d3bc1e496b7ad3e2d750d5cbd57
Instruction ID: 3509bc47d4361644c1c17ebe1f8505ad554bdad55ebf1524c520b5f6bafa7f5f
Opcode Fuzzy Hash: 4e4d09047b3cdbb947732d8811f315ea27631d3bc1e496b7ad3e2d750d5cbd57
Instruction Fuzzy Hash: F331C522B1A68295FE10AF25E4442B9A770FF85784F950432DE5D9B7B9DF2CE024C750

Function 00007FF7A9237D00 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9237D11
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9237D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9237D8F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupcallocfree
String ID:
API String ID: 1236595397-0
Opcode ID: 18e51c7933e36dbe072fc1e6b9de0d7a764243fc1643ae9b43aad4505edc27b6
Instruction ID: 28970ac9b5a0c531a74077a81b6f34df98584724ee4e5206e0c9535d6fcd5962
Opcode Fuzzy Hash: 18e51c7933e36dbe072fc1e6b9de0d7a764243fc1643ae9b43aad4505edc27b6
Instruction Fuzzy Hash: 5A31B432A0AB8581FB45EF14E4503B9A3B0EB85B84F994030DE4C877E8DF3DD4A58720

Function 00007FF7A9246B71 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 1294909896-517259162
Opcode ID: fdf0165b405180c609463d708bb49a02b6395d80da96d6824e44ca2099b62b5c
Instruction ID: 88cba11bf7739cc0a870b3875615f51fd0351ecb87bdbaf250e43781fa1cfffd
Opcode Fuzzy Hash: fdf0165b405180c609463d708bb49a02b6395d80da96d6824e44ca2099b62b5c
Instruction Fuzzy Hash: C4317365A0B78254FF15AF6194001F9A771AF45788FCA0835DE4E8B7EEDE3CE1648360

Function 00007FF7A9246BAF Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9248830: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924887C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: d2f36c8e533aa65bf272bc8ba16eed6d9482cf31a20ba834183fc25668133949
Instruction ID: ab1e2efcef53f0f981d837e880188068056858c4260680f465a32b877e057bcc
Opcode Fuzzy Hash: d2f36c8e533aa65bf272bc8ba16eed6d9482cf31a20ba834183fc25668133949
Instruction Fuzzy Hash: EE319465A0B78254FF11AF6198001F9A771AF45788F8A1436DE4E8B7EEDF3CE1648360

Function 00007FF7A9246B89 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A924A340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924A375

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9246FAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9247053

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Signature Algorithm, xrefs: 00007FF7A9247027
Serial Number: %s, xrefs: 00007FF7A9246F9C
Serial Number, xrefs: 00007FF7A9246F82
Signature Algorithm: %s, xrefs: 00007FF7A9247041

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc
String ID: Serial Number: %s$ Signature Algorithm: %s$Serial Number$Signature Algorithm
API String ID: 3061335427-517259162
Opcode ID: 323fcd58ecea6a16c295afccc92647082d260c735a11eecebd6353d59ad9483b
Instruction ID: 26332592e8b017f877bba19c54ee2085de308a46e3c5ba36aa3a23b298753aea
Opcode Fuzzy Hash: 323fcd58ecea6a16c295afccc92647082d260c735a11eecebd6353d59ad9483b
Instruction Fuzzy Hash: 0931A665A0B78254FF11AF6198001F9A771AF45788F8A0436DE4E8B7EEDF3CE1648360

Function 00007FF7A9235993 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92359AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9235A2B

Strings

OS/400, xrefs: 00007FF7A92359F9
SITE NAMEFMT 1, xrefs: 00007FF7A9235A0C

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: fe538aab275fc3171028efb847620390d4dffb2370dc283baeecfe34265402ae
Instruction ID: f0597b68b0fbc62e9a75d50967d433f3710a53d0556ee86e8287248fdad0f1ef
Opcode Fuzzy Hash: fe538aab275fc3171028efb847620390d4dffb2370dc283baeecfe34265402ae
Instruction Fuzzy Hash: 9031C425A0E6C285F774AF15D4547BAA3B0EB447A4FD14031CA8D876EDDE3CE466C360

Function 00007FF7A920B0A0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7A920B0D3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7A920B0E7
CloseHandle.KERNEL32 ref: 00007FF7A920B0F4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7A920B116
closesocket.WS2_32 ref: 00007FF7A920B134
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7A920B14D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: e72156355a2816e9e89a9b422e023203ad5753827b4254cb327d050f1c5cb743
Instruction ID: 42279f53f1d6dfd4c046e6439f3f0b402ace978aed712844d3f35cb4c0d118e3
Opcode Fuzzy Hash: e72156355a2816e9e89a9b422e023203ad5753827b4254cb327d050f1c5cb743
Instruction Fuzzy Hash: 12214536605A4196FB60AF12E584269B370FB49B90F454131CF8E87BA9DF3DE4758710

Function 00007FF7A92092D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A92277D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92277F1

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92093A1

Strings

Replaced, xrefs: 00007FF7A9209631
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
Added, xrefs: 00007FF7A920963D
FALSE, xrefs: 00007FF7A920937B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _errno_strdup
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 2151398962-2292467869
Opcode ID: e12f10c06c25c29b3ca564988956bed1e443afc4fd55eb22afd563b6d70a5101
Instruction ID: a473f478e405144693cb9539b5149d50b966f0fae540af4623ce00facdf32e61
Opcode Fuzzy Hash: e12f10c06c25c29b3ca564988956bed1e443afc4fd55eb22afd563b6d70a5101
Instruction Fuzzy Hash: B761526594A68245FFB1AF1594443B9A7B1AF44754F8A4032DB8E826F9DF2CEC64C320

Function 00007FF7A92091CD Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9227720: strchr.VCRUNTIME140 ref: 00007FF7A9227756

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92093A1

Strings

Replaced, xrefs: 00007FF7A9209631
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 00007FF7A9209647
Added, xrefs: 00007FF7A920963D
FALSE, xrefs: 00007FF7A920937B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupstrchr
String ID: %s cookie %s="%s" for domain %s, path %s, expire %I64d$Added$FALSE$Replaced
API String ID: 3727083984-2292467869
Opcode ID: 8afcc1c645df5e162f9a2b91359d1ff63dabb3131ca6873a8123190fd9bf3871
Instruction ID: f7e510e74acd46fe4e8d74d5220378e66964600d918ec6850a1b70a0ba24229d
Opcode Fuzzy Hash: 8afcc1c645df5e162f9a2b91359d1ff63dabb3131ca6873a8123190fd9bf3871
Instruction Fuzzy Hash: 7661726594B78245FFB1AF219444379A7B1AF44794F864032DB8E826FADF2CEC64C320

Function 00007FF7A92221D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92223DD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92223F5

Strings

The requested URL returned error: %d, xrefs: 00007FF7A922237E
Forcing HTTP/1.1 for NTLM, xrefs: 00007FF7A9222299

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: Forcing HTTP/1.1 for NTLM$The requested URL returned error: %d
API String ID: 1865132094-1204028548
Opcode ID: 880982cd06b7de418e4a4004529eeb904e5bd38db217128112a4d66e20e95c12
Instruction ID: 35c769f572746259caa94919ef65a22d37037752de84797acb9e2ca8e3009e15
Opcode Fuzzy Hash: 880982cd06b7de418e4a4004529eeb904e5bd38db217128112a4d66e20e95c12
Instruction Fuzzy Hash: 04519631A0E68281FB68AF2495403FDA7B1EB41B54F990135DA4DCA6EDCF2EE4708771

Function 00007FF7A91F2640 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A91F4340: memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371

Part of subcall function 00007FF7A91F3C60: memcpy.VCRUNTIME140 ref: 00007FF7A91F3CB3

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2712
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F2760
__std_exception_copy.VCRUNTIME140 ref: 00007FF7A91F27B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F27FD

Strings

out_of_range, xrefs: 00007FF7A91F2686

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$__std_exception_copy
String ID: out_of_range
API String ID: 2484256320-3053435996
Opcode ID: 69411949e343efd952bcbe5b76621d8e4763016664c4a99b2c8afe446aad0421
Instruction ID: 1f056de733db0c707071061feb039b6f8b8325623ae4761929bf5b9e06814902
Opcode Fuzzy Hash: 69411949e343efd952bcbe5b76621d8e4763016664c4a99b2c8afe446aad0421
Instruction Fuzzy Hash: 29519032A1AB4599FB00EF64E4403AC7371EB54798F815632DB6D43AE9EF3CD1A58310

