Edit tour

Windows Analysis Report
HxesZl7bIx.exe

Overview

General Information

Sample name:	HxesZl7bIx.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	124edb48ce763a1b36c8e8736a865190c0e4928274acb617ce55e31e8c27c83f
Analysis ID:	1428503
MD5:	054664da74deb75df32022e644c197d0
SHA1:	398448ae19a22710cc848ff4c90b4a3599db5da1
SHA256:	124edb48ce763a1b36c8e8736a865190c0e4928274acb617ce55e31e8c27c83f
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found iframes

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

HxesZl7bIx.exe (PID: 6648 cmdline: "C:\Users\user\Desktop\HxesZl7bIx.exe" MD5: 054664DA74DEB75DF32022E644C197D0)

chrome.exe (PID: 2004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/account MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1948,i,11509186462824718599,1135908042397387967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1852,i,4759629210035678805,3371975258739190933,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: HxesZl7bIx.exe	ReversingLabs: Detection: 58%
Source: HxesZl7bIx.exe	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for sample

Source: HxesZl7bIx.exe

Joe Sandbox ML: detected

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-744840401&timestamp=1713490840509
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-744840401&timestamp=1713490840509
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-744840401&timestamp=1713490840509
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1434896875&timestamp=1713490842131
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: Iframe src: /_/bscframe
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: Iframe src: https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1434896875&timestamp=1713490842131
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: Iframe src: /_/bscframe

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0

HTTP Parser: Title: YouTube does not match URL

Source: https://www.facebook.com/video	HTTP Parser: <input type="password" .../> found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: <input type="password" .../> found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: <input type="password" .../> found

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No favicon
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No favicon

Source: https://www.facebook.com/video	HTTP Parser: No <meta name="author".. found
Source: https://www.facebook.com/video	HTTP Parser: No <meta name="author".. found
Source: https://www.facebook.com/video	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No <meta name="author".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No <meta name="author".. found

Source: https://www.facebook.com/video	HTTP Parser: No <meta name="copyright".. found
Source: https://www.facebook.com/video	HTTP Parser: No <meta name="copyright".. found
Source: https://www.facebook.com/video	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ARZ0qKJLIKz32uIgJ_XUijV6-eEWxbL7O4dV3kkBejnKnqjZuT15OnMI73XE9kLzLAgI-twNBImiAA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1426224490%3A1713490837846023&theme=mn&ddm=0	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&ifkv=ARZ0qKL0DVE35ds1FJrf8bmielkHjbMlqNt3A4cXeGJvW1xKqa9aG6HehzWNdNmxUN2QRhvG8r-77w&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S2097916348%3A1713490837852387&theme=mn&ddm=0	HTTP Parser: No <meta name="copyright".. found

Source: HxesZl7bIx.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49940 version: TLS 1.2

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B68EE FindFirstFileW,FindClose,	0_2_003B68EE
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_003B698F
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003AD076
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003AD3A9
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003B9642
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003B979D
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_003B9B2B
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_003ADBBE
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_003B5C97

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 41MB

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.136.127
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003BCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_003BCE44

Source: global traffic	HTTP traffic detected: GET /video HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yb/l/0,cross/YevIHjTZjnO.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yb/r/G3Nm7rYDpD0.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3ifhN4/yX/l/en_US/nChwAUT1aUgDYvatkvPhoORf7s0WJvHMPn1wRO-dUcIoL9XF0wO0ej9ML-m_DiQrfXi0ByZrEbi6c-BC0lRf3kmQVAblIutlJuDu8FjJ2mAf5cwjSvgZCKCmXkp8GwrOMn7m1Rdzuzi16ygkVEIahZX1XqpI1Q50zl6ZBgWvsJpQFrYrGc1wa-Oq19cr_l1DuzAtWVDh4cn1CMxub3y91qmloYqXsrAa0b9bMzu_eJMlvvhSHqOL8xCqhxFHLp55HfXW__mMgFRlCsGN0FHzi95_wmB-51YxoStyBz2gE2pEQn4HVER6vHpPn3-WFWVy-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iwN74/yD/l/en_US/APoqa-iIOjvrn_I8kVuFfvi1Qie0qdVBFdoHo8RmQG6EroQ9FNgpiRhTLojQtsFNcs.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iHrB4/y-/l/en_US/Sd6LZm7F8MR.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yA/r/OMXgFqU76kP.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3ic_A4/yy/l/en_US/SV3JvfEjy-HECsg6rc0g3Q_nx0QPfkJnvo7kHHAR2WLloFvVgikQZOAlimUDEtcYdfpXFYHV90WF8xsw_y3zVOBS5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iCjQ4/yT/l/en_US/-cuErFyZKsI.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iQbs4/yg/l/en_US/EX6jmVQkY6L.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yo/r/RBVykxDUbUn.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iFd24/yd/l/en_US/dj10Ym9OUFW.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iMBH4/ym/l/en_US/PM0yz8J0_9eatA4AbcUXJ_xGj4GgHf6uoyMXsyMcajeZkbHSqEKHvKE5vIR6Z6_fPD4wyD5Ym16tXudcxB4NWZK-0RNSBe8qSPG4UpY82FpGVUugonw1necxJMJfxNSBC0jRQvPTG6MYkFOrTRdkwmU8Y3mM84SfiWlvqtZjCyJ63My3zlOMrO0CLM5TVwEj1ba-rOSQb0hClwF360PJEynPfrjI.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3ifWF4/yt/l/en_US/3KWduJcmUWu.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yo/r/RBVykxDUbUn.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bulk-route-definitions/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bulk-route-definitions/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yR/r/4TRsPp18HYl.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3i7Vo4/y6/l/en_US/LznjGi-Mcyn.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bulk-route-definitions/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuZ.AWXg241u3QQ
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-744840401&timestamp=1713490840509 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=TISbAQ87lBo; VISITOR_INFO1_LIVE=Bm5Gpp9tStI; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgPg%3D%3D
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yR/r/4TRsPp18HYl.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yy/r/q9P8VRdD1Am.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3iNTg4/yA/l/en_US/2obelxd4ucH.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/434846145_750354690635123_5825280892337708034_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=VY_PguNQYqkAb4vYZ4J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAA-dZ2FVoVBFW58UvtffQQCH__zs3TaqlqaDmOBrIH9A&oe=66278A45 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438043668_951275763118012_9085738709733793549_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Ag36yU8NZ2YAb6DVjhK&_nc_oc=AdhGlZK-sKtqhfza7ml_SykynPBUSx2UizoL0jq-Q1WsBlq6hBHetpwRDqkENWqjVAg&_nc_ht=scontent-atl3-2.xx&oh=00_AfA66vG8Ma9yADhKUsRHkt3rFZiZhApEGqODDzKsb816Dw&oe=6627B1A4 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/437942529_992446696222628_1543467553494358279_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=AcwWWyFNr0wAb46GRke&_nc_ht=scontent-atl3-2.xx&oh=00_AfCufZFJTsYS1oCzs70XhJ1l36Gl75o7UJvA_kTMwh_8Eg&oe=6627949F HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/437105006_1102269597670542_4976784059220029358_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Q8Y5BK9l_XIAb4Cr9pt&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-I28Z40HUGosKs6OU1VaGQD7MbfRLpHLFa4by2T23cA&oe=6627854D HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/426704283_408014474976170_8736400465975078399_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ld6EvftXIT0Ab47SqER&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGwovxP7ofS8GVbz5awfT4XOcqHTKR7fDAa7B5m_KB7g&oe=6627A8C4 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438193268_922912702947462_7506581556452730663_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=F1f1WyXRCfUAb5H7pg3&_nc_ht=scontent-atl3-2.xx&oh=00_AfDB1zgmFI527f9DlANisuRmydguLRC3xydmlEEaw4wURA&oe=6627B6C7 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/436859318_962909741584758_3870588264605380752_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=s7KXFq-dOKwAb6FUqMa&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-GpW_tvCHQBURGYoJaXuwYk2uRI3TGoOELVJq2jzi8A&oe=6627A99F HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t51.29350-10/438882269_729999509341792_5681810228876178213_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rx4uzBlOIl8Ab6ytXk7&_nc_ht=scontent-atl3-2.xx&oh=00_AfAvO6SJOH5Y80LRz1OMs2wXXZ5sp1gyOizIOTgXp7L6GA&oe=66279CD1 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/435585243_1336893433647196_6208832241633396260_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=elYzPYAIG9kAb6SZKEF&_nc_ht=scontent-atl3-2.xx&oh=00_AfCvf0SUTHuy36cSdF56yN534pHFsf_uSWdDHk8TaBveJA&oe=6627852B HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/435297039_1622642408563885_856096703543016407_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=GWAVaQ02VJ8Ab6-Thma&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGNYDZ7rzrA5aOKLdOlSZvN9nxTDaGyE2PI0T-WhTcwA&oe=6627AC74 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1434896875&timestamp=1713490842131 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=TISbAQ87lBo; VISITOR_INFO1_LIVE=Bm5Gpp9tStI; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgPg%3D%3D
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/437942529_992446696222628_1543467553494358279_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=AcwWWyFNr0wAb46GRke&_nc_ht=scontent-atl3-2.xx&oh=00_AfCufZFJTsYS1oCzs70XhJ1l36Gl75o7UJvA_kTMwh_8Eg&oe=6627949F HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/426704283_408014474976170_8736400465975078399_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ld6EvftXIT0Ab47SqER&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGwovxP7ofS8GVbz5awfT4XOcqHTKR7fDAa7B5m_KB7g&oe=6627A8C4 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/434846145_750354690635123_5825280892337708034_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=VY_PguNQYqkAb4vYZ4J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAA-dZ2FVoVBFW58UvtffQQCH__zs3TaqlqaDmOBrIH9A&oe=66278A45 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438193268_922912702947462_7506581556452730663_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=F1f1WyXRCfUAb5H7pg3&_nc_ht=scontent-atl3-2.xx&oh=00_AfDB1zgmFI527f9DlANisuRmydguLRC3xydmlEEaw4wURA&oe=6627B6C7 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438043668_951275763118012_9085738709733793549_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Ag36yU8NZ2YAb6DVjhK&_nc_oc=AdhGlZK-sKtqhfza7ml_SykynPBUSx2UizoL0jq-Q1WsBlq6hBHetpwRDqkENWqjVAg&_nc_ht=scontent-atl3-2.xx&oh=00_AfA66vG8Ma9yADhKUsRHkt3rFZiZhApEGqODDzKsb816Dw&oe=6627B1A4 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/437105006_1102269597670542_4976784059220029358_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Q8Y5BK9l_XIAb4Cr9pt&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-I28Z40HUGosKs6OU1VaGQD7MbfRLpHLFa4by2T23cA&oe=6627854D HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yb/r/7NqDjYL3eb9.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3ivlb4/yn/l/en_US/5ZMgj96iLR9.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3ieKI4/yX/l/en_US/aia9_5MaGl8.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/436859318_962909741584758_3870588264605380752_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=s7KXFq-dOKwAb6FUqMa&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-GpW_tvCHQBURGYoJaXuwYk2uRI3TGoOELVJq2jzi8A&oe=6627A99F HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/435585243_1336893433647196_6208832241633396260_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=elYzPYAIG9kAb6SZKEF&_nc_ht=scontent-atl3-2.xx&oh=00_AfCvf0SUTHuy36cSdF56yN534pHFsf_uSWdDHk8TaBveJA&oe=6627852B HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/435297039_1622642408563885_856096703543016407_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=GWAVaQ02VJ8Ab6-Thma&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGNYDZ7rzrA5aOKLdOlSZvN9nxTDaGyE2PI0T-WhTcwA&oe=6627AC74 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t51.29350-10/438882269_729999509341792_5681810228876178213_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rx4uzBlOIl8Ab6ytXk7&_nc_ht=scontent-atl3-2.xx&oh=00_AfAvO6SJOH5Y80LRz1OMs2wXXZ5sp1gyOizIOTgXp7L6GA&oe=66279CD1 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yb/r/7NqDjYL3eb9.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/430843272_438547758855568_3782525580529738461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ki7LIH_ntfYAb7lEcz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfCIj5_yMIP5Es9E9YFuWRv8iLuRq49yvysp8vObeIcFQA&oe=66278DC5 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA
Source: global traffic	HTTP traffic detected: GET /ajax/bulk-route-definitions/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438091798_1180371333322580_3869440255780885829_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xEMShP_qLFMAb55VT3m&_nc_ht=scontent-atl3-2.xx&oh=00_AfDWfJxHj0HZNwe-NDko3zvnYAmSYlIZukKiC1ty_egxkw&oe=6627908C HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/427423164_1136863804107170_2890424799444787669_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=B9Pc79yiemQAb6zBz4r&_nc_ht=scontent-atl3-2.xx&oh=00_AfCiWqDXjAXfVtRjlfSGhw15nEOc_vXUOs2xVTfr50viLg&oe=6627A6F7 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/430843272_438547758855568_3782525580529738461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ki7LIH_ntfYAb7lEcz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfCIj5_yMIP5Es9E9YFuWRv8iLuRq49yvysp8vObeIcFQA&oe=66278DC5 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438193634_720475476662614_5584509116371930153_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-ExROFrTdmwAb5t0lBc&_nc_ht=scontent-atl3-2.xx&oh=00_AfDC4ORowz8xLhxbrweQGY8ubgpNS608cJQiE9HwjWJqyw&oe=66279C6D HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bulk-route-definitions/ HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ; wd=1280x907
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438091798_1180371333322580_3869440255780885829_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xEMShP_qLFMAb55VT3m&_nc_ht=scontent-atl3-2.xx&oh=00_AfDWfJxHj0HZNwe-NDko3zvnYAmSYlIZukKiC1ty_egxkw&oe=6627908C HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t51.29350-10/434466436_742991631307311_2684269917892696380_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=lEVRaVUhRrUAb6Mesom&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGHE-qbLV-U2v08MXPZy2tIrgHciSRcQNZx7LxILUMmA&oe=6627AD2E HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=7&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuc.AWVYKvhM6i8
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/427755631_1521380321923283_7278901302032905672_n.jpg?stp=dst-jpg_p296x100&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xJQH45NEw5sAb6WK0Xa&_nc_ht=scontent-atl3-2.xx&oh=00_AfDz4tA7Z9g7MaNQs3vhOnXqFfZweGTXP76ZT7aDiBvboA&oe=6627A761 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/427423164_1136863804107170_2890424799444787669_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=B9Pc79yiemQAb6zBz4r&_nc_ht=scontent-atl3-2.xx&oh=00_AfCiWqDXjAXfVtRjlfSGhw15nEOc_vXUOs2xVTfr50viLg&oe=6627A6F7 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=8&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuc.AWVYKvhM6i8
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yl/r/SDtEN57PJgl.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.facebook.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/438193634_720475476662614_5584509116371930153_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-ExROFrTdmwAb5t0lBc&_nc_ht=scontent-atl3-2.xx&oh=00_AfDC4ORowz8xLhxbrweQGY8ubgpNS608cJQiE9HwjWJqyw&oe=66279C6D HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/294724701_110489671750480_988274315942354852_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=CsDREyxMCqwAb6Zm1uF&_nc_ht=scontent-atl3-2.xx&oh=00_AfDUhmgSNym9P3hgORApjgvt5uZCr5vKPXDneN84pBy-xQ&oe=662798CE HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t51.29350-10/434466436_742991631307311_2684269917892696380_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=lEVRaVUhRrUAb6Mesom&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGHE-qbLV-U2v08MXPZy2tIrgHciSRcQNZx7LxILUMmA&oe=6627AD2E HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/429682066_368649729457593_2210717644653039134_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=PCsmMolcaEYAb5liA2T&_nc_ht=scontent-atl3-2.xx&oh=00_AfAr3LnIIBAW4Oll3CfuMViVa6IZ_P_aBcdVZ1tFLfUJ0Q&oe=66278F81 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/427755631_1521380321923283_7278901302032905672_n.jpg?stp=dst-jpg_p296x100&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xJQH45NEw5sAb6WK0Xa&_nc_ht=scontent-atl3-2.xx&oh=00_AfDz4tA7Z9g7MaNQs3vhOnXqFfZweGTXP76ZT7aDiBvboA&oe=6627A761 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/438331716_2765174076970236_1145479496426679813_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=obA5gIRYYUYAb7KFZz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfDhyPAWHnsY26BikqP407np3qhXfYGR6avsj0inolkFDg&oe=6627A836 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t1.6435-1/166562961_289775365843871_1089544784969631943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=gsiZqHemNI0Ab7xotOc&_nc_ht=scontent-atl3-2.xx&oh=00_AfCJ2y8PnGo5iYFIOIqkgTsp2QT4Magjkq-glreMKFQsPQ&oe=664932DC HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/294724701_110489671750480_988274315942354852_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=CsDREyxMCqwAb6Zm1uF&_nc_ht=scontent-atl3-2.xx&oh=00_AfDUhmgSNym9P3hgORApjgvt5uZCr5vKPXDneN84pBy-xQ&oe=662798CE HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=9&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/414867464_7046595375378763_4861839573446109840_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=QVssM7vGW2oAb4BrMfp&_nc_ht=scontent-atl3-2.xx&oh=00_AfDu-H0r-6CfzXEJPa3gbJwso6VAEOgSMr--wRf3P1KcMw&oe=66279958 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/429682066_368649729457593_2210717644653039134_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=PCsmMolcaEYAb5liA2T&_nc_ht=scontent-atl3-2.xx&oh=00_AfAr3LnIIBAW4Oll3CfuMViVa6IZ_P_aBcdVZ1tFLfUJ0Q&oe=66278F81 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t1.6435-1/182862089_329809465171561_9124100968924750007_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rbjHzLvzucEAb5bZn4H&_nc_ht=scontent-atl3-2.xx&oh=00_AfDvEfsbAQgrTPLx-opY6lSgCA3J3Ac-nhnwCNbY_jzosg&oe=664928B3 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/438331716_2765174076970236_1145479496426679813_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=obA5gIRYYUYAb7KFZz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfDhyPAWHnsY26BikqP407np3qhXfYGR6avsj0inolkFDg&oe=6627A836 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t1.6435-1/166562961_289775365843871_1089544784969631943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=gsiZqHemNI0Ab7xotOc&_nc_ht=scontent-atl3-2.xx&oh=00_AfCJ2y8PnGo5iYFIOIqkgTsp2QT4Magjkq-glreMKFQsPQ&oe=664932DC HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t51.29350-10/438844348_833636295261460_8820580507418716899_n.jpg?stp=dst-jpg_p206x206&_nc_cat=111&ccb=1-7&_nc_sid=5f2048&_nc_ohc=J7XdDp8SzdsAb7ozIpk&_nc_ht=scontent-atl3-2.xx&oh=00_AfCB8Q844RX1O_1OVOJ0GECUmomF3JgeZ_RWXRdhba-onA&oe=66278584 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/417843986_7077021149032703_7323956251606094932_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=LP1IcS8WNgkAb5jFRoV&_nc_ht=scontent-atl3-2.xx&oh=00_AfA70jyAe-1RiEXheUHVhxrne1KBbSQ7H9DEFsRhZDQbsQ&oe=6627932F HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/414867464_7046595375378763_4861839573446109840_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=QVssM7vGW2oAb4BrMfp&_nc_ht=scontent-atl3-2.xx&oh=00_AfDu-H0r-6CfzXEJPa3gbJwso6VAEOgSMr--wRf3P1KcMw&oe=66279958 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/429173328_1660370348130360_2791089032841410318_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=oTY5-d1wVVAAb4mnIdt&_nc_ht=scontent-atl3-2.xx&oh=00_AfDbm_PgkHfw_O7s22gOSLB_gTtS0owWxPY3tvmWzgR_aQ&oe=66278BDF HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t1.6435-1/182862089_329809465171561_9124100968924750007_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rbjHzLvzucEAb5bZn4H&_nc_ht=scontent-atl3-2.xx&oh=00_AfDvEfsbAQgrTPLx-opY6lSgCA3J3Ac-nhnwCNbY_jzosg&oe=664928B3 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/297577919_10217274176765031_2994694822502324520_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-3rUZ9jyX0wAb5bIv02&_nc_ht=scontent-atl3-2.xx&oh=00_AfCINx_mKEMbP48d8aI4g-TLfOU0Eri64MtOnKfkm9oufA&oe=6627AB82 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t51.29350-10/438844348_833636295261460_8820580507418716899_n.jpg?stp=dst-jpg_p206x206&_nc_cat=111&ccb=1-7&_nc_sid=5f2048&_nc_ohc=J7XdDp8SzdsAb7ozIpk&_nc_ht=scontent-atl3-2.xx&oh=00_AfCB8Q844RX1O_1OVOJ0GECUmomF3JgeZ_RWXRdhba-onA&oe=66278584 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/417843986_7077021149032703_7323956251606094932_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=LP1IcS8WNgkAb5jFRoV&_nc_ht=scontent-atl3-2.xx&oh=00_AfA70jyAe-1RiEXheUHVhxrne1KBbSQ7H9DEFsRhZDQbsQ&oe=6627932F HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yO/r/q8Uic1K195T.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=a&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
Source: global traffic	HTTP traffic detected: GET /v/t15.5256-10/429173328_1660370348130360_2791089032841410318_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=oTY5-d1wVVAAb4mnIdt&_nc_ht=scontent-atl3-2.xx&oh=00_AfDbm_PgkHfw_O7s22gOSLB_gTtS0owWxPY3tvmWzgR_aQ&oe=66278BDF HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hads-ak-prn2/1487645_6012475414660_1439393861_n.png HTTP/1.1Host: scontent.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v/t39.30808-1/297577919_10217274176765031_2994694822502324520_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-3rUZ9jyX0wAb5bIv02&_nc_ht=scontent-atl3-2.xx&oh=00_AfCINx_mKEMbP48d8aI4g-TLfOU0Eri64MtOnKfkm9oufA&oe=6627AB82 HTTP/1.1Host: scontent-atl3-2.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/yO/r/q8Uic1K195T.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/manifest/ HTTP/1.1Host: www.facebook.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform-version: "10.0.0"dpr: 1sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: manifestReferer: https://www.facebook.com/videoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
Source: global traffic	HTTP traffic detected: GET /rsrc.php/yT/r/aGT3gskzWBf.ico HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hads-ak-prn2/1487645_6012475414660_1439393861_n.png HTTP/1.1Host: scontent.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/yT/r/aGT3gskzWBf.ico HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y0/r/eFZD1KABzRA.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.facebook.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rsrc.php/v3/y0/r/eFZD1KABzRA.png HTTP/1.1Host: static.xx.fbcdn.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=b&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d+yvfuDOyXFdawd&MD=Th7e1MAM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=e&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
Source: global traffic	HTTP traffic detected: GET /ajax/webstorage/process_keys/?state=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=g&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
Source: global traffic	HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d+yvfuDOyXFdawd&MD=Th7e1MAM HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=h&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
Source: global traffic	HTTP traffic detected: GET /ajax/webstorage/process_keys/?state=1 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
Source: global traffic	HTTP traffic detected: GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=j&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1Host: www.facebook.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcvm.AWUVYGdJSe8

Source: chromecache_223.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_232.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/CCT5pM3qiNk/ equals www.facebook.com (Facebook)
Source: chromecache_223.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_232.6.dr, chromecache_153.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/MDzNl_j9yvg/ equals www.facebook.com (Facebook)
Source: chromecache_133.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/OKBVmODmb-W/ equals www.facebook.com (Facebook)
Source: chromecache_232.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/V9vdYColc4k/ equals www.facebook.com (Facebook)
Source: chromecache_133.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/WRsJ32R7YJG/ equals www.facebook.com (Facebook)
Source: chromecache_232.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/aJoeSHn7XcN/ equals www.facebook.com (Facebook)
Source: chromecache_232.6.dr, chromecache_153.6.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <https://www.facebook.com/video1-1-0C equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: >https://www.youtube.com/accountrosoft\WindowsINetCookiesOl equals www.youtube.com (Youtube)
Source: chromecache_173.6.dr	String found in binary or memory: _.Jw(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.Jw(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.Jw(_.Sw(c))+"&hl="+_.Jw(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.Jw(m)+"/chromebook/termsofservice.html?languageCode="+_.Jw(d)+"&regionCode="+_.Jw(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded":"")+"?hl="+_.Jw(d)+"&gl="+_.Jw(c)+(h?"&color_scheme="+ equals www.youtube.com (Youtube)
Source: chromecache_191.6.dr	String found in binary or memory: __d("Chromedome",["fbt"],(function(a,b,c,d,e,f,g,h){function i(){if(document.domain==null)return null;var a=document.domain,b=/^intern\./.test(a);if(b)return null;b=/(^\|\.)facebook\.(com\|sg)$/.test(a);if(b)return"facebook";b=/(^\|\.)instagram\.com$/.test(a);if(b)return"instagram";b=/(^\|\.)threads\.net$/.test(a);if(b)return"threads";b=/(^\|\.)messenger\.com$/.test(a);return b?"messenger":null}function j(a){if(a==="instagram")return h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable an Instagram feature or \"hack\" someone's account, it is a scam and will give them access to your Instagram account.");return a==="threads"?h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Threads feature or \"hack\" someone's account, it is a scam and will give them access to your Threads account."):h._("This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or \"hack\" someone's account, it is a scam and will give them access to your Facebook account.")}function a(a){if(top!==window)return;a=i();if(a==null)return;var b=h._("Stop!");a=j(a);var c=h._("See {url} for more information.",[h._param("url","https://www.facebook.com/selfxss")]);if(window.chrome\|\|window.safari){var d="font-family:helvetica; font-size:20px; ";[[b,d+"font-size:50px; font-weight:bold; color:red; -webkit-text-stroke:1px black;"],[a,d],[c,d],["",""]].map(function(a){window.setTimeout(console.log.bind(console,"\n%c"+a[0].toString(),a[1]))})}else{b=[""," .d8888b. 888 888","d88P Y88b 888 888","Y88b. 888 888",' "Y888b. 888888 .d88b. 88888b. 888',' "Y88b. 888 d88""88b 888 "88b 888',' "888 888 888 888 888 888 Y8P',"Y88b d88P Y88b. Y88..88P 888 d88P",' "Y8888P" "Y888 "Y88P" 88888P" 888'," 888"," 888"," 888"];d=(""+a.toString()).match(/.{35}.+?\s+\|.+$/g);if(d!=null){a=Math.floor(Math.max(0,(b.length-d.length)/2));for(var e=0;e<b.length\|\|e<d.length;e++){var f=b[e];b[e]=f+new Array(45-f.length).join(" ")+(d[e-a]\|\|"")}}console.log("\n\n\n"+b.join("\n")+"\n\n"+c.toString()+"\n");return}}g.start=a}),226); equals www.facebook.com (Facebook)
Source: chromecache_133.6.dr	String found in binary or memory: __d("CometCookieConsent2023Q1OtherCompanies.react",["fbt","CometCookieConsentModalStringsUpdated","CometCookieConsentSectionAccordion.react","CometCookieConsentUtils.react","CometListCell.react","CometListCellPressable.react","CometListCellText.react","CometSwitch.react","DisclosureAddOn.react","TetraText.react","gkx","react"],(function(a,b,c,d,e,f,g,h){"use strict";var i,j=i\|\|(i=d("react")),k=i.useState;function a(){var a=k(!1),b=a[0],e=a[1];a=c("gkx")("1834");return j.jsxs("div",{className:"x1nb4dca x1q0q8m5 xso031l xx6bls6",children:[j.jsx("div",{className:"x9orja2",children:j.jsx(c("TetraText.react"),{type:"headlineEmphasized2",children:d("CometCookieConsentModalStringsUpdated").COOKIES_FROM_OTHER_COMPANIES_SECTION_HEADER})}),a?j.jsxs(j.Fragment,{children:[j.jsx(c("CometListCell.react"),{addOnEnd:j.jsx(c("CometSwitch.react"),{onValueChange:function(){e(!b)},value:b,children:h._("Toggle")}),content:j.jsx(c("CometListCellText.react"),{body:j.jsx(c("TetraText.react"),{type:"body3",children:d("CometCookieConsentModalStringsUpdated").getCookiesFromOtherCompaniesSubHeader(r)})}),hasBottomDivider:!1}),j.jsx(c("CometListCellPressable.react"),{addOnEnd:j.jsx(c("DisclosureAddOn.react"),{}),content:j.jsx(c("CometListCellText.react"),{headline:j.jsx(c("TetraText.react"),{type:"headline3",children:d("CometCookieConsentModalStringsUpdated").CATEGORY_CONTROLS_ENTRY_TEXT})}),onPress:function(){}})]}):j.jsx("div",{className:"xx6bls6 x1cnzs8",children:j.jsx(c("TetraText.react"),{type:"body3",children:d("CometCookieConsentModalStringsUpdated").getCookiesFromOtherCompaniesSubHeader(r)})}),j.jsx(c("CometCookieConsentSectionAccordion.react"),{content:m,sectionTitle:l}),j.jsx(c("CometCookieConsentSectionAccordion.react"),{content:o,sectionTitle:n}),j.jsx(c("CometCookieConsentSectionAccordion.react"),{content:q,sectionTitle:p})]})}a.displayName=a.name+" [from "+f.id+"]";var l=j.jsx(c("CometListCellText.react"),{headline:j.jsx(c("TetraText.react"),{type:"headlineEmphasized3",children:d("CometCookieConsentModalStringsUpdated").HOW_WE_USE_THESE_COOKIES})}),m=j.jsxs("div",{style:{marginLeft:10},children:[j.jsx("div",{style:{paddingBottom:10,paddingTop:10},children:j.jsx(c("TetraText.react"),{type:"body3",children:d("CometCookieConsentModalStringsUpdated").HOW_WE_USE_THESE_COOKIES_INTRO})}),j.jsx(d("CometCookieConsentUtils.react").CometConsentListBullets,{list:[d("CometCookieConsentModalStringsUpdated").HOW_WE_USE_THESE_COOKIES_ITEM_1,d("CometCookieConsentModalStringsUpdated").HOW_WE_USE_THESE_COOKIES_ITEM_2,d("CometCookieConsentModalStringsUpdated").HOW_WE_USE_THESE_COOKIES_ITEM_3]})]}),n=j.jsx(c("CometListCellText.react"),{headline:j.jsx(c("TetraText.react"),{type:"headlineEmphasized3",children:d("CometCookieConsentModalStringsUpdated").IF_ALLOW_THESE_COOKIES})}),o=j.jsx("div",{style:{marginLeft:10},children:j.jsx(d("CometCookieConsentUtils.react").CometConsentListBullets,{list:[d("CometCookieConsentModalStringsUpdated").IF_ALLOW_THESE_COOKIES_ITEM_1,d("CometCookieCons
Source: chromecache_124.6.dr	String found in binary or memory: __d("CometLegalFooter.react",["fbt","ix","BaseMiddot.react","CometErrorBoundary.react","CometLazyPopoverTrigger.react","CometLink.react","CometPressable.react","FBCookieSettingsLoggedOutConfig","JSResourceForInteraction","ServerTime","TetraIcon.react","TetraText.react","XHealthPolicyCometControllerRouteBuilder","XPrivacyPolicyCometControllerRouteBuilder","fbicon","gkx","react","useCurrentRoute"],(function(a,b,c,d,e,f,g,h,i){"use strict";var j,k=j\|\|d("react"),l=c("JSResourceForInteraction")("CometLegalFooterMoreMenu.react").__setRef("CometLegalFooter.react");function m(){try{var a;return(a=new Date(d("ServerTime").getMillis()))==null?void 0:a.getFullYear()}catch(a){return null}}function a(a){var b=a.isHelpCenter;b=b===void 0?!1:b;var e=a.isPage;e=e===void 0?!1:e;var f=a.onClick;a=d("FBCookieSettingsLoggedOutConfig").should_show_cookie_settings;var g=c("useCurrentRoute")(),j=m(),n=c("XPrivacyPolicyCometControllerRouteBuilder").buildUri({entry_point:"comet_dropdown"}),o=c("XHealthPolicyCometControllerRouteBuilder").buildUri({});e=[{href:"https://www.facebook.com/legal/terms/information_about_page_insights_data",label:h._("Information about Page Insights Data"),render:e&&c("gkx")("22806")},{href:n.toString(),label:h._("Privacy"),testid:"CometDropdownPrivacy"},{href:o.toString(),label:h._("Consumer Health Privacy"),render:c("gkx")("2828"),testid:"CometDropdownHealthPrivacy"},{href:"/terms?ref=pf",label:"Impressum/Terms/NetzDG/UrhDaG",render:c("gkx")("22807")&&!c("gkx")("22808")},{href:"/terms?ref=pf",label:h._("Imprint\/Terms"),render:c("gkx")("22808")},{href:"/legal/germany/",label:"UrhDaG/MStV",render:c("gkx")("22808")},{href:"/policies?ref=pf",label:h._("Terms"),render:!c("gkx")("22807")&&!c("gkx")("22808"),testid:"CometDropdownTerms"},{href:"/business/",label:h._("Advertising")},{href:"/help/568137493302217",label:k.jsxs(k.Fragment,{children:[h._("Ad Choices")," ",k.jsx(c("CometErrorBoundary.react"),{children:k.jsx("span",{className:"x1n2onr6 x1qiirwl",children:k.jsx(c("TetraIcon.react"),{color:"secondary",icon:d("fbicon")._(i("871692"),12)})})})]})},{href:"/policies/cookies/",label:h._("Cookies"),testid:"CometDropdownCookies"},{href:"/privacy/cookie_settings/",label:h._("Cookie Settings"),render:a}].filter(function(a){return a.render==null\|\|a.render===!0});var p=[];if((g==null?void 0:(n=g.rootView.props)==null?void 0:n.seoCrawlingPool)&&(g==null?void 0:(o=g.rootView.props)==null?void 0:o.seoCrawlingPool.url)){Array.from(Array((g==null?void 0:(a=g.rootView.props)==null?void 0:a.seoCrawlingPool.multiple_links)\|\|0)).forEach(function(a,b){p.push(k.jsxs("li",{className:"xt0psk2",children:[k.jsx(c("CometLink.react"),{color:"secondary",href:g==null?void 0:(a=g.rootView.props)==null?void 0:a.seoCrawlingPool.url,onClick:f,weight:"normal",children:g==null?void 0:(a=g.rootView.props)==null?void 0:a.seoCrawlingPool.link_string}),k.jsx(c("BaseMiddot.react"),{})]},b))})}if((g==null?void 0:(n=g.rootView.props)==null?void 0:n.seoGrowthAutomationCrawlingPool)&&(g
Source: chromecache_133.6.dr	String found in binary or memory: __d("FacebookCookieConsentCustomization",["fbt","ix","JSResourceForInteraction","XCookiesPolicyControllerRouteBuilder","isBaseline4EnabledForLoggedOut","isCNILEnabledForLoggedOut","lazyLoadComponent"],(function(a,b,c,d,e,f,g,h,i){"use strict";var j=c("lazyLoadComponent")(c("JSResourceForInteraction")("FacebookCometCookieConsentDialogDataSettings.react").__setRef("FacebookCookieConsentCustomization"));a=function(){var a,b,d,e=null;c("isBaseline4EnabledForLoggedOut")()\|\|c("isCNILEnabledForLoggedOut")()?(b=i("1954651"),d=i("1954649"),e=h._("More options")):(b=i("856481"),d=i("856481"),e=h._("Manage Data Settings"));a=(a=(a=c("XCookiesPolicyControllerRouteBuilder").buildUri({}).getQualifiedUri())==null?void 0:(a=a.setDomain("www.facebook.com"))==null?void 0:a.toString())!=null?a:"";return{essentialCookiesOnly:!1,faviconDark:d,faviconLight:b,policyUrl:a,productName:"FACEBOOK",secondaryAction:{label:e,viewReference:j}}};b=a;g["default"]=b}),226); equals www.facebook.com (Facebook)
Source: chromecache_132.6.dr	String found in binary or memory: __d("RealtimeGraphQLRequest",["invariant","RequestStreamCommonRequestStreamCommonTypes","TransportSelectingClientSingleton","nullthrows","regeneratorRuntime"],(function(a,b,c,d,e,f,g,h){"use strict";a=function(){function a(a){var b=this,e=a.method,f=a.doc_id,g=a.is_intern,i=a.extra_headers,j=a.body,k=a.instrumentation_data;a=a.sandbox;this.$12=function(a){switch(a){case d("RequestStreamCommonRequestStreamCommonTypes").FlowStatus.Started:if(b.$10){b.$9!=null\|\|h(0,13576);a=Date.now()-c("nullthrows")(b.$9);b.$7!=null&&b.$7(a)}else b.$10=!0,b.$5!=null&&b.$5();break;case d("RequestStreamCommonRequestStreamCommonTypes").FlowStatus.Stopped:b.$9=Date.now();b.$6!=null&&b.$6(!1,!1);break;default:break}};this.$10=!1;e={method:e,doc_id:f};g===!0&&(e=babelHelpers["extends"]({},e,{www_tier:"intern"}));a!=null&&(e=babelHelpers["extends"]({},e,{www_sandbox:a.replace(/^not-www\.(\d+)\.(od\|sb)\.internalfb\.com$/,"www.$1.$2.facebook.com")}));i!=null&&(e=babelHelpers["extends"]({},e,i));this.$1=e;this.$2=JSON.stringify(j);this.$11=k}var e=a.prototype;e.onResponse=function(a){this.$3=a;return this};e.onError=function(a){this.$4=a;return this};e.onActive=function(a){this.$5=a;return this};e.onPause=function(a){this.$6=a;return this};e.onResume=function(a){this.$7=a;return this};e.onRetryUpdateRequestBody=function(a){this.$8=a;this.$1=babelHelpers["extends"]({},this.$1,{request_stream_retry:"false"});return this};e.send=function(){var a,d;return b("regeneratorRuntime").async(function(e){while(1)switch(e.prev=e.next){case 0:this.$3!=null\|\|h(0,33593);a={onData:c("nullthrows")(this.$3)};this.$4!=null&&(a=babelHelpers["extends"]({},a,{onTermination:this.$4}));a=babelHelpers["extends"]({},a,{onFlowStatus:this.$12});this.$8!=null&&(a=babelHelpers["extends"]({},a,{onRetryUpdateRequestBody:this.$8}));e.next=7;return b("regeneratorRuntime").awrap(c("TransportSelectingClientSingleton").requestStream(this.$1,this.$2,a,this.$11));case 7:d=e.sent;return e.abrupt("return",{cancel:function(){d.cancel()},amendExperimental:function(a){try{d.amendWithoutAck(JSON.stringify(a));return!0}catch(a){return!1}}});case 9:case"end":return e.stop()}},null,this)};return a}();g["default"]=a}),98); equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000002.1651698087.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bts://www.youtube.com/account equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651698087.0000000001068000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/video equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651698087.0000000001068000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account"% equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001088000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000003.1650965775.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com/video)" equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com; equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comA equals www.facebook.com (Facebook)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comp\ equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comu\ equals www.youtube.com (Youtube)
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com\|d equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.youtube.com

Source: unknown

HTTP traffic detected: POST /ajax/qm/?__a=1&__user=0&__comet_req=15&jazoest=2903 HTTP/1.1Host: www.facebook.comConnection: keep-aliveContent-Length: 124sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedsec-ch-ua-platform-version: "10.0.0"dpr: 1sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.facebook.comSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.facebook.com/videoAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuZ.AWXg241u3QQ; expires=Thu, 18-Jul-2024 01:40:41 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=08tYrEllOTxZIgVIa..BmIcuZ..AAA.0.0.BmIcuZ.AWVIsZslkTc; expires=Thu, 18-Jul-2024 01:40:41 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ; expires=Thu, 18-Jul-2024 01:40:42 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuc.AWVYKvhM6i8; expires=Thu, 18-Jul-2024 01:40:44 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; expires=Thu, 18-Jul-2024 01:40:45 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is; expires=Thu, 18-Jul-2024 01:41:07 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingSet-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcvm.AWUVYGdJSe8; expires=Thu, 18-Jul-2024 01:41:58 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=Nonereporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}

Source: chromecache_173.6.dr	String found in binary or memory: https://accounts.google.com
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com#v
Source: HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/0
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/2
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/2x
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/66
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/9
Source: chromecache_173.6.dr	String found in binary or memory: https://accounts.google.com/TOS?loc=
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/UserWdtH
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Y
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/bu
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/me
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ne
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o&
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/pe
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/u
Source: HxesZl7bIx.exe, 00000000.00000002.1651698087.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.coms
Source: chromecache_224.6.dr, chromecache_149.6.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
Source: chromecache_173.6.dr	String found in binary or memory: https://families.google.com/intl/
Source: chromecache_132.6.dr	String found in binary or memory: https://fburl.com/comet_preloading
Source: chromecache_132.6.dr	String found in binary or memory: https://fburl.com/dialog-provider).
Source: chromecache_132.6.dr	String found in binary or memory: https://fburl.com/wiki/m19zmtlh
Source: chromecache_227.6.dr, chromecache_235.6.dr	String found in binary or memory: https://fburl.com/wiki/xrzohrqb
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://g.co/recover
Source: chromecache_167.6.dr	String found in binary or memory: https://lexical.dev/docs/error?
Source: chromecache_133.6.dr	String found in binary or memory: https://optout.aboutads.info/
Source: chromecache_173.6.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://play.google.com/work/enroll?identifier=
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://play.google/intl/
Source: chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/privacy
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/privacy/additional
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/privacy/additional/embedded?gl=kr
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/privacy/google-partners
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/technologies/location-data
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/terms
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/terms/location/embedded
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://policies.google.com/terms/service-specific
Source: chromecache_124.6.dr	String found in binary or memory: https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/animation/
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
Source: chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_v1.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
Source: chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/get_family_link_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_0.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_0.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/alreadyinstalledfamilylink.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/installfamilylink.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
Source: chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://support.google.com/accounts?hl=
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://support.google.com/accounts?p=new-si-ui
Source: chromecache_133.6.dr	String found in binary or memory: https://support.google.com/chrome/answer/95647
Source: chromecache_173.6.dr	String found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
Source: chromecache_224.6.dr, chromecache_149.6.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.google.com
Source: chromecache_173.6.dr	String found in binary or memory: https://www.google.com/intl/
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
Source: chromecache_223.6.dr	String found in binary or memory: https://www.internalfb.com/intern/invariant/
Source: chromecache_133.6.dr	String found in binary or memory: https://www.youronlinechoices.com/
Source: HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001088000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000003.1650965775.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC
Source: HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountrosoft
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
Source: chromecache_133.6.dr	String found in binary or memory: https://youradchoices.ca/
Source: chromecache_218.6.dr, chromecache_173.6.dr	String found in binary or memory: https://youtube.com/t/terms?gl=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900

Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.33.136.127:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49940 version: TLS 1.2

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003BEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_003BEAFF

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003BED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_003BED6A

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

0_2_003BEAFF

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003AAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_003AAA57

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003D9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_003D9576

System Summary

Binary is likely a compiled AutoIt script file

Source: HxesZl7bIx.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: HxesZl7bIx.exe, 00000000.00000000.1646659099.0000000000402000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b230da33-c
Source: HxesZl7bIx.exe, 00000000.00000000.1646659099.0000000000402000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_029e8069-1
Source: HxesZl7bIx.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d58b49ed-6
Source: HxesZl7bIx.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7fec1754-0

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003AD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_003AD5EB

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003A1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_003A1201

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003AE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_003AE8F6

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00348060	0_2_00348060
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B2046	0_2_003B2046
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003A8298	0_2_003A8298
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0037E4FF	0_2_0037E4FF
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0037676B	0_2_0037676B
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003D4873	0_2_003D4873
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0036CAA0	0_2_0036CAA0
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0034CAF0	0_2_0034CAF0
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0035CC39	0_2_0035CC39
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00376DD9	0_2_00376DD9
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0035B119	0_2_0035B119
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003491C0	0_2_003491C0
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00361394	0_2_00361394
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00361706	0_2_00361706
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0036781B	0_2_0036781B
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00347920	0_2_00347920
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0035997D	0_2_0035997D
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003619B0	0_2_003619B0
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00367A4A	0_2_00367A4A
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00361C77	0_2_00361C77
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00367CA7	0_2_00367CA7
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003CBE44	0_2_003CBE44
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00379EEE	0_2_00379EEE
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00361F32	0_2_00361F32
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0034BF40	0_2_0034BF40

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: String function: 00360A30 appears 46 times
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: String function: 0035F9F2 appears 31 times

Source: HxesZl7bIx.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@36/204@32/12

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003B37B5 GetLastError,FormatMessageW,

0_2_003B37B5

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003A10BF AdjustTokenPrivileges,CloseHandle,		0_2_003A10BF
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003A16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_003A16C3

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003B51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_003B51CD

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003CA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_003CA67C

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003B648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_003B648E

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_003442A2

Source: HxesZl7bIx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HxesZl7bIx.exe	ReversingLabs: Detection: 58%
Source: HxesZl7bIx.exe	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\HxesZl7bIx.exe "C:\Users\user\Desktop\HxesZl7bIx.exe"
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/account
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1948,i,11509186462824718599,1135908042397387967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1852,i,4759629210035678805,3371975258739190933,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/account	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1948,i,11509186462824718599,1135908042397387967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1852,i,4759629210035678805,3371975258739190933,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Section loaded: wkscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\InProcServer32

Jump to behavior

Source: HxesZl7bIx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: HxesZl7bIx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: HxesZl7bIx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: HxesZl7bIx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: HxesZl7bIx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: HxesZl7bIx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: HxesZl7bIx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: HxesZl7bIx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: HxesZl7bIx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: HxesZl7bIx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: HxesZl7bIx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: HxesZl7bIx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_003442DE

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_00360A76 push ecx; ret

0_2_00360A89

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0035F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0035F98E
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003D1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_003D1C41

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95491

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

API coverage: 3.0 %

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B68EE FindFirstFileW,FindClose,	0_2_003B68EE
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_003B698F
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003AD076
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_003AD3A9
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003B9642
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003B979D
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_003B9B2B
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_003ADBBE
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003B5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_003B5C97

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_003442DE

Source: HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003BEAA2 BlockInput,

0_2_003BEAA2

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_00372622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00372622

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_003442DE

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_00364CE8 mov eax, dword ptr fs:[00000030h]

0_2_00364CE8

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003A0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_003A0B62

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00372622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00372622
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_0036083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0036083F
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003609D5 SetUnhandledExceptionFilter,	0_2_003609D5
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_00360C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00360C21

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

0_2_003A1201

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_00382BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00382BA5

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003AB226 SendInput,keybd_event,

0_2_003AB226

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003C22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_003C22DA

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/account	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video	Jump to behavior
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/	Jump to behavior

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

0_2_003A0B62

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003A1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_003A1663

Source: HxesZl7bIx.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: HxesZl7bIx.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_00360698 cpuid

0_2_00360698

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003B8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_003B8195

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_0039D27A GetUserNameW,

0_2_0039D27A

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_0037BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0037BB6F

Source: C:\Users\user\Desktop\HxesZl7bIx.exe

Code function: 0_2_003442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_003442DE

Source: HxesZl7bIx.exe	Binary or memory string: WIN_81
Source: HxesZl7bIx.exe	Binary or memory string: WIN_XP
Source: HxesZl7bIx.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: HxesZl7bIx.exe	Binary or memory string: WIN_XPe
Source: HxesZl7bIx.exe	Binary or memory string: WIN_VISTA
Source: HxesZl7bIx.exe	Binary or memory string: WIN_7
Source: HxesZl7bIx.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003C1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_003C1204
Source: C:\Users\user\Desktop\HxesZl7bIx.exe	Code function: 0_2_003C1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_003C1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	2 Valid Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HxesZl7bIx.exe	58%	ReversingLabs	Win32.Spyware.Risepro
HxesZl7bIx.exe	56%	Virustotal		Browse
HxesZl7bIx.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://youradchoices.ca/	0%	URL Reputation	safe
https://fburl.com/dialog-provider).	0%	URL Reputation	safe
https://lexical.dev/docs/error?	0%	URL Reputation	safe
https://fburl.com/wiki/xrzohrqb	0%	URL Reputation	safe
https://play.google/intl/	0%	URL Reputation	safe
https://fburl.com/comet_preloading	0%	URL Reputation	safe
https://fburl.com/wiki/m19zmtlh	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	31.13.65.36	true	false	high
youtube-ui.l.google.com	108.177.122.93	true	false	high
scontent.xx.fbcdn.net	31.13.65.7	true	false	high
play.google.com	64.233.177.101	true	false	high
www3.l.google.com	142.250.9.139	true	false	high
www.google.com	64.233.176.147	true	false	high
scontent-atl3-2.xx.fbcdn.net	31.13.88.13	true	false	high
www.facebook.com	unknown	unknown	false	high
accounts.youtube.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
static.xx.fbcdn.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438193268_922912702947462_7506581556452730663_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=F1f1WyXRCfUAb5H7pg3&_nc_ht=scontent-atl3-2.xx&oh=00_AfDB1zgmFI527f9DlANisuRmydguLRC3xydmlEEaw4wURA&oe=6627B6C7	false	high
https://static.xx.fbcdn.net/rsrc.php/v3ic_A4/yy/l/en_US/SV3JvfEjy-HECsg6rc0g3Q_nx0QPfkJnvo7kHHAR2WLloFvVgikQZOAlimUDEtcYdfpXFYHV90WF8xsw_y3zVOBS5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://www.facebook.com/video	false	high
https://static.xx.fbcdn.net/rsrc.php/v3ieKI4/yX/l/en_US/aia9_5MaGl8.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yA/r/OMXgFqU76kP.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/YevIHjTZjnO.css?_nc_x=Ij3Wp8lg5Kz	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/294724701_110489671750480_988274315942354852_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=CsDREyxMCqwAb6Zm1uF&_nc_ht=scontent-atl3-2.xx&oh=00_AfDUhmgSNym9P3hgORApjgvt5uZCr5vKPXDneN84pBy-xQ&oe=662798CE	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/430843272_438547758855568_3782525580529738461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ki7LIH_ntfYAb7lEcz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfCIj5_yMIP5Es9E9YFuWRv8iLuRq49yvysp8vObeIcFQA&oe=66278DC5	false	high
https://www.facebook.com/ajax/qm/?__a=1&__user=0&__comet_req=15&jazoest=2903	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=a&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=d&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/G3Nm7rYDpD0.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438091798_1180371333322580_3869440255780885829_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xEMShP_qLFMAb55VT3m&_nc_ht=scontent-atl3-2.xx&oh=00_AfDWfJxHj0HZNwe-NDko3zvnYAmSYlIZukKiC1ty_egxkw&oe=6627908C	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=9&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/417843986_7077021149032703_7323956251606094932_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=LP1IcS8WNgkAb5jFRoV&_nc_ht=scontent-atl3-2.xx&oh=00_AfA70jyAe-1RiEXheUHVhxrne1KBbSQ7H9DEFsRhZDQbsQ&oe=6627932F	false	high
https://www.facebook.com/ajax/webstorage/process_keys/?state=1	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=b&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/437942529_992446696222628_1543467553494358279_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=AcwWWyFNr0wAb46GRke&_nc_ht=scontent-atl3-2.xx&oh=00_AfCufZFJTsYS1oCzs70XhJ1l36Gl75o7UJvA_kTMwh_8Eg&oe=6627949F	false	high
https://static.xx.fbcdn.net/rsrc.php/v3ifhN4/yX/l/en_US/nChwAUT1aUgDYvatkvPhoORf7s0WJvHMPn1wRO-dUcIoL9XF0wO0ej9ML-m_DiQrfXi0ByZrEbi6c-BC0lRf3kmQVAblIutlJuDu8FjJ2mAf5cwjSvgZCKCmXkp8GwrOMn7m1Rdzuzi16ygkVEIahZX1XqpI1Q50zl6ZBgWvsJpQFrYrGc1wa-Oq19cr_l1DuzAtWVDh4cn1CMxub3y91qmloYqXsrAa0b9bMzu_eJMlvvhSHqOL8xCqhxFHLp55HfXW__mMgFRlCsGN0FHzi95_wmB-51YxoStyBz2gE2pEQn4HVER6vHpPn3-WFWVy-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=j&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/414867464_7046595375378763_4861839573446109840_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=QVssM7vGW2oAb4BrMfp&_nc_ht=scontent-atl3-2.xx&oh=00_AfDu-H0r-6CfzXEJPa3gbJwso6VAEOgSMr--wRf3P1KcMw&oe=66279958	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/297577919_10217274176765031_2994694822502324520_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-3rUZ9jyX0wAb5bIv02&_nc_ht=scontent-atl3-2.xx&oh=00_AfCINx_mKEMbP48d8aI4g-TLfOU0Eri64MtOnKfkm9oufA&oe=6627AB82	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t1.6435-1/182862089_329809465171561_9124100968924750007_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rbjHzLvzucEAb5bZn4H&_nc_ht=scontent-atl3-2.xx&oh=00_AfDvEfsbAQgrTPLx-opY6lSgCA3J3Ac-nhnwCNbY_jzosg&oe=664928B3	false	high
https://www.youtube.com/account	false	high
https://www.google.com/favicon.ico	false	high
https://www.facebook.com/data/manifest/	false	high
https://static.xx.fbcdn.net/rsrc.php/v3ifWF4/yt/l/en_US/3KWduJcmUWu.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=4&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=7&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/yT/r/aGT3gskzWBf.ico	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iQbs4/yg/l/en_US/EX6jmVQkY6L.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/v3i7Vo4/y6/l/en_US/LznjGi-Mcyn.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/434846145_750354690635123_5825280892337708034_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=VY_PguNQYqkAb4vYZ4J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAA-dZ2FVoVBFW58UvtffQQCH__zs3TaqlqaDmOBrIH9A&oe=66278A45	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/7NqDjYL3eb9.png	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/eFZD1KABzRA.png	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yR/r/4TRsPp18HYl.png	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=e&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/q8Uic1K195T.png	false	high
https://static.xx.fbcdn.net/rsrc.php/v3ivlb4/yn/l/en_US/5ZMgj96iLR9.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/RBVykxDUbUn.png	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/436859318_962909741584758_3870588264605380752_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=s7KXFq-dOKwAb6FUqMa&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-GpW_tvCHQBURGYoJaXuwYk2uRI3TGoOELVJq2jzi8A&oe=6627A99F	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t1.6435-1/166562961_289775365843871_1089544784969631943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=gsiZqHemNI0Ab7xotOc&_nc_ht=scontent-atl3-2.xx&oh=00_AfCJ2y8PnGo5iYFIOIqkgTsp2QT4Magjkq-glreMKFQsPQ&oe=664932DC	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iMBH4/ym/l/en_US/PM0yz8J0_9eatA4AbcUXJ_xGj4GgHf6uoyMXsyMcajeZkbHSqEKHvKE5vIR6Z6_fPD4wyD5Ym16tXudcxB4NWZK-0RNSBe8qSPG4UpY82FpGVUugonw1necxJMJfxNSBC0jRQvPTG6MYkFOrTRdkwmU8Y3mM84SfiWlvqtZjCyJ63My3zlOMrO0CLM5TVwEj1ba-rOSQb0hClwF360PJEynPfrjI.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t51.29350-10/438844348_833636295261460_8820580507418716899_n.jpg?stp=dst-jpg_p206x206&_nc_cat=111&ccb=1-7&_nc_sid=5f2048&_nc_ohc=J7XdDp8SzdsAb7ozIpk&_nc_ht=scontent-atl3-2.xx&oh=00_AfCB8Q844RX1O_1OVOJ0GECUmomF3JgeZ_RWXRdhba-onA&oe=66278584	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/435297039_1622642408563885_856096703543016407_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=GWAVaQ02VJ8Ab6-Thma&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGNYDZ7rzrA5aOKLdOlSZvN9nxTDaGyE2PI0T-WhTcwA&oe=6627AC74	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438043668_951275763118012_9085738709733793549_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Ag36yU8NZ2YAb6DVjhK&_nc_oc=AdhGlZK-sKtqhfza7ml_SykynPBUSx2UizoL0jq-Q1WsBlq6hBHetpwRDqkENWqjVAg&_nc_ht=scontent-atl3-2.xx&oh=00_AfA66vG8Ma9yADhKUsRHkt3rFZiZhApEGqODDzKsb816Dw&oe=6627B1A4	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=h&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=g&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/427423164_1136863804107170_2890424799444787669_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=B9Pc79yiemQAb6zBz4r&_nc_ht=scontent-atl3-2.xx&oh=00_AfCiWqDXjAXfVtRjlfSGhw15nEOc_vXUOs2xVTfr50viLg&oe=6627A6F7	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iNTg4/yA/l/en_US/2obelxd4ucH.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/SDtEN57PJgl.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iFd24/yd/l/en_US/dj10Ym9OUFW.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://www.facebook.com/ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=8&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iCjQ4/yT/l/en_US/-cuErFyZKsI.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/429682066_368649729457593_2210717644653039134_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=PCsmMolcaEYAb5liA2T&_nc_ht=scontent-atl3-2.xx&oh=00_AfAr3LnIIBAW4Oll3CfuMViVa6IZ_P_aBcdVZ1tFLfUJ0Q&oe=66278F81	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438193634_720475476662614_5584509116371930153_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-ExROFrTdmwAb5t0lBc&_nc_ht=scontent-atl3-2.xx&oh=00_AfDC4ORowz8xLhxbrweQGY8ubgpNS608cJQiE9HwjWJqyw&oe=66279C6D	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iHrB4/y-/l/en_US/Sd6LZm7F8MR.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	high
https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/q9P8VRdD1Am.js?_nc_x=Ij3Wp8lg5Kz	false	high
https://play.google.com/log?hasfast=true&authuser=0&format=json	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/435585243_1336893433647196_6208832241633396260_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=elYzPYAIG9kAb6SZKEF&_nc_ht=scontent-atl3-2.xx&oh=00_AfCvf0SUTHuy36cSdF56yN534pHFsf_uSWdDHk8TaBveJA&oe=6627852B	false	high
https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/438331716_2765174076970236_1145479496426679813_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=obA5gIRYYUYAb7KFZz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfDhyPAWHnsY26BikqP407np3qhXfYGR6avsj0inolkFDg&oe=6627A836	false	high
https://static.xx.fbcdn.net/rsrc.php/v3iwN74/yD/l/en_US/APoqa-iIOjvrn_I8kVuFfvi1Qie0qdVBFdoHo8RmQG6EroQ9FNgpiRhTLojQtsFNcs.js?_nc_x=Ij3Wp8lg5Kz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.youtube.com/accountrosoft	HxesZl7bIx.exe, 00000000.00000003.1650742948.0000000001094000.00000004.00000020.00020000.00000000.sdmp, HxesZl7bIx.exe, 00000000.00000002.1651746451.0000000001094000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/work/enroll?identifier=	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://policies.google.com/terms/service-specific	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://g.co/recover	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072	chromecache_173.6.dr	false		high
https://policies.google.com/technologies/cookies	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://policies.google.com/terms	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://www.google.com	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://www.internalfb.com/intern/invariant/	chromecache_223.6.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://youradchoices.ca/	chromecache_133.6.dr	false	URL Reputation: safe	unknown
https://www.youronlinechoices.com/	chromecache_133.6.dr	false		high
https://youtube.com/t/terms?gl=	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://fburl.com/dialog-provider).	chromecache_132.6.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/	chromecache_173.6.dr	false		high
https://apis.google.com/js/api.js	chromecache_224.6.dr, chromecache_149.6.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_173.6.dr	false		high
https://lexical.dev/docs/error?	chromecache_167.6.dr	false	URL Reputation: safe	unknown
https://fburl.com/wiki/xrzohrqb	chromecache_227.6.dr, chromecache_235.6.dr	false	URL Reputation: safe	unknown
https://policies.google.com/privacy	chromecache_173.6.dr	false		high
https://play.google/intl/	chromecache_218.6.dr, chromecache_173.6.dr	false	URL Reputation: safe	unknown
https://families.google.com/intl/	chromecache_173.6.dr	false		high
https://optout.aboutads.info/	chromecache_133.6.dr	false		high
https://policies.google.com/technologies/location-data	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://support.google.com/accounts?p=new-si-ui	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://fburl.com/comet_preloading	chromecache_132.6.dr	false	URL Reputation: safe	unknown
https://support.google.com/chrome/answer/95647	chromecache_133.6.dr	false		high
https://policies.google.com/privacy/google-partners	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://policies.google.com/privacy/additional	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_224.6.dr, chromecache_149.6.dr	false		high
https://fburl.com/wiki/m19zmtlh	chromecache_132.6.dr	false	URL Reputation: safe	unknown
https://policies.google.com/privacy/additional/embedded?gl=kr	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://policies.google.com/terms/location/embedded	chromecache_218.6.dr, chromecache_173.6.dr	false		high
https://support.google.com/accounts?hl=	chromecache_218.6.dr, chromecache_173.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.13.65.36	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
142.250.9.139	www3.l.google.com	United States	15169	GOOGLEUS	false
31.13.65.7	scontent.xx.fbcdn.net	Ireland	32934	FACEBOOKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
64.233.177.101	play.google.com	United States	15169	GOOGLEUS	false
108.177.122.93	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
64.233.176.147	www.google.com	United States	15169	GOOGLEUS	false
31.13.88.35	unknown	Ireland	32934	FACEBOOKUS	false
31.13.88.13	scontent-atl3-2.xx.fbcdn.net	Ireland	32934	FACEBOOKUS	false
142.251.15.105	unknown	United States	15169	GOOGLEUS	false
142.251.15.138	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428503
Start date and time:	2024-04-19 03:39:45 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HxesZl7bIx.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	124edb48ce763a1b36c8e8736a865190c0e4928274acb617ce55e31e8c27c83f
Detection:	MAL
Classification:	mal60.evad.winEXE@36/204@32/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 33 Number of non-executed functions: 319

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.136.84, 172.217.215.100, 172.217.215.102, 172.217.215.139, 172.217.215.101, 172.217.215.113, 172.217.215.138, 74.125.138.94, 34.104.35.123, 172.253.124.94, 64.233.176.94, 64.233.177.95, 173.194.219.95, 64.233.176.95, 142.251.15.95, 142.250.9.95, 74.125.136.95, 172.217.215.95, 74.125.138.95, 142.250.105.95, 172.253.124.95, 64.233.185.95, 108.177.122.95, 64.233.185.94, 23.55.60.33, 192.229.211.108, 173.194.219.94, 142.250.105.84, 142.250.105.113, 142.250.105.138, 142.250.105.100, 142.250.105.102, 142.250.105.139, 142.250.105.101
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://aeno.co.jp.talglfts.cc/aeon	Get hash	malicious	Unknown	Browse
	https://scsang.cn/	Get hash	malicious	Unknown	Browse
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse
	https://setteledpaineter.uk.nf/	Get hash	malicious	Unknown	Browse
	https://zmmzmnsnnbxbbxvcxv22.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse
	https://dev217.d3uf3ys8fxt6s2.amplifyapp.com/Win08ShDMeEr0887/index.html	Get hash	malicious	Unknown	Browse
	https://www.huiyuan-sh.com/	Get hash	malicious	Unknown	Browse
	https://sdcoes.net/LandingPage/Index/122/	Get hash	malicious	HTMLPhisher	Browse
	https://appddd08.z19.web.core.windows.net/Win0security-helpline07/index.html?ph0n=1-844-492-0415	Get hash	malicious	TechSupportScam	Browse
	https://6a5ff6af4b0fe3e6f0bd452927dfb55b352fdd2d1bab6d1e7de2b641e2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://aeno.co.jp.talglfts.cc/aeon	Get hash	malicious	Unknown	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://scsang.cn/	Get hash	malicious	Unknown	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://cvn7.sa.com/invoice.html?app=	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://setteledpaineter.uk.nf/	Get hash	malicious	Unknown	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://www.huiyuan-sh.com/	Get hash	malicious	Unknown	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://sdcoes.net/LandingPage/Index/122/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://appddd08.z19.web.core.windows.net/Win0security-helpline07/index.html?ph0n=1-844-492-0415	Get hash	malicious	TechSupportScam	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://6a5ff6af4b0fe3e6f0bd452927dfb55b352fdd2d1bab6d1e7de2b641e2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 20.114.59.183 23.33.136.127
	https://www.cmmnamijedtovnuf.com/	Get hash	malicious	Unknown	Browse	52.165.165.26 20.114.59.183 23.33.136.127

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	37458
Entropy (8bit):	7.9680820524536635
Encrypted:	false
SSDEEP:	768:xYNV8IrpyBcAs5ZLKMV+ORQoANtz6HRbZW7KF7pdot:xA9AsfVHQ1R6xEgQ
MD5:	D59F1140F1346D39223B6CC43AC39CA1
SHA1:	49EC5CD5737DB4DE71F505B6807438B7170971BB
SHA-256:	84831F3CEA83511E8CC289EBB078ECE1663BC20B8BC5AF46382263F276FC9E4D
SHA-512:	2E427666063702B1E18F1FF25D73D95F461E585D031E52CD7A8614B21FEF4EC644F5DE2AA961047860FDAF6AFB9380E7B6C02FECF2084668FA38AB079ADB81C3
Malicious:	false
Reputation:	low
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/437942529_992446696222628_1543467553494358279_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=AcwWWyFNr0wAb46GRke&_nc_ht=scontent-atl3-2.xx&oh=00_AfCufZFJTsYS1oCzs70XhJ1l36Gl75o7UJvA_kTMwh_8Eg&oe=6627949F
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000a9180000902b0000322e0000bc310000fc400000455800008f5e0000f36100006e66000052920000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."......................................................................................Hn..q$.b......0..%.sL$. .......:.evm..q...N(i...gN2..U...(.Y.hW.quvWo..c.....}........&4.."H...."B`.0.8..se.b)..4.."..Y].2....vzM5(..FU.Fm9..-T.N.\...../...N...4...g....?.......L....#...`4....M...6.I.....)..].d.....Y..&.SL.Q._.6...u.U6...k%....b.z......wx..1._P.`.`..I.&.......L...;.H.\...4.Mh......[]....-2..u.F}....i...4.b.........^....1y.y}B`...0......!4....4C.C.$SX.h.I..........Ul..R..D.eh........b..M..o..}.OH.....z.\|k..................&.....y...9.j..E5N......N..[74..E..Z4g.:..Z*...&.b.J.4Dz....q5....t.x..?/...,...`...4.....hN,`B..0YX."M@..)..U.c..u:..fzL.@.g.+E.h.n.Z+..

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 189 x 177, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	7303
Entropy (8bit):	7.860646772141492
Encrypted:	false
SSDEEP:	192:AafLZ3TzdkUpBN3MnG4WGOwhiYLUNlQLc:jfLJTxDpBZMG4niXlQLc
MD5:	5FF833A3E0296C7BE5E130413D6F0431
SHA1:	6CB1CFBA275E5047F186EF39B6163ADF66137221
SHA-256:	25524E1E2D251DA55AA20821BE2B39A7EC96BA956B197E2D974D7C6F3D44006D
SHA-512:	366BA42BC157B98113DB3345B48B5DD1F7482CA0C9C4FD51B0868B19F97CDF029F3639C35DC454A8D63C73A69B783C1B2A9CADFEB1088095AC4C5B717C199BA1
Malicious:	false
Reputation:	low
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/RBVykxDUbUn.png
Preview:	.PNG........IHDR...............Ly....PLTEGpL.................................................................................................................................................................................................................................................................................(.8............................................................;;;...................................................................x..\|..x.........................................o......................................x..v....................v..w..............................................eee................w.....w.........................................w..w.................v..w........x..x..x..w..w..w.................w..w..v..v..............w..w.....w..w..w.....w.............n~f....tRNS........>......~..Z...8.H.)f.....,.$.pd...MP...!.............^B.vET.J...x...:i5\....2rzl.X...<a...6......@.....~q../..6.....3..J.!.@,..P.z.e]X......../..@F.!R.@...l........

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32859)
Category:	downloaded
Size (bytes):	609189
Entropy (8bit):	5.282937195948207
Encrypted:	false
SSDEEP:	6144:5sf0DTn3/YWkay5zzjRCkZ0aJcwBWh2lV:5sfCDPA7zztn0p2lV
MD5:	9A86CB14F1C001B7F9D17E7FCD0E02D6
SHA1:	EDE46D8EFB11991937420BE700C1B5A4FD8A357A
SHA-256:	73408CF261FF9CF70EEB3D3B6821113A7A03F35414501452459D30AB488D04A3
SHA-512:	556324362BF52E403F18D9327A172B81334728199630E60D80407A826657FFB2F345B65E893A2C0C83861977B9B4A594B034461DF4ABA50DAC348357BBEE8E7B
Malicious:	false
Reputation:	low
URL:	"https://static.xx.fbcdn.net/rsrc.php/v3/yb/l/0,cross/YevIHjTZjnO.css?_nc_x=Ij3Wp8lg5Kz"
Preview:	form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1631)
Category:	downloaded
Size (bytes):	38525
Entropy (8bit):	5.3838229197405845
Encrypted:	false
SSDEEP:	768:ka4ZsJiVqZZIpNGVMfgXafCcgBRyLa7l6txRjXbwm75/JgZRrQAT6l:bZCfVfCCa7qxR3nt/JgT6
MD5:	F269DC67D0E2355F1A50E500D5BE54A8
SHA1:	96A3A5C465D8A6B18373BF73138DBEB2B03AE534
SHA-256:	7FAB6151E7F2088D3E76373C563CCC3F9AE1523C49E8D38225F82158F8557954
SHA-512:	4B81B50467C5CD3CB11DCA60F6A9438214557565BEE34558B128BE17628965A6184D5845E4B61B883D8C4F140BE97259A16AF5361280EE1ADE4F0E674A4B2101
Malicious:	false
Reputation:	low
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.mpa=function(a){var b=0,c;for(c in a)b++;return b};_.npa=function(a){return a.hh&&"function"==typeof a.hh?a.hh():_.ja(a)\|\|"string"===typeof a?a.length:_.mpa(a)};_.qn=function(a){if(a.Xg&&"function"==typeof a.Xg)return a.Xg();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ja(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.ob(a)};._.opa=function(a){if(a.Vg&&"function"==typeof a.Vg)return a.Vg();if(!a.Xg\|\|"function"!=typeof a.Xg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ja(a)\|\|"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.pb(a)}}};.var ppa,spa,rpa,qpa,Gn,In,Epa,vpa,xpa,wpa,Apa,ypa;ppa=function(a,b,c){if(b)re

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	54252
Entropy (8bit):	7.978625718488979
Encrypted:	false
SSDEEP:	768:rqGU/CM2VuwTUYlLqyDL6iZR110sTcUhCUE120w+5ds+Fe7s7gXpGbtG1D4:rSa1YalhDL3BY8CUEE0nxFeg/btY0
MD5:	DFD58CA8892F923373F24EFB868E1CEF
SHA1:	2A5FF788B78845E9BF5755F741ABC74A65C47F8C
SHA-256:	29D6791B32719037072BF93B68E05E4792297C2A50A2689432D9BA0183E33951
SHA-512:	7560C5A130791ACD2E02830CC6A1D59CB936B984E0E58D45D5BF970004B8EF71E4ABFF84A1D05E23F635BAAA8FE510FA4B93E756872CDA771C6118143BA05B23
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000b7190000ff340000713600009e380000ec480000dc71000008780000527b0000fb7e0000ecd30000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................H..j... r.. $..i.$R.$.B.d..H....H.K..HV.h......~mx..mj.f.....a.=..z.$.c..h/.l....u.=.z...._.+-..C$...`4...C...a. e P2.B. +qV.....@.0.s.j._H...v.V.;+u..9..ggX....t~....t.;.vQh..../....>..K..2.AB$.l.t..."(d.2S.`...hI.C.I.`.IH!.v..C..Qu..h....r.+....6.S..g&......1~..meu:.N...F.1....Z.\|....:....C...Q.J.....b1 !..H.`..Hd....2E0H.IbX.UeE.g.X.5F=.!...x[...k.cY..7...k./g...f.Y.^..znZ....y\..DM.`..Y.c.@......h..b1.\..Wb0t$E.Y...B.>.".v.W..Q.R.D..........q._....s.\|.....].g{....=.{..>..o..:s..rH....0.......d!..WGc........3F..j.. .2.. ....Sekm.<h......,..uj......0H+..o>..uy.........q{.