Function 00007FF7A921EF80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921EFEA
tolower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921F05B
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A921F0BB

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00007FF7A921F0E2
:%u, xrefs: 00007FF7A921EFFE, 00007FF7A921F064

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: tolower$_time64
String ID: :%u$Hostname in DNS cache was stale, zapped
API String ID: 4068448496-2924501231
Opcode ID: 06351f1d74089b1c4cf54dd601dba43c393ae8743f230a4fab5003ca783ced33
Instruction ID: 61ba252d72747f703f8ce516250ae214390b6034c15b4c7b5de8406b95b22fd8
Opcode Fuzzy Hash: 06351f1d74089b1c4cf54dd601dba43c393ae8743f230a4fab5003ca783ced33
Instruction Fuzzy Hash: 3D41D57261A692D1FA20AF11E8407B8A771EB44B88F954131DE5D877E9DF3CE025C710

Function 00007FF7A91F4340 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4371
memcpy.VCRUNTIME140(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F4436
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A91F448A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91F4491

Part of subcall function 00007FF7A924F220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7A91F441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A924F23A

Strings

https://keyauth.win/api/1.2/, xrefs: 00007FF7A91F4342

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID: https://keyauth.win/api/1.2/
API String ID: 1155477157-3933380396
Opcode ID: 33eb9b0c9fa6c3dd31b06b9bf23052ed593f8d5e9918006aba88df42aaf8b3cc
Instruction ID: cfd085b9d969aa852b831ac293537ed13e216b1486521906f6dd808960a9d7c2
Opcode Fuzzy Hash: 33eb9b0c9fa6c3dd31b06b9bf23052ed593f8d5e9918006aba88df42aaf8b3cc
Instruction Fuzzy Hash: BC31F923B07A5944FE16EE59E54827892609B40FE4F864631CF2D577E5EE7CE0A28314

Function 00007FF7A9236A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A922C0B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,?,00000000,00007FF7A921343F), ref: 00007FF7A922C0DE

_open.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9236AFF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9236B4B
_close.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9236B62
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9236B7B

Strings

Couldn't open file %s, xrefs: 00007FF7A9236B29

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_close_openmalloc
String ID: Couldn't open file %s
API String ID: 3412525164-447283422
Opcode ID: 59d9bdc89a16612f8a46926a7e35e4debfea2d3dc4d7380ec52f6a9a83d830bb
Instruction ID: 47695c0fe8e6b8f6679d455ec004eeef1911107f995d2056d1a6d102c9e5659b
Opcode Fuzzy Hash: 59d9bdc89a16612f8a46926a7e35e4debfea2d3dc4d7380ec52f6a9a83d830bb
Instruction Fuzzy Hash: BD41C232A09BC181FB189F25E40126AE7B6FB44B94F898131DA9D876ECDF3CE4618711

Function 00007FF7A9215DB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A9215E2E

Part of subcall function 00007FF7A9202530: GetLastError.KERNEL32 ref: 00007FF7A9202552
Part of subcall function 00007FF7A9202530: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A920255A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215E4C
recv.WS2_32 ref: 00007FF7A9215E77
WSAGetLastError.WS2_32 ref: 00007FF7A9215E89

Strings

Recv failure: %s, xrefs: 00007FF7A9215EB5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLast$_errnofreememcpyrecv
String ID: Recv failure: %s
API String ID: 267823591-4276829032
Opcode ID: ebcf257c4a2114831f15766f2dc4dfb20bbce8943d5d9083b2c15b3b8f1d6ac9
Instruction ID: f1e06b4dd259d6e69e3282563a18504aec2a0bd9b2bb3529826f78765268537f
Opcode Fuzzy Hash: ebcf257c4a2114831f15766f2dc4dfb20bbce8943d5d9083b2c15b3b8f1d6ac9
Instruction Fuzzy Hash: 30318B76B06B4181FB10AF15E8806AAA3A0BB48FD8FA14135DE1D877D9DF3CD4759350

Function 00007FF7A9249489 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92494B0
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9249963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9249977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92499DE

Strings

FALSE, xrefs: 00007FF7A92494A5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: isupper$_strdupfree
String ID: FALSE
API String ID: 3359907120-3701058176
Opcode ID: a093fb7c3125ffeb7d49eb43a9c9f91557a493e485a83db2e56f96e9643b04a7
Instruction ID: e405467ca0b794e9680d0773f6ceef15a6d866a17bfc6c9638d4785f5a9a9763
Opcode Fuzzy Hash: a093fb7c3125ffeb7d49eb43a9c9f91557a493e485a83db2e56f96e9643b04a7
Instruction Fuzzy Hash: F631C526E8E59645FF12DF299544378EBB09B81F64F868631C59A817EDCE2C90A5C320

Function 00007FF7A9230E00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9230E3B
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9230E81
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9230EE6

Strings

RCPT TO:<%s>, xrefs: 00007FF7A9230ECB
RCPT TO:<%s@%s>, xrefs: 00007FF7A9230EBD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfreestrpbrk
String ID: RCPT TO:<%s>$RCPT TO:<%s@%s>
API String ID: 1812939018-579818044
Opcode ID: 9778b4d2c78d1be126744fc6fd40f20908801dcedee1af406dd428e0304b0b5a
Instruction ID: 0d461ce1645049dd0adee25c0a58c7b56d135fc5f7168f474a56f9dc81eb3e0f
Opcode Fuzzy Hash: 9778b4d2c78d1be126744fc6fd40f20908801dcedee1af406dd428e0304b0b5a
Instruction Fuzzy Hash: B5318266A5AB8181FB01EF15E4402B9F3B1EB84B90F894231EA9E437E9DF7CD551C320

Function 00007FF7A9248D30 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9248D5D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249226

Strings

%s: %s, xrefs: 00007FF7A9249211
FALSE, xrefs: 00007FF7A9248D52
TRUE, xrefs: 00007FF7A9248D4B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: %s: %s$FALSE$TRUE
API String ID: 1865132094-3430445539
Opcode ID: 4310e46cd7ce90e1ad1bdfb38d41339c9ff7328e9a1c26c0aff0c3a6f9394385
Instruction ID: 7eda79afa9a6efa2153040ab8ce0c35f175cc0290600abe6faec579de15f5882
Opcode Fuzzy Hash: 4310e46cd7ce90e1ad1bdfb38d41339c9ff7328e9a1c26c0aff0c3a6f9394385
Instruction Fuzzy Hash: 7E01C465A0E78291FE65AF55A8043B5A370AB41F80F854032CE4D873E9DF3CE1A58321

Function 00007FF7A9244360 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A92442C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A92442E6
Part of subcall function 00007FF7A92442C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244307
Part of subcall function 00007FF7A92442C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244322
Part of subcall function 00007FF7A92442C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244330
Part of subcall function 00007FF7A92442C0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244342

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92443E6

Strings

HTTP, xrefs: 00007FF7A924436A
NTLM, xrefs: 00007FF7A924439E, 00007FF7A9244450

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM
API String ID: 2190258309-4188377180
Opcode ID: 43012eb3f689aee281185361822544b533c42a8cafd51f74645435e902687c1b
Instruction ID: 397ee141a02abf36c7505983a104976e4579319c6f904e3edec0b365922207c9
Opcode Fuzzy Hash: 43012eb3f689aee281185361822544b533c42a8cafd51f74645435e902687c1b
Instruction Fuzzy Hash: E261513260AB8582EB60DF15E44066AB3F4FB88B84F954135DE8D87BA8DF3CD564CB50

Function 00007FF7A9231A6B Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9231B20

Strings

ABOR, xrefs: 00007FF7A9231C1B
control connection looks dead, xrefs: 00007FF7A9231D12
Remembering we are in dir "%s", xrefs: 00007FF7A9231BB8
Failure sending ABOR command: %s, xrefs: 00007FF7A9231C41

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: ABOR$Failure sending ABOR command: %s$Remembering we are in dir "%s"$control connection looks dead
API String ID: 1294909896-1891748601
Opcode ID: 3966cbdc087ff2c56d545021f4f9f42fb389aac008171acb0951deb46aa5e794
Instruction ID: c3513d9f7a860902a7f78ab82848bd9774fde851aca493bac35ffb2ba917c379
Opcode Fuzzy Hash: 3966cbdc087ff2c56d545021f4f9f42fb389aac008171acb0951deb46aa5e794
Instruction Fuzzy Hash: E851CB6190E68245FA68FF3055903BAA271EF41364FC60631C76D871EBDF3CE4658361

Function 00007FF7A9249D65 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249DA8
memcpy.VCRUNTIME140 ref: 00007FF7A9249DCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249E9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249EEF

Strings

TRUE, xrefs: 00007FF7A9249EF9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: TRUE
API String ID: 3401966785-3412697401
Opcode ID: 7a60933361d66e042f4ed40c107b40e861dd608e334930d086dd408f562776e0
Instruction ID: 29b17119ede32fbb5893f474fbdb7f9390bb03a97f6dac94f157a006a273e20d
Opcode Fuzzy Hash: 7a60933361d66e042f4ed40c107b40e861dd608e334930d086dd408f562776e0
Instruction Fuzzy Hash: 7C418B26B4B69141FF059E159914374AB62EB81FE0F958632CA6EC73EDCE2DD0A5C320

Function 00007FF7A9249079 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92490BC
memcpy.VCRUNTIME140 ref: 00007FF7A92490E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92491B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249226

Strings

%s: %s, xrefs: 00007FF7A9249211

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$mallocmemcpy
String ID: %s: %s
API String ID: 3401966785-1451338302
Opcode ID: e66466ae2840696eb1dc030d8444e1a2cc7fa524691e41c30585bedcb2711759
Instruction ID: c6d796e9e0639f6dedd422dfc41a2c0e7b2a510344942ace156b5c394a7ba14c
Opcode Fuzzy Hash: e66466ae2840696eb1dc030d8444e1a2cc7fa524691e41c30585bedcb2711759
Instruction Fuzzy Hash: 6C417B15A4B2D146FA28AE0654183B5A7A1EB81FE0F45C235CF6F877EDDE2CD0658320

Function 00007FF7A9247283 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7A92473B1
Start Date: %s, xrefs: 00007FF7A92475A7
GMT, xrefs: 00007FF7A924733E
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Start Date: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$Start Date
API String ID: 1294909896-619256714
Opcode ID: 9a15ba1d605ed583abdf94cf9e0e31442b73b194b7c266ca60172562ee573b3c
Instruction ID: 39601013260de5e22c5f6d34574a0f14729681683879c02716368637b13d2325
Opcode Fuzzy Hash: 9a15ba1d605ed583abdf94cf9e0e31442b73b194b7c266ca60172562ee573b3c
Instruction Fuzzy Hash: F051A361A0B6D295FB21AF2095041B8EBB9EB41780FC64432DA5D866ECDF3CE665C720

Function 00007FF7A922E480 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A92277D0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A92277F1

memcpy.VCRUNTIME140 ref: 00007FF7A922E5F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922E5FF

Strings

Found %I64d bytes to download, xrefs: 00007FF7A922E552
Failed to parse FETCH response., xrefs: 00007FF7A922E4DE
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 00007FF7A922E5BD

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _errnofreememcpy
String ID: Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 738009125-4268564757
Opcode ID: 5aab1c2ab631b84c312a4581d797abb5c7e6f2d2f3aab9d97cd5028584257e8e
Instruction ID: 593b49b3018f50e11b7a18c615c832caca13a4d4d08ba7aaad29c0c74791690a
Opcode Fuzzy Hash: 5aab1c2ab631b84c312a4581d797abb5c7e6f2d2f3aab9d97cd5028584257e8e
Instruction Fuzzy Hash: 7551AF22A097C682FA14AF65E4006F9E374FB45B94F954032DB8D83AE9DF7CE065C321

Function 00007FF7A92471C0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Strings

Start Date: %s, xrefs: 00007FF7A92475A7
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7A924726F
GMT, xrefs: 00007FF7A924721C
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$Start Date
API String ID: 1294909896-2752585153
Opcode ID: 5be12d62590af904ce245efa497dd516717957f9578276e8508743edb4b2da2d
Instruction ID: dd3e1165a210ad9cadb3ace08778ebf9171088bd1dcd35210d88693f1032d350
Opcode Fuzzy Hash: 5be12d62590af904ce245efa497dd516717957f9578276e8508743edb4b2da2d
Instruction Fuzzy Hash: D7317261A0EA8295FB21AF2094001B9E775FB45784FCA4432DA5D9B2EDDF3CE664C320

Function 00007FF7A9247F4E Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 821f344e4387d99d094f460dd31e790350a8fa6c45690ae250e442adb781d46b
Instruction ID: 837d5c7f9d9aa0aef0b84f80c04ee174e1bb9032e7c32ac8217267009f389607
Opcode Fuzzy Hash: 821f344e4387d99d094f460dd31e790350a8fa6c45690ae250e442adb781d46b
Instruction Fuzzy Hash: 7321B426B09AC286FA109F16A8442E9A370FB88BD4F890532DE6D977E9DF3CD155C710

Function 00007FF7A9231FC0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A923208B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92320A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92320B8

Strings

QUIT, xrefs: 00007FF7A9231FEF
Failure sending QUIT command: %s, xrefs: 00007FF7A9232013

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 5283eec305416bd89451f50decc0ddadba9a72e66af60d126ba8d4c79a7ff1cd
Instruction ID: ec49826588896c94a2317cd3da4f31aa6a33268c3f2dd0b5d390449939c39a50
Opcode Fuzzy Hash: 5283eec305416bd89451f50decc0ddadba9a72e66af60d126ba8d4c79a7ff1cd
Instruction Fuzzy Hash: B8317032A0A78291FB44EF2595402BAA7B0FB45F84FC54031DA5D8B6E9CF3CD065C361

Function 00007FF7A9228BC0 Relevance: 7.6, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9214FA0), ref: 00007FF7A9228BF5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9214FA0), ref: 00007FF7A9228C0A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9214FA0), ref: 00007FF7A9228C1F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9214FA0), ref: 00007FF7A9228C4C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9214FA0), ref: 00007FF7A9228C55
memcpy.VCRUNTIME140(?,?,?,00007FF7A9214FA0), ref: 00007FF7A9228C89

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$calloc$memcpy
String ID:
API String ID: 3478730034-0
Opcode ID: 4e5a0de7d13c98f7526ba3692002c6a0f4b14e26cd4a486146107d706928a7f8
Instruction ID: ae21d522a102c06fed3b80e26e734ec9eb02e8032ff5018eb016aedf278a0821
Opcode Fuzzy Hash: 4e5a0de7d13c98f7526ba3692002c6a0f4b14e26cd4a486146107d706928a7f8
Instruction Fuzzy Hash: 7E219271A0BB8186F714AF119860279A7B0FB48B90F854635DB9E9B7ECDF3CD4608711

Function 00007FF7A9237E30 Relevance: 7.6, APIs: 5, Instructions: 62stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9237E61
strchr.VCRUNTIME140 ref: 00007FF7A9237E8D
strchr.VCRUNTIME140 ref: 00007FF7A9237EA4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9237EC3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$_strdupmalloc
String ID:
API String ID: 4236146995-0
Opcode ID: 09a0a5750fdd496b22acac525b84c4e6bfd2504136f8648360faf783504f0cf1
Instruction ID: 458478a5861565111d1fa585944e9c4f264fcffeadbe66be6fb910a96311390e
Opcode Fuzzy Hash: 09a0a5750fdd496b22acac525b84c4e6bfd2504136f8648360faf783504f0cf1
Instruction Fuzzy Hash: 8C219D62A16B8581FF85EF61D4403A963E0EB89B54F490134DF4D8BBA8EF3CD4A0C325

Function 00007FF7A9247414 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924744F
memcpy.VCRUNTIME140 ref: 00007FF7A9247475
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Strings

Start Date: %s, xrefs: 00007FF7A92475A7
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemallocmemcpy
String ID: Start Date: %s$Start Date
API String ID: 3056473165-2389359183
Opcode ID: 1d6b5fb7cdc13361c7e07b199e903807efadbc61c393c67ccd4a28155f3d3ce8
Instruction ID: 492e73246b8fb88fae41306be0ebd4ccf3a7426c8d7b99d99e648d91c17505e2
Opcode Fuzzy Hash: 1d6b5fb7cdc13361c7e07b199e903807efadbc61c393c67ccd4a28155f3d3ce8
Instruction Fuzzy Hash: 37210695A0B3C251FE15AF2189042B8A772AF557D4F8A4531CD2D8B7FDDF3CA5648320