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4199)
Category:	downloaded
Size (bytes):	19278
Entropy (8bit):	5.369599228603606
Encrypted:	false
SSDEEP:	384:cvdvKJdlmqS6Y09al9NSQqbZrM+McC4Gw+RXY2RAgpho55WW12:KvV6Y09a3wrHCQ+RIVgwWW12
MD5:	CF3995B2563E0EBF8D485583199AA881
SHA1:	AD8F16F214600B1C8D4B18E6BC227CBBE7921804
SHA-256:	D2D12D9D00DB79F5F874A8A5BF942591D4DB684901EDA33A7CDCA25E6F84377C
SHA-512:	B19CF516537D180DD64A6B9ECDD9760085971422511FF59FA05D120B43B4971611429B5A03D7D5384029D1691B6B414F9340701CA337D5CBA429C32CBE8D4310
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Qu=function(a){this.Ga=_.t(a)};_.A(_.Qu,_.v);_.Ru=function(a,b){return _.wd(a,3,b,_.Cc)};_.Qu.Mb=[1,2,3,4];.var wCa=_.da.URL,xCa,yCa,ACa,zCa;try{new wCa("http://example.com"),xCa=!0}catch(a){xCa=!1}yCa=xCa;.ACa=function(a){var b=_.dh("A");try{_.Kb(b,new _.wb(a));var c=b.protocol}catch(e){throw Error("hc`"+a);}if(""===c\|\|":"===c\|\|":"!=c[c.length-1])throw Error("hc`"+a);if(!zCa.has(c))throw Error("hc`"+a);if(!b.hostname)throw Error("hc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};zCa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.BCa=function(a){if(yCa){try{var b=new wCa(a)}catch(d){throw Error("hc`"+a);}var c=zCa.g

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6560)
Category:	downloaded
Size (bytes):	81188
Entropy (8bit):	5.647262660047423
Encrypted:	false
SSDEEP:	1536:p1qtW0SxACVgBdx5ql20g4oVMmb5siwQYYv:p1qtW0SiCWBoZgdqPQYq
MD5:	D984298C4486BD1411CA5A745328B977
SHA1:	88DC3D8BCB6C6B342B40D96E4D1706E4DF819123
SHA-256:	5B3C2A62284438B9F608AF213065D8FF09D9ED715F4F255E251C65D92E7EAAA7
SHA-512:	6BC2F70A84AA87EDB99D01F68C92552E693937C2389102AC75B1AC74BF5F2260CFCA8841AE1F14AFC8A92B63984F31859EF938520BE4C19A413EACA6468184D7
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3ic_A4/yy/l/en_US/SV3JvfEjy-HECsg6rc0g3Q_nx0QPfkJnvo7kHHAR2WLloFvVgikQZOAlimUDEtcYdfpXFYHV90WF8xsw_y3zVOBS5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("usePartialViewImpression",["useVisibilityObserver"],(function(a,b,c,d,e,f,g){"use strict";function a(a){var b=a.onImpressionEnd;a=a.onImpressionStart;return c("useVisibilityObserver")({onHidden:b,onVisible:a,options:{hiddenWhenCSSStyleHidden:!0,hiddenWhenZeroArea:!0}})}g["default"]=a}),98);.__d("useFadeEffect",["clearTimeout","react","setTimeout","useDoubleEffectHack_DO_NOT_USE_THIS_IS_TRACKED"],(function(a,b,c,d,e,f,g){"use strict";var h;b=h\|\|d("react");var i=b.useCallback,j=b.useLayoutEffect,k=b.useReducer,l=b.useRef,m=1e3;function n(a,b){switch(b.type){case"start":return{isTransitioning:!0,shouldBeVisible:b.shouldBeVisible};case"finish":return{isTransitioning:!1,shouldBeVisible:a.shouldBeVisible};default:return a}}function a(a){var b=l(null),d=k(n,{isTransitioning:!1,shouldBeVisible:!1}),e=d[0],f=e.isTransitioning;e=e.shouldBeVisible;var g=d[1],h=l(null),o=l(null);c("useDoubleEffectHack_DO_NOT_USE_THIS_IS_TRACKED")(function(){return function(){h.current!=null

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1600
Entropy (8bit):	5.2114513236869175
Encrypted:	false
SSDEEP:	24:kMYD7FG1NPxuZiWQt+Jcu+yNPx1gODoHTR8uPlyH/6Hum/NtukNPx01JQSokp484:o7UHjAj+s4zR8ClyH5agKGwhkUshvNrw
MD5:	FFE1B082415A066E522D9B7F02EC70E6
SHA1:	041340B4440097D12D3EF465501E51DDC000BAD1
SHA-256:	E7D5B7A3B13D2D5F4599251A11E72AA814CE843921DCDF38C4C0CF2EEB191A67
SHA-512:	8CA5C9CEF07A886536C49648CBC24EAA9026E49FD2DDE95F1470E95D1F3E720158BB4CB8FE411CF7C0FCA4049327129D4342443231B6DC2F7D0963C0B4BD9C0A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.qf(_.dja);_.Nv=function(a){_.I.call(this,a.Ha);this.aa=a.Wa.cache};_.A(_.Nv,_.I);_.Nv.Na=_.I.Na;_.Nv.Ba=function(){return{Wa:{cache:_.$o}}};_.Nv.prototype.execute=function(a){_.nb(a,function(b){var c;_.ie(b)&&(c=b.Za.Wb(b.fb));c&&this.aa.lD(c)},this);return{}};_.Eq(_.yja,_.Nv);._.l();._.k("VwDzFe");.var hE=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.Sq;this.fa=a.Fa.metadata;this.da=a.Fa.Jq};_.A(hE,_.I);hE.Na=_.I.Na;hE.Ba=function(){return{Fa:{Sq:_.ID,metadata:_.oVa,Jq:_.FD}}};hE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.nb(a,function(c){var d=2===b.fa.getType(c.Ed())?b.aa.Xb(c):b.aa.aa(c);return _.Ij(c,_.JD)?d.then(function(e){return _.md(e)}):d},this)};_.Eq(_.Dja,hE);._.l();._.k("sP4Vbe");._.nVa=new _.xe(_.zja);._.l();._.k("A7fCU");.var ND=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.tL};_.A(ND,_.I);ND.Na=_.I.Na;ND.Ba=function(){r

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	downloaded
Size (bytes):	1479
Entropy (8bit):	5.306981966963761
Encrypted:	false
SSDEEP:	24:kMYD7x3u0oobgQNcKYYGWn/HTwfUuH0NPIehiofo89Lay2CLtuNGbMfO+Gb6gf6+:o7x+0oo89eHuH6VeyGCZuNGbMG+GbXi+
MD5:	60908F81C5350005E490CB2A7ABB3F37
SHA1:	B82FC316F3035AFF1AFE2035CEB9A2CB04726876
SHA-256:	613712129110A4869B9C63F7058D972C46A410199B8D31C821C5A79A5FC2C2E9
SHA-512:	A88D4E0C24430FF04B84EA2B5EC1B04F9B60C5227FE38D0418C8F710425553CA661B6394A33150C2D75446FD1FB22F01389D9CBA760A36346D963EC3C6B178F1
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.oVa=new _.xe(_.Fk);._.l();._.k("bm51tf");.var rVa=!!(_.Qf[0]>>20&1);var tVa=function(a,b,c,d,e){this.fa=a;this.ta=b;this.ja=c;this.Ca=d;this.Ia=e;this.aa=0;this.da=sVa(this)},uVa=function(a){var b={};_.Ka(a.EN(),function(e){b[e]=!0});var c=a.pN(),d=a.vN();return new tVa(a.kK(),1E3c.aa(),a.XM(),1E3d.aa(),b)},sVa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},OD=function(a,b){return a.aa>=a.fa?!1:null!=b?!!a.Ia[b]:!0};var PD=function(a){_.I.call(this,a.Ha);this.Gc=null;this.fa=a.Fa.EQ;this.ja=a.Fa.metadata;a=a.Fa.D$;this.da=a.fa.bind(a)};_.A(PD,_.I);PD.Na=_.I.Na;PD.Ba=function(){return{Fa:{EQ:_.pVa,metadata:_.oVa,D$:_.iVa}}};PD.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Ed()))return _.Xk(a);var c=this.fa.aa;return(c=c?uVa(c):null)&&OD(c)?_.Fta(a,vVa(this,a,b,c)):_.Xk(a)};.var vVa=function(a,b,c,d){return c.then(function(e){r

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4907)
Category:	downloaded
Size (bytes):	52436
Entropy (8bit):	5.4460924171443725
Encrypted:	false
SSDEEP:	768:EmsMRensj20tJ9Z5Q6K3usSXVRc0Pj+P3fPO:EmcnsjDJtQ6K3uXcajcfPO
MD5:	5FBDED90A1AF0E640367483CA38B8CD9
SHA1:	BEA215E97D7F14A81606C51F0498442EDC2C77CA
SHA-256:	4000EE261BF101DEC4C11600D2B7646F6E9C3326FD7EBD27B7AEC9DD3850F0A6
SHA-512:	570177A93342B96ADF673A91E11845A8C8EBE7AF9A3E43D26A53F70A1074725225B764F1FDAFD4F7BDDE429904496A3ED201C3BAD7CF02776717C6ADA4D6AB35
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iFd24/yd/l/en_US/dj10Ym9OUFW.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("useCometTextDirection",["UnicodeBidi","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=(h\|\|d("react")).useMemo,j={LTR:"ltr",NEUTRAL:"auto",RTL:"rtl"};function a(a,b){return i(function(){var c=d("UnicodeBidi").getDirection(a,b);return j[c]},[b,a])}g["default"]=a}),98);.__d("CometRoundedTextInput.react",["BaseFocusRing.react","BaseTextInput.react","CometScreenReaderText.react","Locale","react","stylex","useBaseInputValidators"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i\|\|(i=d("react"));b=i;var k=b.useId,l=b.useState,m={backgroundPlaceholder:{backgroundColor:"xmjcpbm",$$css:!0},backgroundSecondary:{backgroundColor:"x1qhmfi1",$$css:!0},disabledInput:{color:"x1dntmbh",cursor:"x1h6gzvc",$$css:!0},fontPlaceholder:{color:"x12scifz","::placeholder_color":"x2s2ed0",":focus::placeholder_color":"xq33zhf",$$css:!0},fontSecondary:{color:"xi81zsa",$$css:!0},hideIconAnimation:{transitionDuration:"xhb22t3",transitionProperty:"xb5gni",transitionTimingFunction:"xcj1dh

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	37458
Entropy (8bit):	7.9680820524536635
Encrypted:	false
SSDEEP:	768:xYNV8IrpyBcAs5ZLKMV+ORQoANtz6HRbZW7KF7pdot:xA9AsfVHQ1R6xEgQ
MD5:	D59F1140F1346D39223B6CC43AC39CA1
SHA1:	49EC5CD5737DB4DE71F505B6807438B7170971BB
SHA-256:	84831F3CEA83511E8CC289EBB078ECE1663BC20B8BC5AF46382263F276FC9E4D
SHA-512:	2E427666063702B1E18F1FF25D73D95F461E585D031E52CD7A8614B21FEF4EC644F5DE2AA961047860FDAF6AFB9380E7B6C02FECF2084668FA38AB079ADB81C3
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000a9180000902b0000322e0000bc310000fc400000455800008f5e0000f36100006e66000052920000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."......................................................................................Hn..q$.b......0..%.sL$. .......:.evm..q...N(i...gN2..U...(.Y.hW.quvWo..c.....}........&4.."H...."B`.0.8..se.b)..4.."..Y].2....vzM5(..FU.Fm9..-T.N.\...../...N...4...g....?.......L....#...`4....M...6.I.....)..].d.....Y..&.SL.Q._.6...u.U6...k%....b.z......wx..1._P.`.`..I.&.......L...;.H.\...4.Mh......[]....-2..u.F}....i...4.b.........^....1y.y}B`...0......!4....4C.C.$SX.h.I..........Ul..R..D.eh........b..M..o..}.OH.....z.\|k..................&.....y...9.j..E5N......N..[74..E..Z4g.:..Z*...&.b.J.4Dz....q5....t.x..?/...,...`...4.....hN,`B..0YX."M@..)..U.c..u:..fzL.@.g.+E.h.n.Z+..

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (682)
Category:	downloaded
Size (bytes):	4126
Entropy (8bit):	5.355816676246375
Encrypted:	false
SSDEEP:	96:GOFB1Kce2eMXmvci7UccRyDlyiKenjwf9Xn6Ow:93Kcri7U1RyDlyiKenjUN6b
MD5:	C18D7346DE40A0E15C7AD41BDC248E21
SHA1:	1AA3B333CABC332A486E1390FE223ECA98CE9BBE
SHA-256:	555F0968B40AA581D32E1802451B0B941875D0A7571CFCDDD3703BF83FE0DF24
SHA-512:	115945EF71ECF7A1FC00775596237E542F90E733D249C38313653E9FEC086666A7A25714EE432BD3AB50A88E917EEE10696C3E445C127B1AFA71860D8AFA1EA4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qf(_.Xna);._.k("sOXFj");.var Kq=function(a){_.I.call(this,a.Ha)};_.A(Kq,_.I);Kq.Na=_.I.Na;Kq.Ba=_.I.Ba;Kq.prototype.aa=function(a){return a()};_.Eq(_.Wna,Kq);._.l();._.k("oGtAuc");._.Jta=new _.xe(_.Xna);._.l();._.k("q0xTif");.var Fua=function(a){var b=function(d){_.Rl(d)&&(_.Rl(d).yc=null,_.Xq(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ir=function(a){_.gp.call(this,a.Ha);this.Qa=this.dom=null;if(this.xi()){var b=_.lk(this.Kf(),[_.Jk,_.Ik]);b=_.th([b[_.Jk],b[_.Ik]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.xq(this,b)}this.Ma=a.yh.W7};_.A(ir,_.gp);ir.Ba=function(){return{yh:{W7:function(){return _.ff(this)}}}};ir.prototype.getContext=function(a){return this.Ma.getContext(a)};.ir.prototype.getData=function(a){return this.Ma.getData(a)};ir.protot

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	749
Entropy (8bit):	4.70368920713592
Encrypted:	false
SSDEEP:	12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
MD5:	AA920B32443219E3EDFA32DEF5EBD457
SHA1:	8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
SHA-256:	E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
SHA-512:	C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
Malicious:	false
URL:	https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	79
Entropy (8bit):	4.71696959175789
Encrypted:	false
SSDEEP:	3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
MD5:	8DC258A49B60FAE051E9A7CE11AD05CF
SHA1:	DAFEF280663F4205FC7F0E47799E9945E6A68D6D
SHA-256:	C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
SHA-512:	5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
Malicious:	false
URL:	https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Preview:	.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19868)
Category:	downloaded
Size (bytes):	1096243
Entropy (8bit):	5.469459874464608
Encrypted:	false
SSDEEP:	6144:IvHytEZ3Ltt9L/S10tb/lpgRhQaSD2AIEAaso0ClbWTX08EEMoOHHbye5co3Ohnf:GytocSdqkbDeSFdhUM37yeSJn5Qo
MD5:	91D5A1483A48119F0F37082456DF0423
SHA1:	BEE214F0B43A14A3208CF4CED90CBD5A02A67A5E
SHA-256:	769459CE1A4F07D40C8136EA07C5B3D292D770C9EF48AEFDD01EFBF1220AA1BF
SHA-512:	AA07A72973466B1FD07A9B488D13D4331E7D5C6C9E71196B0BCE083B416663D9F1FDA9926801967931960FA345B5399B6500353572460A9D2E6C560F2B8CD0BA
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iHrB4/y-/l/en_US/Sd6LZm7F8MR.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometStyleXDarkTheme",[],(function(a,b,c,d,e,f){e.exports={"fds-black":"black","fds-black-alpha-05":"rgba(0, 0, 0, 0.05)","fds-black-alpha-10":"rgba(0, 0, 0, 0.1)","fds-black-alpha-15":"rgba(0, 0, 0, 0.15)","fds-black-alpha-20":"rgba(0, 0, 0, 0.2)","fds-black-alpha-30":"rgba(0, 0, 0, 0.3)","fds-black-alpha-40":"rgba(0, 0, 0, 0.4)","fds-black-alpha-50":"rgba(0, 0, 0, 0.5)","fds-black-alpha-60":"rgba(0, 0, 0, 0.6)","fds-black-alpha-80":"rgba(0, 0, 0, 0.8)","fds-blue-05":"black","fds-blue-30":"black","fds-blue-40":"black","fds-blue-60":"black","fds-blue-70":"black","fds-blue-80":"black","fds-button-text":"black","fds-comment-background":"black","fds-dark-mode-gray-35":"black","fds-dark-mode-gray-50":"black","fds-dark-mode-gray-70":"black","fds-dark-mode-gray-80":"black","fds-dark-mode-gray-90":"black","fds-dark-mode-gray-100":"black","fds-gray-00":"black","fds-gray-05":"black","fds-gray-10":"black","fds-gray-20":"black","fds-gray-25":"black","fds-gray-30":"black","

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11296)
Category:	downloaded
Size (bytes):	1201212
Entropy (8bit):	5.5187204704481685
Encrypted:	false
SSDEEP:	6144:KP4UMN9g9kXY8TyMZ4RyOCeR8t0c3QLojhC+2m7TXhLPGMZl7jn85/PPyoKH79yd:iWgngnOCOk047mpD4ktIVS
MD5:	57E9DB06EC76820702832E98D81A5FF8
SHA1:	D1486BE4842D756B2D5FE1638D2D8ED6AAF0AE0F
SHA-256:	1B3FF046CF5035ABC2FC33496C24A18CFA4FA5DC1FEF4EC4B0779A864357F14E
SHA-512:	56CC3B3648A2B635772620B7414F5FFBCA768F58AE9413591D2C8AAB0E7442A0FE24E64F0365A69AB2097682C8E78FCD73C21C74427BAFD1593B399E5448B6DC
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iwN74/yD/l/en_US/APoqa-iIOjvrn_I8kVuFfvi1Qie0qdVBFdoHo8RmQG6EroQ9FNgpiRhTLojQtsFNcs.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometSetDenseModeMutation_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="4486145264820781"}),null);.__d("CometSetDenseModeMutation.graphql",["CometSetDenseModeMutation_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a=[{defaultValue:null,kind:"LocalArgument",name:"input"}],c=[{alias:null,args:[{kind:"Variable",name:"input",variableName:"input"}],concreteType:"SetDenseModeResponsePayload",kind:"LinkedField",name:"set_dense_mode",plural:!1,selections:[{alias:null,args:null,concreteType:"Viewer",kind:"LinkedField",name:"viewer",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"dense_mode_setting",storageKey:null}],storageKey:null}],storageKey:null}];return{fragment:{argumentDefinitions:a,kind:"Fragment",metadata:null,name:"CometSetDenseModeMutation",selections:c,type:"Mutation",abstractKey:null},kind:"Request",operation:{argumentDefinitions:a,kind:"Operation",name:"CometSetDenseModeMutation",selections:

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	65489
Entropy (8bit):	7.982718871834297
Encrypted:	false
SSDEEP:	1536:+Q5NdaQtWNKp6HDDTzbYUMeyuaKxtUrjtvI/I9rKJk/9ENf:dfSNq67YHeTaRN3ES8f
MD5:	20540C6290859E2ABC1CDBCFC2895CAD
SHA1:	2B9ED0ABE813C6CB332AB672EDA72CC58D4EF850
SHA-256:	3D200CF6CB9434137ED244C2F347BF920E8FA23A88DEEBB7D76433695A311DB1
SHA-512:	3BF5A9B001A3804EE6E9334EF7313A4BC5D82F62B18A674E4D1F6A63349078927458C773B5481B0F5A0CC627CFB5BDC4D7025DE77D40011914B5BD28A73AFF8A
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000a31d00008a3e0000ee42000041460000726100004b93000077990000dba000006fa70000d1ff0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."....................................................................................X.I...T.....J...L.F41.......l.(...".1O.a7%4,.tts.....S_..5..t.+.X%z ...%.M..!....a..`......u..J.P....z...W......b.40.q3..8p..WT...P,.C..#@.........^.>}]...tp.g..}&w.uh..&..21.X.k.KH.+-)".Ptd.!.X1...q......3.%..%.lbe..G.Z..C.%..Kv>..@.,V]...".W..6.q...y...xp... ..=..G.vS..e-]....S....eC..!...KR.0..."[[1...9 .,..j.Re-.g.,e..P2....Pt:....J[[4...``../c:mj.L.7E.D..'.......~......TW....y..4J.Q4...F..P.#X.u-.,.-...bZ...<.....Cb.8..F.tP..._`.L..X...X.sl..k..UW.........d...9T_.....@b7w<..v*.RF...`[...Fa...)uj...Q...C6}y.o.^..h.N-z).h.%V....^.Q..g.@....YH.c...;,F...;.EE

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	10842
Entropy (8bit):	7.919889108874909
Encrypted:	false
SSDEEP:	192:qJsWaJR7aoyVmHXQB2rHkkcJbUm6fpk8NqZVe8T6O5zHe2BgJ5CIqzVpYuBDX6:qJ0en2JcFRKA7dz+bfNuprhK
MD5:	FD5DDC990A5173358D4B6CA63E44F25D
SHA1:	9E2AF4109A1F758B059715172AF66BA1CB72D48D
SHA-256:	EDDC81589BB16256E0F67D25D92F6550A5FE2F35DA923F44FE61FEDFD0CA9C8D
SHA-512:	268D96FA6CC765B95A7C6F91C2AED0E59EF4C4ED00322817664160686202FC7396EBF5D1E7D70E03380253179FDB3E29ECA71B9007AE1DA42649B543BA441F50
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/430843272_438547758855568_3782525580529738461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ki7LIH_ntfYAb7lEcz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfCIj5_yMIP5Es9E9YFuWRv8iLuRq49yvysp8vObeIcFQA&oe=66278DC5
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000540600005f0c0000360d0000f90d0000da110000a2190000b21a0000e31b0000041d00005a2a0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................g..&.%.q.W...V..+.........-..."..s.X..%.=2.....nI...!.~./.;.K.WL`B...JIp..M.h.71..B.F..C.hr.g...3L.%...K.#....?CuR"..k......Bd!5CDd...M.:.l.<..A...d.....\wcW.z...5.a@...<-.W.#....gU.v..S..$[<....E.";U.....A..(...?..g.._>..oa..d6..G.;+.*... .3.iq.X:!A.rmZ..slMB...?@..`.;V.X..1`\.7...q.<.LVq.X..../U...>.E]f....~4..B.E......3..9o..y..u...\.&]F.j#...'.e....}..P.T,N.....).1r.6.c......i...;...-Ve.\...RT..`&.1.._J..G.bGECA..e.0..m.<..../;B..t.Dc.>.<..GINVaI.3=...../_....y....r ..4.j@e.yLJj....Q!......]u.....f..q6..q.....i3.W.1..j. r...&.".[..s.px...J.O<6.......o..dx....m(/(fZ.....

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	downloaded
Size (bytes):	1884
Entropy (8bit):	5.292262488069745
Encrypted:	false
SSDEEP:	48:o7YQTzKjrL3AnFw4paFNW7xOkZfIt3UrkCq/srw:otoLcFx4kRIes4w
MD5:	2DB6AB32BE79D1F4C092D251080FD3FF
SHA1:	393B0124159B4B7269CABA1991D8BB0F24EBF073
SHA-256:	523799F3A4E2A3F4A453A43AC03CD6B01EFAC005DAB66CE87277B9CCEC7BB67F
SHA-512:	6D6DDA518FB82DE0D554B21810CC33A8C4708043377F4BA5C8AD1372DACAE52A02213C4A919EBF3AF27BEBFCE5432BAF0346A3E823A65AE442D1B9AF6D60BDFA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.ZX=function(a){_.I.call(this,a.Ha);this.window=a.Fa.window.get();this.Bc=a.Fa.Bc};_.A(_.ZX,_.I);_.ZX.Na=_.I.Na;_.ZX.Ba=function(){return{Fa:{window:_.Hq,Bc:_.NB}}};_.ZX.prototype.Yn=function(){};_.ZX.prototype.addEncryptionRecoveryMethod=function(){};_.$X=function(a){return(null==a?void 0:a.lq)\|\|function(){}};_.aY=function(a){return(null==a?void 0:a.sca)\|\|function(){}};_.bY=function(a){return(null==a?void 0:a.Sn)\|\|function(){}};._.JBb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.KBb=function(a){setTimeout(function(){throw a;},0)};_.ZX.prototype.uJ=function(){return!0};_.Eq(_.Cl,_.ZX);._.l();._.k("ziXSP");.var AY=function(a){_.ZX.call(this,a.Ha)};_.A(AY,_.ZX);AY.Na=_.ZX.Na;AY.Ba=_.ZX.Ba;AY.prototype.Yn=function(a,b,c){var d;

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	downloaded
Size (bytes):	1884
Entropy (8bit):	5.292262488069745
Encrypted:	false
SSDEEP:	48:o7YQTzKjrL3AnFw4paFNW7xOkZfIt3UrkCq/srw:otoLcFx4kRIes4w
MD5:	2DB6AB32BE79D1F4C092D251080FD3FF
SHA1:	393B0124159B4B7269CABA1991D8BB0F24EBF073
SHA-256:	523799F3A4E2A3F4A453A43AC03CD6B01EFAC005DAB66CE87277B9CCEC7BB67F
SHA-512:	6D6DDA518FB82DE0D554B21810CC33A8C4708043377F4BA5C8AD1372DACAE52A02213C4A919EBF3AF27BEBFCE5432BAF0346A3E823A65AE442D1B9AF6D60BDFA
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.ZX=function(a){_.I.call(this,a.Ha);this.window=a.Fa.window.get();this.Bc=a.Fa.Bc};_.A(_.ZX,_.I);_.ZX.Na=_.I.Na;_.ZX.Ba=function(){return{Fa:{window:_.Hq,Bc:_.NB}}};_.ZX.prototype.Yn=function(){};_.ZX.prototype.addEncryptionRecoveryMethod=function(){};_.$X=function(a){return(null==a?void 0:a.lq)\|\|function(){}};_.aY=function(a){return(null==a?void 0:a.sca)\|\|function(){}};_.bY=function(a){return(null==a?void 0:a.Sn)\|\|function(){}};._.JBb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.KBb=function(a){setTimeout(function(){throw a;},0)};_.ZX.prototype.uJ=function(){return!0};_.Eq(_.Cl,_.ZX);._.l();._.k("ziXSP");.var AY=function(a){_.ZX.call(this,a.Ha)};_.A(AY,_.ZX);AY.Na=_.ZX.Na;AY.Ba=_.ZX.Ba;AY.prototype.Yn=function(a,b,c){var d;

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	14752
Entropy (8bit):	7.95133599564624
Encrypted:	false
SSDEEP:	384:lWMKufemn5FWcuyAP3br8ZY2yFND721IR6PNle2O:wMKufem5X3m3P8ZUnD721I6sT
MD5:	DD98B71294FA3DB08CD02F7A5836DB59
SHA1:	D950D4BA9C8EF107939BCA2A39850B53FB7B6AFA
SHA-256:	1D7B13130FB7979596CC191CADEB7D921387752BC45384599B772B862A7B0F63
SHA-512:	33031C27BF47612EEA6E872D43503CBD1B7065A102450C6F2BA6D11A587BBB32CB4952210429C95ECA77BECE6E00CB4E2FBDD7277D8CC785D3211EB0FB928D63
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000058060000240e00007f0f0000d7100000af1700007c220000962300004f25000010270000a0390000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................NG..p.....I.........V.8...\|....&..\R.(.......P.G..g..>.z5..j..(Mo^XVa......T.E...+:...K....@..........5.......<...3.V.@@..p..3..'2.)P/:....8/:...i./..B.:..$......(.c.$s^,.=.4G 5....TPUE..T....fW...P.q....G3R8@....6...j.w.P.r......m:..jT...Z..N.0.K.e.F.\|n....c5.1;..."I.......{$..kE....D..j......7.+..y....>L?.f...A..Md(...3...[.8y...A&.aF..M.(..=..?8.Z.Zi..r..C5T]e....c.e..%F.O8D...)..M.N4.gX..1.9*.h.`...m......"USS}..a....J... R.iA...E!...W3>.....B.r$.e6Yt.j.....[B$.6.s..Q......B.0....).f.F.t..7.Z.)..:{.{ga.O."h./.7.1.yGr.8rJ`]\|SN<..XE..C..@...T.K!..Wr(^.w...V`g.e-.u.!.EQ.<D..N......P..M

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (504)
Category:	downloaded
Size (bytes):	2215
Entropy (8bit):	5.36757102910705
Encrypted:	false
SSDEEP:	48:ob1bEIZs1Ii7Bq7ZKhGdfWK7Dt75vpTMW1zmieTHWxrw:o5r8Ph4fPtdv91zmieT8w
MD5:	306BAA59FBF8C921E798B0D5496B3915
SHA1:	CB3B568B8C1F7A8187BC4146D91B3471E2152DCA
SHA-256:	C816386F29E09DEDABBA8AC4F9A1BC06799796BE47AB9E88B1F34A3CA6CF333D
SHA-512:	131121A04F87D5F41B659C932DE2FE268DE9B49DA890044DCA224C46D6F385A097BE7E472C831E7A1E16FB3D54E22A2D5D1D7501831E079CCA12C3978AEE95A5
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iCBEqb,nKuFpb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.YKa=_.y("iCBEqb",[_.Roa]);._.k("iCBEqb");.var VH=function(a){_.J.call(this,a.Ha);this.aa=a.Fa.xz};_.A(VH,_.J);VH.Ba=function(){return{Fa:{xz:_.UH}}};VH.prototype.EB=function(){var a=this.aa;_.w4a(a);_.v4a(a)};_.K(VH.prototype,"IYtByb",function(){return this.EB});_.M(_.YKa,VH);._.l();._.eMa=_.y("nKuFpb",[_.Kl,_.Bx]);._.k("nKuFpb");.var p_a=_.zf(["target"]),q_a=_.zf(["aria-"]),r_a=_.zf(["aria-"]),EF=function(a){_.xF.call(this,a.Ha);this.Kc=a.Fa.Kc;this.link=this.oa().find("A").kd(0);if(_.tC(this.oa())){a=this.oa().el();var b=this.Pe.bind(this);a.__soy_skip_handler=b}};_.A(EF,_.xF);EF.Ba=function(){return{Fa:{Kc:_.Iq}}};_.g=EF.prototype;_.g.ue=function(){};_.g.nE=function(a){_.Kb(this.link.el(),a)};_.g.Xr=function(a){_.qq([_.Db(p_a)],this.link.Nb(),"target",a)};._.g.click=function(a){if("keydown"===a.type&&"Enter"===_.CF(a.event))return!1;_.xF.prototype.click.call(this,a);retu

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	78051
Entropy (8bit):	7.983933898861147
Encrypted:	false
SSDEEP:	1536:lx83jrKkX2iQ+7ffeBaDZ93Fz+kexFWRuiCu7hMIP7Yc01RAay/d66ZR2D0:lMykGo7ffeBaDBzdMWR+WlPh0DTy/deA
MD5:	F74C9B5EF20192771073E2E178D57458
SHA1:	863E1F8A54902AD8857657C8E6BE5553FDBFB554
SHA-256:	D21535051F8872F74064DA184627F5538A4DC60F4F1DBED86F2FCB45B63070A1
SHA-512:	27290DE4E63C954F140776587F5EC9EFB6DD67A95A82D271D82F7833FC6529F36B03A1D6806B42133BC6AF4C0EF474768921377786221718C5895354CE2E7049
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/435297039_1622642408563885_856096703543016407_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=GWAVaQ02VJ8Ab6-Thma&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGNYDZ7rzrA5aOKLdOlSZvN9nxTDaGyE2PI0T-WhTcwA&oe=6627AC74
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000401d0000aa490000614c00005b500000277d0000b4bb0000f3c1000075c6000064cc0000e3300100....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................!...PA......@..@..(..4y.HF...NW..d-%t,...]..W.....!2DT........4U..A..4p\J.l...j[J.X+.XH.l...0U.Q...+G.EQ..k...%4zX..#'\|U[..y.h.:'..uDr..s8...:..y.!.'j.q+..s.I.^"n.o/1..K..rz./.;..\|4.YEU..Q.,.V:.:..:G.2..D..=.1\|...k<s.'Y....9;....Y..K0..>Q..#.....e....1..#.T.....,.....5n.w._G9.iB..~.....W.C<.$n.Z."t2.Z..K.x..QE......=.#c%.\m..:=..L.elcK.R.C.....u1.l.N.-..n...KB.\.]^>.+.42.G..B.'+ZPL.&.s=?(5.UW.}Z\|nK.V..-...w.....b.Y.JX..r.(F..<.q.".#.Qb7'sO..."....fjb..w.\...;c.....iv....W..:L.f...[...ws....~....A.=..;.F,..r.O+V.e.T....V..$...):e...6..fa.A...[3g\|.3R^hS.E.G.$.e.;..%.GgC..V.^.js.?;

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	10418
Entropy (8bit):	7.930675235975432
Encrypted:	false
SSDEEP:	192:PwkivHe26vknv0fAPK/mxAQqnmZXoMzIQSRKtmhKiAQdCfP/ojylFqfUXzZWZ5uV:4dvHe2Z8fK9wno2NRL4QdCfgcXzZWZ5e
MD5:	BB9B228A0C7D0D5C44D70CC5E186FE2D
SHA1:	3F8908385FAFC85C21399AF1E3D8B2BA841AE216
SHA-256:	367CE64112BCE6C6BCBB067D8AB83AB3E64C8D581B6C87145846F5F6B088EA3F
SHA-512:	FD7B81F6F2BB9B38393D2B7CD25CBBBB3C300B255ACB85DED35D7FBFF8B8C84FF799FB3190FEB5E1AC38C6189A833304E0F7375B8AF42495D953C1709EEC3E05
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100008b050000590a00001d0b0000240c00005212000039190000511a00006f1b0000b91c0000b2280000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."................................................................................{<.@.....J4..".".".".$..@$......(.......).e...n....A.!..D...D..........{.....O....Z..i.....u.5..N.y. :`h..-.P.4....E.7...^m3.?@zh..;.8=<..y.}mK..a.....?....`...{d.}/a..I..#...#.]...z.g.WtMr.T..p.R....{\|...=u.........,K.b..@.....A....MV...:......~...l...\..hA...T......Ue..m7..R..bRVDa.(..$!P.!...h..Z.[...A.,J....jX.jh3S..#$0V0,h.W.FO.......9.u......=.I..%.c-.I5.R.m$..vN&O>.8J...5Y...f..6do....._)..W;....j.R.[/=K.v..c.."3...........K.Wv5.f,rL.6+1..:..-.7..O.....4gp.#.:.F4..I...i...\r1..9....2.W.&.e.,.$6:..w....1...c...Y.F..M........\re.[\.W.....vF.Yqf.g\|+[.~.....en..E......\

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	14054
Entropy (8bit):	7.9437832987054176
Encrypted:	false
SSDEEP:	384:a8IFSwshv2F23zJ/7roApP5gzkraSj5duLzWtR:gFl4K2D9flbrdj5duHWP
MD5:	DBBA1A59E3CB5ACF6B5DECFB0B5D2193
SHA1:	49595B4C908C4357C431BBE2712CF75F6D253E42
SHA-256:	3D92EE06DB31E1F4DECBF451AEADBC687B927D1E977ADB5BD156E94913A75A04
SHA-512:	9380E618537E5FC8B5D10F6B111113E2A1294273D81AAC7EFEDAC36792D4C7A9AAF0C0BDA1EEA034AC098D8ABD02ED03ED9F082CD170F52D9B082C53070C650D
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t51.29350-10/434466436_742991631307311_2684269917892696380_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=lEVRaVUhRrUAb6Mesom&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGHE-qbLV-U2v08MXPZy2tIrgHciSRcQNZx7LxILUMmA&oe=6627AD2E
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100001a060000230d0000d40d0000af0e00002f1600002d2100003e2200003f23000061240000e6360000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n....".................................................................................>...9P.E...U.9{..C...S.y..S......}\|/w....9...G..."..E;....TT6.s...&...TS...Z...EEU.Ay....;..S.......[.j......:.CR.K5.8%k..V....2P$.......y.54{84..n.c8....U....,x.).gm........8(..2#...5./.<g.$5.c.u.9Q...Tg@..,.d...rK...7.9#H{....+.M.9.p.jH.p......'.x.AV..6.(Vr...Q.C`gH.Kk\..L.g...:)k..p...,..;..w@.Z.....4.d%.+J`'..)...Ci...n&.....#.J.2...9..~.d.):.p..KRLef.....X..Pi.\|o.:c.@}=...&..Ts...8...j\|......e.9.\]y9..V...2.Uf....e$Y...3usz.\S..u\.y......4)..yw.p.;..H.3.znB.c..[.rQIjY`.&..5.... .]..\|.8[:.q..........72..k........gy.c.'gS.....5Z.2..7Y-~A<..."A.5dV.......P[.......P.N..e..t....

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (504)
Category:	downloaded
Size (bytes):	2215
Entropy (8bit):	5.36757102910705
Encrypted:	false
SSDEEP:	48:ob1bEIZs1Ii7Bq7ZKhGdfWK7Dt75vpTMW1zmieTHWxrw:o5r8Ph4fPtdv91zmieT8w
MD5:	306BAA59FBF8C921E798B0D5496B3915
SHA1:	CB3B568B8C1F7A8187BC4146D91B3471E2152DCA
SHA-256:	C816386F29E09DEDABBA8AC4F9A1BC06799796BE47AB9E88B1F34A3CA6CF333D
SHA-512:	131121A04F87D5F41B659C932DE2FE268DE9B49DA890044DCA224C46D6F385A097BE7E472C831E7A1E16FB3D54E22A2D5D1D7501831E079CCA12C3978AEE95A5
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iCBEqb,nKuFpb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.YKa=_.y("iCBEqb",[_.Roa]);._.k("iCBEqb");.var VH=function(a){_.J.call(this,a.Ha);this.aa=a.Fa.xz};_.A(VH,_.J);VH.Ba=function(){return{Fa:{xz:_.UH}}};VH.prototype.EB=function(){var a=this.aa;_.w4a(a);_.v4a(a)};_.K(VH.prototype,"IYtByb",function(){return this.EB});_.M(_.YKa,VH);._.l();._.eMa=_.y("nKuFpb",[_.Kl,_.Bx]);._.k("nKuFpb");.var p_a=_.zf(["target"]),q_a=_.zf(["aria-"]),r_a=_.zf(["aria-"]),EF=function(a){_.xF.call(this,a.Ha);this.Kc=a.Fa.Kc;this.link=this.oa().find("A").kd(0);if(_.tC(this.oa())){a=this.oa().el();var b=this.Pe.bind(this);a.__soy_skip_handler=b}};_.A(EF,_.xF);EF.Ba=function(){return{Fa:{Kc:_.Iq}}};_.g=EF.prototype;_.g.ue=function(){};_.g.nE=function(a){_.Kb(this.link.el(),a)};_.g.Xr=function(a){_.qq([_.Db(p_a)],this.link.Nb(),"target",a)};._.g.click=function(a){if("keydown"===a.type&&"Enter"===_.CF(a.event))return!1;_.xF.prototype.click.call(this,a);retu

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	43734
Entropy (8bit):	7.977117490439355
Encrypted:	false
SSDEEP:	768:NkqMnNA8TM4S2M7z1dkYnF1wqmrqSwlUZsYvxHjygS:NEnq4XGHF1wGUy2+j
MD5:	F889BE3DC9F0375666D9570689BA1C85
SHA1:	E5F6478A38B3E8587720A321842F7335A52D3B60
SHA-256:	2747556558DCE0DF54DB9AA14480396681C2A2A5D3C409C29092AB7205E985A9
SHA-512:	9C3F2693EEE2C51E15B4BCA533612D2FD3B62EFB84934C30EB87F4D2043CF7A8DD505034BCB3299147E4107422A30B3016101CA5B059EA2F824F1E9C38E92834
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438043668_951275763118012_9085738709733793549_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Ag36yU8NZ2YAb6DVjhK&_nc_oc=AdhGlZK-sKtqhfza7ml_SykynPBUSx2UizoL0jq-Q1WsBlq6hBHetpwRDqkENWqjVAg&_nc_ht=scontent-atl3-2.xx&oh=00_AfA66vG8Ma9yADhKUsRHkt3rFZiZhApEGqODDzKsb816Dw&oe=6627B1A4
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000571c000063340000153a00006f4000002f49000021650000716b00006b72000061790000d6aa0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................(.T..2.AZ..@....$@...d..B.6.....6......Nebv..aX...iH...XV.iH...iS....D. M )v..P......+W........)....!r...-....)..L..E"z..Nf-eD..@XV..!.. .DFH.. ...I.8..".Q3..!.Bm.D..H..@-...tP.v8..j.\/E......$..DF.E.d..H'.#nF..N..J.Yj$.[..p...&D........b....@.......P.F.p...E..,+.(+C........}...'........p....H".5Y0 J)!....+.]..CM...L.......b..........p.b...u.j.6k ..ZD.....6.S...B.sk...H.o..BA'....L.9..QI).b....'.VF...@YJV.....$."bHh.......bA".,UD'Zl.P...L....4D:....DF...@1..........L'(....WD"....DD.T....2..@....Z.J..... ".....`. .Z.0...g...D......Bh.....,...4.N2.*.iQ.+........#c.(.....@..&.h.h........ M.,

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	749
Entropy (8bit):	4.70368920713592
Encrypted:	false
SSDEEP:	12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
MD5:	AA920B32443219E3EDFA32DEF5EBD457
SHA1:	8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
SHA-256:	E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
SHA-512:	C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	49949
Entropy (8bit):	7.958841483287345
Encrypted:	false
SSDEEP:	1536:7UGe6dAFspoSAan34l6ay6GcLa9vLRtzte:EmaOonan3JJ0IvLRFte
MD5:	1A0AD136812389246EC732AA6D497185
SHA1:	69EB416CA6A61F3977CD1AB078DE3059B843BD27
SHA-256:	4FE0FFEB22281EC58D5C54DC12439C8A437BDD98F963F3A43217B3F76F51652D
SHA-512:	65BD7DEBD5C12E33C664128AA8F2DE659C9B65F5EF8A14E95E2770564C2F0C9C7D515A5F7498B474B619E3327E03A3A552878004E5ACE1EF6C6D6668EC008EBC
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000a5190000663500002e370000313900004a420000656a00009e700000fb730000fb7700001dc30000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".............................................................................\|.A!.b.`.e`..A#)........e_...].xh...E!.1..B$'..^WK.-.z.^.ig...;.:z..8....=z..f:9...Vk..p.C...[(....m...?c...b..!...BG>.3...O....}Ybh9........cK....\|...u...Z.L.3.....>or..f.Sg...:b..x..m...X\+...P3...q\|3..SF......a..Y$..$..I$..O...k...0..!rW,%sN..b.I..~..;.y...S.FcT...,.V.R......%...^MY..`+..h..pZ..^.?.....F.[..7....!.#.I$.A3.....6..,....q..e..a....=6..u....~Y.1.Y$..f...$.Tj.P.b....+.\|.^~.M.9.C...h....*..W.}7......}2.8vCh+$..1V$.$...?Q..\f..:....D.da....em.s:.t....}h.:^~.....A!....M...Z..3.../^~..n.B+T.K.@...U.)......+py.....-...I$..O...oL..i..+^....YN.F....[...l.P.{.].o.p.3....$.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1983
Entropy (8bit):	7.292203917377081
Encrypted:	false
SSDEEP:	48:FVHiWIGlHXhuzURMgczrlvmLZumdqSJCG:FV+4H4zhzBOQmdqsCG
MD5:	4570E2FF1E7DFBF38A7F1AE2E83F1F7C
SHA1:	A265A3EC5543675EF797E8C363A868F7846DE391
SHA-256:	D532D6701ED5AAC60724E10E6FA6BB2DA1A6C00FCFF7F7688897DC2F8924195F
SHA-512:	AC7A20500FC2D11421B8AC0C2EC0ABDC7E16F8D01E592CF54C5FF99EED3246543397EEDB0024A9AECE6B151F8222BD32902227393F2EA10EBFA2D387072B48CA
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t1.6435-1/166562961_289775365843871_1089544784969631943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=gsiZqHemNI0Ab7xotOc&_nc_ht=scontent-atl3-2.xx&oh=00_AfCJ2y8PnGo5iYFIOIqkgTsp2QT4Magjkq-glreMKFQsPQ&oe=664932DC
Preview:	......JFIF..............Photoshop 3.0.8BIM..........g..UJs-vNrDDGwsGx_gqQk2..(.bFBMD0a000a85010000fb010000ba020000020300005e03000062040000530500008d050000d60500002f060000bf070000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................w.T..{..`E..y...i.z}.a.;[N,...4(XOn].W.i~......g=....h..7.0t...'..............................!................4......?..W.H.5O....~.Bzw...>C....k...6.......q.[.3.K}.k.N..(\|.=.9.u.w..mn..W.Y..GG........9.........\G....<..?.....~j.Lxa%.2J.%.jz............................!.1"2Q........?.D.$..D.....O$e.1.d.P.C.....!........................1Q.!2ab........?.i...jw!%%s?.S[.l]E.)pZ..>Ls..-.[....,......................!."1A.#Qaq..3BRbc...........?...W.....{).....0..j..n.D.gy\<.,....u1......R...!P.I.0<...)..KL.....$&..MwDv..I...w@..}.H....6......g.qID..Mk..C6...mP.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2362)
Category:	downloaded
Size (bytes):	220329
Entropy (8bit):	5.444373950921745
Encrypted:	false
SSDEEP:	3072:FbtvBkNQB0w3NSOm3Rt9whvd6Ptfk/7aNyHD9KhLh:x0a0wNmBwK67cyj4hLh
MD5:	5EC9290C20B7C8A00BA5437D0985C6D7
SHA1:	D022526F1BA74C809681372A9D36091C623C63C8
SHA-256:	807B395EB83156C9B0FADFA651AB25EFD1740238C4616246F41EB0CD3EFDA3C2
SHA-512:	5A2B8A393E9EAF321983D018D63204B9F1747A18E2691475C4DE53E30501E84810074DCCFF2BF936D505BCF1FC65A0A61903F84043CEE32BEF9E8459C6452777
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEcbZ8Mh_fWCWdmaUqyRggLbEJmUQ/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x3a22c03e, 0x800b1c4, 0x3e079c46, 0x10814500, 0x6, 0x0, 0x201ac000, 0x199, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.. Names of events that are special to jsaction. These are not all. event types that are legal to use in either HTML or the addEvent(). API, but these are the ones that are treated specially. All other. DOM events can be used in either addEvent() or in the value of the. jsaction attribute. Beware of browser specific events or events. that don't bubble though: If they are not mentioned he

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1983
Entropy (8bit):	7.292203917377081
Encrypted:	false
SSDEEP:	48:FVHiWIGlHXhuzURMgczrlvmLZumdqSJCG:FV+4H4zhzBOQmdqsCG
MD5:	4570E2FF1E7DFBF38A7F1AE2E83F1F7C
SHA1:	A265A3EC5543675EF797E8C363A868F7846DE391
SHA-256:	D532D6701ED5AAC60724E10E6FA6BB2DA1A6C00FCFF7F7688897DC2F8924195F
SHA-512:	AC7A20500FC2D11421B8AC0C2EC0ABDC7E16F8D01E592CF54C5FF99EED3246543397EEDB0024A9AECE6B151F8222BD32902227393F2EA10EBFA2D387072B48CA
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM..........g..UJs-vNrDDGwsGx_gqQk2..(.bFBMD0a000a85010000fb010000ba020000020300005e03000062040000530500008d050000d60500002f060000bf070000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................w.T..{..`E..y...i.z}.a.;[N,...4(XOn].W.i~......g=....h..7.0t...'..............................!................4......?..W.H.5O....~.Bzw...>C....k...6.......q.[.3.K}.k.N..(\|.=.9.u.w..mn..W.Y..GG........9.........\G....<..?.....~j.Lxa%.2J.%.jz............................!.1"2Q........?.D.$..D.....O$e.1.d.P.C.....!........................1Q.!2ab........?.i...jw!%%s?.S[.l]E.)pZ..>Ls..-.[....,......................!."1A.#Qaq..3BRbc...........?...W.....{).....0..j..n.D.gy\<.,....u1......R...!P.I.0<...)..KL.....$&..MwDv..I...w@..}.H....6......g.qID..Mk..C6...mP.

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1838
Entropy (8bit):	7.16782310287291
Encrypted:	false
SSDEEP:	48:g2xeiWiLkYl8fmjeQsBFQ2kahJ3pjn9LRPSeV:Zx/Lnl8eEBFQzUPxLRJV
MD5:	C903C483E9B1C944726E52F2CE209EDC
SHA1:	814C53A092D8D28F42BE79484CC977A630B17137
SHA-256:	D9F7FFC81C431E9BE81DFC0085F6AA3839DFB0BA9B9158D9EAF30EFF2D223510
SHA-512:	D7B9688903D55A8E70B5F373E35EE7A59B4CC09A30AA104207334528DF99C300E484EB8539A499E0B36AC520ACDE08B6FC45C92747DD93759F74E8A0FDAA77BF
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/297577919_10217274176765031_2994694822502324520_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-3rUZ9jyX0wAb5bIv02&_nc_ht=scontent-atl3-2.xx&oh=00_AfCINx_mKEMbP48d8aI4g-TLfOU0Eri64MtOnKfkm9oufA&oe=6627AB82
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000ef0100009d020000090300008103000031040000eb0400002a05000095050000080600002e070000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...............................................................................}e..T..D3..`<S.N....7..E...t..\..C..5,h.<.\|E...rj .L...f...K..Gn.q?...#...........................2"3!$1...........k..q....\|f..(.\._..0.8%.f......{..B.V.,.....#x....k.....:.%....g..q.9...U...}+A..D.Z\|5.H.#...\|."....B.,.}u...}c..?.>......%.........................."13Q..a..........?.....^r...g).d.........E4...!.L.....H.q...~...O..?...'........................!..1.a.23CQq.........?..a.d.%.A]..=q.w.M:....%..hA.+<..`..+..7G.........T....z.}..B....'........................!1A..2BQaq"..........?...T.....*b...i..5...I.Z[!C4.....>P.i.]%A..Cmi...?.,..z....$......cr..!.T:..Mg..zN.].Y..}

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	2.6465732373896285
Encrypted:	false
SSDEEP:	24:Es5ed8vZa+/kffJTyN5J5iXSvjDxatgFFjiZq1MJUikeVgl2fwFfBaTzh4mpCbak:2fq3OqXAzh4jaJV9HxG8Q
MD5:	3E764F0F737767B30A692FAB1DE3CE49
SHA1:	58FA0755A8EE455819769EE0E77C23829BF488DD
SHA-256:	88AE5454A7C32C630703440849D35C58F570D8EECC23C071DBE68D63CE6A40D7
SHA-512:	2831536A2CA9A2562B7BE1053DF21C2ED51807C9D332878CF349DC0B718D09EEB587423B488C415672C89E42D98D9A9218FACE1FCF8E773492535CB5BD67E278
Malicious:	false
Preview:	............ .h...&... .... .........(....... ..... ..........................................h. .f...............f...g...d.@.........................`...e...f...f...............f...f...f...e...p...............`...f...f...f...f...............f...f...f...f...f...p...........e...f...f...f...f...............f...f...f...f...f...e.......d.@.f...f...f...f...f...............f...f...f...f...f...f...h. .e...f...f...f....U..........................y'..f...f...f...g...f...f...f...f...............................U..f...f...f...f...f...f...f...f..................................f...f...f...f...f...f...f...f...f...f...............f...f...f...f...f...f...f...f...f...f...f...f...f...............p...f...f...f...f...f...f...f...f...f...f...f...f...................d...U..f...f...f...e...h. .f...f...f...f...f....d......................f...f...f...h.@.....f...f...f...f...f...f....t.................f...f...f...........p...f...f...f...f...f...f...f...f...f...f...f...f...`...............p...f...f...f...f

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18915)
Category:	downloaded
Size (bytes):	43237
Entropy (8bit):	5.680707641754852
Encrypted:	false
SSDEEP:	768:5RWw2BBHWtPd0h3A4LWhNzrXNAtU9ArbM+AI99yNIE:5QBZWtmw4LqPXNIU9ArbMP
MD5:	A20A57297296210AE55C26306436FCE5
SHA1:	AF8363C369F8FD23868093CE0FF02C8D88C229C0
SHA-256:	2DE52103B1FEEB037AF1757A1D10CB77A335258410AFF50F3CC4B93589357FDB
SHA-512:	E0BD233E5F75ECCC4D5018E1F7A4650D13BDD84D4DDCBB1BF482CB35CC836B85CE146F0A2B41DEA578CECF05FB8E7A6C9B6F28DC79A81801A9898B700860020C
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/../*. License: https://www.facebook.com/legal/license/t3hOLs8wlXy/. /.__d("bignumber-js-9.0.1",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b},h;function i(){(function(a){var b,c=/^-?(?:\d+(?:\.\d)?\|\.\d+)(?:e[+-]?\d+)?$/i,d=Math.ceil,e=Math.floor,f="[BigNumber Error] ",i=f+"Number primitive has more than 15 significant digits: ",j=1e14,k=14,l=9007199254740991,m=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],n=1e7,o=1e9;function p(b){var g,h,x,y=a.prototype={constructor:a,toString:null,valueOf:null},z=new a(1),A=20,B=4,C=-7,D=21,E=-1e7,F=1e7,G=!1,H=1,I=0,J={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xa0",suffix:""},K="0123456789abcdefghijklmnopqrstuvwxyz";function a(b,d){var f,g,j,m,n,o,p,q,r=this;if(!(r instanceof a))return new a(b,d);if(d==null){if(b&&b._isBigNumber===!0){r.s=b.s;!b.c\|\|b.e>F?r.c=r.e=null:b.e<E?r.c=[r.e=0]:(r.e=b.e,r.c=b.c.slice());retur

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1600
Entropy (8bit):	5.2114513236869175
Encrypted:	false
SSDEEP:	24:kMYD7FG1NPxuZiWQt+Jcu+yNPx1gODoHTR8uPlyH/6Hum/NtukNPx01JQSokp484:o7UHjAj+s4zR8ClyH5agKGwhkUshvNrw
MD5:	FFE1B082415A066E522D9B7F02EC70E6
SHA1:	041340B4440097D12D3EF465501E51DDC000BAD1
SHA-256:	E7D5B7A3B13D2D5F4599251A11E72AA814CE843921DCDF38C4C0CF2EEB191A67
SHA-512:	8CA5C9CEF07A886536C49648CBC24EAA9026E49FD2DDE95F1470E95D1F3E720158BB4CB8FE411CF7C0FCA4049327129D4342443231B6DC2F7D0963C0B4BD9C0A
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.qf(_.dja);_.Nv=function(a){_.I.call(this,a.Ha);this.aa=a.Wa.cache};_.A(_.Nv,_.I);_.Nv.Na=_.I.Na;_.Nv.Ba=function(){return{Wa:{cache:_.$o}}};_.Nv.prototype.execute=function(a){_.nb(a,function(b){var c;_.ie(b)&&(c=b.Za.Wb(b.fb));c&&this.aa.lD(c)},this);return{}};_.Eq(_.yja,_.Nv);._.l();._.k("VwDzFe");.var hE=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.Sq;this.fa=a.Fa.metadata;this.da=a.Fa.Jq};_.A(hE,_.I);hE.Na=_.I.Na;hE.Ba=function(){return{Fa:{Sq:_.ID,metadata:_.oVa,Jq:_.FD}}};hE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.nb(a,function(c){var d=2===b.fa.getType(c.Ed())?b.aa.Xb(c):b.aa.aa(c);return _.Ij(c,_.JD)?d.then(function(e){return _.md(e)}):d},this)};_.Eq(_.Dja,hE);._.l();._.k("sP4Vbe");._.nVa=new _.xe(_.zja);._.l();._.k("A7fCU");.var ND=function(a){_.I.call(this,a.Ha);this.aa=a.Fa.tL};_.A(ND,_.I);ND.Na=_.I.Na;ND.Ba=function(){r

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 189 x 177, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7303
Entropy (8bit):	7.860646772141492
Encrypted:	false
SSDEEP:	192:AafLZ3TzdkUpBN3MnG4WGOwhiYLUNlQLc:jfLJTxDpBZMG4niXlQLc
MD5:	5FF833A3E0296C7BE5E130413D6F0431
SHA1:	6CB1CFBA275E5047F186EF39B6163ADF66137221
SHA-256:	25524E1E2D251DA55AA20821BE2B39A7EC96BA956B197E2D974D7C6F3D44006D
SHA-512:	366BA42BC157B98113DB3345B48B5DD1F7482CA0C9C4FD51B0868B19F97CDF029F3639C35DC454A8D63C73A69B783C1B2A9CADFEB1088095AC4C5B717C199BA1
Malicious:	false
Preview:	.PNG........IHDR...............Ly....PLTEGpL.................................................................................................................................................................................................................................................................................(.8............................................................;;;...................................................................x..\|..x.........................................o......................................x..v....................v..w..............................................eee................w.....w.........................................w..w.................v..w........x..x..x..w..w..w.................w..w..v..v..............w..w.....w..w..w.....w.............n~f....tRNS........>......~..Z...8.H.)f.....,.$.pd...MP...!.............^B.vET.J...x...:i5\....2rzl.X...<a...6......@.....~q../..6.....3..J.!.@,..P.z.e]X......../..@F.!R.@...l........

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	19202
Entropy (8bit):	7.9566158438787795
Encrypted:	false
SSDEEP:	384:THA/OMpI5OQgt8JdMG80H1bAStmUua0pmmLFCQmRp6KOwVLnrSjZbLU:THA3pI5Ngt8JOS8imUuaxxVn+jNU
MD5:	31DF3DE9CF56444E8646FDC08951D78B
SHA1:	57BDB3850525114A8B946FCCCED11C04B33E5600
SHA-256:	005367FBEFA262FADA312667F3ED6642ADE53A9C0BD6DD9D480DD679446BD021
SHA-512:	B8986A2A643D0E14A299AF1BBA64CA0EA581378C710D3742BE573252373322475ABE80CCED41311DA65D9205DA843B1D00FC7807A9C19B887612A276DEEAA75D
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t51.29350-10/438844348_833636295261460_8820580507418716899_n.jpg?stp=dst-jpg_p206x206&_nc_cat=111&ccb=1-7&_nc_sid=5f2048&_nc_ohc=J7XdDp8SzdsAb7ozIpk&_nc_ht=scontent-atl3-2.xx&oh=00_AfCB8Q844RX1O_1OVOJ0GECUmomF3JgeZ_RWXRdhba-onA&oe=66278584
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100004f060000890f0000711000007c110000c91c0000cb2c0000e02d0000282f0000a5300000024b0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................J.F..$..R.."/C.1E.F.......e8t..5}.iW.V.tBI..g...}....m,90..R`<.xC.Y..!. iW.g..VW....+Z.........y......H..eZBH(TlRS,.bhY..MA?...qm...z.mm\|.........)rr.t8Hz<..z..E...../.:.%.o:`..>...JZ%.....".3..B.<..g .f..j.9k....X ...P.~`.h5...)...(.@_EO+mVM..[.a._B.#...F.T..c.G..".........E..F..7+a....F...=Uk.....i.U.N..Z"f.....?4J...J....>.{...[\|i^V.U..z...N...1H.\...t.u.<ttOG..pk..n...I.>......hX.d.J.j].3.V?.xNf..%.....n....6.~......6...M...0..Z.l.....5]..cw.N.p..g...>;Q_..A..X.).;....Soko..+.8....:Ya..g.H_)b..E..)t._a.[,..}V......R..k!.Y......j..T.M.`.a`[..p.+*.=..PZ8F.%......_....

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	6.919955735083681
Encrypted:	false
SSDEEP:	24:gqS3+/fc1spSNFvTztUG8AzFEzmxlGpKG3PPuiN3I80AV3eRAGAtfFoBCZKEhZ:gfufiWSNFH/BEijGH3uG3BjeR8bb3
MD5:	FF4BCADF6B7659FB0F522FFFE068AEAC
SHA1:	52B092B6DB28163E7655EE9917BBF316C34A8EC1
SHA-256:	EC28F03032BF24069FE93AAE86575BC76253E1E489C80F9A9CC7AF3B9DDBDAAF
SHA-512:	47AE28A0BF932C56F8167B2939450B16780C30482E4CC5A6D018D847A8BF956740B72B9294ABFCD026A04398E4B9C2BCD1DB2562078706F80C3E708D331E6561
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e801000079020000bc02000008030000a30300004704000080040000bd0400000305000012060000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................5y.^..)d.....;.a3...u.....y..N]x....:q.8.b.QV....di....R....!...8...$.........................1..!".#2A................l..B.iu.>..:....J..h.+NN...1.u..Gn..tX.ma.)..vHe)HV4...9.$...W....?.d#.c..jF.I....h...P._............................!1..Q........?.U...\|..........@.;=.E.n..........................!..1..2........?...$Q....m...9.=...O..?...).....................!..."12a ABQqr............?.!..f%...7P.G.....ahS...m4.R6p.a..9r...jU.......b+XPB... e.A...sp..a...K...F._....t....B.&....9Q.h....O...$....................!1AQ..q. a............?!Yy%tD..>.r....0G...@/...;Q..e..\|..e.#..cY..l.._.w.k.%..

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 51x50, components 3
Category:	dropped
Size (bytes):	1667
Entropy (8bit):	7.071413286519926
Encrypted:	false
SSDEEP:	48:g7iWWOc2SICHOBQJx41Jl8oEsst4ZSLvG:eVru+1JNtst4qvG
MD5:	86BDA689B7E7FE6D3C074876FC2E59EB
SHA1:	2714449E86B0179FE2F55D9779DC2623CB54090F
SHA-256:	FF0222D7921D7345E897297424062019F9190542D3967041CFDFA1E6E4DC5AF5
SHA-512:	AAB8E6B13BD0E9A15B877A4AEE7570D355E54CC13C5D0469A6A683709227DBC6347E69111EA1A5E5F4530EA8A6592C88A91BF63E406EAD974424F67E4E72E89B
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000e001000087020000cc02000013030000c00300007f040000b5040000f80400003f05000083060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.3.."...........................................................................Z.oXFN.+..7nL.D`..z...,S.W9`.\|.!._U.!Y...t.h....6T.......K`)?...$........................2.#...!"13..........(,..0..&.MbC...}....I.d.X....\2 "3ld.....2S.W..Z...}).........vz..Z....F..)........{l.w...]._]r.B.A..E"J.....J./p..G...\|?... ........................A.!.1a........?..+f8.E.V.y!%..)..V2.F....O............................! 1A........?..,.VY.qedIt(..J...~....&.....................!.1..Qa."2Aqr..........?.I....k..Uc~....:.^....4q...pm..V...9..g...;......H...wj....lhF0Q.E?I?.....o.............#.\|..A.fb..]..y.#.....&.../.....#....................!1AQ.aq..............?!5e.......jZ...R..0aj.......M

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	downloaded
Size (bytes):	3141
Entropy (8bit):	5.381866681101836
Encrypted:	false
SSDEEP:	48:o7VSeBvFfGiW0rq8sdQfydNQ8jsN4FwCYYnyTM4WCOcUkp+4pP8mLjujrFQp4rw:oA4zWynYzdOqbnyT6COm+4V8zO8w
MD5:	18637A7357C35DBB1A9E667CFCF52ED0
SHA1:	0FD3CA9D31EA8BDBD658236A8D70421F7B22F30D
SHA-256:	25815BE99894ED26F3B92AE4A2C542F5AE523C44C7F83CCC90E63FCE939AC50A
SHA-512:	BDF27DB349AEBA777DEC00EC6F505A01A5926837D9DB95BC1D3A204DC53A0AA7760DAFB8834A025B5333468B635ED875CBFFC63F771AD3682108EB711C821073
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Pv=function(a){_.I.call(this,a.Ha)};_.A(Pv,_.I);Pv.Na=_.I.Na;Pv.Ba=_.I.Ba;Pv.prototype.gN=function(a){return _.ke(this,{Wa:{mO:_.wj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.rh(function(e){window._wjdc=function(f){d(f);e(wEa(f,b,a))}}):wEa(c,b,a)})};var wEa=function(a,b,c){return(a=a&&a[c])?a:b.Wa.mO.gN(c)};.Pv.prototype.aa=function(a,b){var c=_.Zsa(b).yi;if(c.startsWith("$")){var d=_.Ul.get(a);_.Np[b]&&(d\|\|(d={},_.Ul.set(a,d)),d[c]=_.Np[b],delete _.Np[b],_.Op--);if(d)if(a=d[c])b=_.je(a);else throw Error("Ob`"+b);else b=null}else b=null;return b};_.Eq(_.Oda,Pv);._.l();._.k("SNUn3");._.vEa=new _.xe(_.rf);._.l();._.k("RMhBfe");.var xEa=function(a,b){a=_.qra(a,b);return 0==a.length?null:a[0].ub},yEa=function(){return Object.values(_.Lo).reduce(function(a,b){return a+Object.keys(b).length},0)},zEa=function(){return Object.entries(_

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	13353
Entropy (8bit):	7.945709571898719
Encrypted:	false
SSDEEP:	192:BzcCoWA06Ro6YsACjWVIzD68X2cfmH+NQrl+VgxLj8Qh5YNYVsAkoGakK5wDfOLO:B/oWA0OfEIfhf60QZ+rQh5YXXK6DGK
MD5:	71C8BE03884B18CB60AA8158B22E7791
SHA1:	B3A3C5AEFDFD6B6AF7AAC7A8BE26F1FC04A4DF80
SHA-256:	7DD9BE104578873D93F6998527285706EAA884A144D1B26270DE250A5B6F6BA4
SHA-512:	9A115EDD29F48EAC69A1E9C0F1BF0C34D9F093EC00E996D47AB13046967CD72F00053176AA2A0411DFFA4EA670730D8D7C744FFEAEE4B06789E6F3B38BD69AE3
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100006b060000ca0c0000670e0000ce0f0000e51400005d1e00006c1f000033210000f622000029340000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................(k.......}....Q.M.......O.g.?F.d69...a...@L.X..P`.r..AD.Q.T.UA.D..%.k_"....4{_..&...(..8.C@.L... .TsD..jhe...LsWB.P.EB.;m.-X.h!..^....e{..1RX..OwFb.v..Pv..t..#..7.]0..U...Q.ku$....t.d.t.F..A.#...3...9.VP/.G.Tv...IU.c..5%.D...&..+..2..d....o:..6.W./>eG_B.....r.#\..Ry.e....>.....}..nEh2HE.nKZ.x.gY.x=...#.G"......:{.Z.z..N..:zr....b...b.....W....yoR...m.`.s..i\....X..4+k#<..c<;u..6.dF.".M...N\|v`L*ow..3..Y.l..C\..(].....Hb.b..[.s.[RFu..X5D.NY...B)...z.m>k...hr)..3...A..G.....d9..9.....m....nK.J:........hO..j..d...X.f.aU- .y...cX.E........Y.w.r...].`.?i.]4..V..c.I....6.OJ...-.?<.k.V

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1851
Entropy (8bit):	7.178026570497497
Encrypted:	false
SSDEEP:	48:grvGiWXLIgaoeuvRc8nGGcLz96/oPfUzhNjic:vLt8uvRn1KyonUlxic
MD5:	BA2F641B3A150880A69352D74CCB4E38
SHA1:	D3D35B9CBAB7075E1B1E935F2220B18635A3E4AF
SHA-256:	337C7111FBCF37AB6D08E79AD3DB652B32347DBEC629F2172234CF1564FC09CD
SHA-512:	ADCAEC4D19FCA0637A34030D0F884052A0E918D9D9F75F3518ACDD08F240735CD06CCFC16979A91A889ED84E0A545F2A90A58F0198A4E2D7785BE8F0D9925CE2
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e701000092020000d50200002a03000012040000fc0400003305000072050000bb0500003b070000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................u......4c....UNg.%..n...$.5.'j`fD...Md....(>...oT.%...}..C...`...W..."..........................!#1..".............q50lC.."......H.....s<.J..d.....d..u.l..\|N.<E.....+.M..v..-."..yT...-.r..z.....}`......U..e..... ...J.3X.....H.K................................!.12........?.k.i..]....o..cf0W......0c............................!1Q........?....U/....3..F...r.G.+.........................!..."1A.a..#2BQq.br.............?..:.n\|!^..9"...5-..-.Wl..]..r...g....N...~..U.4......u0Jqm*.}./.w..k..L5..W.M.tN;a [....J.o...U....R#p.V.y.....q.......}..}.....l..]...JuZ.LI).&159.5_.U..6...X0.J..U.

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (775)
Category:	downloaded
Size (bytes):	1479
Entropy (8bit):	5.306981966963761
Encrypted:	false
SSDEEP:	24:kMYD7x3u0oobgQNcKYYGWn/HTwfUuH0NPIehiofo89Lay2CLtuNGbMfO+Gb6gf6+:o7x+0oo89eHuH6VeyGCZuNGbMG+GbXi+
MD5:	60908F81C5350005E490CB2A7ABB3F37
SHA1:	B82FC316F3035AFF1AFE2035CEB9A2CB04726876
SHA-256:	613712129110A4869B9C63F7058D972C46A410199B8D31C821C5A79A5FC2C2E9
SHA-512:	A88D4E0C24430FF04B84EA2B5EC1B04F9B60C5227FE38D0418C8F710425553CA661B6394A33150C2D75446FD1FB22F01389D9CBA760A36346D963EC3C6B178F1
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.oVa=new _.xe(_.Fk);._.l();._.k("bm51tf");.var rVa=!!(_.Qf[0]>>20&1);var tVa=function(a,b,c,d,e){this.fa=a;this.ta=b;this.ja=c;this.Ca=d;this.Ia=e;this.aa=0;this.da=sVa(this)},uVa=function(a){var b={};_.Ka(a.EN(),function(e){b[e]=!0});var c=a.pN(),d=a.vN();return new tVa(a.kK(),1E3c.aa(),a.XM(),1E3d.aa(),b)},sVa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},OD=function(a,b){return a.aa>=a.fa?!1:null!=b?!!a.Ia[b]:!0};var PD=function(a){_.I.call(this,a.Ha);this.Gc=null;this.fa=a.Fa.EQ;this.ja=a.Fa.metadata;a=a.Fa.D$;this.da=a.fa.bind(a)};_.A(PD,_.I);PD.Na=_.I.Na;PD.Ba=function(){return{Fa:{EQ:_.pVa,metadata:_.oVa,D$:_.iVa}}};PD.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Ed()))return _.Xk(a);var c=this.fa.aa;return(c=c?uVa(c):null)&&OD(c)?_.Fta(a,vVa(this,a,b,c)):_.Xk(a)};.var vVa=function(a,b,c,d){return c.then(function(e){r

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4524)
Category:	downloaded
Size (bytes):	18268
Entropy (8bit):	5.42591198336479
Encrypted:	false
SSDEEP:	192:Y67RUv40koAmqLJ5YsKR1tslYNxwN1QHhw7QIeWlbV7owwE4GefhiJs58Cd5Ng+X:Y67RJUCi5VULBwE4GefhiiT5NPtxT
MD5:	B16DE47D6E3B7716F40692C89F6B577E
SHA1:	57879E9863D36D0FED2FAB0C5CAA52DF43747D10
SHA-256:	7A9AD8CADBDF21FBF68ABAD72C21D216FF352732D7124047B64BB9949E0699C5
SHA-512:	0921F78DB1A4B33C4D31D3273EF9060130A261F2BB69263E3FD1240FA39FFA2348A46C5032CA2DA90A9880C8A65A3C7F8DBF0A64CA1D4DEB05F03CC9A7A0DF41
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3ieKI4/yX/l/en_US/aia9_5MaGl8.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometFocusGroupFirstLetterNavigation",["isStringNullOrEmpty","react"],(function(a,b,c,d,e,f,g){"use strict";var h;b=h\|\|d("react");var i=b.useEffect,j=b.useState,k=function(a){return a.slice(0,1).toLowerCase()};function a(a){var b=j(void 0),d=b[0],e=b[1];i(function(){var b;b=a==null?void 0:(b=a.current)==null?void 0:b.innerText;c("isStringNullOrEmpty")(b)\|\|e(k(b))},[a]);return d}e=function(a){if(a.type==="PRINT_CHAR"){a.event.stopPropagation();var b=a.event.key.toLowerCase();b=a.getItemByTag(b);b!=null&&a.focusItem(b)}};g.getFirstLetterNavigationTag=k;g.useFirstLetterNavigationTag=a;g.handleFirstLetterNavigation=e}),98);.__d("useCometConfirmationDialog",["FDSDialogLoadingState.react","react","requireDeferred","useCometDeferredDialog"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h\|\|(h=d("react")),j=h.useCallback,k=c("requireDeferred")("CometConfirmationDialogImpl.react").__setRef("useCometConfirmationDialog");function l(){return i.jsx(c("FDSDialogLoadingState.re

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	96
Entropy (8bit):	4.362961159354576
Encrypted:	false
SSDEEP:	3:bh6G3XWZNDrMyMcbtugSUhdei3XWZNDrMyMcI:bnXS5JtpnS5O
MD5:	F71C4EFD36879E28A721AAF93B559B3F
SHA1:	2AA52C4FD618680148F935B280F96496EFD7E153
SHA-256:	F39FC3D962FAE023EBB725DFDBA524226C593C6EB2BC2C1F23C454D63CC10EC2
SHA-512:	8EB53CB46F668813C99768F701C00D1E2FF18FFE86F50C0C0A17DFAC06B339DCB513F58972CDEDB5A372035596806F69F50E5F6228B5F0AFE5992E13AADE080F
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkbMnFS9SzlUhIFDYOoWz0SBQ3Fk8QkEhcJsA2cf48--pcSBQ14bxIZEgUNxZPEJA==?alt=proto
Preview:	CiIKEw2DqFs9GgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCiIKEw14bxIZGgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgC

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2792)
Category:	downloaded
Size (bytes):	156170
Entropy (8bit):	5.422215342133794
Encrypted:	false
SSDEEP:	3072:pdxAuhp4iaafRo8meL1JquiZwUwmYEuz1var8z:94iaafRo8meL1JquiZwUwmYEuz1vars
MD5:	F22570AFBB167A9D84C38D5C1948832F
SHA1:	58118810D0948B0A7CF969E540AE270211847A32
SHA-256:	9AB55965C17864100DCC997E8194FAB801C19800342CF8F62489EA5B9E8E88A2
SHA-512:	546D103DD2328769D192E8692533FEE611DEC37ABF820B4F511C9C81C6291A0EA614BB0B7612FDD45F81EFD3FF2F620B580A31312BF5F710C25D8A0FCCF7091B
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3ifWF4/yt/l/en_US/3KWduJcmUWu.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometUFIShareActionLinkMenuQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6645300872230027"}),null);.__d("CometUFIShareActionLinkMenuQuery$Parameters",["CometUFIShareActionLinkMenuQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometUFIShareActionLinkMenuQuery_facebookRelayOperation"),metadata:{},name:"CometUFIShareActionLinkMenuQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometContextualMessage.react",["fbt","ix","CometRow.react","CometRowItem.react","FDSIcon.react","FbtResultBase","TetraTextPairing.react","fbicon","react","stylex"],(function(a,b,c,d,e,f,g,h,i){"use strict";var j,k,l=k\|\|d("react"),m={root:{borderTopStartRadius:"x1lq5wgf",borderTopEndRadius:"xgqcy7u",borderBottomEndRadius:"x30kzoy",borderBottomStartRadius:"x9jhf4c",overflowX:"x6ikm8r",overflowY:"x10wlt62",paddingTop:"x1iorvi4",paddingEnd:"x150jy0e",paddingBottom:"x1l90r2v",paddingStart

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2106
Entropy (8bit):	7.554456957317547
Encrypted:	false
SSDEEP:	48:EWP8JUaPVKWwCtcHB3sXXRBJ3v8qkZ/aWr/3KZerMLvSOxJ3Df8sfqV1:lkJVKWw03XXZ4Meo931fq
MD5:	6452ED75C53E1A8E90A664DF18959A90
SHA1:	AC01FC2F40F0E4808E22A9C569F3775F0F15A5E2
SHA-256:	C7BAC3E7016DFC7EB5787579BAC6B975B433FC1A9C279DAFC35649D4782F2061
SHA-512:	4B23F7FB31826943CBA6496BD74DC620C8EC3B8F0525497E825F1F1F87486335D4374F85417458C3C3E018C2215B9B419D7DE77CB67AAE9EA619038432E1EB10
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/eFZD1KABzRA.png
Preview:	.PNG........IHDR.............e..5...YPLTEGpL.e..e..e..p..e..f..f..h..f..f..`..`.....g..f..f..g..g..f..f..f..g..f..h..e..f..d..g..e..e..c..f..f..e..f..g..g..e..f..f........i..h..e..f..f.....e........e..g..f..f..f..f..f..f..g........f..e..e.......F........................f....F.....d........'y.....p....E.....U..7..t.................6..t...........U.................................p......uy...LtRNS.0`..... ......p..._....@..@..oPP...O.^..__....0.o.o.oO..p.P.P_n. ..@0..P........DIDATx..YS.G..G.]..N...t.6&.$..8v\|.>{.."....m.3...../...X..../.....z..Z...^-."\|GT(T.K..Z..n..z.3..BT..Z....\.)..Y.....)..\XZs%..e../...........:....Z.R...,X...B....VCL......".~)P...@..P..8......YG..<...=..BLs..CX........0..J...I....Z..,....0g...i...B..}6.Eh.$.g.D1.k......... ..WYD....O..b~.~......U..s4..?...d0........x.g7.zF...........9..G.A...~...=#.w0.1Z......K..BV..>....x.p...<LS...ft..(\|...2XDE.Q...yc..$Mu.@.L...R=.X,.H....!.X).j../.-q2.....09.........\...&.bYk........j.o......../.u}..(5!.

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	6.912986208184796
Encrypted:	false
SSDEEP:	24:gqSS16c1speHcyYsJcXFYlYmES8Y/JtDGGVkOoHoT3Y/Y3kY9r8:gc6iWeHRt+FTm//JwGVGoTI9R
MD5:	EFFA6F52F341851B74A084A4FD5F1036
SHA1:	BD36987647F27DA5390A0E2C3B6D21241367A535
SHA-256:	EDC23FB7556BB99826CEC2EA7CB947E24FB8E912AE21F1843B56F59D3E8889D0
SHA-512:	C55109041411BFE01F473E08E04080AEB2DFCEE88DD9639E9EDA36F78ECF5F9456E048E4F179E957D5B2B5922626B19BF8859241ACFDD4C8E2A6636A299A581E
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t1.6435-1/182862089_329809465171561_9124100968924750007_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rbjHzLvzucEAb5bZn4H&_nc_ht=scontent-atl3-2.xx&oh=00_AfDvEfsbAQgrTPLx-opY6lSgCA3J3Ac-nhnwCNbY_jzosg&oe=664928B3
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6a010000d70100006602000087020000bd0200007d0300002e0400005e0400007f040000ae040000bf050000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..........................................................................z..m....H............>.]L.)..+.".....5.......wp8....%..........................12....!"#...........u.2.`8..'.).z.1L..\3./...kk.3;.d.../.......uw;jE.t....@,....n5.....$? G..gW...y.b.!>..c..)......t..D......................@........?.......................@........?.....)..........................!1Q Ra#A.."2q........?..R.JG.......=XFVM.(......u$(k..E}...Y.SSJW....!KA'.y.HK...{G.Rp.Km.A.o...N..k.@m...n....B..;.a.p.4.*.?F~..SJ.LH.Zq/R.......;....^e$.lcg>.c..%..."....................1!Aa.Q..q...........?!...L.!h#.-i.V.;O.#.C...A.)m.L..q. \|.....1...^S[..Ps%.m....0.....T.]G..g!u.{e1......!:..<F.l..s.0.

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 25 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	804
Entropy (8bit):	5.9272601627884605
Encrypted:	false
SSDEEP:	12:6v/7ykl/f/je0aVMrCwGPlc+Zen0JTSdoc9EdyBw3w6xuS8SNGqsaNg:onBaVHwGPlxen0NSucwXoSJN+8g
MD5:	C156C107AE735C5F3813220235E0D11E
SHA1:	F655A14E144551432AAE9BA0A7FE0E237A65AE51
SHA-256:	D75C74B337113A0C65EBFF05ED63A487A0E158BC7246B987A28943667DF46C5B
SHA-512:	A2729CA423327C0855BDC68374AE0EA6B211043EBD39A63B7248BF4E288B9641BF3F827EA01C4FB0444BCFBC68B6E06B51EEDE746668F14D4F7225B9B941CC81
Malicious:	false
Preview:	.PNG........IHDR.......@......,n....PLTEGpL....................................................................................................................................................................................................................................................^.g...QtRNS..d....(..........B...:.>...0..XVLJ\|<.t....Rv....6D4n.......@x.8...h..\... .NJ.!V....IDATx^...@...4Q@.yf.:1l.9.../3.M...l..U.#........$?...........kI]\|.$GI&#.{.R..../d7$..x!.c..X..\B>...x./..X..[....SQ!@c\%..RNr"rrv.!.b.%.......j...n,...u..*).y.]."..r.b..P...B.FU....`.........s...,..y..(.3...!$.. ....F.(.a...g.?R.F.B:....$C...t...........\..N....c..2..`..VH.1..mF>.....t.L.MxDY....Y..U.6.$...O.(.....U.)/.e.mk..$.^.N....-........:.U.d.7...yp_i...Y.z....t..=...f#Q....IEND.B`.