Function 00007FF7A9247CE8 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc
String ID: Signature: %s$Signature
API String ID: 2190258309-1663925961
Opcode ID: 9f9e178f16ade19dc1900a37d73241538544160596d2ff85383f5765750df41d
Instruction ID: 625af08357f714c2f5e1a6bc64b09051d8a42b5dbcccf50eb2c6d28bde9369b4
Opcode Fuzzy Hash: 9f9e178f16ade19dc1900a37d73241538544160596d2ff85383f5765750df41d
Instruction Fuzzy Hash: 4B21A466A1A68281FA10EF16E8442FAA370FF84784F850432DE4D9B7BDEF3CD0658750

Function 00007FF7A9247D26 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9248830: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924887C

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: a3048aa88f5481e977e4bf15883ddcb57f422f8ed18edb564a71fd8417773f62
Instruction ID: 524aeb9f6b554750aab43f60dbf183893cb4cc9d6645396bcbdc43a1f5693a29
Opcode Fuzzy Hash: a3048aa88f5481e977e4bf15883ddcb57f422f8ed18edb564a71fd8417773f62
Instruction Fuzzy Hash: 98218066A1AA8282FA10EF16E8442EAA370FF84784F850432DE4D9B7BDDF3CD055C750

Function 00007FF7A9247D00 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A924A340: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924A375

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248129
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9248169
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924817C

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Signature, xrefs: 00007FF7A92480FF
Signature: %s, xrefs: 00007FF7A9248117

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: malloc$free
String ID: Signature: %s$Signature
API String ID: 1480856625-1663925961
Opcode ID: 29df05abbe23e080694c13c828d848e5daf697a94d1e2d7977cb9b17836fe0f0
Instruction ID: 7c8d0454d4e7775f9758189b718bc641f13d52938349a4d862f391dfec743d12
Opcode Fuzzy Hash: 29df05abbe23e080694c13c828d848e5daf697a94d1e2d7977cb9b17836fe0f0
Instruction Fuzzy Hash: CB218366A0AA8282FA10EF15E8442EAA370FF84784F850432DE4D9B7BDDF3CD0558750

Function 00007FF7A920AC30 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7A920B0D3
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00007FF7A920B0E7
CloseHandle.KERNEL32 ref: 00007FF7A920B0F4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7A920B116
closesocket.WS2_32 ref: 00007FF7A920B134
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 00007FF7A920B14D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 4878dfb08abf4d62c0811a917b0330daba04addaecc353a69332e903f3cdf168
Instruction ID: f0e5e025a83e514b0988dc78cf289b9e65eb9d522bd420f35af9599c42a9b439
Opcode Fuzzy Hash: 4878dfb08abf4d62c0811a917b0330daba04addaecc353a69332e903f3cdf168
Instruction Fuzzy Hash: E5112E3660AB4196FB60AF12E580229B370FB49B90F454131CF8E87B99CF3DE4758720

Function 00007FF7A9202C70 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF7A92025A9), ref: 00007FF7A9202F0F

Strings

No data record of requested type, xrefs: 00007FF7A9202EF3
Unrecoverable error in call to nameserver, xrefs: 00007FF7A9202EFC
Host not found, xrefs: 00007FF7A9202ED8
Host not found, try again, xrefs: 00007FF7A9202F05

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strncpy
String ID: Host not found$Host not found, try again$No data record of requested type$Unrecoverable error in call to nameserver
API String ID: 3301158039-3625861382
Opcode ID: 55d1d090db7c1c3de59bb57f77865a81e67a0d711e357185eca95066715039be
Instruction ID: b53056e90f0ce687cf014f757f4fb24d54a372361a6a654f3a6a2113c3163c39
Opcode Fuzzy Hash: 55d1d090db7c1c3de59bb57f77865a81e67a0d711e357185eca95066715039be
Instruction Fuzzy Hash: FF11CA52A0D54241FA9DEF18F598178A6B0AF157C0FCA5133CA0E866FDDE6CFCB48220

Function 00007FF7A9249A25 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9249A4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249EEF

Strings

FALSE, xrefs: 00007FF7A9249A40
TRUE, xrefs: 00007FF7A9249EF9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: FALSE$TRUE
API String ID: 1865132094-1412513891
Opcode ID: 52dbfcf0bc509b08e57582c530e74b9c749b78a1f88125740cda3f1396062d8a
Instruction ID: 2eb7ad5902c3c3cf82666b84192505c7fbf328ea4ca477f2455e343bef619cea
Opcode Fuzzy Hash: 52dbfcf0bc509b08e57582c530e74b9c749b78a1f88125740cda3f1396062d8a
Instruction Fuzzy Hash: 2041E766B4BB5584FF159E55900027CAB71AB41F98F978932CE4DC63ECDE2CE090C720

Function 00007FF7A923BA70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99networkCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A923BAB1
_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF7A923BAF0
WSAGetLastError.WS2_32 ref: 00007FF7A923BB48

Strings

TFTP response timeout, xrefs: 00007FF7A923BB0A

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _time64$ErrorLast
String ID: TFTP response timeout
API String ID: 3339832089-3820788777
Opcode ID: bcc65da3112b9898e49bdcb51b83b6df0a4a8cec6a207d6273f9c3bbd6bb681d
Instruction ID: 7fd36fe5a40f1123bb8d19ee4aab01b61c411034f3cc52ed7c8212d9d3932053
Opcode Fuzzy Hash: bcc65da3112b9898e49bdcb51b83b6df0a4a8cec6a207d6273f9c3bbd6bb681d
Instruction Fuzzy Hash: CD41D33260AA4181FB64AF25D4102BAB371EB84BA0F814231DE1D877EDDF3CD421C720

Function 00007FF7A92494BE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9249963
isupper.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9249977
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92499DE

Strings

%s%lx, xrefs: 00007FF7A9249528

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: isupper$free
String ID: %s%lx
API String ID: 573759493-530121141
Opcode ID: 78bacc826303a778cdbb3b0cd42861cc680a6f886fa74149ed1fd9057103a59a
Instruction ID: c755106b4765d2d086a7ea00831868997dd4972dea2ed6d0bcdd9c331d89144b
Opcode Fuzzy Hash: 78bacc826303a778cdbb3b0cd42861cc680a6f886fa74149ed1fd9057103a59a
Instruction Fuzzy Hash: 87311526E4F59645FF12AF248444378EFB19B92F44F968531C58EC1BEDCE2DA060C720

Function 00007FF7A9215B20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C45
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C60

Strings

..., xrefs: 00007FF7A9215BB2
..., xrefs: 00007FF7A9215BC8

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: fwrite
String ID: ...$...
API String ID: 3559309478-2253869979
Opcode ID: fe69c839dbd5bc766fae40da0c673553272da8655bc74c9512825af1007667f4
Instruction ID: 5eb537440fa00b3eeea393ab33349a9a2e55d6d6d3f8edc329f3fab0ae5c6596
Opcode Fuzzy Hash: fe69c839dbd5bc766fae40da0c673553272da8655bc74c9512825af1007667f4
Instruction Fuzzy Hash: B631D03160AA8191FB20EF10E8447B9A3A1FB84B94F968131CA5D837E8CF3DE165C780

Function 00007FF7A9224160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9223B99), ref: 00007FF7A92241ED

Strings

Failed to alloc memory for big header!, xrefs: 00007FF7A92241F8
Rejected %zu bytes header (max is %d)!, xrefs: 00007FF7A922418B

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: realloc
String ID: Failed to alloc memory for big header!$Rejected %zu bytes header (max is %d)!
API String ID: 471065373-1365219457
Opcode ID: f86380c646ce5bcb2119ccde352bdc61727163a04116e283a44783e2d53e82c4
Instruction ID: 23a860c45c66e0cad5824cc9999090805aa58e491c6f3956b7b1c656106ec4e5
Opcode Fuzzy Hash: f86380c646ce5bcb2119ccde352bdc61727163a04116e283a44783e2d53e82c4
Instruction Fuzzy Hash: EE215132719A8586EB04AF1AE5402ADA771F748BC4F954131EF5D47B69CF3CD4A1C350

Function 00007FF7A9204343 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92043D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92043EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920440B

Strings

:, xrefs: 00007FF7A92043C6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: c12e5907c8ac4808f97f9a4378fe066be5d850ebbbfdff9d712e82b163fb025c
Instruction ID: 2a42f97513a8842b5b5ca65aeaa001a2a110a337a1d0e18a2564c94173481ac4
Opcode Fuzzy Hash: c12e5907c8ac4808f97f9a4378fe066be5d850ebbbfdff9d712e82b163fb025c
Instruction Fuzzy Hash: C321673260AB8585FAA5AF15E540365B3B0EB44754F998131DF9C877E8EF3CE8648720

Function 00007FF7A922DF10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

LIST "%s" *, xrefs: 00007FF7A922DF97
%s%s, xrefs: 00007FF7A922DF43

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID:
String ID: %s%s$LIST "%s" *
API String ID: 0-1744359683
Opcode ID: 82659c531ac46db61e45604e64b3c51eda8f20cc3ff10ad045b5a1318bb21b71
Instruction ID: feec348612d470e483f99b92c0a9a04eeecb4d791df15ed3035d4d3940731a02
Opcode Fuzzy Hash: 82659c531ac46db61e45604e64b3c51eda8f20cc3ff10ad045b5a1318bb21b71
Instruction Fuzzy Hash: 76113D31A0A74291FA14AF55E4401F9A7B0EB48BC4F8A4432EE0D877A9DF2CE9658360

Function 00007FF7A92044C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A92043D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92043EE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920440B

Strings

:, xrefs: 00007FF7A92043C6

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$_strdup
String ID: :
API String ID: 2653869212-336475711
Opcode ID: fbae02e50cc18ef5b5a9e0c186c9653f79c9926cbf91814a9cb1437aa3e86943
Instruction ID: 3ade4bbfb0413a436a700f86e5aef3c749ee937d443b9f766997c83527423ff5
Opcode Fuzzy Hash: fbae02e50cc18ef5b5a9e0c186c9653f79c9926cbf91814a9cb1437aa3e86943
Instruction Fuzzy Hash: 6711693260BB8585FAA59F19E540365B370EB44750F958131CF9C837E8EF3CE8648720

Function 00007FF7A923A4C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7A923A4FD
WSAGetLastError.WS2_32 ref: 00007FF7A923A507

Strings

SENT, xrefs: 00007FF7A923A522
Sending data failed (%d), xrefs: 00007FF7A923A50D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 4fdbe3d46c39b5b2be172d77a634fe70c18dd00084c841988a18434b7b5d76a9
Instruction ID: 484419676f0b85cf903c22769824f4b2bd0bc344f1644c857d8e00f26597ed20
Opcode Fuzzy Hash: 4fdbe3d46c39b5b2be172d77a634fe70c18dd00084c841988a18434b7b5d76a9
Instruction Fuzzy Hash: 0301F532719A82C1EB14AF16E840569BB30FB84FC4B8A4131CB5D83769DE3CD511C790

Function 00007FF7A9247191 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9247194
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

Start Date: %s, xrefs: 00007FF7A92475A7
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: Start Date: %s$Start Date
API String ID: 3985033223-2389359183
Opcode ID: 5aed8597f901552310ba748cc73d7b78091621cb25b40185b1c473950a9b6176
Instruction ID: d638810fa6c65949e66d68d7e12336f763244121245ab2f766408e3c380a75de
Opcode Fuzzy Hash: 5aed8597f901552310ba748cc73d7b78091621cb25b40185b1c473950a9b6176
Instruction Fuzzy Hash: 60018891A0F68261FA15AF1054041F5A776AF45784FCA4831CE0E8E5FDDF3CA5748331

Function 00007FF7A92220C0 Relevance: 6.3, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF7A9222124
strchr.VCRUNTIME140 ref: 00007FF7A9222137
strchr.VCRUNTIME140 ref: 00007FF7A9222149
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A922217B
memcpy.VCRUNTIME140 ref: 00007FF7A92221A5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strchr$mallocmemcpy
String ID:
API String ID: 320687583-0
Opcode ID: 669084abc15617068597db42d5e804fa019d3102868cd429b047c0c84ecd3ed1
Instruction ID: 2f5f967083cf82cce368e8159fb3da248b88c800ff56c66f5b54493be1b11fdc
Opcode Fuzzy Hash: 669084abc15617068597db42d5e804fa019d3102868cd429b047c0c84ecd3ed1
Instruction Fuzzy Hash: 5F21D511A0F69101FE59AF1155502F9E6E19F44BC4F8D4131DE8C877EAEE2EE5628320

Function 00007FF7A92442C0 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A92442E6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244307
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244322
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244330
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9240D55), ref: 00007FF7A9244342

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5b3e946a27e07d252e929778e6aff48a1a8b80c127e65d9acecdd987244c36db
Instruction ID: 911e151ab7c00bf73bc85b3e7dda37e851a9dc7411612db263e3146712ece0e8
Opcode Fuzzy Hash: 5b3e946a27e07d252e929778e6aff48a1a8b80c127e65d9acecdd987244c36db
Instruction Fuzzy Hash: A5119536606B4182EB04EF26E99012CB3B4FF84F887554525CE4E87BB8CF38D8A5C351

Function 00007FF7A9249BDF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249EEF

Strings

%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7A9249D01
GMT, xrefs: 00007FF7A9249C8E
TRUE, xrefs: 00007FF7A9249EF9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$TRUE
API String ID: 1294909896-910067264
Opcode ID: 827816eb88385286688fad259ded2f9a8fa2d6193bbe7a158b01ee7b8134f968
Instruction ID: d34caed027bb2573a481716a2ca844b500cfde56a2e75c0db3f6907c9ccea446
Opcode Fuzzy Hash: 827816eb88385286688fad259ded2f9a8fa2d6193bbe7a158b01ee7b8134f968
Instruction Fuzzy Hash: FD510576A8E69654FB109F10E504179EBB5EB85B90FD68032C94D826ECCF3CD461C310

Function 00007FF7A9248EF0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249226

Strings

%s: %s, xrefs: 00007FF7A9249211
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00007FF7A924901A
GMT, xrefs: 00007FF7A9248FAE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %s: %s$ GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s
API String ID: 1294909896-2632828617
Opcode ID: 31be0a04404c87ce6739d3f6a56588eab08c8b8809761ae956e84f7110d28733
Instruction ID: fb96fd23a8f1964216671497b2917ced01a6e9f7c838dc72662da0b2d80232c9
Opcode Fuzzy Hash: 31be0a04404c87ce6739d3f6a56588eab08c8b8809761ae956e84f7110d28733
Instruction Fuzzy Hash: D441C661A1E69295FA60AF15A4042B9F7B2FB81B90FD68031CE5D877E8CF3CE565C310

Function 00007FF7A91FD500 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91FD1C8), ref: 00007FF7A91FD5DE
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91FD1C8), ref: 00007FF7A91FD60C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A91FD1C8), ref: 00007FF7A91FD675

Part of subcall function 00007FF7A924F220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7A91F441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A924F23A

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91FD682

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmallocmemcpymemset
String ID:
API String ID: 2942768764-0
Opcode ID: 3e328a47ceb9c28100f02eb2afa9d9752b4eedd341486f30e2d669ee0c81cc19
Instruction ID: 3968816cf27edbc9e08d1d6bca5cc30d791f3995dec8ca6ab9e5cd1a5e026e49
Opcode Fuzzy Hash: 3e328a47ceb9c28100f02eb2afa9d9752b4eedd341486f30e2d669ee0c81cc19
Instruction Fuzzy Hash: FF41E877706A4951EA11EF25E10427DA3B0BB44BA4FD64A32CB2D877E4EF2CE061C310

Function 00007FF7A91FEE50 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A91FEF5F

Part of subcall function 00007FF7A924F220: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,-3333333333333333,00007FF7A91F441E,7FFFFFFFFFFFFFFF,https://keyauth.win/api/1.2/,-3333333333333333,00007FF7A91F1B79), ref: 00007FF7A924F23A

memcpy.VCRUNTIME140 ref: 00007FF7A91FEF4C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91FEFCD
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91FEFDA

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1155477157-0
Opcode ID: 5a7c4ca9e5dc21f930117366e7ba758c1473e2ea03fa1ca2f7c5ebe054da9f1c
Instruction ID: ce58409cba647e90db219a2a6c872465e10891df995bbf4e5491531e0f49a559
Opcode Fuzzy Hash: 5a7c4ca9e5dc21f930117366e7ba758c1473e2ea03fa1ca2f7c5ebe054da9f1c
Instruction Fuzzy Hash: 8A41C523716B8A81EA15EF29E4441ACA771AB44BE0F954632DB6D877E4EF3CE061C310