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	31621
Entropy (8bit):	7.9437232017667005
Encrypted:	false
SSDEEP:	768:kCVYN1GYTfqkqaE3EKooUq8z2yFERNQrr+4Drp+VPAsQq:kCu1hY05N9jEkqjBAsH
MD5:	A3807A62C850ED4E8C61A8052D4A041D
SHA1:	2F3DA85AAA4D6E29A88A33130DBB6AFBDEFE1F45
SHA-256:	CB6AAE49FBA40CD345DDE263D861E3627A0CC2C7C710322AD137EF3E375E6CA8
SHA-512:	696B6A5EC56E9C88FE4A4387652C8AF772739F0D0B2AEAA40AA1E46CA24A64DA21A8450426805790C293A2069E6DECB745641C35B64F6E30885AE08A8B0D4D9D
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/436859318_962909741584758_3870588264605380752_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=s7KXFq-dOKwAb6FUqMa&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-GpW_tvCHQBURGYoJaXuwYk2uRI3TGoOELVJq2jzi8A&oe=6627A99F
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100003f180000fa290000d82c000047300000aa340000b74800005a4f00009653000083580000857b0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..................................................................................@....HH..... @..........L........................@...L."`...................0....D..."`.......h.....LH..........L"&............@.....@.......L........&.............@.........PDH........@......A.....(........ ...@.&...Q.l.,....d."P5......H..........&......R...][(........H..Q................"`D..D.Ef5kY....J..I]-....e...A5..................&.L.......V..7b.Mjb.j.I4.Zfij_......5........1 ...............5....-MZ.k.D.SjYt.ZI...mh..f&M.P.P%.....D.....H.. ...D....!.@.$...H..` ..... ...$D... &."$....@.....@...........H..1 ... ....."`.......Q0.....T.J..............0 @..@..(..0j%D....-....y.~.W..zy.Vb\|.p.....

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	14054
Entropy (8bit):	7.9437832987054176
Encrypted:	false
SSDEEP:	384:a8IFSwshv2F23zJ/7roApP5gzkraSj5duLzWtR:gFl4K2D9flbrdj5duHWP
MD5:	DBBA1A59E3CB5ACF6B5DECFB0B5D2193
SHA1:	49595B4C908C4357C431BBE2712CF75F6D253E42
SHA-256:	3D92EE06DB31E1F4DECBF451AEADBC687B927D1E977ADB5BD156E94913A75A04
SHA-512:	9380E618537E5FC8B5D10F6B111113E2A1294273D81AAC7EFEDAC36792D4C7A9AAF0C0BDA1EEA034AC098D8ABD02ED03ED9F082CD170F52D9B082C53070C650D
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100001a060000230d0000d40d0000af0e00002f1600002d2100003e2200003f23000061240000e6360000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n....".................................................................................>...9P.E...U.9{..C...S.y..S......}\|/w....9...G..."..E;....TT6.s...&...TS...Z...EEU.Ay....;..S.......[.j......:.CR.K5.8%k..V....2P$.......y.54{84..n.c8....U....,x.).gm........8(..2#...5./.<g.$5.c.u.9Q...Tg@..,.d...rK...7.9#H{....+.M.9.p.jH.p......'.x.AV..6.(Vr...Q.C`gH.Kk\..L.g...:)k..p...,..;..w@.Z.....4.d%.+J`'..)...Ci...n&.....#.J.2...9..~.d.):.p..KRLef.....X..Pi.\|o.:c.@}=...&..Ts...8...j\|......e.9.\]y9..V...2.Uf....e$Y...3usz.\S..u\.y......4)..yw.p.;..H.3.znB.c..[.rQIjY`.&..5.... .]..\|.8[:.q..........72..k........gy.c.'gS.....5Z.2..7Y-~A<..."A.5dV.......P[.......P.N..e..t....

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17337)
Category:	downloaded
Size (bytes):	777920
Entropy (8bit):	5.736234414933445
Encrypted:	false
SSDEEP:	6144:jJou68BNc2sU9zAbIfeTBUWV2my1MS1VQCBHxx1D+jb:jQ8BNuUmG1HVZf0b
MD5:	13CBC7EB82860B6266DCCFC59F3C75F7
SHA1:	B3EC028CD0954DB4974744C12303EF2210F09187
SHA-256:	F68FEA62E44D6433E59101A40D898A335BA9E4D1DBDC36899705B79FE9AE1CC2
SHA-512:	4A8BA7F7C1FFB7FC71F68102AF62B794CF6D2B570F4FF0B4764753D98AF0A1D52E6386DDEC81FFC30119B1475FB739C3EABA27943BC15FB5C3B179D57EF017A4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,zu7j8,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,aC1iue,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 49 x 74, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1633
Entropy (8bit):	7.352151724937379
Encrypted:	false
SSDEEP:	48:Qy3Hwa/3ffWoAf6t+snxsGhlYUcGwMMQ1:xQaXfKG+IJcJM51
MD5:	72EE577BCC1A6A29D0422C3EB1248861
SHA1:	800818D8D4A3E67D49ED2A3A935B355F8452DDDD
SHA-256:	97FADFDD7D274DAABD9F7D79C817F4A9FACC08EBA67E38284698525E8A1FFFD0
SHA-512:	A373DB5E786A91D299394B45D707A067CEC708966B8757BF84F5BEF0F167E7EE4388C4356468526A6A8B4AD3521773FE78FDE18422B16F730D9116245544171B
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/7NqDjYL3eb9.png
Preview:	.PNG........IHDR...1...J.....%.L,....PLTE.....................GpL...........................FFF......ooo...BBB.......................................NNN...uuu...............................................................999..................,,,.........AAA...............444......................................................777...WWW......:::.....................333........CCC........................zzzhhh....."""{{{...jjj.............%%%...555............................................bbbccc.........rrr......sssrrrsss.................................to.K....tRNSfJ....\.Td..hLfl.xP6.\x.....jf..\|..N\|`........N..R`..n..^.tVp..V.v...z...t.\|.."^v.hfBlZX.j...tb..p~b....:4r..x...h......n.......n.t.....`.`.....b....b.................TIDATx^..es#G.....dY`.33...!3C.0.c.....~.\|.D+E.f....}.T......j...3..3...)C."...'..........GK._..........J.....%..vw:....D&+5.fl... ..@..Q.4.$.h.&Zb..N.....b-.h.".....R'.b.n...!.T#..N.G.a..UEg.DZ.3.....OtC{......+.7.......E.$...

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 25 x 593, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3656
Entropy (8bit):	7.528124637803877
Encrypted:	false
SSDEEP:	96:PuqrXtfBG94QoxrLXwyHVMAVA4P9Nj+W3kjpQWfI:PuqrDG943LXwyHa94+W3gfI
MD5:	6E71389EE4977DB158B74A541DD43719
SHA1:	1AEAE3113EFDDDEBA195CB3EC301894DB2E53CEF
SHA-256:	112843EFE26A4F45FC9675BCF8F77653FF94D6DADC84B38070F644EECF2664D8
SHA-512:	457C8234F56E8701A1A8C2090CE047DE561F25FAA4E65CA8C66E4C139F030615E3DC68283ECE00B97348251ED460AA22AE0703D10D3A481E9384C769F59AD7AC
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yR/r/4TRsPp18HYl.png
Preview:	.PNG........IHDR.......Q........y....PLTEGpL.............................................................................................................................................................................................................................................................................................................................................................................................m.5....tRNS............$.."NP....J>..d....T...........t,Z...(... ..\.V\|`...D&....l...j.<..fn..X:H..4...8h.2.~...F.zL0r..6B.x^b..p@R.v..-L....IDATx^...W...../.. ( .(8..(..\.C.:.........?.$...^.=g.{.?..z....`hKvm.[..l.....5.v.A.4...G...WF.e.M5....].&....PF...X[......AS..f....c..J7q.."..1.j.3...J.......Q.q..ma...j.;...Q.W..d."W.!2.&s.eT$.#X...<..Y..i...>.fMJ...P.V.x...!.......1...!:...........i...Q..F.)rU.....k....HhJ..2.C.zf..L{eZ...N.O..D.i?I..E...J.......,.{..A..4..Xg.3.....M\.8k7...........px=...=..$E.gU...c..te.H..mI...7.&,+...$.;

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 25 x 64, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	804
Entropy (8bit):	5.9272601627884605
Encrypted:	false
SSDEEP:	12:6v/7ykl/f/je0aVMrCwGPlc+Zen0JTSdoc9EdyBw3w6xuS8SNGqsaNg:onBaVHwGPlxen0NSucwXoSJN+8g
MD5:	C156C107AE735C5F3813220235E0D11E
SHA1:	F655A14E144551432AAE9BA0A7FE0E237A65AE51
SHA-256:	D75C74B337113A0C65EBFF05ED63A487A0E158BC7246B987A28943667DF46C5B
SHA-512:	A2729CA423327C0855BDC68374AE0EA6B211043EBD39A63B7248BF4E288B9641BF3F827EA01C4FB0444BCFBC68B6E06B51EEDE746668F14D4F7225B9B941CC81
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/q8Uic1K195T.png
Preview:	.PNG........IHDR.......@......,n....PLTEGpL....................................................................................................................................................................................................................................................^.g...QtRNS..d....(..........B...:.>...0..XVLJ\|<.t....Rv....6D4n.......@x.8...h..\... .NJ.!V....IDATx^...@...4Q@.yf.:1l.9.../3.M...l..U.#........$?...........kI]\|.$GI&#.{.R..../d7$..x!.c..X..\B>...x./..X..[....SQ!@c\%..RNr"rrv.!.b.%.......j...n,...u..*).y.]."..r.b..P...B.FU....`.........s...,..y..(.3...!$.. ....F.(.a...g.?R.F.B:....$C...t...........\..N....c..2..`..VH.1..mF>.....t.L.MxDY....Y..U.6.$...O.(.....U.)/.e.mk..$.^.N....-........:.U.d.7...yp_i...Y.z....t..=...f#Q....IEND.B`.

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 192 x 192, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	7.554456957317547
Encrypted:	false
SSDEEP:	48:EWP8JUaPVKWwCtcHB3sXXRBJ3v8qkZ/aWr/3KZerMLvSOxJ3Df8sfqV1:lkJVKWw03XXZ4Meo931fq
MD5:	6452ED75C53E1A8E90A664DF18959A90
SHA1:	AC01FC2F40F0E4808E22A9C569F3775F0F15A5E2
SHA-256:	C7BAC3E7016DFC7EB5787579BAC6B975B433FC1A9C279DAFC35649D4782F2061
SHA-512:	4B23F7FB31826943CBA6496BD74DC620C8EC3B8F0525497E825F1F1F87486335D4374F85417458C3C3E018C2215B9B419D7DE77CB67AAE9EA619038432E1EB10
Malicious:	false
Preview:	.PNG........IHDR.............e..5...YPLTEGpL.e..e..e..p..e..f..f..h..f..f..`..`.....g..f..f..g..g..f..f..f..g..f..h..e..f..d..g..e..e..c..f..f..e..f..g..g..e..f..f........i..h..e..f..f.....e........e..g..f..f..f..f..f..f..g........f..e..e.......F........................f....F.....d........'y.....p....E.....U..7..t.................6..t...........U.................................p......uy...LtRNS.0`..... ......p..._....@..@..oPP...O.^..__....0.o.o.oO..p.P.P_n. ..@0..P........DIDATx..YS.G..G.]..N...t.6&.$..8v\|.>{.."....m.3...../...X..../.....z..Z...^-."\|GT(T.K..Z..n..z.3..BT..Z....\.)..Y.....)..\XZs%..e../...........:....Z.R...,X...B....VCL......".~)P...@..P..8......YG..<...=..BLs..CX........0..J...I....Z..,....0g...i...B..}6.Eh.$.g.D1.k......... ..WYD....O..b~.~......U..s4..?...d0........x.g7.zF...........9..G.A...~...=#.w0.1Z......K..BV..>....x.p...<LS...ft..(\|...2XDE.Q...yc..$Mu.@.L...R=.X,.H....!.X).j../.-q2.....09.........\...&.bYk........j.o......../.u}..(5!.

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (591)
Category:	downloaded
Size (bytes):	1221
Entropy (8bit):	5.166309777431971
Encrypted:	false
SSDEEP:	24:ylRZCXDqt6psqdCduo8GYyahZCDZuTYxZIyaMEbT:WR0VLIwoxdzDIOg
MD5:	51ECBADC09941E74DFCFCAB092E44AF4
SHA1:	126A556CE9AA75F0D476AAA4D758E6E3FBE6BAD8
SHA-256:	974E4E8F72B91CA6A45356E36A6E25B64EA4B8D5EB02AC7B204E7EDB62980257
SHA-512:	4233B928E181E7AFCC484D20298B7356CACDA625C6EEC512058A28E043D4BB5F83FBE306C7FFB823860FC9EF9E1042DE6BD10872C19ABDC7FFABA6B8F89DB20E
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/SDtEN57PJgl.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometVideoHomePlaylistRootQuery$Parameters",["StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:"8245394992142953",metadata:{},name:"CometVideoHomePlaylistRootQuery",operationKind:"query",text:null,providedVariables:{__relay_internal__pv__StoriesRingrelayprovider:b("StoriesRing.relayprovider")}}};e.exports=a}),null);.__d("HelpContentGalaxyDiv.react",["react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h\|\|d("react");function a(a){a=a.children;return i.jsx("div",{children:a})}a.displayName=a.name+" [from "+f.id+"]";g["default"]=a}),98);.__d("CometVideoHomePlaylistRoot.entrypoint",["CometVideoHomePlaylistRootQuery$Parameters","JSResourceForInteraction","WebPixelRatio","buildCometVideoHomeRoute.entrypoint"],(function(a,b,c,d,e,f,g){"use strict";a=c("buildCometVideoHomeRoute.entrypoint")(c("JSResourceForInteraction")("CometVideoHomePlaylistRoot.react").__setRef("CometVideoHomePlaylistRoot.entrypoint"),f

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3449
Entropy (8bit):	5.476559526829746
Encrypted:	false
SSDEEP:	96:oWqZ4RE7YGueGE3bYetPjR6lv7esvpagGahjOw:wZ4R8XkvAgGq
MD5:	F6053E7D421B4DBDA6B13AFE6A4E8331
SHA1:	A4040265AD3E09BEEB0B6C8EC35156831A56F9AA
SHA-256:	666B45739C898F59D524D3C78B5FBF452E731DFE64CE2BBB5E7C1D45181EDE93
SHA-512:	CA5836BD044567762D922B20ECAA977ECBDFDE5BFE14CD692B489C93A6B25155ED1346FE60ABB93DFF986E944754899C7420982F354083463C3150ED5557504F
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,iCBEqb,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var ota=function(){var a=_.ae();return _.yi(a,1)};var lq=function(a){this.Ga=_.t(a,0,lq.messageId)};_.A(lq,_.v);lq.prototype.Ja=function(){return _.Zh(this,1)};lq.prototype.Va=function(a){return _.Ki(this,1,a)};lq.messageId="f.bo";var mq=function(){_.Ak.call(this)};_.A(mq,_.Ak);mq.prototype.Xc=function(){this.PO=!1;pta(this);_.Ak.prototype.Xc.call(this)};mq.prototype.aa=function(){qta(this);if(this.Rz)return rta(this),!1;if(!this.NQ)return nq(this),!0;this.dispatchEvent("p");if(!this.oK)return nq(this),!0;this.kI?(this.dispatchEvent("r"),nq(this)):rta(this);return!1};.var sta=function(a){var b=new _.zn(a.X_);null!=a.qL&&b.aa("authuser",a.qL);return b},rta=function(a){a.Rz=!0;var b=sta(a),c="rt=r&f_uid="+_.Ng(a.oK);_.gl(b,(0,_.of)(a.fa,a),"POST",c)};.mq.prototype.fa=function(a){a=a.target;qta(this);if(_.jl(a)){this.iG=0;if(this.kI)this.Rz=!1,this.dispatchEvent("

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	43734
Entropy (8bit):	7.977117490439355
Encrypted:	false
SSDEEP:	768:NkqMnNA8TM4S2M7z1dkYnF1wqmrqSwlUZsYvxHjygS:NEnq4XGHF1wGUy2+j
MD5:	F889BE3DC9F0375666D9570689BA1C85
SHA1:	E5F6478A38B3E8587720A321842F7335A52D3B60
SHA-256:	2747556558DCE0DF54DB9AA14480396681C2A2A5D3C409C29092AB7205E985A9
SHA-512:	9C3F2693EEE2C51E15B4BCA533612D2FD3B62EFB84934C30EB87F4D2043CF7A8DD505034BCB3299147E4107422A30B3016101CA5B059EA2F824F1E9C38E92834
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000571c000063340000153a00006f4000002f49000021650000716b00006b72000061790000d6aa0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................(.T..2.AZ..@....$@...d..B.6.....6......Nebv..aX...iH...XV.iH...iS....D. M )v..P......+W........)....!r...-....)..L..E"z..Nf-eD..@XV..!.. .DFH.. ...I.8..".Q3..!.Bm.D..H..@-...tP.v8..j.\/E......$..DF.E.d..H'.#nF..N..J.Yj$.[..p...&D........b....@.......P.F.p...E..,+.(+C........}...'........p....H".5Y0 J)!....+.]..CM...L.......b..........p.b...u.j.6k ..ZD.....6.S...B.sk...H.o..BA'....L.9..QI).b....'.VF...@YJV.....$."bHh.......bA".,UD'Zl.P...L....4D:....DF...@1..........L'(....WD"....DD.T....2..@....Z.J..... ".....`. .Z.0...g...D......Bh.....,...4.N2.*.iQ.+........#c.(.....@..&.h.h........ M.,

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1299)
Category:	downloaded
Size (bytes):	114271
Entropy (8bit):	5.5553458905033555
Encrypted:	false
SSDEEP:	1536:byWA1WOEJNjYEEU0AzsWZYDq7Z3pbwQ+Fk3OTzB+9gmSeA5K2qU0UG2uioteT9:blALEJbX7Zj8k3OTzB+ymSeilG2keB
MD5:	F313DC5B5708A43B9EEEF5C24F67A10F
SHA1:	8DB79236A8CAECDE461C55994FE11235D7194F47
SHA-256:	5E161ACD7EAF302818E14124B8AFD174B165238FFCB2F249B0ABF22CCBC2A6E6
SHA-512:	E8FDFD5225D7EAED1C1AB093237915448C3F7F9DAD4E96C213F608DC1699D285A0C46E522B65BF73629A6184FF6BC5C0B1BBAF3B2F1E78BED98E5B033D0E421D
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=AvtSve,CMcBD,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,hc6Ubd,inNHtf,lsjVmc,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var zvb=_.y("ltDFwf");var cU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.tb=this.Ra("P1ekSe");this.kb=this.Ra("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Ia=[];this.fa=_.Vr(this).Xb(function(){this.Ia.length&&(this.Ia.forEach(this.f9,this),this.Ia=[]);this.La&&(this.La=!1,this.tb.ob("transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,this.kb.ob("transform","scaleX("+this.ja+")"));_.Tq(b,"B6Vhqe",this.Ca);_.Tq(b,"D6TUi",this.ta);_.Tq(b,"juhVM",this.Ma);_.Tq(b,"qdulke",this.aa)}).build();this.fa();_.xg&&_.Vr(this).Xb(function(){b.pb("ieri7c")}).Ce().build()();_.Hz(this.oa().el(),this.Sa.bind(this))};_.A(cU,_.J);cU.Ba=_.J.Ba;.cU.prototype.Sa=function(a,b){Avb(this

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3449
Entropy (8bit):	5.476559526829746
Encrypted:	false
SSDEEP:	96:oWqZ4RE7YGueGE3bYetPjR6lv7esvpagGahjOw:wZ4R8XkvAgGq
MD5:	F6053E7D421B4DBDA6B13AFE6A4E8331
SHA1:	A4040265AD3E09BEEB0B6C8EC35156831A56F9AA
SHA-256:	666B45739C898F59D524D3C78B5FBF452E731DFE64CE2BBB5E7C1D45181EDE93
SHA-512:	CA5836BD044567762D922B20ECAA977ECBDFDE5BFE14CD692B489C93A6B25155ED1346FE60ABB93DFF986E944754899C7420982F354083463C3150ED5557504F
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,iCBEqb,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var ota=function(){var a=_.ae();return _.yi(a,1)};var lq=function(a){this.Ga=_.t(a,0,lq.messageId)};_.A(lq,_.v);lq.prototype.Ja=function(){return _.Zh(this,1)};lq.prototype.Va=function(a){return _.Ki(this,1,a)};lq.messageId="f.bo";var mq=function(){_.Ak.call(this)};_.A(mq,_.Ak);mq.prototype.Xc=function(){this.PO=!1;pta(this);_.Ak.prototype.Xc.call(this)};mq.prototype.aa=function(){qta(this);if(this.Rz)return rta(this),!1;if(!this.NQ)return nq(this),!0;this.dispatchEvent("p");if(!this.oK)return nq(this),!0;this.kI?(this.dispatchEvent("r"),nq(this)):rta(this);return!1};.var sta=function(a){var b=new _.zn(a.X_);null!=a.qL&&b.aa("authuser",a.qL);return b},rta=function(a){a.Rz=!0;var b=sta(a),c="rt=r&f_uid="+_.Ng(a.oK);_.gl(b,(0,_.of)(a.fa,a),"POST",c)};.mq.prototype.fa=function(a){a=a.target;qta(this);if(_.jl(a)){this.iG=0;if(this.kI)this.Rz=!1,this.dispatchEvent("

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 493x960, components 3
Category:	dropped
Size (bytes):	52250
Entropy (8bit):	7.979354059494914
Encrypted:	false
SSDEEP:	1536:at6By3dTdfGiAKbh+YMjGQUvacwfHZ8gT0y6:at6By3dxhAN3XCa7x6
MD5:	FB04F942B9C2C0113DC79FDD16EFC00B
SHA1:	8D4C614C94875AA2A210FFCECC73E8B25583262B
SHA-256:	DF20F14158446ABDA70F6A4236C38EB37F4439A19E1BF22203D1CBC3FF546F30
SHA-512:	19AA4595DE6DF58869A0385D3A6468F10D91E4BE9AC1FB12A72CEFD3F0A00AE07AA88E3C3377A9533B1EEE48A777FF85D278384D14062C5386B20238C69298AA
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100000f160000b5300000d3310000193300004d4f000081780000357e0000788000009c8200001acc0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."......................................................................................./Cw!.T....Y"...b$vZ....E...4.+..t...h1.2.Si.[.j<k.}r.=../.....4.%-d...c.a"...j.."[`..Z.i.st....! ...+`..Ad..z.D.{O$..Q.{...m..\|...0.B.aYx............H..a..O..m.&.....Z.S".U.[..:....5G....<..p...9.m{...AI....A#A..+.C.BE..,%R..<.4.`.`..cC..F...ZyV.......<&.b..5.$..ZMV^.^Ee...c.B.FR+B..&..)0X.@.X.X......H(.E....A!.M...$Fx!h)0......$aXH......I...a.@......\.H..&:.B%W. `.`.d+..a....D,(.@..2.0.x#.,2.0..HI..0$$..BE...........*.I......I.....1..Lx..W.......u.ok~u...L.a. .D&.0.$X.@.....!.........." ..... .... .........v._8...z..v.=z'..>...C/.......!....A!.0.B..Aa#.a..E. ....GP......u.b$h,bsu..K

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (682)
Category:	downloaded
Size (bytes):	4126
Entropy (8bit):	5.355816676246375
Encrypted:	false
SSDEEP:	96:GOFB1Kce2eMXmvci7UccRyDlyiKenjwf9Xn6Ow:93Kcri7U1RyDlyiKenjUN6b
MD5:	C18D7346DE40A0E15C7AD41BDC248E21
SHA1:	1AA3B333CABC332A486E1390FE223ECA98CE9BBE
SHA-256:	555F0968B40AA581D32E1802451B0B941875D0A7571CFCDDD3703BF83FE0DF24
SHA-512:	115945EF71ECF7A1FC00775596237E542F90E733D249C38313653E9FEC086666A7A25714EE432BD3AB50A88E917EEE10696C3E445C127B1AFA71860D8AFA1EA4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qf(_.Xna);._.k("sOXFj");.var Kq=function(a){_.I.call(this,a.Ha)};_.A(Kq,_.I);Kq.Na=_.I.Na;Kq.Ba=_.I.Ba;Kq.prototype.aa=function(a){return a()};_.Eq(_.Wna,Kq);._.l();._.k("oGtAuc");._.Jta=new _.xe(_.Xna);._.l();._.k("q0xTif");.var Fua=function(a){var b=function(d){_.Rl(d)&&(_.Rl(d).yc=null,_.Xq(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ir=function(a){_.gp.call(this,a.Ha);this.Qa=this.dom=null;if(this.xi()){var b=_.lk(this.Kf(),[_.Jk,_.Ik]);b=_.th([b[_.Jk],b[_.Ik]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.xq(this,b)}this.Ma=a.yh.W7};_.A(ir,_.gp);ir.Ba=function(){return{yh:{W7:function(){return _.ff(this)}}}};ir.prototype.getContext=function(a){return this.Ma.getContext(a)};.ir.prototype.getData=function(a){return this.Ma.getData(a)};ir.protot

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1299)
Category:	downloaded
Size (bytes):	114271
Entropy (8bit):	5.5553458905033555
Encrypted:	false
SSDEEP:	1536:byWA1WOEJNjYEEU0AzsWZYDq7Z3pbwQ+Fk3OTzB+9gmSeA5K2qU0UG2uioteT9:blALEJbX7Zj8k3OTzB+ymSeilG2keB
MD5:	F313DC5B5708A43B9EEEF5C24F67A10F
SHA1:	8DB79236A8CAECDE461C55994FE11235D7194F47
SHA-256:	5E161ACD7EAF302818E14124B8AFD174B165238FFCB2F249B0ABF22CCBC2A6E6
SHA-512:	E8FDFD5225D7EAED1C1AB093237915448C3F7F9DAD4E96C213F608DC1699D285A0C46E522B65BF73629A6184FF6BC5C0B1BBAF3B2F1E78BED98E5B033D0E421D
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=AvtSve,CMcBD,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,hc6Ubd,inNHtf,lsjVmc,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var zvb=_.y("ltDFwf");var cU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.tb=this.Ra("P1ekSe");this.kb=this.Ra("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Ia=[];this.fa=_.Vr(this).Xb(function(){this.Ia.length&&(this.Ia.forEach(this.f9,this),this.Ia=[]);this.La&&(this.La=!1,this.tb.ob("transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,this.kb.ob("transform","scaleX("+this.ja+")"));_.Tq(b,"B6Vhqe",this.Ca);_.Tq(b,"D6TUi",this.ta);_.Tq(b,"juhVM",this.Ma);_.Tq(b,"qdulke",this.aa)}).build();this.fa();_.xg&&_.Vr(this).Xb(function(){b.pb("ieri7c")}).Ce().build()();_.Hz(this.oa().el(),this.Sa.bind(this))};_.A(cU,_.J);cU.Ba=_.J.Ba;.cU.prototype.Sa=function(a,b){Avb(this

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.71696959175789
Encrypted:	false
SSDEEP:	3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
MD5:	8DC258A49B60FAE051E9A7CE11AD05CF
SHA1:	DAFEF280663F4205FC7F0E47799E9945E6A68D6D
SHA-256:	C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
SHA-512:	5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
Malicious:	false
Preview:	.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 25 x 593, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3656
Entropy (8bit):	7.528124637803877
Encrypted:	false
SSDEEP:	96:PuqrXtfBG94QoxrLXwyHVMAVA4P9Nj+W3kjpQWfI:PuqrDG943LXwyHa94+W3gfI
MD5:	6E71389EE4977DB158B74A541DD43719
SHA1:	1AEAE3113EFDDDEBA195CB3EC301894DB2E53CEF
SHA-256:	112843EFE26A4F45FC9675BCF8F77653FF94D6DADC84B38070F644EECF2664D8
SHA-512:	457C8234F56E8701A1A8C2090CE047DE561F25FAA4E65CA8C66E4C139F030615E3DC68283ECE00B97348251ED460AA22AE0703D10D3A481E9384C769F59AD7AC
Malicious:	false
Preview:	.PNG........IHDR.......Q........y....PLTEGpL.............................................................................................................................................................................................................................................................................................................................................................................................m.5....tRNS............$.."NP....J>..d....T...........t,Z...(... ..\.V\|`...D&....l...j.<..fn..X:H..4...8h.2.~...F.zL0r..6B.x^b..p@R.v..-L....IDATx^...W...../.. ( .(8..(..\.C.:.........?.$...^.=g.{.?..z....`hKvm.[..l.....5.v.A.4...G...WF.e.M5....].&....PF...X[......AS..f....c..J7q.."..1.j.3...J.......Q.q..ma...j.;...Q.W..d."W.!2.&s.eT$.#X...<..Y..i...>.fMJ...P.V.x...!.......1...!:...........i...Q..F.)rU.....k....HhJ..2.C.zf..L{eZ...N.O..D.i?I..E...J.......,.{..A..4..Xg.3.....M\.8k7...........px=...=..$E.gU...c..te.H..mI...7.&,+...$.;

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 493x960, components 3
Category:	downloaded
Size (bytes):	52250
Entropy (8bit):	7.979354059494914
Encrypted:	false
SSDEEP:	1536:at6By3dTdfGiAKbh+YMjGQUvacwfHZ8gT0y6:at6By3dxhAN3XCa7x6
MD5:	FB04F942B9C2C0113DC79FDD16EFC00B
SHA1:	8D4C614C94875AA2A210FFCECC73E8B25583262B
SHA-256:	DF20F14158446ABDA70F6A4236C38EB37F4439A19E1BF22203D1CBC3FF546F30
SHA-512:	19AA4595DE6DF58869A0385D3A6468F10D91E4BE9AC1FB12A72CEFD3F0A00AE07AA88E3C3377A9533B1EEE48A777FF85D278384D14062C5386B20238C69298AA
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426704283_408014474976170_8736400465975078399_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ld6EvftXIT0Ab47SqER&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGwovxP7ofS8GVbz5awfT4XOcqHTKR7fDAa7B5m_KB7g&oe=6627A8C4
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100000f160000b5300000d3310000193300004d4f000081780000357e0000788000009c8200001acc0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."......................................................................................./Cw!.T....Y"...b$vZ....E...4.+..t...h1.2.Si.[.j<k.}r.=../.....4.%-d...c.a"...j.."[`..Z.i.st....! ...+`..Ad..z.D.{O$..Q.{...m..\|...0.B.aYx............H..a..O..m.&.....Z.S".U.[..:....5G....<..p...9.m{...AI....A#A..+.C.BE..,%R..<.4.`.`..cC..F...ZyV.......<&.b..5.$..ZMV^.^Ee...c.B.FR+B..&..)0X.@.X.X......H(.E....A!.M...$Fx!h)0......$aXH......I...a.@......\.H..&:.B%W. `.`.d+..a....D,(.@..2.0.x#.,2.0..HI..0$$..BE...........*.I......I.....1..Lx..W.......u.ok~u...L.a. .D&.0.$X.@.....!.........." ..... .... .........v._8...z..v.=z'..>...C/.......!....A!.0.B..Aa#.a..E. ....GP......u.b$h,bsu..K

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	70232
Entropy (8bit):	7.9666191782494025
Encrypted:	false
SSDEEP:	1536:rfW5k66GHPwsUeee89Fw46cGfFqbyPrxYYSq/GxQGfIQvTBZJ:K5AePCFwzv9YKVY3xQuIQ5
MD5:	9A7091A492415AF553555400B202DCD2
SHA1:	C05C31143809A1D8B1E4E55E8797834A1B7D02F2
SHA-256:	950622954AB94A7521295C81A81856572C50C91F5B8B288730B4A26CBD81F201
SHA-512:	D4685E0F4BE07779D6696C5C63B103C05E41A7E6CEE2B77C59348F4DDF21BF40408916878CBF10F14AF5561C88A390D14674E2F559263E080F5BDC333A0D0F91
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e0100001f1900004b430000fb4300006e440000355d00008c9f0000c3a50000d8a70000f2a9000058120100....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................&.A .W....\.Bd#...4^S]6..\........`C 2.BT....%]T..U.BK.K.U..........\.J.....iV.....z(K."..............}".R`.in].R.]..W....@.K..QWp.TT.T..tI!TTH.j.$.4(.Y...}..9.H<`.......v6..R.0h..D...AA......$.E..eh..i,...eU.!.$YV%.....IE..E..-u.......:......jf".R.A....T...PR.r..\.$.WR......%"....v..P.P`P V.2..CA....6.Ly'SI&.n..NEN... 3=..YWT..\.\.[...D..I.T..B.H...\....Xt"2.+".(.......l..&0..Z9.3.R....~...i.....\_a%.U].W..EK.K..$.h.4b.$\(....I".r.R....U\.]..T.T.T.T...N...>......~,.....$..kW....Y.Wv@G-F,U..M..SL...XWT.2 .\..eB..!..V."\..W.K].HJ.$..BqW.g[]^=2....o.$.r...'{..hD......z.......T...

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3367)
Category:	downloaded
Size (bytes):	22248
Entropy (8bit):	5.524709429717922
Encrypted:	false
SSDEEP:	192:ZVvQK1EDR3ztYhIp93sSxiCb/aEU/dLCjHqc2TcCQhxs2k+j5ZyEhFy/+OdQp:Hvz1EDDpRbijdmjHqc2+s2Jg/+r
MD5:	066D0045D9BCEFE02F3B8875657A5166
SHA1:	FEAD4EF2867A078EB21476F666A4B2FCFE8A0BEF
SHA-256:	88900388911219C00F9B02E04AC44ED084218AF636F4FCA6AD01F1EA5F52E26F
SHA-512:	A1ED271996464988ECD796987526B550AA8DEFEA33D6BD126A9E4523663319F9D7209E46D0833CC0083281958FE32BAA4B0B47953698B3CF05372706AB012169
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iNTg4/yA/l/en_US/2obelxd4ucH.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("FBReelsRootWithEntrypointQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7295530517233440"}),null);.__d("FBReelsRootWithEntrypointQuery$Parameters",["CometUFIReactionsEnableShortName.relayprovider","FBReelsRootWithEntrypointQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("FBReelsRootWithEntrypointQuery_facebookRelayOperation"),metadata:{},name:"FBReelsRootWithEntrypointQuery",operationKind:"query",text:null,providedVariables:{__relay_internal__pv__CometUFIReactionsEnableShortNamerelayprovider:b("CometUFIReactionsEnableShortName.relayprovider")}}};e.exports=a}),null);.__d("useFBReelsViewerClose",["CometRouteRenderType","useCometRouterDispatcher"],(function(a,b,c,d,e,f,g){"use strict";function a(){var a=d("CometRouteRenderType").useIsPushView(),b=c("useCometRouterDispatcher")();return function(){!a&&b&&b.goBack?b.goBack():a&&b&&b.popPushView&&b.popPushView()}}g["default"]=a}),9

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7990)
Category:	downloaded
Size (bytes):	477626
Entropy (8bit):	5.566284245527673
Encrypted:	false
SSDEEP:	3072:+ZrLY2kiAGRx0KDCJcrjrMwmvsPJ8PcgcelRDKRsHu8aq9jpgc7S/i18EvJZGwS/:YKielhksn9jOc7S618cZGxrpsU6FIFTj
MD5:	0DF9B6A82AD4F1CB0E215406320EFED9
SHA1:	843FD6F63AE5DE45BF24D1ED9E9AD67F19FE4C6C
SHA-256:	A56221B6061939CE3F4AF73BE2BD68C438ED9AB0EDF8D867ACE70B5E1051661B
SHA-512:	FAB0FED88B9F641318536D2E4CA71C3C657D5D8742A555F553D0E011C69D2D7C3561604B563777872B2A61ACF158CE1E5F425280E37B6F7E42AC9C263150457C
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3ivlb4/yn/l/en_US/5ZMgj96iLR9.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometBatchNotificationsStateChangeSubscription_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6546596222061607"}),null);.__d("CometBatchNotificationsStateChangeSubscription.graphql",["CometBatchNotificationsStateChangeSubscription_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a={defaultValue:null,kind:"LocalArgument",name:"environment"},c={defaultValue:null,kind:"LocalArgument",name:"input"},d=[{alias:null,args:[{kind:"Variable",name:"data",variableName:"input"}],concreteType:"BatchNotificationStateChangeSubscribeResponsePayload",kind:"LinkedField",name:"batch_notification_state_change_subscribe",plural:!1,selections:[{alias:null,args:null,concreteType:"Notification",kind:"LinkedField",name:"aggregated_notifications",plural:!0,selections:[{alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"seen_state",storageKey:null}],storageKey:null},{alias:null,args:nu

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	10418
Entropy (8bit):	7.930675235975432
Encrypted:	false
SSDEEP:	192:PwkivHe26vknv0fAPK/mxAQqnmZXoMzIQSRKtmhKiAQdCfP/ojylFqfUXzZWZ5uV:4dvHe2Z8fK9wno2NRL4QdCfgcXzZWZ5e
MD5:	BB9B228A0C7D0D5C44D70CC5E186FE2D
SHA1:	3F8908385FAFC85C21399AF1E3D8B2BA841AE216
SHA-256:	367CE64112BCE6C6BCBB067D8AB83AB3E64C8D581B6C87145846F5F6B088EA3F
SHA-512:	FD7B81F6F2BB9B38393D2B7CD25CBBBB3C300B255ACB85DED35D7FBFF8B8C84FF799FB3190FEB5E1AC38C6189A833304E0F7375B8AF42495D953C1709EEC3E05
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/429173328_1660370348130360_2791089032841410318_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=oTY5-d1wVVAAb4mnIdt&_nc_ht=scontent-atl3-2.xx&oh=00_AfDbm_PgkHfw_O7s22gOSLB_gTtS0owWxPY3tvmWzgR_aQ&oe=66278BDF
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100008b050000590a00001d0b0000240c00005212000039190000511a00006f1b0000b91c0000b2280000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."................................................................................{<.@.....J4..".".".".$..@$......(.......).e...n....A.!..D...D..........{.....O....Z..i.....u.5..N.y. :`h..-.P.4....E.7...^m3.?@zh..;.8=<..y.}mK..a.....?....`...{d.}/a..I..#...#.]...z.g.WtMr.T..p.R....{\|...=u.........,K.b..@.....A....MV...:......~...l...\..hA...T......Ue..m7..R..bRVDa.(..$!P.!...h..Z.[...A.,J....jX.jh3S..#$0V0,h.W.FO.......9.u......=.I..%.c-.I5.R.m$..vN&O>.8J...5Y...f..6do....._)..W;....j.R.[/=K.v..c.."3...........K.Wv5.f,rL.6+1..:..-.7..O.....4gp.#.:.F4..I...i...\r1..9....2.W.&.e.,.$6:..w....1...c...Y.F..M........\re.[\.W.....vF.Yqf.g\|+[.~.....en..E......\