Function 00007FF7A924ACA0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,00007FF7A922E250,?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?), ref: 00007FF7A924ACF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924AD7C

Strings

%s, xrefs: 00007FF7A924ACC5

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %s
API String ID: 1294909896-3043279178
Opcode ID: 3dec9be71de818296eefc6841ac82d9d5c2068740bb44cf0d56241c2c03ae543
Instruction ID: 36f8aaeea6bd36162aa9c48cb798007eaa8bdf7fa888b180196faf23aa29b3aa
Opcode Fuzzy Hash: 3dec9be71de818296eefc6841ac82d9d5c2068740bb44cf0d56241c2c03ae543
Instruction Fuzzy Hash: 6E416132609B85C2EA51AF26F8401AAB3B0FB85B94F554134DF8D47BA9DF3CE0A5C710

Function 00007FF7A91F4D80 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF7A91F4E5F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF7A91F4E9C
memcpy.VCRUNTIME140 ref: 00007FF7A91F4EA6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A91F4ED3

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1775671525-0
Opcode ID: 84fc0c9fc749d483c17e1c68080b76c48a8cf66d0d10195ee6f4a235847b4203
Instruction ID: 6674cb5c0aeffe3dbac4265b569c548ad7507c2ec12cdd5309a7125f6804aab1
Opcode Fuzzy Hash: 84fc0c9fc749d483c17e1c68080b76c48a8cf66d0d10195ee6f4a235847b4203
Instruction Fuzzy Hash: A2310B2270A78954FE11AF19F6082A8E371AB04BE0F854731DF6D477EAEE7CE0618310

Function 00007FF7A9249B25 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249EEF

Strings

%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7A9249BCB
GMT, xrefs: 00007FF7A9249B79
TRUE, xrefs: 00007FF7A9249EF9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT$TRUE
API String ID: 1294909896-918878739
Opcode ID: 8a71655f282392d3830732b0269ceafa9df360a790edef6b006c5a542ca8bcaf
Instruction ID: c59fbe64997a0a607b69f234abafa8b02f3a19b3057f8ab67fcf833f23e596f3
Opcode Fuzzy Hash: 8a71655f282392d3830732b0269ceafa9df360a790edef6b006c5a542ca8bcaf
Instruction Fuzzy Hash: A231C326A4AB8594FB10DF25E5401A9B771F785B94FD68032CA4D476E8CF3CE565C310

Function 00007FF7A92361FD Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9236234

Part of subcall function 00007FF7A9215B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C45
Part of subcall function 00007FF7A9215B20: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7A9215C60

Strings

Wildcard - "%s" skipped by user, xrefs: 00007FF7A923629D
Wildcard - START of "%s", xrefs: 00007FF7A923623D
%s%s, xrefs: 00007FF7A9236204

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: fwrite$free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 3468156532-1133524294
Opcode ID: 49cd96d361e9171cdf57459e1b052c556336426e381457a8b672f1ff9933ff31
Instruction ID: 969075e10fd1fba0b98bc82a6a2af487a0950a3a93d11fabd91246965a19c408
Opcode Fuzzy Hash: 49cd96d361e9171cdf57459e1b052c556336426e381457a8b672f1ff9933ff31
Instruction Fuzzy Hash: 9B417F32A0AA46C5FB14EF15D8451AEB3B4EB44B84F8A4032CE4D8B7EDDE38D4548360

Function 00007FF7A9248E35 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249226

Strings

%s: %s, xrefs: 00007FF7A9249211
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00007FF7A9248ED9
GMT, xrefs: 00007FF7A9248E89

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: %s: %s$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 1294909896-1153420294
Opcode ID: b17227d6485868971059d0b9f51ef7794cb604431ad0df6e9abd3e13c4bbbb78
Instruction ID: aaef19bbddfedeeb71a5ebcd61a000b06e82fe21d47348ed094842b402622e54
Opcode Fuzzy Hash: b17227d6485868971059d0b9f51ef7794cb604431ad0df6e9abd3e13c4bbbb78
Instruction Fuzzy Hash: B531C561A0AB8194FB60AF51A4046A9B3B0FB85B80FD64032DB5D872E9CF7CD569C310

Function 00007FF7A9249D6D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249DA8
memcpy.VCRUNTIME140 ref: 00007FF7A9249DCE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249EEF

Strings

TRUE, xrefs: 00007FF7A9249EF9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemallocmemcpy
String ID: TRUE
API String ID: 3056473165-3412697401
Opcode ID: 4fa6d89091b4c7693dce85ad5346afe7253c36bb71040b92a043348c8cc14574
Instruction ID: a3686e5d3ac1bda571df234c766cb1607032bf21e411bd00cf0f83c2251845e5
Opcode Fuzzy Hash: 4fa6d89091b4c7693dce85ad5346afe7253c36bb71040b92a043348c8cc14574
Instruction Fuzzy Hash: C121E26AB4B64644FF02AF16A9003749772AB85FE4F868532CE1D877ECDE3DD0918310

Function 00007FF7A9210270 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2
memcpy.VCRUNTIME140 ref: 00007FF7A92102FD

Part of subcall function 00007FF7A9205650: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9205665

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9210332

Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205787
Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205793

Strings

%s:, xrefs: 00007FF7A92102DC

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$malloc$memcpy
String ID: %s:
API String ID: 901724546-64597662
Opcode ID: a469fec1b4ccff3057bf10bb4f9d07726373d9b9a26cd4589d43c1dfc9649c06
Instruction ID: 4e4e8dd8250881e9c739e6bc41dc5163d9e45daeff8b8a843b621a958cbf7ff8
Opcode Fuzzy Hash: a469fec1b4ccff3057bf10bb4f9d07726373d9b9a26cd4589d43c1dfc9649c06
Instruction Fuzzy Hash: 9E210632A49B8581EB00DF12E8401AAB3B4FB44BE4F890131EE5D877E9DF3CD4618310

Function 00007FF7A9249081 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92490BC
memcpy.VCRUNTIME140 ref: 00007FF7A92490E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249226

Strings

%s: %s, xrefs: 00007FF7A9249211

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemallocmemcpy
String ID: %s: %s
API String ID: 3056473165-1451338302
Opcode ID: 7229280416604259d6556af02c2c9e827d5ddb8e253802bc73edd64814dc06ae
Instruction ID: 77b672cd4a9beeda23b1b0f9a39489d7aa687c26a7f105d365953647bb5a0d25
Opcode Fuzzy Hash: 7229280416604259d6556af02c2c9e827d5ddb8e253802bc73edd64814dc06ae
Instruction Fuzzy Hash: 2521D159A4A78281FA64AF06A9043B6E261BB84FE0F858131CE1D87BEDDE3CE0558311

Function 00007FF7A92470DA Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92475B9

Strings

Start Date: %s, xrefs: 00007FF7A92475A7
%s%lx, xrefs: 00007FF7A9247135
Start Date, xrefs: 00007FF7A924758D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Start Date: %s$%s%lx$Start Date
API String ID: 1294909896-3519493645
Opcode ID: f40d74bcef681f4a9c27888e2e95ccd445439a2c8eaf92efe54413689fd1bc4c
Instruction ID: 8cb1e84bc9b0941af7f5da1a2aacb462994f61cb0a70f416b8e8fca0ece332df
Opcode Fuzzy Hash: f40d74bcef681f4a9c27888e2e95ccd445439a2c8eaf92efe54413689fd1bc4c
Instruction Fuzzy Hash: E921D851B0F28255FE21AF2094042F9A772AB457C4FC64831CA1EDF6FDDE2CA5648320

Function 00007FF7A921930D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A9219125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A921913F

Strings

I32, xrefs: 00007FF7A9219115
I64, xrefs: 00007FF7A9219135

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: be0daff2e94bafb18531155782e38ef461bcad53d09ac79b585c6de7ca848f85
Instruction ID: b8ffa920de57b3d622f61e7aefb52caa656bd3ed5027fbfa21d7e0cfefaa3860
Opcode Fuzzy Hash: be0daff2e94bafb18531155782e38ef461bcad53d09ac79b585c6de7ca848f85
Instruction Fuzzy Hash: DA21DA36A4E65281F7146F21E8546B9FAB4AB04F44F964131CA49C22F9DE2CD634C760

Function 00007FF7A9243160 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9243EC9,00000000,?,?,00007FF7A9243486), ref: 00007FF7A9243189
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9243EC9,00000000,?,?,00007FF7A9243486), ref: 00007FF7A92431C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A9243EC9,00000000,?,?,00007FF7A9243486), ref: 00007FF7A92431D2
memcpy.VCRUNTIME140(?,?,?,00007FF7A9243EC9,00000000,?,?,00007FF7A9243486), ref: 00007FF7A92431FA

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: freemallocmemcpyrealloc
String ID:
API String ID: 3881842442-0
Opcode ID: 966fe282aaecfd9ca9c63adee5f07712b9437c76de7d035a7979e8c0797f2e00
Instruction ID: b34ce573fae6648aafaa3bf079be1f1bbaca0f80370306364a3650288509f053
Opcode Fuzzy Hash: 966fe282aaecfd9ca9c63adee5f07712b9437c76de7d035a7979e8c0797f2e00
Instruction Fuzzy Hash: D721422661AB8181EB54DF15E450229A3A0FB88FC4B458431DF5E8776DDF3CD4A1C710

Function 00007FF7A92324E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54stringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92324FD
strstr.VCRUNTIME140 ref: 00007FF7A923253C
strstr.VCRUNTIME140 ref: 00007FF7A9232554

Strings

;type=, xrefs: 00007FF7A923252F, 00007FF7A923254D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strstr$calloc
String ID: ;type=
API String ID: 3224321581-3507045495
Opcode ID: 83e9a0abc2bae5adc2c59bdec6c8b8bc2d0dd47fa936807e381e13c174e72484
Instruction ID: 45e0e5282e9afc5f6ed5a9f79e44ac12ff9e0c287f17345b3945cb57fe3d21c8
Opcode Fuzzy Hash: 83e9a0abc2bae5adc2c59bdec6c8b8bc2d0dd47fa936807e381e13c174e72484
Instruction Fuzzy Hash: 9421D8315096C281F7599F14E4503A977B0FB48784F894131DBAE87BE9DF7CE1A18320

Function 00007FF7A922BF70 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BF98
GetEnvironmentVariableA.KERNEL32(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFBE
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFDF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A92104E9,?,?,?,?,00007FF7A920F88B), ref: 00007FF7A922BFF0

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: realloc$EnvironmentVariablefree
String ID:
API String ID: 2828309815-0
Opcode ID: 1d816d6bc5e7816cd3c2fedaeb2bf27846472c7cafed14cf8fea33b346e8af73
Instruction ID: f0d2c282224668a95cccfc6c6bc1cce2043b7ef6998eaa2bdcdf773892aa92c5
Opcode Fuzzy Hash: 1d816d6bc5e7816cd3c2fedaeb2bf27846472c7cafed14cf8fea33b346e8af73
Instruction Fuzzy Hash: F0115421B0F74241FA60AF125544279E1A1FF88BC0F564435DE4D87BECDE7CE4605754

Function 00007FF7A924D350 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7A924D38D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924D39D
WideCharToMultiByte.KERNEL32 ref: 00007FF7A924D3CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A924D3D9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 305a81510860c09381c2a902cc7a5b2b405dc6c19f7ccc444ffd5f2c178b3282
Instruction ID: 9cdd963d0c75e9df89803e6a5d420a02a46c19babfe5a621c6c26645867011e9
Opcode Fuzzy Hash: 305a81510860c09381c2a902cc7a5b2b405dc6c19f7ccc444ffd5f2c178b3282
Instruction Fuzzy Hash: 92114231B0A74186F7109F62A84012DBAB0FB84BC0B454134DB4D877A8DF3CE511CB50

Function 00007FF7A9221990 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92219EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221A0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9221A13

Strings

Proxy-Connection: Keep-Alive, xrefs: 00007FF7A92219A0

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID: Proxy-Connection: Keep-Alive
API String ID: 1294909896-2835282938
Opcode ID: 4643923d4b30904997aa07d5a610e97fb1143f6965d6fce54f0be17f18545a7a
Instruction ID: 1360a8ea23584f38802c109f78adfeb8a42d24c417a850958bbfac0fc3a04120
Opcode Fuzzy Hash: 4643923d4b30904997aa07d5a610e97fb1143f6965d6fce54f0be17f18545a7a
Instruction Fuzzy Hash: AD01C422B0A64182FA156F56B8803A9E260EF44BF0F454230DEAD4B7E9DF7CD8A58350

Function 00007FF7A920B160 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,00007FF7A920B112,?,?,?,00000000), ref: 00007FF7A920B171
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B112,?,?,?,00000000), ref: 00007FF7A920B17A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A920B112,?,?,?,00000000), ref: 00007FF7A920B184
closesocket.WS2_32 ref: 00007FF7A920B1A2

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: f7db1f6b52b8137dabff5e355225a063c8c071eb0e0a3607985648b3c81ec94a
Instruction ID: c214f9666e70c846eae4d0a5729e5340e85b074151fafbaa9557de32822f9f86
Opcode Fuzzy Hash: f7db1f6b52b8137dabff5e355225a063c8c071eb0e0a3607985648b3c81ec94a
Instruction Fuzzy Hash: 80011212D1AA8183FB54EF71C8601786330FFE9F5CB466325DE6E411F99F68E5E48211

Function 00007FF7A92191FA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A9219125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A921913F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9219182

Strings

I32, xrefs: 00007FF7A9219115
I64, xrefs: 00007FF7A9219135

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: 1358533ad48d2a44edb7be55f214641631c560d286165498f760eaa2cff14d2d
Instruction ID: 7a329bbad1bfd8fa8bc797706dcf64bc9d49d54750290d83cc8a0a03cfa9b4b4
Opcode Fuzzy Hash: 1358533ad48d2a44edb7be55f214641631c560d286165498f760eaa2cff14d2d
Instruction Fuzzy Hash: F9F08929B1E64391F6145F25AC58675A6B49F09BC4F864131C91EC22FDCE2DD274C731

Function 00007FF7A9219202 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A9219125
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00007FF7A9218FD8), ref: 00007FF7A921913F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9219182

Strings

I32, xrefs: 00007FF7A9219115
I64, xrefs: 00007FF7A9219135

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: db1690a034e4f0b08ee31cc761834fde37e5dc528d1476bcce24f82338d2e76d
Instruction ID: 4a03edde9e63f9357986240c5ba2dafddd1087b2cdafc7ddf3846e16b1eb15cd
Opcode Fuzzy Hash: db1690a034e4f0b08ee31cc761834fde37e5dc528d1476bcce24f82338d2e76d
Instruction Fuzzy Hash: 07F08929B1E643D1F6145F25AC58675A6B49F09BC4F864131C91EC22FDCE2DD274C731

Function 00007FF7A92411F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF7A92165A6), ref: 00007FF7A9241204

Strings

%lx, xrefs: 00007FF7A92414EA

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _errno
String ID: %lx
API String ID: 2918714741-1448181948
Opcode ID: 0a772e466704e744c028a0ef675a9f26dcc24f8481fe655da62be58b0fd10eb9
Instruction ID: bfdf108f85f1d849ce79ac7188668a3bf95946420251f462665ce51cb8182fbd
Opcode Fuzzy Hash: 0a772e466704e744c028a0ef675a9f26dcc24f8481fe655da62be58b0fd10eb9
Instruction Fuzzy Hash: AA81BE22A0D1D145F7688F24949027DBBF0FBD6784F464235EAAFC22EADA3CD455CB20

Function 00007FF7A922CF10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7A922C8F3), ref: 00007FF7A922CFE2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_,?,00000000,00007FF7A922C8F3), ref: 00007FF7A922D033

Strings

(){ %*], xrefs: 00007FF7A922CF2D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupmalloc
String ID: (){ %*]
API String ID: 3515966317-731572209
Opcode ID: edfa90b2e97fb788039a27bbcd7159ae8301d3c23095dfbe1ba32d8146c13546
Instruction ID: a21b03040a186630d82b61abd609c820a91db54910373eaac4c33dbd24e04102
Opcode Fuzzy Hash: edfa90b2e97fb788039a27bbcd7159ae8301d3c23095dfbe1ba32d8146c13546
Instruction Fuzzy Hash: A1316D2190F74544FE61AF1050403F4BBE19F96754FD64172DA4E472F9CF2DA516C230

Function 00007FF7A9218D20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9218D40
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9218D9B