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 51x50, components 3
Category:	downloaded
Size (bytes):	1667
Entropy (8bit):	7.071413286519926
Encrypted:	false
SSDEEP:	48:g7iWWOc2SICHOBQJx41Jl8oEsst4ZSLvG:eVru+1JNtst4qvG
MD5:	86BDA689B7E7FE6D3C074876FC2E59EB
SHA1:	2714449E86B0179FE2F55D9779DC2623CB54090F
SHA-256:	FF0222D7921D7345E897297424062019F9190542D3967041CFDFA1E6E4DC5AF5
SHA-512:	AAB8E6B13BD0E9A15B877A4AEE7570D355E54CC13C5D0469A6A683709227DBC6347E69111EA1A5E5F4530EA8A6592C88A91BF63E406EAD974424F67E4E72E89B
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/429682066_368649729457593_2210717644653039134_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=PCsmMolcaEYAb5liA2T&_nc_ht=scontent-atl3-2.xx&oh=00_AfAr3LnIIBAW4Oll3CfuMViVa6IZ_P_aBcdVZ1tFLfUJ0Q&oe=66278F81
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000e001000087020000cc02000013030000c00300007f040000b5040000f80400003f05000083060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.3.."...........................................................................Z.oXFN.+..7nL.D`..z...,S.W9`.\|.!._U.!Y...t.h....6T.......K`)?...$........................2.#...!"13..........(,..0..&.MbC...}....I.d.X....\2 "3ld.....2S.W..Z...}).........vz..Z....F..)........{l.w...]._]r.B.A..E"J.....J./p..G...\|?... ........................A.!.1a........?..+f8.E.V.y!%..)..V2.F....O............................! 1A........?..,.VY.qedIt(..J...~....&.....................!.1..Qa."2Aqr..........?.I....k..Uc~....:.^....4q...pm..V...9..g...;......H...wj....lhF0Q.E?I?.....o.............#.\|..A.fb..]..y.#.....&.../.....#....................!1AQ.aq..............?!5e.......jZ...R..0aj.......M

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (834)
Category:	downloaded
Size (bytes):	7669
Entropy (8bit):	5.358621282750075
Encrypted:	false
SSDEEP:	192:KoBsYETJv5wkjv7JkfKNuv0DCzeBinCWBKRYaRdR2bRuRPR5RGRfRhRAR8RA:1sBXwknJrN/s2t
MD5:	C342BFA66173FE4BCC024C34B5B7BCB7
SHA1:	32BB20CACA08FBE056A15218A778B5DCA219134C
SHA-256:	93127A8CDDC51F0FFA89579EBA1578F54CA2CF65701550E9F6A611362C79A1A9
SHA-512:	F878BEE61FE8CCC5B1B279E2AF265720D26558BF5C4EC819C8A897607B6726C2156C6D4D0F621F4434E9233BB6C10843C837FDC848A3586D52B849AFD7A71FE4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,iCBEqb,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qMa=_.y("wg1P6b",[_.tx,_.El,_.Kl]);._.k("wg1P6b");.var m1a=function(a,b){b=b\|\|_.Ja;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var h=b(0,a[f]);0<h?c=f+1:(d=f,e=!h)}return e?c:-c-1},n1a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o1a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n1a(b,a)},p1a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.xg&&!(9<=Number(_.Eg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n1a(a,b):!c&&_.hh(e,b)?-1*o1a(a,b):!d&&_.hh(f,a)?o1a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Vg(a);c=d.create

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (834)
Category:	downloaded
Size (bytes):	7669
Entropy (8bit):	5.358621282750075
Encrypted:	false
SSDEEP:	192:KoBsYETJv5wkjv7JkfKNuv0DCzeBinCWBKRYaRdR2bRuRPR5RGRfRhRAR8RA:1sBXwknJrN/s2t
MD5:	C342BFA66173FE4BCC024C34B5B7BCB7
SHA1:	32BB20CACA08FBE056A15218A778B5DCA219134C
SHA-256:	93127A8CDDC51F0FFA89579EBA1578F54CA2CF65701550E9F6A611362C79A1A9
SHA-512:	F878BEE61FE8CCC5B1B279E2AF265720D26558BF5C4EC819C8A897607B6726C2156C6D4D0F621F4434E9233BB6C10843C837FDC848A3586D52B849AFD7A71FE4
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,f8Gu1e,hc6Ubd,iAskyc,iCBEqb,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,nKuFpb,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFktUL8CS9ma2bFQwiLvYX2iyBOiw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.qMa=_.y("wg1P6b",[_.tx,_.El,_.Kl]);._.k("wg1P6b");.var m1a=function(a,b){b=b\|\|_.Ja;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var h=b(0,a[f]);0<h?c=f+1:(d=f,e=!h)}return e?c:-c-1},n1a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o1a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n1a(b,a)},p1a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.xg&&!(9<=Number(_.Eg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n1a(a,b):!c&&_.hh(e,b)?-1*o1a(a,b):!d&&_.hh(f,a)?o1a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Vg(a);c=d.create

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4199)
Category:	downloaded
Size (bytes):	19278
Entropy (8bit):	5.369599228603606
Encrypted:	false
SSDEEP:	384:cvdvKJdlmqS6Y09al9NSQqbZrM+McC4Gw+RXY2RAgpho55WW12:KvV6Y09a3wrHCQ+RIVgwWW12
MD5:	CF3995B2563E0EBF8D485583199AA881
SHA1:	AD8F16F214600B1C8D4B18E6BC227CBBE7921804
SHA-256:	D2D12D9D00DB79F5F874A8A5BF942591D4DB684901EDA33A7CDCA25E6F84377C
SHA-512:	B19CF516537D180DD64A6B9ECDD9760085971422511FF59FA05D120B43B4971611429B5A03D7D5384029D1691B6B414F9340701CA337D5CBA429C32CBE8D4310
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Qu=function(a){this.Ga=_.t(a)};_.A(_.Qu,_.v);_.Ru=function(a,b){return _.wd(a,3,b,_.Cc)};_.Qu.Mb=[1,2,3,4];.var wCa=_.da.URL,xCa,yCa,ACa,zCa;try{new wCa("http://example.com"),xCa=!0}catch(a){xCa=!1}yCa=xCa;.ACa=function(a){var b=_.dh("A");try{_.Kb(b,new _.wb(a));var c=b.protocol}catch(e){throw Error("hc`"+a);}if(""===c\|\|":"===c\|\|":"!=c[c.length-1])throw Error("hc`"+a);if(!zCa.has(c))throw Error("hc`"+a);if(!b.hostname)throw Error("hc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};zCa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.BCa=function(a){if(yCa){try{var b=new wCa(a)}catch(d){throw Error("hc`"+a);}var c=zCa.g

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	7.16782310287291
Encrypted:	false
SSDEEP:	48:g2xeiWiLkYl8fmjeQsBFQ2kahJ3pjn9LRPSeV:Zx/Lnl8eEBFQzUPxLRJV
MD5:	C903C483E9B1C944726E52F2CE209EDC
SHA1:	814C53A092D8D28F42BE79484CC977A630B17137
SHA-256:	D9F7FFC81C431E9BE81DFC0085F6AA3839DFB0BA9B9158D9EAF30EFF2D223510
SHA-512:	D7B9688903D55A8E70B5F373E35EE7A59B4CC09A30AA104207334528DF99C300E484EB8539A499E0B36AC520ACDE08B6FC45C92747DD93759F74E8A0FDAA77BF
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000ef0100009d020000090300008103000031040000eb0400002a05000095050000080600002e070000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...............................................................................}e..T..D3..`<S.N....7..E...t..\..C..5,h.<.\|E...rj .L...f...K..Gn.q?...#...........................2"3!$1...........k..q....\|f..(.\._..0.8%.f......{..B.V.,.....#x....k.....:.%....g..q.9...U...}+A..D.Z\|5.H.#...\|."....B.,.}u...}c..?.>......%.........................."13Q..a..........?.....^r...g).d.........E4...!.L.....H.q...~...O..?...'........................!..1.a.23CQq.........?..a.d.%.A]..=q.w.M:....%..hA.+<..`..+..7G.........T....z.}..B....'........................!1A..2BQaq"..........?...T.....*b...i..5...I.Z[!C4.....>P.i.]%A..Cmi...?.,..z....$......cr..!.T:..Mg..zN.].Y..}

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1444
Entropy (8bit):	6.819931355715897
Encrypted:	false
SSDEEP:	24:gqnAbc1sphjLFLli1RXTGISb5yhP4mhZliMuVlkX6QK:gOkiW9FLM7DG75fAdUuqQK
MD5:	A0931F1A6AED072E9CC81D4DD6A62D84
SHA1:	77BA9F964C726C31406A21E7F389F5D98EC8E65D
SHA-256:	106BF592B4968DE4D6B6378C85194F2ED801BD22E1FBC43DA1AB681BDB257E49
SHA-512:	AEF1573DB366539ADC8E5B35286990C733DBFE3AA4E989F7A849CDB7A4B7D7163907DE3D2FE5A0DC9529EBBF833248BC65A1FFC3B50B81D7C6F461DB4F49D392
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/438331716_2765174076970236_1145479496426679813_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=obA5gIRYYUYAb7KFZz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfDhyPAWHnsY26BikqP407np3qhXfYGR6avsj0inolkFDg&oe=6627A836
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e20100006b020000bb0200000603000072030000fb0300003304000077040000bf040000a4050000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".................................................................................<...y...<.b.=.f.m.,.Z.CP...(O......b.<I_...M..."...j.....o... ..........................!"12............^..YoS..r.~.Z........\|WuZ.z:.5.).Bg.s>X...'l...NHc....3.J=...H.Y..... T2..vcl.?.h........!.....................!....12..Q........?...bm...4.&..K..T...........h.\|.7f..8.............................!."1........?.j..T.5.....z...$ly.k.[....&......................!1 "..AQ....aq........?..}......O.J.[N..2.}..Z.X0:.r.Xv>.[(4...M,.Y.vWB....../C..N.... ....................!1A.Qaq...........?!......8%..x..v."..O..-b0..../q\|....j....F....>)F.........Pcd3@tqN:&V..e.D..Kp..Y.......c...N.[kQ).-(

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	2.6465732373896285
Encrypted:	false
SSDEEP:	24:Es5ed8vZa+/kffJTyN5J5iXSvjDxatgFFjiZq1MJUikeVgl2fwFfBaTzh4mpCbak:2fq3OqXAzh4jaJV9HxG8Q
MD5:	3E764F0F737767B30A692FAB1DE3CE49
SHA1:	58FA0755A8EE455819769EE0E77C23829BF488DD
SHA-256:	88AE5454A7C32C630703440849D35C58F570D8EECC23C071DBE68D63CE6A40D7
SHA-512:	2831536A2CA9A2562B7BE1053DF21C2ED51807C9D332878CF349DC0B718D09EEB587423B488C415672C89E42D98D9A9218FACE1FCF8E773492535CB5BD67E278
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/yT/r/aGT3gskzWBf.ico
Preview:	............ .h...&... .... .........(....... ..... ..........................................h. .f...............f...g...d.@.........................`...e...f...f...............f...f...f...e...p...............`...f...f...f...f...............f...f...f...f...f...p...........e...f...f...f...f...............f...f...f...f...f...e.......d.@.f...f...f...f...f...............f...f...f...f...f...f...h. .e...f...f...f....U..........................y'..f...f...f...g...f...f...f...f...............................U..f...f...f...f...f...f...f...f..................................f...f...f...f...f...f...f...f...f...f...............f...f...f...f...f...f...f...f...f...f...f...f...f...............p...f...f...f...f...f...f...f...f...f...f...f...f...................d...U..f...f...f...e...h. .f...f...f...f...f....d......................f...f...f...h.@.....f...f...f...f...f...f....t.................f...f...f...........p...f...f...f...f...f...f...f...f...f...f...f...f...`...............p...f...f...f...f

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1444
Entropy (8bit):	6.819931355715897
Encrypted:	false
SSDEEP:	24:gqnAbc1sphjLFLli1RXTGISb5yhP4mhZliMuVlkX6QK:gOkiW9FLM7DG75fAdUuqQK
MD5:	A0931F1A6AED072E9CC81D4DD6A62D84
SHA1:	77BA9F964C726C31406A21E7F389F5D98EC8E65D
SHA-256:	106BF592B4968DE4D6B6378C85194F2ED801BD22E1FBC43DA1AB681BDB257E49
SHA-512:	AEF1573DB366539ADC8E5B35286990C733DBFE3AA4E989F7A849CDB7A4B7D7163907DE3D2FE5A0DC9529EBBF833248BC65A1FFC3B50B81D7C6F461DB4F49D392
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e20100006b020000bb0200000603000072030000fb0300003304000077040000bf040000a4050000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".................................................................................<...y...<.b.=.f.m.,.Z.CP...(O......b.<I_...M..."...j.....o... ..........................!"12............^..YoS..r.~.Z........\|WuZ.z:.5.).Bg.s>X...'l...NHc....3.J=...H.Y..... T2..vcl.?.h........!.....................!....12..Q........?...bm...4.&..K..T...........h.\|.7f..8.............................!."1........?.j..T.5.....z...$ly.k.[....&......................!1 "..AQ....aq........?..}......O.J.[N..2.}..Z.X0:.r.Xv>.[(4...M,.Y.vWB....../C..N.... ....................!1A.Qaq...........?!......8%..x..v."..O..-b0..../q\|....j....F....>)F.........Pcd3@tqN:&V..e.D..Kp..Y.......c...N.[kQ).-(

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 49 x 74, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1633
Entropy (8bit):	7.352151724937379
Encrypted:	false
SSDEEP:	48:Qy3Hwa/3ffWoAf6t+snxsGhlYUcGwMMQ1:xQaXfKG+IJcJM51
MD5:	72EE577BCC1A6A29D0422C3EB1248861
SHA1:	800818D8D4A3E67D49ED2A3A935B355F8452DDDD
SHA-256:	97FADFDD7D274DAABD9F7D79C817F4A9FACC08EBA67E38284698525E8A1FFFD0
SHA-512:	A373DB5E786A91D299394B45D707A067CEC708966B8757BF84F5BEF0F167E7EE4388C4356468526A6A8B4AD3521773FE78FDE18422B16F730D9116245544171B
Malicious:	false
Preview:	.PNG........IHDR...1...J.....%.L,....PLTE.....................GpL...........................FFF......ooo...BBB.......................................NNN...uuu...............................................................999..................,,,.........AAA...............444......................................................777...WWW......:::.....................333........CCC........................zzzhhh....."""{{{...jjj.............%%%...555............................................bbbccc.........rrr......sssrrrsss.................................to.K....tRNSfJ....\.Td..hLfl.xP6.\x.....jf..\|..N\|`........N..R`..n..^.tVp..V.v...z...t.\|.."^v.hfBlZX.j...tb..p~b....:4r..x...h......n.......n.t.....`.`.....b....b.................TIDATx^..es#G.....dY`.33...!3C.0.c.....~.\|.D+E.f....}.T......j...3..3...)C."...'..........GK._..........J.....%..vw:....D&+5.fl... ..@..Q.4.$.h.&Zb..N.....b-.h.".....R'.b.n...!.T#..N.G.a..UEg.DZ.3.....OtC{......+.7.......E.$...

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	6.912986208184796
Encrypted:	false
SSDEEP:	24:gqSS16c1speHcyYsJcXFYlYmES8Y/JtDGGVkOoHoT3Y/Y3kY9r8:gc6iWeHRt+FTm//JwGVGoTI9R
MD5:	EFFA6F52F341851B74A084A4FD5F1036
SHA1:	BD36987647F27DA5390A0E2C3B6D21241367A535
SHA-256:	EDC23FB7556BB99826CEC2EA7CB947E24FB8E912AE21F1843B56F59D3E8889D0
SHA-512:	C55109041411BFE01F473E08E04080AEB2DFCEE88DD9639E9EDA36F78ECF5F9456E048E4F179E957D5B2B5922626B19BF8859241ACFDD4C8E2A6636A299A581E
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6a010000d70100006602000087020000bd0200007d0300002e0400005e0400007f040000ae040000bf050000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..........................................................................z..m....H............>.]L.)..+.".....5.......wp8....%..........................12....!"#...........u.2.`8..'.).z.1L..\3./...kk.3;.d.../.......uw;jE.t....@,....n5.....$? G..gW...y.b.!>..c..)......t..D......................@........?.......................@........?.....)..........................!1Q Ra#A.."2q........?..R.JG.......=XFVM.(......u$(k..E}...Y.SSJW....!KA'.y.HK...{G.Rp.Km.A.o...N..k.@m...n....B..;.a.p.4.*.?F~..SJ.LH.Zq/R.......;....^e$.lcg>.c..%..."....................1!Aa.Q..q...........?!...L.!h#.-i.V.;O.#.C...A.)m.L..q. \|.....1...^S[..Ps%.m....0.....T.]G..g!u.{e1......!:..<F.l..s.0.

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1851
Entropy (8bit):	7.178026570497497
Encrypted:	false
SSDEEP:	48:grvGiWXLIgaoeuvRc8nGGcLz96/oPfUzhNjic:vLt8uvRn1KyonUlxic
MD5:	BA2F641B3A150880A69352D74CCB4E38
SHA1:	D3D35B9CBAB7075E1B1E935F2220B18635A3E4AF
SHA-256:	337C7111FBCF37AB6D08E79AD3DB652B32347DBEC629F2172234CF1564FC09CD
SHA-512:	ADCAEC4D19FCA0637A34030D0F884052A0E918D9D9F75F3518ACDD08F240735CD06CCFC16979A91A889ED84E0A545F2A90A58F0198A4E2D7785BE8F0D9925CE2
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/417843986_7077021149032703_7323956251606094932_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=LP1IcS8WNgkAb5jFRoV&_nc_ht=scontent-atl3-2.xx&oh=00_AfA70jyAe-1RiEXheUHVhxrne1KBbSQ7H9DEFsRhZDQbsQ&oe=6627932F
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e701000092020000d50200002a03000012040000fc0400003305000072050000bb0500003b070000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................u......4c....UNg.%..n...$.5.'j`fD...Md....(>...oT.%...}..C...`...W..."..........................!#1..".............q50lC.."......H.....s<.J..d.....d..u.l..\|N.<E.....+.M..v..-."..yT...-.r..z.....}`......U..e..... ...J.3X.....H.K................................!.12........?.k.i..]....o..cf0W......0c............................!1Q........?....U/....3..F...r.G.+.........................!..."1A.a..#2BQq.br.............?..:.n\|!^..9"...5-..-.Wl..]..r...g....N...~..U.4......u0Jqm*.}./.w..k..L5..W.M.tN;a [....J.o...U....R#p.V.y.....q.......}..}.....l..]...JuZ.LI).&159.5_.U..6...X0.J..U.

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.542000661265563
Encrypted:	false
SSDEEP:	3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
MD5:	B3B89B9C275343BC6798E3A83564FDDB
SHA1:	32367475C527C3F5E5DB0BF42C348816FF4D157B
SHA-256:	900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
SHA-512:	ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	49949
Entropy (8bit):	7.958841483287345
Encrypted:	false
SSDEEP:	1536:7UGe6dAFspoSAan34l6ay6GcLa9vLRtzte:EmaOonan3JJ0IvLRFte
MD5:	1A0AD136812389246EC732AA6D497185
SHA1:	69EB416CA6A61F3977CD1AB078DE3059B843BD27
SHA-256:	4FE0FFEB22281EC58D5C54DC12439C8A437BDD98F963F3A43217B3F76F51652D
SHA-512:	65BD7DEBD5C12E33C664128AA8F2DE659C9B65F5EF8A14E95E2770564C2F0C9C7D515A5F7498B474B619E3327E03A3A552878004E5ACE1EF6C6D6668EC008EBC
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/435585243_1336893433647196_6208832241633396260_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=elYzPYAIG9kAb6SZKEF&_nc_ht=scontent-atl3-2.xx&oh=00_AfCvf0SUTHuy36cSdF56yN534pHFsf_uSWdDHk8TaBveJA&oe=6627852B
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000a5190000663500002e370000313900004a420000656a00009e700000fb730000fb7700001dc30000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".............................................................................\|.A!.b.`.e`..A#)........e_...].xh...E!.1..B$'..^WK.-.z.^.ig...;.:z..8....=z..f:9...Vk..p.C...[(....m...?c...b..!...BG>.3...O....}Ybh9........cK....\|...u...Z.L.3.....>or..f.Sg...:b..x..m...X\+...P3...q\|3..SF......a..Y$..$..I$..O...k...0..!rW,%sN..b.I..~..;.y...S.FcT...,.V.R......%...^MY..`+..h..pZ..^.?.....F.[..7....!.#.I$.A3.....6..,....q..e..a....=6..u....~Y.1.Y$..f...$.Tj.P.b....+.\|.^~.M.9.C...h....*..W.}7......}2.8vCh+$..1V$.$...?Q..\f..:....D.da....em.s:.t....}h.:^~.....A!....M...Z..3.../^~..n.B+T.K.@...U.)......+py.....-...I$..O...oL..i..+^....YN.F....[...l.P.{.].o.p.3....$.

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (709)
Category:	downloaded
Size (bytes):	4098
Entropy (8bit):	5.113421799212034
Encrypted:	false
SSDEEP:	48:KUR0kZKyR0kaArVkzzQxPYqX9q2lqAEY8HIXOYl6nMLycA1:EmRqb7Njnsq
MD5:	BDA846C27D3C9A4454900A0253FD001D
SHA1:	AAC6CB1D95D54F8DC67A96D2F1DEFB47B132C5AD
SHA-256:	A005ABB5D7EA73A7923F39238E35F5DCF8A58B5A808C7707A297718AD8A94632
SHA-512:	058237D6C3877B708259439E2C5FAA1FC4FD805DD756960F84FF6A1464ED9ACBA11C753AA03E2B1B16EDEC7DBD6A8F09AE65D7C3C0E3BD7AB43B332F715A109A
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yy/r/q9P8VRdD1Am.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometVideoHomeCatalogRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7427489174004657"}),null);.__d("CometVideoHomeCatalogRootQuery$Parameters",["CometVideoHomeCatalogRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeCatalogRootQuery_facebookRelayOperation"),metadata:{},name:"CometVideoHomeCatalogRootQuery",operationKind:"query",text:null,providedVariables:{__relay_internal__pv__StoriesRingrelayprovider:b("StoriesRing.relayprovider")}}};e.exports=a}),null);.__d("CometVideoHomeLiveRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="25344570781853646"}),null);.__d("CometVideoHomeLiveRootQuery$Parameters",["CometUFIShareActionMigration.relayprovider","CometVideoHomeLiveRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{i

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	6.748131750674164
Encrypted:	false
SSDEEP:	48:7dl/ulEROUIiWp5jf8gNe4ZZWF1VqDrYx5H5lSNNh:Rl/PwpJtWFPqwx5H58T
MD5:	382C9BF0B8D6E1C8871D2E98CE92C065
SHA1:	9ED65BB897758B639608806A3666849268BD62BA
SHA-256:	E9DE79388ED47AD95D4439983573219C54D215B96BE5BAAA75745440969FAE48
SHA-512:	6ED26591476B92E239B8694EB3E30B0E9ACA8EE580729C25ED29168365726C6E87DDDC9C9B4DE2FB073C32E7B815AF68318300EE6623FEB58E5D75F130C01840
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE.......lcms....mntrRGB XYZ ............acspMSFT....sawsctrl.......................-hand.......<.Q.E(z..................................desc.......^cprt........wtpt........rXYZ...,....gXYZ...@....bXYZ...T....rTRC...h...`gTRC...h...`bTRC...h...`desc........uP3.............text....CC0.XYZ .......Q........XYZ ..........=.....XYZ ......J....7....XYZ ......(8.......curv..........\|.....u.....N.....b.......j.. C$.)j.~3.9.?.FWM6Tv\.d.l.uV~..,.6..........e.w........Photoshop 3.0.8BIM.......h..(.bFBMD0a000a48030000b60300004b0400008c040000d9040000a30500004a06000084060000c60600001607000020080000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................\.D..;:.V..j....[.....a...e.c\|&.b.:adqQ.2+...&........."............................."02............c..*.v.v.@..F1.C.B#'....fL.-......

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x370, components 3
Category:	dropped
Size (bytes):	18541
Entropy (8bit):	7.941642645642244
Encrypted:	false
SSDEEP:	384:+wo6YgtTkdzo2yrVH9N+xGsK4YLx837+rKBSALMQ:46FSoTVdN+u4aIkK1t
MD5:	7AF8389EBFA7BDA6E1A4F826527764AC
SHA1:	BFE9D87C68AEB2638DE26051BC8765E12516DA72
SHA-256:	B5275CD6D2D8A324E78324CCB86491B91617CB645BE1283A021374509AC5A64B
SHA-512:	811D46DBAB4985ABF74F81E690DC8B7265AE26674CEB92A55EA174B7AF1DB1F75B48DC6D2467611A3CF4A10752E89BB46CF15975E0B699E77980219D8914C124
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7101000003080000ee1200005f1400005c15000064220000b82f00003e310000a4320000db3300006d480000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......r.(.."................................................................................@..........................Q..........................F].W...d.O...So.J..~..x......Z#..\|.......V.2.~8.X.yx....d..~" .....{.P...4y../....p..S...z.......S.5>.@Zm9hl1t.SQ....=.73@.......t0.n.....1g:S..7.f.[,.Zn.LU5:.P7...6f.Fl.{A..1.....Y.y.&...........h.LUM..B.t.>... C.....8CI.....CH../E....mt.".C\.I.via,...@............\|......H.U}i..k.&Q.vj.A4...............QM.k..]...5R....e.M...6.z........D.^3.........G^..w.l:$.w.d?R<..@......(.%..,....72.$Vb4.R4.R0....T".e.A0.A$Azy..\.q........W.W..JM..N......V.WL..&...zW..Z.+.i.:...F1.%.b3..8Cu..I.l1.....q6...L........g....7.....:...N...if..L.l...z.zv

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	31621
Entropy (8bit):	7.9437232017667005
Encrypted:	false
SSDEEP:	768:kCVYN1GYTfqkqaE3EKooUq8z2yFERNQrr+4Drp+VPAsQq:kCu1hY05N9jEkqjBAsH
MD5:	A3807A62C850ED4E8C61A8052D4A041D
SHA1:	2F3DA85AAA4D6E29A88A33130DBB6AFBDEFE1F45
SHA-256:	CB6AAE49FBA40CD345DDE263D861E3627A0CC2C7C710322AD137EF3E375E6CA8
SHA-512:	696B6A5EC56E9C88FE4A4387652C8AF772739F0D0B2AEAA40AA1E46CA24A64DA21A8450426805790C293A2069E6DECB745641C35B64F6E30885AE08A8B0D4D9D
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100003f180000fa290000d82c000047300000aa340000b74800005a4f00009653000083580000857b0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..................................................................................@....HH..... @..........L........................@...L."`...................0....D..."`.......h.....LH..........L"&............@.....@.......L........&.............@.........PDH........@......A.....(........ ...@.&...Q.l.,....d."P5......H..........&......R...][(........H..Q................"`D..D.Ef5kY....J..I]-....e...A5..................&.L.......V..7b.Mjb.j.I4.Zfij_......5........1 ...............5....-MZ.k.D.SjYt.ZI...mh..f&M.P.P%.....D.....H.. ...D....!.@.$...H..` ..... ...$D... &."$....@.....@...........H..1 ... ....."`.......Q0.....T.J..............0 @..@..(..0j%D....-....y.~.W..zy.Vb\|.p.....

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8257)
Category:	downloaded
Size (bytes):	55735
Entropy (8bit):	5.3807664492847875
Encrypted:	false
SSDEEP:	768:loNVXNaeaikNT+fhtgB/8jhdxahd6imF6U5v/FLXisVLk3a+aw/T3THDizp3FvOC:ugd6FF6U5v/FjisNk3a+awDbDiFv
MD5:	28056153FBA8F7EA8BE56E44F0C5FBD5
SHA1:	241DEF990C1AFD16BC738A91CC41BEE2DCF95647
SHA-256:	D1F62021ABF4D7F9EAF9ABDE656D69E2568897D5D00875273525B2A53104E5B4
SHA-512:	24E4B75A95305C8746CA7877451F6D613D954E66CF33410C87C756B7BD49F9F480CA3A51282AD15517293C12138C3B871437ECE330C53A34E7B6DDCCBFE198A5
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iCjQ4/yT/l/en_US/-cuErFyZKsI.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometTextWithEntitiesRelay_entity.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},b={alias:null,args:null,concreteType:"WorkForeignEntityInfo",kind:"LinkedField",name:"work_foreign_entity_info",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"type",storageKey:null}],storageKey:null},c={kind:"Variable",name:"scale",variableName:"scale"},d={alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},e={alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},f={alias:null,args:null,kind:"ScalarField",name:"width",storageKey:null},g={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null};return{argumentDefinitions:[{kind:"RootArgument",name:"scale"}],kind:"Fragment",metadata:{mask:!1},name:"CometTextWithEntitiesRelay_entity",selections:[{alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},{alias:null,a

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	40329
Entropy (8bit):	7.936810122078746
Encrypted:	false
SSDEEP:	768:o2ynYR/ofQmkjWuwZhNXnIhll+K/JydpdnezsAaf2UeDGWRJLya3y:NPm/uw7NX4TnBydpde7e2UmJJ8
MD5:	D757EB36CFFE1D41B52DD2B6866E907D
SHA1:	E3F72BA8E81B7E84FFEBFA5C0B56A1C462C8C92D
SHA-256:	190139BE8688156BAD59BC43EDB7879DAF7A78310C4F6B40D83AA5D679AD8304
SHA-512:	D75DB33EC389CA4BDB4B0265FCB12A6F18C79B667C796827CE1FCECD970F0F0203D57252C265DCD3C030C3B799F2260A6FEAB350D4C106E369CED7225B92D6FD
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a710100009a1300006b2900005a2b0000e32d0000263e00002f5d00006d6300002766000069690000899d0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................P........................................................................................................................................................................................................................................................................................................................................................................................-..K............?!.a>..l}].?.=......\|.A./g.=....L..yy./.......{...g.......u...1..G..t.?/......=W..g....~.S.v\|.......yu.f...`............c...\>.\|\|.....c..{..8}......}_.<..\|o.......x..I.y._\>...........C.z.F>;.........=.P......>...>.

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	dropped
Size (bytes):	78051
Entropy (8bit):	7.983933898861147
Encrypted:	false
SSDEEP:	1536:lx83jrKkX2iQ+7ffeBaDZ93Fz+kexFWRuiCu7hMIP7Yc01RAay/d66ZR2D0:lMykGo7ffeBaDBzdMWR+WlPh0DTy/deA
MD5:	F74C9B5EF20192771073E2E178D57458
SHA1:	863E1F8A54902AD8857657C8E6BE5553FDBFB554
SHA-256:	D21535051F8872F74064DA184627F5538A4DC60F4F1DBED86F2FCB45B63070A1
SHA-512:	27290DE4E63C954F140776587F5EC9EFB6DD67A95A82D271D82F7833FC6529F36B03A1D6806B42133BC6AF4C0EF474768921377786221718C5895354CE2E7049
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000401d0000aa490000614c00005b500000277d0000b4bb0000f3c1000075c6000064cc0000e3300100....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................!...PA......@..@..(..4y.HF...NW..d-%t,...]..W.....!2DT........4U..A..4p\J.l...j[J.X+.XH.l...0U.Q...+G.EQ..k...%4zX..#'\|U[..y.h.:'..uDr..s8...:..y.!.'j.q+..s.I.^"n.o/1..K..rz./.;..\|4.YEU..Q.,.V:.:..:G.2..D..=.1\|...k<s.'Y....9;....Y..K0..>Q..#.....e....1..#.T.....,.....5n.w._G9.iB..~.....W.C<.$n.Z."t2.Z..K.x..QE......=.#c%.\m..:=..L.elcK.R.C.....u1.l.N.-..n...KB.\.]^>.+.42.G..B.'+ZPL.&.s=?(5.UW.}Z\|nK.V..-...w.....b.Y.JX..r.(F..<.q.".#.Qb7'sO..."....fjb..w.\...;c.....iv....W..:L.f...[...ws....~....A.=..;.F,..r.O+V.e.T....V..$...):e...6..fa.A...[3g\|.3R^hS.E.G.$.e.;..%.GgC..V.^.js.?;

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1136)
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	5.249530958699059
Encrypted:	false
SSDEEP:	24:hY6svN/6zSU6pedQf3Zvcn1BZdAe1nCr1LTHI5z1sW:3qN/2+pUAew85zf
MD5:	FBE36EB2EECF1B90451A3A72701E49D2
SHA1:	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D
SHA-256:	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
SHA-512:	7B1FD6CF34C26AF2436AF61A1DE16C9DBFB4C43579A9499F4852A7848F873BAC15BEEEA6124CF17F46A9F5DD632162364E0EC120ACA5F65E7C5615FF178A248F
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 400 (Bad Request)!!1</title>. <style>. {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//ww

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45939)
Category:	downloaded
Size (bytes):	133933
Entropy (8bit):	5.119339824813065
Encrypted:	false
SSDEEP:	3072:N5uEi/bA+TnJDpamoObnmodwbwnwmwowd6/yW8RNK+blic1rU6fJGnjkuC6hfMEm:Pblic1rU6fJGjQ6hkefClYTYIXC
MD5:	A58DCE0BBB3B76F4FD6852C35F599BE4
SHA1:	F51DDE775936DE985A452BBE0F4F6881CA9BE89F
SHA-256:	FFB87EE19BF4671A655FC8FBF707D11A51CF49867E469D52204D571E9B85E4C4
SHA-512:	BB7AA635872ACB855AC3A30EA78AAAA1CD65C2005A002EA429C7D2060225BB307A3DD98ADB68F9F0F09FABD4034768D67DC3608C2E3E3E317FBB9728B66EBDD3
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iQbs4/yg/l/en_US/EX6jmVQkY6L.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometImageFromIXValueRelayWrapper_sprite.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometImageFromIXValueRelayWrapper_sprite",selections:[{alias:null,args:null,kind:"ScalarField",name:"sprited",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_map_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"preloading_spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"w",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"h",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"p",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sz",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",na

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1631)
Category:	downloaded
Size (bytes):	38528
Entropy (8bit):	5.384133251279092
Encrypted:	false
SSDEEP:	768:ka4ZsJiVqZZIpNGVMfgXafCcgBRyLa7l6txRjXbwm75/JgZRrQAT6S:bZCfVfCCa7qxR3nt/JgTv
MD5:	4E0944AA5E27FEA7B7B95D6414E3ED7C
SHA1:	DBB6533C5B16E82CF4B5659F16FEEC57EC223352
SHA-256:	166B738AF44110DF77673740FD48CA6C95099F7249BED2D05A3ADC17D305BE75
SHA-512:	32A39B95679CBDB86C87E35007845EF50A6D12C0A09B37FF7CD52E10BD4B0FEC8271AA9D884751BD71D5D341EBB82B4B0987DD7B6EF18F4A7C707D70554B891E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.mpa=function(a){var b=0,c;for(c in a)b++;return b};_.npa=function(a){return a.hh&&"function"==typeof a.hh?a.hh():_.ja(a)\|\|"string"===typeof a?a.length:_.mpa(a)};_.qn=function(a){if(a.Xg&&"function"==typeof a.Xg)return a.Xg();if("undefined"!==typeof Map&&a instanceof Map\|\|"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ja(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.ob(a)};._.opa=function(a){if(a.Vg&&"function"==typeof a.Vg)return a.Vg();if(!a.Xg\|\|"function"!=typeof a.Xg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ja(a)\|\|"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.pb(a)}}};.var ppa,spa,rpa,qpa,Gn,In,Epa,vpa,xpa,wpa,Apa,ypa;ppa=function(a,b,c){if(b)re

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	10842
Entropy (8bit):	7.919889108874909
Encrypted:	false
SSDEEP:	192:qJsWaJR7aoyVmHXQB2rHkkcJbUm6fpk8NqZVe8T6O5zHe2BgJ5CIqzVpYuBDX6:qJ0en2JcFRKA7dz+bfNuprhK
MD5:	FD5DDC990A5173358D4B6CA63E44F25D
SHA1:	9E2AF4109A1F758B059715172AF66BA1CB72D48D
SHA-256:	EDDC81589BB16256E0F67D25D92F6550A5FE2F35DA923F44FE61FEDFD0CA9C8D
SHA-512:	268D96FA6CC765B95A7C6F91C2AED0E59EF4C4ED00322817664160686202FC7396EBF5D1E7D70E03380253179FDB3E29ECA71B9007AE1DA42649B543BA441F50
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000540600005f0c0000360d0000f90d0000da110000a2190000b21a0000e31b0000041d00005a2a0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................g..&.%.q.W...V..+.........-..."..s.X..%.=2.....nI...!.~./.;.K.WL`B...JIp..M.h.71..B.F..C.hr.g...3L.%...K.#....?CuR"..k......Bd!5CDd...M.:.l.<..A...d.....\wcW.z...5.a@...<-.W.#....gU.v..S..$[<....E.";U.....A..(...?..g.._>..oa..d6..G.;+.*... .3.iq.X:!A.rmZ..slMB...?@..`.;V.X..1`\.7...q.<.LVq.X..../U...>.E]f....~4..B.E......3..9o..y..u...\.&]F.j#...'.e....}..P.T,N.....).1r.6.c......i...;...-Ve.\...RT..`&.1.._J..G.bGECA..e.0..m.<..../;B..t.Dc.>.<..GINVaI.3=...../_....y....r ..4.j@e.yLJj....Q!......]u.....f..q6..q.....i3.W.1..j. r...&.".[..s.px...J.O<6.......o..dx....m(/(fZ.....

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	16053
Entropy (8bit):	7.961789404978669
Encrypted:	false
SSDEEP:	384:Ae6MV7ymZ8T3305Nh/2qbd1nB4hTQ5G8Dsc:d6MVZW7EpvnBnYWsc
MD5:	6E7B7BB3431FBE82C67C30C970AD1A28
SHA1:	FD0A46095ABDAE689503046471E81F1E43546E89
SHA-256:	B4D636038AD4405CC9B1795FBD493C40DBA2E1A39ED3348F70648141AEAE28F3
SHA-512:	107CA18D7146AD67E8E05415F355BC3434FB94D996CDF6082805103ED3CA7390C45F892C92083B984430E8601749DBC84FE24A461BBE43A51B2D9D930993F75D
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000990600005a0f0000b5100000c31200002c1b000093260000a527000063290000802b0000b53e0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..................................................................................[.A!..H.FFd..z.i..h.Q.)#.B.TL.K..K.{2......E..V.gY.Oo.o.........c....d....AYE..J..$....~m4t.[.......gG......=...s..z..w...J....{.'J.T..;x.......G.....E....._[.o?....>'...B.x1....6...5....v.d'nG";..(H.n.[D...z<...7..o?......?V.}...l.i..Xv..=...v..9........i../vZYY..}.?.7......gK...+l....h...8r$..1....y!.%_S.2.C,...&.]....j{.r...r.r...y....?...o7...9..7w$......v1.P.Q[.SA.`...U.o:gB...Zk.A..v.Z.uUO..}..gk...V.j.a"......Du&.....J..U..k..g..K4...R....#.!3..n....+kR+..W..3S..ZY.S.l.1.:t&.....\.F,.L.C.i.:..Ceh...U.>'%..Lu.:.^B...b.\.X.OJ...sx..#.&.;.6M4)t.t.O;".X....VbNU.c.

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17337)
Category:	downloaded
Size (bytes):	775885
Entropy (8bit):	5.736788669490529
Encrypted:	false
SSDEEP:	6144:jJou68BNc2sU9zAbIfeTBUWw2my1MS1VYXBHdj1D+jb:jQ8BNuUFG1HVQL2b
MD5:	230E0F33DD27816556B7C0AE8D43FAB4
SHA1:	2E5EE96ABAF3AFD144F95251414ED00746D52604
SHA-256:	7850170043E2322437E423EE7A58FDFD38C374C33CBE2823BDDF0F69EB85D839
SHA-512:	73BFC78164A757C6CC71797109B7BD8ED2957537B5DDD7D4406A30695C40B12F0557432720E89374B14CCB7C2A2A33B7D3371E865E3D524B4FC906ED76ACA991
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,zu7j8,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,aC1iue,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
Preview:	"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:ez1h8FfY:Kh8Fw
MD5:	A62223264CD530204B2933EF9B663F93
SHA1:	7CD63C5A89DB974468AA6765C5BE8DC719AB811D
SHA-256:	FD802AFC88F2A78C16207E7055F163D903BE3B32E3A11A95E84ACC6284798883
SHA-512:	02276DFEBBC9C4BBA0286232D571C16155F017914CEB37B3F32FC12D3B81B174478C20444902E31957FAEF59BAD0C80D4D1D5241E5DBABDB69CB3F1314E9AE6E
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlyCXj1PD6lfBIFDb2Fgw8=?alt=proto
Preview:	Cg8KDQ29hYMPGgYIARABGAM=

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	13353
Entropy (8bit):	7.945709571898719
Encrypted:	false
SSDEEP:	192:BzcCoWA06Ro6YsACjWVIzD68X2cfmH+NQrl+VgxLj8Qh5YNYVsAkoGakK5wDfOLO:B/oWA0OfEIfhf60QZ+rQh5YXXK6DGK
MD5:	71C8BE03884B18CB60AA8158B22E7791
SHA1:	B3A3C5AEFDFD6B6AF7AAC7A8BE26F1FC04A4DF80
SHA-256:	7DD9BE104578873D93F6998527285706EAA884A144D1B26270DE250A5B6F6BA4
SHA-512:	9A115EDD29F48EAC69A1E9C0F1BF0C34D9F093EC00E996D47AB13046967CD72F00053176AA2A0411DFFA4EA670730D8D7C744FFEAEE4B06789E6F3B38BD69AE3
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438091798_1180371333322580_3869440255780885829_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xEMShP_qLFMAb55VT3m&_nc_ht=scontent-atl3-2.xx&oh=00_AfDWfJxHj0HZNwe-NDko3zvnYAmSYlIZukKiC1ty_egxkw&oe=6627908C
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100006b060000ca0c0000670e0000ce0f0000e51400005d1e00006c1f000033210000f622000029340000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................(k.......}....Q.M.......O.g.?F.d69...a...@L.X..P`.r..AD.Q.T.UA.D..%.k_"....4{_..&...(..8.C@.L... .TsD..jhe...LsWB.P.EB.;m.-X.h!..^....e{..1RX..OwFb.v..Pv..t..#..7.]0..U...Q.ku$....t.d.t.F..A.#...3...9.VP/.G.Tv...IU.c..5%.D...&..+..2..d....o:..6.W./>eG_B.....r.#\..Ry.e....>.....}..nEh2HE.nKZ.x.gY.x=...#.G"......:{.Z.z..N..:zr....b...b.....W....yoR...m.`.s..i\....X..4+k#<..c<;u..6.dF.".M...N\|v`L*ow..3..Y.l..C\..(].....Hb.b..[.s.[RFu..X5D.NY...B)...z.m>k...hr)..3...A..G.....d9..9.....m....nK.J:........hO..j..d...X.f.aU- .y...cX.E........Y.w.r...].`.?i.]4..V..c.I....6.OJ...-.?<.k.V

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1554
Entropy (8bit):	6.919955735083681
Encrypted:	false
SSDEEP:	24:gqS3+/fc1spSNFvTztUG8AzFEzmxlGpKG3PPuiN3I80AV3eRAGAtfFoBCZKEhZ:gfufiWSNFH/BEijGH3uG3BjeR8bb3
MD5:	FF4BCADF6B7659FB0F522FFFE068AEAC
SHA1:	52B092B6DB28163E7655EE9917BBF316C34A8EC1
SHA-256:	EC28F03032BF24069FE93AAE86575BC76253E1E489C80F9A9CC7AF3B9DDBDAAF
SHA-512:	47AE28A0BF932C56F8167B2939450B16780C30482E4CC5A6D018D847A8BF956740B72B9294ABFCD026A04398E4B9C2BCD1DB2562078706F80C3E708D331E6561
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/414867464_7046595375378763_4861839573446109840_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=QVssM7vGW2oAb4BrMfp&_nc_ht=scontent-atl3-2.xx&oh=00_AfDu-H0r-6CfzXEJPa3gbJwso6VAEOgSMr--wRf3P1KcMw&oe=66279958
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e801000079020000bc02000008030000a30300004704000080040000bd0400000305000012060000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................5y.^..)d.....;.a3...u.....y..N]x....:q.8.b.QV....di....R....!...8...$.........................1..!".#2A................l..B.iu.>..:....J..h.+NN...1.u..Gn..tX.ma.)..vHe)HV4...9.$...W....?.d#.c..jF.I....h...P._............................!1..Q........?.U...\|..........@.;=.E.n..........................!..1..2........?...$Q....m...9.=...O..?...).....................!..."12a ABQqr............?.!..f%...7P.G.....ahS...m4.R6p.a..9r...jU.......b+XPB... e.A...sp..a...K...F._....t....B.&....9Q.h....O...$....................!1AQ..q. a............?!Yy%tD..>.r....0G...@/...;Q..e..\|..e.#..cY..l.._.w.k.%..

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	dropped
Size (bytes):	19202
Entropy (8bit):	7.9566158438787795
Encrypted:	false
SSDEEP:	384:THA/OMpI5OQgt8JdMG80H1bAStmUua0pmmLFCQmRp6KOwVLnrSjZbLU:THA3pI5Ngt8JOS8imUuaxxVn+jNU
MD5:	31DF3DE9CF56444E8646FDC08951D78B
SHA1:	57BDB3850525114A8B946FCCCED11C04B33E5600
SHA-256:	005367FBEFA262FADA312667F3ED6642ADE53A9C0BD6DD9D480DD679446BD021
SHA-512:	B8986A2A643D0E14A299AF1BBA64CA0EA581378C710D3742BE573252373322475ABE80CCED41311DA65D9205DA843B1D00FC7807A9C19B887612A276DEEAA75D
Malicious:	false
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100004f060000890f0000711000007c110000c91c0000cb2c0000e02d0000282f0000a5300000024b0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................J.F..$..R.."/C.1E.F.......e8t..5}.iW.V.tBI..g...}....m,90..R`<.xC.Y..!. iW.g..VW....+Z.........y......H..eZBH(TlRS,.bhY..MA?...qm...z.mm\|.........)rr.t8Hz<..z..E...../.:.%.o:`..>...JZ%.....".3..B.<..g .f..j.9k....X ...P.~`.h5...)...(.@_EO+mVM..[.a._B.#...F.T..c.G..".........E..F..7+a....F...=Uk.....i.U.N..Z"f.....?4J...J....>.{...[\|i^V.U..z...N...1H.\...t.u.<ttOG..pk..n...I.>......hX.d.J.j].3.V?.xNf..%.....n....6.~......6...M...0..Z.l.....5]..cw.N.p..g...>;Q_..A..X.).;....Soko..+.8....:Ya..g.H_)b..E..)t._a.[,..}V......R..k!.Y......j..T.M.`.a`[..p.+*.=..PZ8F.%......_....

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20303)
Category:	downloaded
Size (bytes):	278291
Entropy (8bit):	5.408718211408449
Encrypted:	false
SSDEEP:	1536:fPHaQFjcTxlJ/yfJkmH9OD47Yzc4HEBuP2j5yeOkFCbPIO6I3uclVuYgyi3i8/KK:+sxahP2j5cnLoxeVGROa
MD5:	388490C03C7779E07DCB2580EEBFEEC2
SHA1:	ED0F2318C04315B34F5EFBE7FCBB80A09EC35C1A
SHA-256:	FD16F1E401275AA0ECE78BBF12E7095CF753E3D17E0327E9CB2F845D3ECAD449
SHA-512:	408A05FFA57A2B79228E7ED4B4CAF819157CFC041BBE4580768C68F85995FD179D372A18FC42DA9F557A372DE3D6F1B2ED7A40F83744C3C3B82BB1CA85E424EC
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/G3Nm7rYDpD0.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)\|\|d.set(e,new Map());var f=d.get(e);f.has(b)\|\|f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2362)
Category:	downloaded
Size (bytes):	220329
Entropy (8bit):	5.4443770705809635
Encrypted:	false
SSDEEP:	3072:4btvBkNQB0w3NSOm3Rt9whvd6Ptfk/7aNyHD9KhLh:A0a0wNmBwK67cyj4hLh
MD5:	4441DDED9C24D3329776DD10688D12A8
SHA1:	07FF661EB06DDD8858DA4B7AEE259597346D4881
SHA-256:	58D7D9D54FF03332C13E22B4471FA7FD3834E070934CB969AE3DEBCB05DEF767
SHA-512:	B4F891DB471F20287A21E6482B4E3C7A9D41422DCBF5F2DC08482C61FEC6D565279CA8DA3F7ABD944B5AD226C957CB10F4395760071B3A5DD030F635F3FA5C79
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eIcQTVVx-II.es5.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArQFmBg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFanHGHzypIF4CDunCjsiQhMN3SxQ/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x3a22c03e, 0x800b1c4, 0x3e079c46, 0x10814500, 0x6, 0x0, 0x201ad000, 0x199, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.. Names of events that are special to jsaction. These are not all. event types that are legal to use in either HTML or the addEvent(). API, but these are the ones that are treated specially. All other. DOM events can be used in either addEvent() or in the value of the. jsaction attribute. Beware of browser specific events or events. that don't bubble though: If they are not mentioned he

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	16053
Entropy (8bit):	7.961789404978669
Encrypted:	false
SSDEEP:	384:Ae6MV7ymZ8T3305Nh/2qbd1nB4hTQ5G8Dsc:d6MVZW7EpvnBnYWsc
MD5:	6E7B7BB3431FBE82C67C30C970AD1A28
SHA1:	FD0A46095ABDAE689503046471E81F1E43546E89
SHA-256:	B4D636038AD4405CC9B1795FBD493C40DBA2E1A39ED3348F70648141AEAE28F3
SHA-512:	107CA18D7146AD67E8E05415F355BC3434FB94D996CDF6082805103ED3CA7390C45F892C92083B984430E8601749DBC84FE24A461BBE43A51B2D9D930993F75D
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438193634_720475476662614_5584509116371930153_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-ExROFrTdmwAb5t0lBc&_nc_ht=scontent-atl3-2.xx&oh=00_AfDC4ORowz8xLhxbrweQGY8ubgpNS608cJQiE9HwjWJqyw&oe=66279C6D
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000990600005a0f0000b5100000c31200002c1b000093260000a527000063290000802b0000b53e0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..................................................................................[.A!..H.FFd..z.i..h.Q.)#.B.TL.K..K.{2......E..V.gY.Oo.o.........c....d....AYE..J..$....~m4t.[.......gG......=...s..z..w...J....{.'J.T..;x.......G.....E....._[.o?....>'...B.x1....6...5....v.d'nG";..(H.n.[D...z<...7..o?......?V.}...l.i..Xv..=...v..9........i../vZYY..}.?.7......gK...+l....h...8r$..1....y!.%_S.2.C,...&.]....j{.r...r.r...y....?...o7...9..7w$......v1.P.Q[.SA.`...U.o:gB...Zk.A..v.Z.uUO..}..gk...V.j.a"......Du&.....J..U..k..g..K4...R....#.!3..n....+kR+..W..3S..ZY.S.l.1.:t&.....\.F,.L.C.i.:..Ceh...U.>'%..Lu.:.^B...b.\.X.OJ...sx..#.&.;.6M4)t.t.O;".X....VbNU.c.

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59439)
Category:	downloaded
Size (bytes):	120679
Entropy (8bit):	5.166036752958725
Encrypted:	false
SSDEEP:	768:sLQpmW+m5yKTYGu9AoaI/mQVzm75W8Zcz834SS40FGXUQvqO4px17or3lQNO301J:TIWeIgiYGQLPE0/I9vCIqYKpd
MD5:	9FFB8DF2A2B9CBF0E7187C22F7720EFC
SHA1:	27479854A2B31AB7AE55F3584518634FB3425F60
SHA-256:	AE69656C229710FFE855E6B5FBAE617179785F20E6B8360F1640C807F80743AD
SHA-512:	6C8BA795574D31D61BD8E5996FB42877BB2CA4C0689696D6855447D1D428994D4D9428308BA56AA419670A74718BC848EBF2F01C858ADEA056C0FC08F4F4EC38
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3i7Vo4/y6/l/en_US/LznjGi-Mcyn.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometUFICommentListRendererForCommentsAPITahoe_renderer$normalization.graphql",["CometTextWithEntitiesRelay_textWithEntities$normalization.graphql"],(function(a,aa,b,c,d,e){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},b={alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},c={kind:"Variable",name:"location",variableName:"feedLocation"},d={kind:"Variable",name:"use_default_actor",variableName:"useDefaultActor"},e={alias:null,args:[c,d],kind:"ScalarField",name:"can_viewer_comment",storageKey:null},f=[d],g={kind:"TypeDiscriminator",abstractKey:"__isActor"},h={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null},i={kind:"Variable",name:"scale",variableName:"scale"},j=[{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null}],k={alias:"profile_picture_depth_0",args:[{kind:"Literal",name:"height",value:32},i,{kind:"Literal",name:"width",value:32}],concreteType:"Ima

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4516)
Category:	downloaded
Size (bytes):	511338
Entropy (8bit):	5.542758575805891
Encrypted:	false
SSDEEP:	6144:XA0FrXImUr8h8QvvW+VYoowgpBDdi2d6uCqcOWVoV:UQvvW+VYoowgYRyp
MD5:	B2AC2F5723CA14C05E990306852713E5
SHA1:	F8D7011467F193D21AE43BE0FE95940501F2BB0F
SHA-256:	65753DDF4D0D0E5F031596EAE408950FFC5164C6493D804D1397FA05BF445600
SHA-512:	CDC184F2330FCF24AB5C6A773D98AEE75DA210557F25481752CE11C4A54426F5C6A882BB8AC9CDDE6925BE2A075FF7E303003DB150AE50BD3BC70C81518DFE3F
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3iMBH4/ym/l/en_US/PM0yz8J0_9eatA4AbcUXJ_xGj4GgHf6uoyMXsyMcajeZkbHSqEKHvKE5vIR6Z6_fPD4wyD5Ym16tXudcxB4NWZK-0RNSBe8qSPG4UpY82FpGVUugonw1necxJMJfxNSBC0jRQvPTG6MYkFOrTRdkwmU8Y3mM84SfiWlvqtZjCyJ63My3zlOMrO0CLM5TVwEj1ba-rOSQb0hClwF360PJEynPfrjI.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometIXTFacebookContentTriggerRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7310683549025256"}),null);.__d("CometIXTFacebookContentTriggerRootQuery$Parameters",["CometIXTFacebookContentTriggerRootQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometIXTFacebookContentTriggerRootQuery_facebookRelayOperation"),metadata:{},name:"CometIXTFacebookContentTriggerRootQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometIXTFacebookContentTriggerEntryPoint.entrypoint",["CometIXTFacebookContentTriggerRootQuery$Parameters","JSResourceForInteraction","WebPixelRatio","react","uuidv4"],(function(a,b,c,d,e,f,g){"use strict";var h;h\|\|c("react");a={getPreloadProps:function(a){return{queries:{reference:{parameters:c("CometIXTFacebookContentTriggerRootQuery$Parameters"),variables:{input:babelHelpers["extends"]({},a,{nt_context:null,trigger_session_id:c("uuidv4")()}),scal

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	2080
Entropy (8bit):	6.748131750674164
Encrypted:	false
SSDEEP:	48:7dl/ulEROUIiWp5jf8gNe4ZZWF1VqDrYx5H5lSNNh:Rl/PwpJtWFPqwx5H58T
MD5:	382C9BF0B8D6E1C8871D2E98CE92C065
SHA1:	9ED65BB897758B639608806A3666849268BD62BA
SHA-256:	E9DE79388ED47AD95D4439983573219C54D215B96BE5BAAA75745440969FAE48
SHA-512:	6ED26591476B92E239B8694EB3E30B0E9ACA8EE580729C25ED29168365726C6E87DDDC9C9B4DE2FB073C32E7B815AF68318300EE6623FEB58E5D75F130C01840
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/294724701_110489671750480_988274315942354852_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=CsDREyxMCqwAb6Zm1uF&_nc_ht=scontent-atl3-2.xx&oh=00_AfDUhmgSNym9P3hgORApjgvt5uZCr5vKPXDneN84pBy-xQ&oe=662798CE
Preview:	......JFIF..............ICC_PROFILE.......lcms....mntrRGB XYZ ............acspMSFT....sawsctrl.......................-hand.......<.Q.E(z..................................desc.......^cprt........wtpt........rXYZ...,....gXYZ...@....bXYZ...T....rTRC...h...`gTRC...h...`bTRC...h...`desc........uP3.............text....CC0.XYZ .......Q........XYZ ..........=.....XYZ ......J....7....XYZ ......(8.......curv..........\|.....u.....N.....b.......j.. C$.)j.~3.9.?.FWM6Tv\.d.l.uV~..,.6..........e.w........Photoshop 3.0.8BIM.......h..(.bFBMD0a000a48030000b60300004b0400008c040000d9040000a30500004a06000084060000c60600001607000020080000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................\.D..;:.V..j....[.....a...e.c\|&.b.:adqQ.2+...&........."............................."02............c..*.v.v.@..F1.C.B#'....fL.-......

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	70232
Entropy (8bit):	7.9666191782494025
Encrypted:	false
SSDEEP:	1536:rfW5k66GHPwsUeee89Fw46cGfFqbyPrxYYSq/GxQGfIQvTBZJ:K5AePCFwzv9YKVY3xQuIQ5
MD5:	9A7091A492415AF553555400B202DCD2
SHA1:	C05C31143809A1D8B1E4E55E8797834A1B7D02F2
SHA-256:	950622954AB94A7521295C81A81856572C50C91F5B8B288730B4A26CBD81F201
SHA-512:	D4685E0F4BE07779D6696C5C63B103C05E41A7E6CEE2B77C59348F4DDF21BF40408916878CBF10F14AF5561C88A390D14674E2F559263E080F5BDC333A0D0F91
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/437105006_1102269597670542_4976784059220029358_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Q8Y5BK9l_XIAb4Cr9pt&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-I28Z40HUGosKs6OU1VaGQD7MbfRLpHLFa4by2T23cA&oe=6627854D
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e0100001f1900004b430000fb4300006e440000355d00008c9f0000c3a50000d8a70000f2a9000058120100....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................&.A .W....\.Bd#...4^S]6..\........`C 2.BT....%]T..U.BK.K.U..........\.J.....iV.....z(K."..............}".R`.in].R.]..W....@.K..QWp.TT.T..tI!TTH.j.$.4(.Y...}..9.H<`.......v6..R.0h..D...AA......$.E..eh..i,...eU.!.$YV%.....IE..E..-u.......:......jf".R.A....T...PR.r..\.$.WR......%"....v..P.P`P V.2..CA....6.Ly'SI&.n..NEN... 3=..YWT..\.\.[...D..I.T..B.H...\....Xt"2.+".(.......l..&0..Z9.3.R....~...i.....\_a%.U].W..EK.K..$.h.4b.$\(....I".r.R....U\.]..T.T.T.T...N...>......~,.....$..kW....Y.Wv@G-F,U..M..SL...XWT.2 .\..eB..!..V."\..W.K].HJ.$..BqW.g[]^=2....o.$.r...'{..hD......z.......T...

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
Category:	downloaded
Size (bytes):	14752
Entropy (8bit):	7.95133599564624
Encrypted:	false
SSDEEP:	384:lWMKufemn5FWcuyAP3br8ZY2yFND721IR6PNle2O:wMKufem5X3m3P8ZUnD721I6sT
MD5:	DD98B71294FA3DB08CD02F7A5836DB59
SHA1:	D950D4BA9C8EF107939BCA2A39850B53FB7B6AFA
SHA-256:	1D7B13130FB7979596CC191CADEB7D921387752BC45384599B772B862A7B0F63
SHA-512:	33031C27BF47612EEA6E872D43503CBD1B7065A102450C6F2BA6D11A587BBB32CB4952210429C95ECA77BECE6E00CB4E2FBDD7277D8CC785D3211EB0FB928D63
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/427423164_1136863804107170_2890424799444787669_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=B9Pc79yiemQAb6zBz4r&_nc_ht=scontent-atl3-2.xx&oh=00_AfCiWqDXjAXfVtRjlfSGhw15nEOc_vXUOs2xVTfr50viLg&oe=6627A6F7
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000058060000240e00007f0f0000d7100000af1700007c220000962300004f25000010270000a0390000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................NG..p.....I.........V.8...\|....&..\R.(.......P.G..g..>.z5..j..(Mo^XVa......T.E...+:...K....@..........5.......<...3.V.@@..p..3..'2.)P/:....8/:...i./..B.:..$......(.c.$s^,.=.4G 5....TPUE..T....fW...P.q....G3R8@....6...j.w.P.r......m:..jT...Z..N.0.K.e.F.\|n....c5.1;..."I.......{$..kE....D..j......7.+..y....>L?.f...A..Md(...3...[.8y...A&.aF..M.(..=..?8.Z.Zi..r..C5T]e....c.e..%F.O8D...)..M.N4.gX..1.9*.h.`...m......"USS}..a....J... R.iA...E!...W3>.....B.r$.e6Yt.j.....[B$.6.s..Q......B.0....).f.F.t..7.Z.)..:{.{ga.O."h./.7.1.yGr.8rJ`]\|SN<..XE..C..@...T.K!..Wr(^.w...V`g.e-.u.!.EQ.<D..N......P..M

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	downloaded
Size (bytes):	3141
Entropy (8bit):	5.381866681101836
Encrypted:	false
SSDEEP:	48:o7VSeBvFfGiW0rq8sdQfydNQ8jsN4FwCYYnyTM4WCOcUkp+4pP8mLjujrFQp4rw:oA4zWynYzdOqbnyT6COm+4V8zO8w
MD5:	18637A7357C35DBB1A9E667CFCF52ED0
SHA1:	0FD3CA9D31EA8BDBD658236A8D70421F7B22F30D
SHA-256:	25815BE99894ED26F3B92AE4A2C542F5AE523C44C7F83CCC90E63FCE939AC50A
SHA-512:	BDF27DB349AEBA777DEC00EC6F505A01A5926837D9DB95BC1D3A204DC53A0AA7760DAFB8834A025B5333468B635ED875CBFFC63F771AD3682108EB711C821073
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.wNZusAFj0iM.es5.O/ck=boq-identity.AccountsSignInUi.abUGhSwZr5E.L.B1.O/am=PsAiOnEsAGLEeeADFAVCBgAAAAAAAAAArAFmBg/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EN3i8d,Fndnac,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,YHI3We,YTxL4,YgOFye,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,eVCnO,f8Gu1e,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,mvkUhe,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,xiZRqc,yRXbo,ywOR5c,zbML3c,ziZ8Mc,zr1jrb,zu7j8,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEIfS_tU4HnpC92_uV8EI2HSJXPxA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:NoODMc;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Pv=function(a){_.I.call(this,a.Ha)};_.A(Pv,_.I);Pv.Na=_.I.Na;Pv.Ba=_.I.Ba;Pv.prototype.gN=function(a){return _.ke(this,{Wa:{mO:_.wj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.rh(function(e){window._wjdc=function(f){d(f);e(wEa(f,b,a))}}):wEa(c,b,a)})};var wEa=function(a,b,c){return(a=a&&a[c])?a:b.Wa.mO.gN(c)};.Pv.prototype.aa=function(a,b){var c=_.Zsa(b).yi;if(c.startsWith("$")){var d=_.Ul.get(a);_.Np[b]&&(d\|\|(d={},_.Ul.set(a,d)),d[c]=_.Np[b],delete _.Np[b],_.Op--);if(d)if(a=d[c])b=_.je(a);else throw Error("Ob`"+b);else b=null}else b=null;return b};_.Eq(_.Oda,Pv);._.l();._.k("SNUn3");._.vEa=new _.xe(_.rf);._.l();._.k("RMhBfe");.var xEa=function(a,b){a=_.qra(a,b);return 0==a.length?null:a[0].ub},yEa=function(){return Object.values(_.Lo).reduce(function(a,b){return a+Object.keys(b).length},0)},zEa=function(){return Object.entries(_

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19338)
Category:	downloaded
Size (bytes):	215291
Entropy (8bit):	5.642709802582249
Encrypted:	false
SSDEEP:	3072:cHMPGyz0qZ5DH+K/HkVvIF26ImqCJnWVcf6kkyh0NzC:KHqZ5rHkVQ8Xel
MD5:	F0FDFDCEAB1A209D578C967F6F4A4A9F
SHA1:	195D6E84FB9486C843C8190C8951B7D593C16940
SHA-256:	F8710EA2607FE30366B5EA4945145334B42DC8E5B0E65699CD3285CC20750192
SHA-512:	ADF0D41BA94D232DFD22D5C71E983D6FBF5DB27A46BF7CEA3A88DD209F753EA773128EE72A89911522C6813ACFC26F8FB6E4B21BE0797149F5D6D523AF50B9CB
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3ifhN4/yX/l/en_US/nChwAUT1aUgDYvatkvPhoORf7s0WJvHMPn1wRO-dUcIoL9XF0wO0ej9ML-m_DiQrfXi0ByZrEbi6c-BC0lRf3kmQVAblIutlJuDu8FjJ2mAf5cwjSvgZCKCmXkp8GwrOMn7m1Rdzuzi16ygkVEIahZX1XqpI1Q50zl6ZBgWvsJpQFrYrGc1wa-Oq19cr_l1DuzAtWVDh4cn1CMxub3y91qmloYqXsrAa0b9bMzu_eJMlvvhSHqOL8xCqhxFHLp55HfXW__mMgFRlCsGN0FHzi95_wmB-51YxoStyBz2gE2pEQn4HVER6vHpPn3-WFWVy-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("QuickLogActionType",[],(function(a,b,c,d,e,f){a=Object.freeze({START:1,SUCCESS:2,FAIL:3,CANCEL:4,DRAW_COMPLETE:5,ON_RESUME:6,ACTIVITY_CREATED:7,CONSISTENCY_MODEL_UPDATER:8,SEND_MESSAGE:9,SUCCESS_COLD:10,SUCCESS_WARM:11,UI_IDLE:12,PHASE_ONE:13,PHASE_TWO:14,DEQUEUE:15,NETWORK_COMPLETE:16,MEMORY_CACHE_VISIT:17,DISK_CACHE_VISIT:18,CONSISTENCY_UPDATE:19,RETURN_TO_CALLER:20,PHOTO_UPLOAD_COMPLETE:21,USER_NAVIGATION_CANCELLATION:22,DB_FETCH:23,SERVER_FETCH:24,SUCCESS_CACHE:25,SUCCESS_DB:26,SUCCESS_NETWORK:27,SUCCESS_LOCAL_UNSPECIFIED:28,CACHE_UPDATED:29,DB_UPDATED:30,DATA_RECEIVED:31,DRAW_VIEW:32,DATA_EMPTY:33,CACHE_FETCH:34,PREPARE_BEGIN:35,PREPARE_END:36,ASYNC_BEGIN:37,ASYNC_END:38,REMOVE_BEGIN:39,REMOVE_END:40,BROADCAST_DONE:41,ON_RESUME_END:42,ON_ATTACH_END:43,ON_FRAGMENT_CREATE_END:44,ON_CREATE_VIEW_END:45,ON_ACTIVITY_CREATED_END:46,ON_START_END:47,QUEUED:48,IN_PROGRESS:49,INIT:50,UNKNOWN:51,RETRY_AFTER_FAILURE:52,RETRY_AFTER_RECONNECT:53,QUEUEING_BEGIN:54,QUEUEING

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	65489
Entropy (8bit):	7.982718871834297
Encrypted:	false
SSDEEP:	1536:+Q5NdaQtWNKp6HDDTzbYUMeyuaKxtUrjtvI/I9rKJk/9ENf:dfSNq67YHeTaRN3ES8f
MD5:	20540C6290859E2ABC1CDBCFC2895CAD
SHA1:	2B9ED0ABE813C6CB332AB672EDA72CC58D4EF850
SHA-256:	3D200CF6CB9434137ED244C2F347BF920E8FA23A88DEEBB7D76433695A311DB1
SHA-512:	3BF5A9B001A3804EE6E9334EF7313A4BC5D82F62B18A674E4D1F6A63349078927458C773B5481B0F5A0CC627CFB5BDC4D7025DE77D40011914B5BD28A73AFF8A
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t51.29350-10/438882269_729999509341792_5681810228876178213_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rx4uzBlOIl8Ab6ytXk7&_nc_ht=scontent-atl3-2.xx&oh=00_AfAvO6SJOH5Y80LRz1OMs2wXXZ5sp1gyOizIOTgXp7L6GA&oe=66279CD1
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000a31d00008a3e0000ee42000041460000726100004b93000077990000dba000006fa70000d1ff0000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."....................................................................................X.I...T.....J...L.F41.......l.(...".1O.a7%4,.tts.....S_..5..t.+.X%z ...%.M..!....a..`......u..J.P....z...W......b.40.q3..8p..WT...P,.C..#@.........^.>}]...tp.g..}&w.uh..&..21.X.k.KH.+-)".Ptd.!.X1...q......3.%..%.lbe..G.Z..C.%..Kv>..@.,V]...".W..6.q...y...xp... ..=..G.vS..e-]....S....eC..!...KR.0..."[[1...9 .,..j.Re-.g.,e..P2....Pt:....J[[4...``../c:mj.L.7E.D..'.......~......TW....y..4J.Q4...F..P.#X.u-.,.-...bZ...<.....Cb.8..F.tP..._`.L..X...X.sl..k..UW.........d...9T_.....@b7w<..v*.RF...`[...Fa...)uj...Q...C6}y.o.^..h.N-z).h.%V....^.Q..g.@....YH.c...;,F...;.EE

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	40329
Entropy (8bit):	7.936810122078746
Encrypted:	false
SSDEEP:	768:o2ynYR/ofQmkjWuwZhNXnIhll+K/JydpdnezsAaf2UeDGWRJLya3y:NPm/uw7NX4TnBydpde7e2UmJJ8
MD5:	D757EB36CFFE1D41B52DD2B6866E907D
SHA1:	E3F72BA8E81B7E84FFEBFA5C0B56A1C462C8C92D
SHA-256:	190139BE8688156BAD59BC43EDB7879DAF7A78310C4F6B40D83AA5D679AD8304
SHA-512:	D75DB33EC389CA4BDB4B0265FCB12A6F18C79B667C796827CE1FCECD970F0F0203D57252C265DCD3C030C3B799F2260A6FEAB350D4C106E369CED7225B92D6FD
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/438193268_922912702947462_7506581556452730663_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=F1f1WyXRCfUAb5H7pg3&_nc_ht=scontent-atl3-2.xx&oh=00_AfDB1zgmFI527f9DlANisuRmydguLRC3xydmlEEaw4wURA&oe=6627B6C7
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a710100009a1300006b2900005a2b0000e32d0000263e00002f5d00006d6300002766000069690000899d0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................P........................................................................................................................................................................................................................................................................................................................................................................................-..K............?!.a>..l}].?.=......\|.A./g.=....L..yy./.......{...g.......u...1..G..t.?/......=W..g....~.S.v\|.......yu.f...`............c...\>.\|\|.....c..{..8}......}_.<..\|o.......x..I.y._\>...........C.z.F>;.........=.P......>...>.

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10325)
Category:	downloaded
Size (bytes):	48634
Entropy (8bit):	5.300241536153402
Encrypted:	false
SSDEEP:	768:zy+gtWrLopo36tlMxz/mEd+aOMjswSo3qi1ataFhhuYAAvzsd0ir53juPFvUDoX6:zyhtCo636tcd+aOMjswSo3XItkuSfFLq
MD5:	03C09C14E56822E4C54D1C4E717D1110
SHA1:	632F0F38E6387AEDCDA97916B0990D751B0FAC89
SHA-256:	3C681F20248108456FABE2F1D41A0ABB84CB990D8E60B9B8DC756AF93FFDA61F
SHA-512:	84E440374CA3FEC50355A124FC14322F4023E5017DB0F772A15EBF9512AE7BF5CC77765239F5D6831B043C35609EBAC70D21CEA6899AA0688F4F3C761C57CA51
Malicious:	false
URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yA/r/OMXgFqU76kP.js?_nc_x=Ij3Wp8lg5Kz
Preview:	;/FB_PKG_DELIM/..__d("CometObjectFitContainer.react",["cr:964538","isStringNullOrEmpty","react","stylex","unrecoverableViolation"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i\|\|d("react");b=j.forwardRef(a);var k={inner:{height:"x5yr21d",position:"x1n2onr6",width:"xh8yej3",$$css:!0},innerWithAspectRatio:{bottom:"x1ey2m1c",boxSizing:"x9f619",end:"xds687c",left:null,right:null,position:"x10l6tqk",start:"x17qophe",top:"x13vifvy",$$css:!0},outer:{height:"x5yr21d",position:"x1n2onr6",width:"xh8yej3",$$css:!0},outerWithAspectRatio:{height:"xt7dq6l",$$css:!0}};function l(a){var b=a.children,d=a.debugRole;d=a.innerInlineStyle;var e=a.innerXStyle,f=a.outerInlineStyle,g=a.outerRef,i=a.outerXStyle;a=a.testid;var l=c("isStringNullOrEmpty")(a)?void 0:a+"-outer";l=c("isStringNullOrEmpty")(a)?void 0:a+"-inner";return j.jsx("div",babelHelpers["extends"]({},{},{className:(h\|\|(h=c("stylex")))(k.outer,i),"data-testid":void 0,ref:g,style:f,children:j.jsx("div",babelHelpers["extends"]({},{},{classNam

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x370, components 3
Category:	downloaded
Size (bytes):	18541
Entropy (8bit):	7.941642645642244
Encrypted:	false
SSDEEP:	384:+wo6YgtTkdzo2yrVH9N+xGsK4YLx837+rKBSALMQ:46FSoTVdN+u4aIkK1t
MD5:	7AF8389EBFA7BDA6E1A4F826527764AC
SHA1:	BFE9D87C68AEB2638DE26051BC8765E12516DA72
SHA-256:	B5275CD6D2D8A324E78324CCB86491B91617CB645BE1283A021374509AC5A64B
SHA-512:	811D46DBAB4985ABF74F81E690DC8B7265AE26674CEB92A55EA174B7AF1DB1F75B48DC6D2467611A3CF4A10752E89BB46CF15975E0B699E77980219D8914C124
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/427755631_1521380321923283_7278901302032905672_n.jpg?stp=dst-jpg_p296x100&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xJQH45NEw5sAb6WK0Xa&_nc_ht=scontent-atl3-2.xx&oh=00_AfDz4tA7Z9g7MaNQs3vhOnXqFfZweGTXP76ZT7aDiBvboA&oe=6627A761
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7101000003080000ee1200005f1400005c15000064220000b82f00003e310000a4320000db3300006d480000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......r.(.."................................................................................@..........................Q..........................F].W...d.O...So.J..~..x......Z#..\|.......V.2.~8.X.yx....d..~" .....{.P...4y../....p..S...z.......S.5>.@Zm9hl1t.SQ....=.73@.......t0.n.....1g:S..7.f.[,.Zn.LU5:.P7...6f.Fl.{A..1.....Y.y.&...........h.LUM..B.t.>... C.....8CI.....CH../E....mt.".C\.I.via,...@............\|......H.U}i..k.&Q.vj.A4...............QM.k..]...5R....e.M...6.z........D.^3.........G^..w.l:$.w.d?R<..@......(.%..,....72.$Vb4.R4.R0....T".e.A0.A$Azy..\.q........W.W..JM..N......V.WL..&...zW..Z.+.i.:...F1.%.b3..8Cu..I.l1.....q6...L........g....7.....:...N...if..L.l...z.zv

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
Category:	downloaded
Size (bytes):	54252
Entropy (8bit):	7.978625718488979
Encrypted:	false
SSDEEP:	768:rqGU/CM2VuwTUYlLqyDL6iZR110sTcUhCUE120w+5ds+Fe7s7gXpGbtG1D4:rSa1YalhDL3BY8CUEE0nxFeg/btY0
MD5:	DFD58CA8892F923373F24EFB868E1CEF
SHA1:	2A5FF788B78845E9BF5755F741ABC74A65C47F8C
SHA-256:	29D6791B32719037072BF93B68E05E4792297C2A50A2689432D9BA0183E33951
SHA-512:	7560C5A130791ACD2E02830CC6A1D59CB936B984E0E58D45D5BF970004B8EF71E4ABFF84A1D05E23F635BAAA8FE510FA4B93E756872CDA771C6118143BA05B23
Malicious:	false
URL:	https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/434846145_750354690635123_5825280892337708034_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=VY_PguNQYqkAb4vYZ4J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAA-dZ2FVoVBFW58UvtffQQCH__zs3TaqlqaDmOBrIH9A&oe=66278A45
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000b7190000ff340000713600009e380000ec480000dc71000008780000527b0000fb7e0000ecd30000....C.....................................%...#... , #&'))..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................H..j... r.. $..i.$R.$.B.d..H....H.K..HV.h......~mx..mj.f.....a.=..z.$.c..h/.l....u.=.z...._.+-..C$...`4...C...a. e P2.B. +qV.....@.0.s.j._H...v.V.;+u..9..ggX....t~....t.;.vQh..../....>..K..2.AB$.l.t..."(d.2S.`...hI.C.I.`.IH!.v..C..Qu..h....r.+....6.S..g&......1~..meu:.N...F.1....Z.\|....:....C...Q.J.....b1 !..H.`..Hd....2E0H.IbX.UeE.g.X.5F=.!...x[...k.cY..7...k./g...f.Y.^..znZ....y\..DM.`..Y.c.@......h..b1.\..Wb0t$E.Y...B.>.".v.W..Q.R.D..........q._....s.\|.....].g{....=.{..>..o..:s..rH....0.......d!..WGc........3F..j.. .2.. ....Sekm.<h......,..uj......0H+..o>..uy.........q{.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.582099133763065
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HxesZl7bIx.exe
File size:	918'528 bytes
MD5:	054664da74deb75df32022e644c197d0
SHA1:	398448ae19a22710cc848ff4c90b4a3599db5da1
SHA256:	124edb48ce763a1b36c8e8736a865190c0e4928274acb617ce55e31e8c27c83f
SHA512:	6b80ba387f0568d244ecd6ecc17414f878b60cff3da5959486f0d43e9a339aab7031ba61b3975abdf1f0dce89d59f7139cfba5bb37cc5c36edd6b5d126454536
SSDEEP:	12288:oqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaLTU:oqDEvCTbMWu7rQYlBQcBiT6rprG8aPU
TLSH:	DA159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x661B3BEC [Sun Apr 14 02:14:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F1F94EEE703h
jmp 00007F1F94EEE00Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F1F94EEE1EDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F1F94EEE1BAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F1F94EF0DADh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F1F94EF0DF8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F1F94EF0DE1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x9888	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x9888	0x9a00	92dd0821987ee8781d8818c136d1675c	False	0.2983969155844156	data	5.268842335732648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0xb50	data			1.0037983425414365
RT_GROUP_ICON	0xdd308	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd380	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd394	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd3a8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd3bc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd498	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 03:40:30.093209982 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 19, 2024 03:40:36.525805950 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.525892019 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.525981903 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.527834892 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.527853966 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.527920008 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.528594971 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.528633118 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.529808998 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.529834986 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.758867025 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.759103060 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.759432077 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.759466887 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.759639978 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.759674072 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.760469913 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.760536909 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.761759996 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.761796951 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.761831045 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.761884928 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.764276981 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.764368057 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.767123938 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.767222881 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.768032074 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.768049002 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:36.768850088 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.768867970 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.815886021 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:36.815897942 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.994126081 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.994174004 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.994227886 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.994260073 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.994415998 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:36.994487047 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.996108055 CEST	49735	443	192.168.2.4	108.177.122.93
Apr 19, 2024 03:40:36.996120930 CEST	443	49735	108.177.122.93	192.168.2.4
Apr 19, 2024 03:40:37.006006002 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.006140947 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.006247997 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.006293058 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.006314993 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.006465912 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.006520033 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.006536007 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.006586075 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.016179085 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.016244888 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.016251087 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.016278028 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.016694069 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.026650906 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.026726007 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.109853983 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.109899998 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.109930038 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.109965086 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.110019922 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.113765001 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.113821030 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.113861084 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.113877058 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.113969088 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.121887922 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.121979952 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.129924059 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.129962921 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.129986048 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.130004883 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.130278111 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.136400938 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.136447906 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.136457920 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.136476994 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.136801004 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.142564058 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.142616987 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.148037910 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.148076057 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.148094893 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.148122072 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.148467064 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.153234959 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.153295994 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.153302908 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.153338909 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.153392076 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.158430099 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.158484936 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.163712978 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.163758993 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.163779020 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.163794994 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.163846970 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.214544058 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.214612961 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.215692043 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.215760946 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.220472097 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.220530987 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.222791910 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.222858906 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.222881079 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.222932100 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.227292061 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.227353096 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.227374077 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.227428913 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.231492043 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.231549025 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.235528946 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.235564947 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.235593081 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.235605955 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.235707998 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.239483118 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.239517927 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.239547968 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.239559889 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.239622116 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.243196964 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.243251085 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.246932983 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.246987104 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.246995926 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.247011900 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.247082949 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.250449896 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.250507116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.250531912 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.250544071 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.250598907 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.253905058 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.253964901 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.257148027 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.257194996 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.257225037 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.257239103 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.258846045 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.260484934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.260544062 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.260569096 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.260626078 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.263477087 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.263533115 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.263545036 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.266536951 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.266591072 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.266603947 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.268045902 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.268140078 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.268151999 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.270935059 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.270970106 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.270987034 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.270999908 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.271374941 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.273719072 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.273775101 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.273802996 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.273861885 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.276318073 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.276376963 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.278933048 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.278995037 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.279011965 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.279064894 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.319966078 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.320049047 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.320072889 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.320120096 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.320187092 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.320949078 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.321016073 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.323394060 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.323426008 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.323478937 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.323818922 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.323833942 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.324384928 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.324454069 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.324469090 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.324522972 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.325814962 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.325881958 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.325901985 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.325956106 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.328213930 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.328300953 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.330488920 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.330554962 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.330612898 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.330666065 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.332765102 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.332823992 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.332849026 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.332907915 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.336090088 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.336153984 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.336189032 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.336241007 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.338252068 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.338313103 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.338337898 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.338392973 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.340365887 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.340425014 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.343173027 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.343250036 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.343255997 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.343274117 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.343333960 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.345935106 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.346002102 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.346016884 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.346074104 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.346451998 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.346513987 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.348414898 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.348490953 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.348496914 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.348519087 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.348575115 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.350320101 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.350383997 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.350404024 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.350461006 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.352272987 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.352338076 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.352356911 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.352415085 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.354233027 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.354299068 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.356015921 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.356081009 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.356117010 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.356137037 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.356355906 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.357731104 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.357798100 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.357814074 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.357883930 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.359498024 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.359587908 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.361274958 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.361408949 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.361473083 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.361500025 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.362838984 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.362907887 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.362921000 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.362942934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.362998009 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.363008976 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.364655972 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.364712954 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.364723921 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.364743948 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.364805937 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.364818096 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.366189957 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.366255999 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.366266966 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.367875099 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.367938995 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.367950916 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.368649960 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.368714094 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.368726015 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.368745089 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.368957043 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.368968010 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.370109081 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.370187044 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.370198965 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.371632099 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.371696949 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.371709108 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.371746063 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.372083902 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.372095108 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.373264074 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.373318911 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.373330116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.373351097 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.373409033 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.373420000 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.374706984 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.374773979 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.374785900 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.376236916 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.376450062 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.376461983 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.377177000 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.377247095 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.377259016 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.377279043 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.377332926 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.377343893 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.378741026 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.378823042 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.378828049 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.378851891 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.378928900 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.380240917 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.380311012 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.381433964 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.381511927 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.381514072 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.381535053 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.381599903 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.382958889 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.383021116 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.383074999 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.383131981 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.384161949 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.384222984 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.385534048 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.385593891 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.385615110 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.385670900 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.386912107 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.386974096 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.386992931 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.387048960 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.423736095 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.423829079 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.424840927 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.424916029 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.424926043 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.424947977 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.425004005 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.425915003 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.425998926 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.426017046 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.426065922 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.427141905 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.427202940 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.428426027 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.428508997 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.428510904 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.428548098 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.429199934 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.429780006 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.429841042 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.429860115 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.429914951 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.431032896 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.431092978 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.432339907 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.432399035 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.432421923 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.432482004 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.433707952 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.433788061 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.433906078 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.433926105 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.434166908 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.434246063 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.434319019 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.434418917 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.434479952 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.434523106 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.434537888 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.434591055 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.434699059 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.434979916 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.435043097 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.435058117 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.435079098 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.435136080 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.435148001 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.435307026 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.435337067 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.435502052 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.435532093 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.435900927 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.435937881 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.436266899 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.436539888 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.436554909 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.437474012 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.437536955 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.437549114 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.437572002 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.437628031 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.437639952 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.438713074 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.438802004 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.438802004 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.438827991 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.438883066 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.439836025 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.439905882 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.440906048 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.440972090 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.441001892 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.441061020 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.442162991 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.442239046 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.442248106 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.442284107 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.442852974 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.443205118 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.443268061 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.444286108 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.444355965 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.444874048 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.444928885 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.444931030 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.444948912 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.445163012 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.446023941 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.446100950 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.446101904 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.446120977 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.446839094 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.447181940 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.447249889 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.448332071 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.448401928 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.448445082 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.448499918 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.449136019 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.449189901 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.449218988 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.449451923 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.450340986 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.450409889 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.452143908 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.452224970 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.452225924 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.452246904 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.452347994 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.452687979 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.452744007 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.452769995 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.452830076 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.453483105 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.453542948 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.454499960 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.454571962 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.454598904 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.454617977 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.454771042 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.455456972 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.455521107 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.455537081 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.455591917 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.456415892 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.456480026 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.457372904 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.457437038 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.457488060 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.457536936 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.458615065 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.458673954 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.458729982 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.458784103 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.459283113 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.459350109 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.460117102 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.460184097 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.460203886 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.460258007 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.461025953 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.461075068 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.461110115 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.461913109 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.461972952 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.461987019 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.462054968 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.462167978 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.462178946 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.462920904 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.462977886 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.462990046 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.463809967 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.463865042 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.463876009 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.463931084 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.464215040 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.464226007 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.464734077 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.464788914 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.464799881 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.464821100 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.465147972 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.465158939 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.465456963 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.465532064 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.465543985 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.466396093 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.466455936 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.466466904 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.466486931 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.466553926 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.466564894 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.467245102 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.467305899 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.467317104 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.467336893 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.467396975 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.467408895 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.468065023 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.468139887 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.468152046 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.468943119 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.469016075 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.469024897 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.469054937 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.469120026 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.469909906 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.469969034 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.469985008 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.470041037 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.470685005 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.470742941 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.471656084 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.471719027 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.471738100 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.471790075 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.472343922 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.472420931 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.472423077 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.472444057 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.472493887 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.473263979 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.473335981 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.473968029 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.474030972 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.474049091 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.474097013 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.474884033 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.474939108 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.474966049 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.475016117 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.475617886 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.475673914 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.476484060 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.476550102 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.476566076 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.476613998 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.477231979 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.477279902 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.477313042 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.477361917 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.478081942 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.478141069 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.478883028 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.478945971 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.478965044 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.479020119 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.479700089 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.479768991 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.479780912 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.479832888 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.480519056 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.480578899 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.481183052 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.481236935 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.481300116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.481353045 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.482095003 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.482156038 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.482176065 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.482225895 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.482865095 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.482918978 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.482948065 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.483679056 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.483747005 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.483760118 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.484528065 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.484589100 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.484601021 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.484622002 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.484677076 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.484688044 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.485039949 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.485095024 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.485105991 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.485126019 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.485177040 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.485188961 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.485676050 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.485733986 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.485745907 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.486552000 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.486668110 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.486732006 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.486743927 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.486812115 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.487293959 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.487370968 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.487376928 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.487396955 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.487447023 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.488042116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.488137007 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.488591909 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.488662958 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.488672972 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.488692999 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.488743067 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.489411116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.489470959 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.489494085 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.489542961 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.489969015 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.490026951 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.490679979 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.490736961 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.490756035 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.490819931 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.491635084 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.491693020 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.491715908 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.491770029 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.492158890 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.492222071 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.492240906 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.492296934 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.492707014 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.492767096 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.493474007 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.493551016 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.493557930 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.493577003 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.493627071 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.494117975 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.494180918 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.494234085 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.494288921 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.494838953 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.494908094 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.527803898 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.527863979 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.527893066 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.527952909 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.528074026 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.528131962 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.528158903 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.528249979 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.528883934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.528959990 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.529314041 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.529382944 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.529392958 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.529416084 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.529465914 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.530132055 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.530204058 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.530252934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.530313969 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.531116009 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.531188011 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.531207085 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.531256914 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.531325102 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.531379938 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.531980991 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.532040119 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.532095909 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.532169104 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.532888889 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.532944918 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.533023119 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.533142090 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.533246994 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.533260107 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.533834934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.533886909 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.533898115 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.533925056 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.534039974 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.534104109 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.534116983 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.534168005 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.534745932 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.534807920 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.535363913 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.535434961 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.535487890 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.535541058 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.535567045 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.535619974 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.536418915 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.536489010 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.536503077 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.536569118 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.537744045 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.537798882 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.537866116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.537919044 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.537949085 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.537997007 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.538172960 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.538222075 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.538256884 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.538305998 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.539071083 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.539135933 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.539158106 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.539203882 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.539243937 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.539292097 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.540405035 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.540466070 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.540525913 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.540576935 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.541487932 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.541543961 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.541639090 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.541695118 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.541718960 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.541734934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.541924000 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.541982889 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.542038918 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.542074919 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.542093039 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.542104006 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.542134047 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.542186975 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.542237997 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.542887926 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.542952061 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.542967081 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.543023109 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.543256044 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.543778896 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.543876886 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.543935061 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.543983936 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.543999910 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.544047117 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.544123888 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.544141054 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.544209003 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.544414043 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.544420004 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.545038939 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.545097113 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.545120001 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.545178890 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.545382977 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.545440912 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.545475006 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.545532942 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.545557976 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.545607090 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.546268940 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.546329021 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.546351910 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.546397924 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.547235966 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.547290087 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.547324896 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.547393084 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.547408104 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.547486067 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.549061060 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.549134970 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.549179077 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.549230099 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.549288034 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.549377918 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.549429893 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.549442053 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.549462080 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.549510956 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.549523115 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.550074100 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.550138950 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.550149918 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.550170898 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.550220013 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.550230980 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.551170111 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.551235914 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.551248074 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.551285028 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.551331997 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.551343918 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.551383018 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.551486969 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.551498890 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552495956 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552557945 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.552571058 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552591085 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552660942 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.552673101 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552707911 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552772045 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.552783966 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552804947 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552853107 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.552864075 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552889109 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.552936077 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.552947044 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.553587914 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.553670883 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.553721905 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.553744078 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.553787947 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.554362059 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.554419041 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.554461002 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.554511070 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.554573059 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.554624081 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.556133986 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.556197882 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.556265116 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.556315899 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.556431055 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.556483984 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.556515932 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.556574106 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.556596994 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.556643963 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.557282925 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.557343006 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.557383060 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.557446003 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.557991028 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.558051109 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.558077097 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.558129072 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.558152914 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.558217049 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.558741093 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.558810949 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.558828115 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.558887959 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.559497118 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.559555054 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.559583902 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.559633970 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.559667110 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.559730053 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.560286045 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.560352087 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.560408115 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.560468912 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.560947895 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.560997963 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.561074972 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.561125994 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.561153889 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.561208010 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.561688900 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.561752081 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.561775923 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.561825991 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.561855078 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.561904907 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.562675953 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.562737942 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.562791109 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.562839985 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.562886000 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.562956095 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.562968969 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.563674927 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.563769102 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.563780069 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.563801050 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.563859940 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.563870907 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.563890934 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.563936949 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.563947916 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564611912 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564661980 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.564673901 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564704895 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564764023 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.564774990 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564794064 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564867020 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.564877987 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.564908981 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565181971 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.565192938 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565567970 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565643072 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.565654039 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565674067 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565745115 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.565773010 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565793037 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.565840006 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.565850973 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.566672087 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.566726923 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.566869974 CEST	49731	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.566893101 CEST	443	49731	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.653948069 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.654242039 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.654297113 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.654829025 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.655100107 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.655185938 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.655214071 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.655282974 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.655301094 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.655745983 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.655818939 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.657542944 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.657545090 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.657608986 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.657625914 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.658077955 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.658173084 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.658189058 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.658242941 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.658255100 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.658409119 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.658909082 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.658993959 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.659329891 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.659420967 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.659512997 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.659528017 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.703270912 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.703295946 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.703299999 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.703334093 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.749311924 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.803658962 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.803782940 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.803796053 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.803982019 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.804117918 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.804601908 CEST	49740	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:37.804619074 CEST	443	49740	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:37.871705055 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.871784925 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.871984005 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.873188972 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.873260975 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.873923063 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.891664982 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.891736031 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.891763926 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.891947031 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.892007113 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.892024994 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.892047882 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.892096043 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.892123938 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.892158985 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.892205954 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.892218113 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.898144960 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.898231030 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.898248911 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.898269892 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.898320913 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.905450106 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.905512094 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.912724972 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.912789106 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.912810087 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.912861109 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.919168949 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.919184923 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.919929028 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.919994116 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.976239920 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.976252079 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.976274014 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.976283073 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.976314068 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.976324081 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.976361036 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.976376057 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.976386070 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.976402998 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.977493048 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.977525949 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.977586031 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.977617979 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.977637053 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.977649927 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.977660894 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.977673054 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.977689981 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.977694035 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.977729082 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.977756977 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:37.996519089 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:37.996596098 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.000061035 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.000133038 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.000185966 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.000276089 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.000386953 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.000405073 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.007318020 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.007380962 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.007395029 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.007442951 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.007587910 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.007601976 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.016565084 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.016634941 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.016649008 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.022310972 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.022387028 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.022401094 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.022464037 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.022555113 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.022567987 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.023753881 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.023777008 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.023819923 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.023822069 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.023855925 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.023866892 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.023881912 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.023961067 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.025028944 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.025084972 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.025118113 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.025146008 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.025151968 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.025177956 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.025203943 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.025229931 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.029550076 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.029704094 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.029731989 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.029758930 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.029841900 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.029855013 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.036984921 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.037060022 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.037074089 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.043752909 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.043836117 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.043843031 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.043863058 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.043916941 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.049956083 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.050019026 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.050043106 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.050101042 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.056832075 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.056890965 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.063575029 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.063637972 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.063656092 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.063723087 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.064583063 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.064609051 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.064646006 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.064662933 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.064680099 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.064701080 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.064740896 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.064805031 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.064831018 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.064897060 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.064938068 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.064960957 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.070434093 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.070496082 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.070518017 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.070568085 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.077212095 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.077285051 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.084614992 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.084683895 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.084722042 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.084784031 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.101233006 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.101295948 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.101317883 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.101372957 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.104188919 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.104266882 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.106187105 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.106210947 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.106339931 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.106339931 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.106372118 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.106427908 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.108705997 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.108748913 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.108778000 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.108794928 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.108815908 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.108830929 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.108839989 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.108867884 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.109091043 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.109405994 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.109457970 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.109492064 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.109539032 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.110867023 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.110949993 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.114434958 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.114500999 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.114537954 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.114587069 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.118560076 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.118622065 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.123431921 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.123498917 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.123522043 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.123579979 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.128212929 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.128271103 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.128299952 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.132988930 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.133052111 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.133065939 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.133094072 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.133143902 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.133156061 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.137343884 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.137411118 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.137418032 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.137443066 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.137478113 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.137897015 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.137967110 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.137979984 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.138463974 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.138536930 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.138627052 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.138627052 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.138658047 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.142621040 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.142704964 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.142705917 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.142729998 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.142827034 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.147423983 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.147488117 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.147507906 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.147557974 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.154624939 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.154699087 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.154700041 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.154736996 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.154824972 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.159600019 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.159657955 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.160361052 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.160430908 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.164350986 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.164359093 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.164388895 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.164443970 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.164515972 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.164566040 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.164568901 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.164566040 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.164599895 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.166408062 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.166429996 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.166465998 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.166482925 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.166513920 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.169126987 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.169192076 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.174724102 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.174806118 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.174817085 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.174834013 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.174886942 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.178680897 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.178745031 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.178807020 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.178857088 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.183254004 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.183316946 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.188715935 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.188783884 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.188807011 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.188855886 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.192753077 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.192853928 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.192955971 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.192969084 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.193319082 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.193339109 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.193382978 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.193420887 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.193450928 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.196194887 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.196239948 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.196260929 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.196280956 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.196295977 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.196518898 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.196574926 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.196585894 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.200798035 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.200869083 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.200880051 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.200901031 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.200953007 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.200978041 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.206264019 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.206325054 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.206336021 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.206361055 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.206414938 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.206425905 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.209805965 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.209841013 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.209849119 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.209866047 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.209883928 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.209914923 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.209918976 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.209925890 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.209940910 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.212160110 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.212214947 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.212748051 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.212809086 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.212862968 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.212889910 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.212919950 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.212944031 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.213030100 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.213089943 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.214031935 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.214112043 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.214123011 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.214165926 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.214807987 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.214818954 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.217941046 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.217994928 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.218005896 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.218095064 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.218169928 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.218180895 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.220725060 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.220813036 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.220824003 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.223176003 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.223253012 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.223263979 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.223298073 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.223368883 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.223380089 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.224705935 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.224787951 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.224792957 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.224812984 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.224895954 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.226747990 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.226792097 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.226824999 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.226845026 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.226870060 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.226990938 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.227047920 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.227062941 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.227097034 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.227113008 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.228233099 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.228322029 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.228348017 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.228398085 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.230670929 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.230755091 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.232942104 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.233001947 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.233059883 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.233120918 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.235384941 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.235444069 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.235492945 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.235563993 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.237663031 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.237740040 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.240159988 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.240228891 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.240257978 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.240302086 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.240441084 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.240463018 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.240497112 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.240516901 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.240541935 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.242386103 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.242444038 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.242464066 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.242522001 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.243911028 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.243932009 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.243967056 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.243983984 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.243999004 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.244981050 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.245033026 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.247196913 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.247243881 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.247277975 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.247330904 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.249663115 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.249716043 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.249744892 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.249789953 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.251559019 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.251625061 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.252505064 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.252551079 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.252578974 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.252594948 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.252620935 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.254487991 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.254559994 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.254570007 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.254607916 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.254658937 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.256021976 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.256037951 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.256063938 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.256124020 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.256128073 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.256143093 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.256153107 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.256155968 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.256222963 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.257589102 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.257657051 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.260601044 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.260663986 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.260718107 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.260771036 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.261691093 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.261740923 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.261809111 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.261857033 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.263905048 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.264004946 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.264059067 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.264070034 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.265983105 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266082048 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.266093969 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266541958 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266582012 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266602039 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.266616106 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266642094 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.266705990 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266750097 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266772985 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.266788006 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.266860008 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.268079042 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.268174887 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.268229008 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.268240929 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.268309116 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.268414974 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.268465042 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.268475056 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.268492937 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.268553019 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.268570900 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.270176888 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.270239115 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.270255089 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.270306110 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.275213003 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.275271893 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.275535107 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.275593042 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.275616884 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.275676012 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.277683973 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.277743101 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.277765989 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.277813911 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.279592991 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.279640913 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.280081987 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.280138969 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.280153990 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.280170918 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.280203104 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.280220032 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.281352043 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.281404018 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.281414032 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.281430960 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.281466961 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.281610966 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.281671047 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.281724930 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.281769037 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.283698082 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.283755064 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.283782005 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.283832073 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.285736084 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.285789967 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.287789106 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.287849903 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.287889004 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.287939072 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.289870977 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.289937973 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.289973021 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.290024996 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.291815996 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.291877031 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.292366028 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.292432070 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.292453051 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.292467117 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.292493105 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.292510033 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.292537928 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.292582989 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.292599916 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.292617083 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.292629957 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.293906927 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.293973923 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.294019938 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.294090033 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.295737982 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.295810938 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.295871019 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.295923948 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.297662020 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.297720909 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.297746897 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.297800064 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.299689054 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.299746037 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.301592112 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.301664114 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.301681042 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.301729918 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.302738905 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.302783966 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.302841902 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.302870989 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.302875042 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.302917004 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.303514957 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.303571939 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.303601980 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.303661108 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.305263996 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.305346012 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.305362940 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.305389881 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.305423021 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.305452108 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.305653095 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.305697918 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.305721998 CEST	443	49743	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.305767059 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.305767059 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.305768013 CEST	49743	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.309911966 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.309954882 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.310019016 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.310204029 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.310223103 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.312865973 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.312915087 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.312937021 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.312944889 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.312973022 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.312983990 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.312999964 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.313050985 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.315747023 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.315788984 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.315818071 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.315830946 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.315867901 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.317315102 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.317375898 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.317385912 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.321729898 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.321811914 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.321826935 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.321893930 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.324163914 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.324213028 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.324240923 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.324253082 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.324268103 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.324318886 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.324361086 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.324368954 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.324484110 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.324533939 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.324665070 CEST	49742	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.324680090 CEST	443	49742	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.329822063 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.329853058 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.330009937 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.330066919 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.330135107 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.330141068 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.330169916 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.330177069 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.330194950 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.330203056 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.339216948 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.339268923 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.339288950 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.339308977 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.339335918 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.339335918 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.346780062 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.346826077 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.346931934 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.346931934 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.346949100 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.347865105 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.347919941 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.347932100 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.354793072 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.354844093 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.354868889 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.354882956 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.354912043 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.354933023 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.361480951 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.361526012 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.361571074 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.361584902 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.361614943 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.361630917 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.368648052 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.368697882 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.368733883 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.368751049 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.368778944 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.368908882 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.375153065 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.375193119 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.375241995 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.375262022 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.375287056 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.375336885 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.376769066 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.376831055 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.380464077 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.380548000 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.380559921 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.380640030 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.386714935 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.386791945 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.386794090 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.386817932 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.386856079 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.392378092 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.392425060 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.392453909 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.392467022 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.392493963 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.397898912 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.397938013 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.397969961 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.397986889 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.398015022 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.398015976 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.398067951 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.398081064 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.403266907 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.403311014 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.403337002 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.403356075 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.403366089 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.403413057 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.408391953 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.408432007 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.408466101 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.408478975 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.408507109 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.408523083 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.414463043 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.414504051 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.414535046 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.414546967 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.414573908 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.414593935 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.417805910 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.417848110 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.417876959 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.417889118 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.417920113 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.417938948 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.418473959 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.418534994 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.422853947 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.422908068 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.422926903 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.422940016 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.422966003 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.426599026 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.426613092 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.426661015 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.426675081 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.426702023 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.431231976 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.431274891 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.431302071 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.431315899 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.431344032 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.435410023 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.435452938 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.435483932 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.435497999 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.435527086 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.435543060 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.435672998 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.435684919 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.439136982 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.439176083 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.439209938 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.439224958 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.439251900 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.439271927 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.440048933 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.440134048 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.440145016 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.440243959 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.440263987 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.440280914 CEST	443	49741	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.440299988 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.440340042 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.440340042 CEST	49741	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.503978968 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.504029989 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.504081011 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.504331112 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.504348040 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.530646086 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.530932903 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.530993938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.532196999 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.532592058 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.532708883 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.532721996 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.533612967 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.553586006 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.553792000 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.553802967 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.554337978 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.554754972 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.554835081 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.554858923 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.578440905 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.600136042 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.610138893 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.721198082 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.721494913 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.721502066 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.722924948 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.722978115 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.723309994 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.723383904 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.723480940 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.723485947 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.765954018 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.780565023 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.780689955 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.781287909 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.802723885 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.802798033 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.802840948 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.802937031 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.802953005 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.802977085 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.803035975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.803052902 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.803101063 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.809762001 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.809838057 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.809864998 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.811688900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.811741114 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.811755896 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.818965912 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.819041967 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.819045067 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.819071054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.819120884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.826256037 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.826322079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.826351881 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.829608917 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.833483934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.833550930 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.833568096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.880531073 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.884903908 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.884923935 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.884949923 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.884970903 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.884980917 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.884990931 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.885015965 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.885023117 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.885023117 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.885039091 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.885077000 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.885077000 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.907113075 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.907278061 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.907334089 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.907351017 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.911659002 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.911720037 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.911734104 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.917697906 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.917778969 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.917788982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.917815924 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.917869091 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.925153971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.925240993 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.925302982 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.925317049 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.931983948 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932049036 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.932137966 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932220936 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932267904 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932275057 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.932292938 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932296038 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932320118 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.932348013 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.932352066 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.932368994 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932393074 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.932451963 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.932466030 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.939657927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.939728022 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.939742088 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.946976900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.947052956 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.947066069 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.947154999 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.947211027 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.947225094 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.954230070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.954282999 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.954298019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.960958958 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.961030960 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.961045027 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.961117029 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.961204052 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.961216927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.967669964 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.967725039 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.967739105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.972413063 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.972456932 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.972484112 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.972500086 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.972537041 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.972537041 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.973077059 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.974411011 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.974462986 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.974477053 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.974498987 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.974550962 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.974565983 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.981189966 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.981370926 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.981389046 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.987946033 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.987998962 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.988013983 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.991440058 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:38.991506100 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:38.991519928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.011507988 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.011564970 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.011578083 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.011601925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.011647940 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.013583899 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.013632059 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.013663054 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.013670921 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.013686895 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.013822079 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.014024019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.014081001 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.014082909 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.014106035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.014157057 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.018168926 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.018214941 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.019372940 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.019485950 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.019500971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.024014950 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.024077892 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.024137020 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.024152040 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.024259090 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.028695107 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.028765917 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.033531904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.033591032 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.033621073 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.033680916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.035793066 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035825014 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035842896 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035855055 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.035886049 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035895109 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.035903931 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035936117 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035959959 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.035993099 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.036006927 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.038288116 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.038374901 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.038665056 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.038680077 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.043045998 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.043117046 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.043131113 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.043195009 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.043256044 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.043270111 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.047036886 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.047085047 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.047111034 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.047118902 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.047158957 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.047816992 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.047889948 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.047904015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.052645922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.052695990 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.052711964 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.052794933 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.052869081 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.052881956 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.057455063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.057600975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.057615042 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.062114000 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.062199116 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.062213898 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.064528942 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.064608097 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.064614058 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.064639091 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.064691067 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.069287062 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.069374084 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.069437027 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.069453001 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.072877884 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.072925091 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.072994947 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.072994947 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.073007107 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.074024916 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.074105024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.074126005 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.074142933 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.074397087 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.078820944 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.078893900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.082710028 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.082756042 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.082794905 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.082808971 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.082834959 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.082869053 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.083569050 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.083633900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.083663940 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.083725929 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.088305950 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.088368893 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.088393927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.088447094 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.092746019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.092832088 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.093136072 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.093151093 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.097260952 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.097322941 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.097336054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.097400904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.097460032 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.097472906 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.101624012 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.101689100 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.101702929 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.102139950 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.102181911 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.102226019 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.102232933 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.102252007 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.102293968 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.102580070 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.102588892 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.105957985 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.106023073 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.106035948 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.106097937 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.106220007 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.106234074 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.107136965 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.107256889 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.107265949 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.107563972 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.110158920 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.110220909 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.110234022 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.110258102 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.110311985 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.110325098 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.112160921 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.112344980 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.114506960 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.114569902 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.114583969 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.115822077 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.115943909 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.115946054 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.115967035 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.116115093 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.118287086 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.118484974 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.118693113 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.118767023 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.118779898 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.118808985 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.118870020 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.122929096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.122991085 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.123029947 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.123078108 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.123295069 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.123359919 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.123363018 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.123372078 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.123408079 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.123548031 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.123610020 CEST	443	49750	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.123663902 CEST	49750	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.127212048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.127291918 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.129928112 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.129996061 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.130021095 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.130202055 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.130213976 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.132546902 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.132611036 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.132623911 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.132740021 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.132785082 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.132812023 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.132818937 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.132895947 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.135210037 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.135291100 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.135303974 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.135350943 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.135771036 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.135783911 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.137902021 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.137962103 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.137974024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.137996912 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.138062954 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.138076067 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.140516043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.140629053 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.140641928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.143101931 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.143167973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.143182039 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.143207073 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.143259048 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.143271923 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.145627975 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.145693064 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.145705938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.146497011 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.146537066 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.146554947 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.146574020 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.146615982 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.146949053 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.147006035 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.147018909 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.149486065 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.149555922 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.149569035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.149590015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.149784088 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.149797916 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.151978016 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.152038097 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.152050972 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.152076960 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.152131081 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.152143955 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.154455900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.154514074 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.154525995 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.154548883 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.154603958 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.154618025 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.156829119 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.156992912 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.157006025 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.159243107 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.159301043 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.159327030 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.159349918 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.159565926 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.161638021 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.161650896 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.161695957 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.161709070 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.161711931 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.161735058 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.161771059 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.161780119 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.161783934 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.163925886 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.163990021 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.166270018 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.166332006 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.166358948 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.166413069 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.167921066 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.167943001 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.168023109 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.168276072 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.168289900 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.168631077 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.168700933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.168720007 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.168790102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.170914888 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.170974016 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.173265934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.173327923 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.173352003 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.173418999 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.174036026 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.174077988 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.174130917 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.174130917 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.174143076 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.175492048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.175554037 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.175612926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.175669909 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.175980091 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.176040888 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.176048994 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.177644014 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.177710056 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.179791927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.179853916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.179874897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.179930925 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.182029963 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.182092905 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.182113886 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.182178974 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.184088945 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.184149981 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.185842037 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.185882092 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.185937881 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.185937881 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.185951948 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.186249018 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.186307907 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.186331987 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.186341047 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.186395884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.188268900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.188328028 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.188409090 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.188462973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.190291882 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.190356016 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.192394972 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.192459106 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.192485094 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.194458961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.194523096 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.194540024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.194561958 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.194617987 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.194631100 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.196506023 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.196590900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.196630955 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.196647882 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.196728945 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.198582888 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.198649883 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.198959112 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.199021101 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.199079990 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.199079990 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.199088097 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.199126005 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.200582981 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.200661898 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.200673103 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.200695992 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.200748920 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.202568054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.202651024 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.202657938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.202678919 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.202730894 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.204509974 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.204581022 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.206505060 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.206564903 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.206590891 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.206644058 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.208415985 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.208475113 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.208513975 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.208581924 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.209490061 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.209547043 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.209597111 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.209605932 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.209624052 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.209729910 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.210619926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.210676908 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.211244106 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.211371899 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.212348938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.212409973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.212426901 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.212486982 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.214181900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.214245081 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.214267015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.214314938 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.214406013 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.214458942 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.216026068 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.216095924 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.217523098 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.217605114 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.217856884 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.217921019 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.217945099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.218003988 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.218991041 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.219077110 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.219631910 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.219700098 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.219716072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.219783068 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.220520973 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.220604897 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.220628977 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.220635891 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.220895052 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.221446991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.221509933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.221527100 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.221577883 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.223256111 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.223316908 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.225083113 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.225153923 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.225169897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.225219965 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.226881981 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.226944923 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.226980925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.227035046 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.228646994 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.228701115 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.229372025 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.229428053 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.229453087 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.229460955 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.229500055 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.230454922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.230518103 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.230540991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.230596066 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.232228041 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.232287884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.232316017 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.232371092 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.233995914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.234057903 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.235721111 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.235788107 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.235805988 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.235861063 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.237292051 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.237354994 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.237376928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.237442017 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.238904953 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.238969088 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.238981962 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.239038944 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.239073992 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.239080906 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.239114046 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.240415096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.240510941 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.240577936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.241967916 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.242053032 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.242109060 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.242125988 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.242499113 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.243428946 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.243510962 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.243525982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.243578911 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.244937897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.245001078 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.246495008 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.246550083 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.246551037 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.246575117 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.246617079 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.246624947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.246655941 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.246709108 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.246709108 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.246717930 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.247895956 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.247976065 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.247986078 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.248007059 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.248059034 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.249361992 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.249427080 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.250813961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.250875950 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.250902891 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.250955105 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.252238035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.252300024 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.252321959 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.252368927 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.253657103 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.253724098 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.253765106 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.253819942 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.253823042 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.253850937 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.253881931 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.254842997 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.254915953 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.254921913 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.255083084 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.255140066 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.255172014 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.255225897 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.256503105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.256568909 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.256587982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.256640911 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.257925034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.258011103 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.259274006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.259335041 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.259380102 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.259433985 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.260688066 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.260770082 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.260775089 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.260797024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.260845900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.261625051 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.261663914 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.261697054 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.261703014 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.261756897 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.261756897 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.262010098 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.262070894 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.263367891 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.263427019 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.263454914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.263514042 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.264705896 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.264765978 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.264791965 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.264842033 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.266031981 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.266093016 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.267327070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.267404079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.267410994 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.267432928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.267482042 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.268126965 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.268184900 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.268199921 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.268224001 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.268259048 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.268282890 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.268615961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.268680096 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.268757105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.268807888 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.269892931 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.269948959 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.269979954 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.270045996 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.271311045 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.271394014 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.272449017 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.272530079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.273241997 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.273312092 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.273747921 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.273811102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.273834944 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.273884058 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.274941921 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.275028944 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.275172949 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.275217056 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.275248051 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.275254011 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.275275946 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.275291920 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.276210070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.276268959 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.276326895 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.277395010 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.277462959 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.277470112 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.277496099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.277558088 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.278557062 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.278629065 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.278639078 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.278659105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.278716087 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.279798031 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.279874086 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.280982971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.281044006 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.281061888 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.281111002 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.281145096 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.281189919 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.281251907 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.281251907 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.281259060 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.281296968 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.282004118 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.282075882 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.282150984 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.282206059 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.282244921 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.282294989 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.283410072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.283467054 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.284490108 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.284547091 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.284583092 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.284648895 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.285689116 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.285748959 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.285769939 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.285824060 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.286823034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.286873102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.287678003 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.287745953 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.287745953 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.287770033 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.287811995 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.287987947 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.288036108 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.288065910 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.288149118 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.289155006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.289230108 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.289271116 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.289325953 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.290261984 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.290349960 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.291484118 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.291536093 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.291563034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.291613102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.292553902 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.292628050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.292632103 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.292653084 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.292721987 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.293176889 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.293216944 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.293240070 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.293256044 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.293293953 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.293618917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.293677092 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.294735909 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.294800997 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.294814110 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.294859886 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.295836926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.295902967 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.295916080 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.295968056 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.296863079 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.296935081 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.297940969 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.298015118 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.298018932 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.298038006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.298397064 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.298480034 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.298547029 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.298608065 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.298608065 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.298618078 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.299021959 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.299082994 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.299099922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.299150944 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.300128937 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.300185919 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.301090956 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.301167965 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.301184893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.301239014 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.302114010 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.302187920 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.302229881 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.302290916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.303174019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.303232908 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.304202080 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.304265022 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.304299116 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.304336071 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.304352045 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.304375887 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.304429054 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.304430008 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.304436922 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.304465055 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.304510117 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.304527044 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.305208921 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.305293083 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.305304050 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.306184053 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.306253910 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.306263924 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.306284904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.306337118 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.307168961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.307246923 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.307252884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.307265997 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.307312012 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.308249950 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.308316946 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.309192896 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.309231043 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.309267044 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.309274912 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.309282064 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.309318066 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.309325933 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.309325933 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.309346914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.309393883 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.310086012 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.310143948 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.310163975 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.310214996 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.311058044 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.311141968 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.312021971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.312084913 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.312115908 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.312211990 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.312987089 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.313046932 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.313066006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.313117981 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.313930035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314004898 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.314692974 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314742088 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314825058 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.314831972 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314836025 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314882994 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.314882994 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.314913034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314937115 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.314950943 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.314992905 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.315804958 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.315896988 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.315897942 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.315917015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.315965891 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.316725016 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.316802025 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.317609072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.317683935 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.317688942 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.317708015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.317756891 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.318567038 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.318644047 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.318645954 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.318665028 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.318725109 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.319209099 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.319257021 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.319307089 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.319314003 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.319334030 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.319360018 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.319466114 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.319534063 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.320491076 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.320549011 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.320569038 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.320616007 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.321214914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.321269035 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.321294069 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.321341038 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.322194099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.322264910 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.322945118 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323008060 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.323024035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323072910 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.323626041 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323668003 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323700905 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.323708057 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323729992 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.323749065 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.323847055 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323908091 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.323925972 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.323978901 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.324326992 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.324480057 