Strings

, xrefs: 00007FF7A9218D53

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: mallocrealloc
String ID:
API String ID: 948496778-3916222277
Opcode ID: a67b52fd0683e3614a5c599cb136438b70bc80eeb823c18120832fc5c8c0abba
Instruction ID: 9417eba5f464c6370a4fc3f5524af5c9814b5c9b3e2ec6591b5d3d9d6f4e4398
Opcode Fuzzy Hash: a67b52fd0683e3614a5c599cb136438b70bc80eeb823c18120832fc5c8c0abba
Instruction Fuzzy Hash: 8211AF7260AB8182EB54AF25E440269B3B0FB18BD4F944535DB5E4B7A8EF38D4B0C350

Function 00007FF7A9217040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FF7A92170BF
setsockopt.WS2_32 ref: 00007FF7A92170EE

Strings

@, xrefs: 00007FF7A921704F

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: b0558b4f33b7700243868af3c9e3b44c4eb939018a2d69d1ab428c96a0d5346e
Instruction ID: 1edb3306dbc6af0f6680f6c24f021c45253f0a25c164c74344f8c8b321bbdc51
Opcode Fuzzy Hash: b0558b4f33b7700243868af3c9e3b44c4eb939018a2d69d1ab428c96a0d5346e
Instruction Fuzzy Hash: B2113071A0A282C6FB209F10E844666F7B0EB85344FA54034DB4987AF9DB7DD5A9CB11

Function 00007FF7A92154F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9215535
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A921555C

Strings

%I64d-, xrefs: 00007FF7A9215547

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: %I64d-
API String ID: 1865132094-19666937
Opcode ID: e7b125d07e945fe28a0df9939d98ca160f14512c24ec3ee86c54ba13bc9671ce
Instruction ID: c434bed70f19f2da4a6285cae68a7a5186bcff3ca91f3cd3a2c483b43abf38cc
Opcode Fuzzy Hash: e7b125d07e945fe28a0df9939d98ca160f14512c24ec3ee86c54ba13bc9671ce
Instruction Fuzzy Hash: 0011E572A07A82C1FB14AF6488053F463F2EB54B48F6D4075C90D8E2B9DF2C94B68330

Function 00007FF7A9249AF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9249AFF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249EEF

Strings

TRUE, xrefs: 00007FF7A9249EF9

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfree
String ID: TRUE
API String ID: 1865132094-3412697401
Opcode ID: 3972d7eecbbcb924a9b2f04503ea757f504c79d36c3c4954c7ee9088535f1f7c
Instruction ID: f03988030e33a56600a54cebbcc20ee7a2e059df62cf8ff43ff0124b659655b8
Opcode Fuzzy Hash: 3972d7eecbbcb924a9b2f04503ea757f504c79d36c3c4954c7ee9088535f1f7c
Instruction Fuzzy Hash: 6E01926AB4B65584FF029F15E500278A776AB45FA4F868832CE4E867E8DE3DD095C320

Function 00007FF7A9248E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7A9248E0F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9249226

Part of subcall function 00007FF7A9210270: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A92102C2

Strings

%s: %s, xrefs: 00007FF7A9249211

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: _strdupfreemalloc
String ID: %s: %s
API String ID: 3985033223-1451338302
Opcode ID: b443616bcdb161d0224055a7af9750bd78aed9a0ab302ed9a2cec95334550153
Instruction ID: 35477e18907ec08e0b9d2f5abc35e6e2b6b0ec09fba9bb4aa0ce4c2894e4f1f5
Opcode Fuzzy Hash: b443616bcdb161d0224055a7af9750bd78aed9a0ab302ed9a2cec95334550153
Instruction Fuzzy Hash: A5F0A459A4E68181FA64BF52B8047F5A370AB85F90F894431CE4D877EADF3CE1A58320

Function 00007FF7A924D2A0 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7A92403D8), ref: 00007FF7A924D2D1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7A92403D8), ref: 00007FF7A924D2E4
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7A92403D8), ref: 00007FF7A924D30B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FF7A92403D8), ref: 00007FF7A924D318

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 401fd561d18a41378e9f1d23ca106fa73c096c2596b837a7fe3ed38c712ed293
Instruction ID: 2cf39ae8b331394ea13d67f97e77125fdee5da11732f71509073bfb0719ada1f
Opcode Fuzzy Hash: 401fd561d18a41378e9f1d23ca106fa73c096c2596b837a7fe3ed38c712ed293
Instruction Fuzzy Hash: 17113321B1A74282F7209F5AF55002AE6B0FF88BD4B894535DB5D87BA8DF3CD5518B10

Function 00007FF7A920BC30 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205787
Part of subcall function 00007FF7A9205760: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A920FD60,?,?,?,?,?,?,?,?,?,?,00000000,00007FF7A9201B91), ref: 00007FF7A9205793

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920BC66
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920BC76
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A920BC84
memset.VCRUNTIME140 ref: 00007FF7A920BCBF

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 966afde81f55b4a45680f927e29d9bdd61b9446a363dd2483b6ff75bf9856eaf
Instruction ID: 5c642928e64247379d48ccd882127d90bc7da5925b2f9eeacd7cefb93e274def
Opcode Fuzzy Hash: 966afde81f55b4a45680f927e29d9bdd61b9446a363dd2483b6ff75bf9856eaf
Instruction Fuzzy Hash: 9C210932E19B81A3E604DF22DA942A8A370F799740F559225EB8C47A65DF74F1F1C300

Function 00007FF7A924AE40 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A922CCC3), ref: 00007FF7A924DDD6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A922CCC3), ref: 00007FF7A924DDF5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A922CCC3), ref: 00007FF7A924DE0F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7A922CCC3), ref: 00007FF7A924DE1D

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 85ebf8214d80495e892cf52649405a4d6cbc49e0494be1aa1a0ffc6913fd7194
Instruction ID: 60b006f75f5c0727372338580b3c8776082d701a3254448176e982d9558c2c84
Opcode Fuzzy Hash: 85ebf8214d80495e892cf52649405a4d6cbc49e0494be1aa1a0ffc6913fd7194
Instruction Fuzzy Hash: AC11EC26A0AA4181FB14AF25E99023CA3B4FF94F84F954431CA4E866BCCF3CD8A4C351

Function 00007FF7A9232C30 Relevance: 5.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9232C68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9232C8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9232CAA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7A9232CBE

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3d7bbf7bf85c89656d30906a6a857632f5a45af87e7b9c2b1b6d7b83672e2938
Instruction ID: db6c799c2872aff9a78c25d7dd08e4fe84bafe8442c4ffe015b34b08c7d12c6d
Opcode Fuzzy Hash: 3d7bbf7bf85c89656d30906a6a857632f5a45af87e7b9c2b1b6d7b83672e2938
Instruction Fuzzy Hash: E2114C36605B81C6E7409F25E580269B3B4F784F44F494035DF8E9B768CF38E8A9C350

Function 00007FF7A9242210 Relevance: 5.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9218435,?,?,00000000,00007FF7A92110F1,?,?,00000000,00007FF7A9211625), ref: 00007FF7A9242220
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9218435,?,?,00000000,00007FF7A92110F1,?,?,00000000,00007FF7A9211625), ref: 00007FF7A9242246
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9218435,?,?,00000000,00007FF7A92110F1,?,?,00000000,00007FF7A9211625), ref: 00007FF7A9242254
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FF7A9218435,?,?,00000000,00007FF7A92110F1,?,?,00000000,00007FF7A9211625), ref: 00007FF7A9242262

Memory Dump Source

Source File: 00000000.00000002.1368324833.00007FF7A91F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A91F0000, based on PE: true

Associated: 00000000.00000002.1368299718.00007FF7A91F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368370061.00007FF7A9251000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368399294.00007FF7A9268000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1368417784.00007FF7A9269000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a91f0000_LDlanZur0i.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2e813ba0d54f36914a56cfa9236fbf532bfcc7bcbafa9ccb2a0669a6b2df3caf
Instruction ID: 54b8444663c15b24df687881b4bbcd64f5fa59f5c3d2f5d74e1336c5a9b00a1b
Opcode Fuzzy Hash: 2e813ba0d54f36914a56cfa9236fbf532bfcc7bcbafa9ccb2a0669a6b2df3caf
Instruction Fuzzy Hash: 87F07936606B4182EB049F26E994028B3B4FB98F987564521CF9D87BB8CF38D4A5C351

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LDlanZur0i.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Phishing

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Windows Analysis Report
LDlanZur0i.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre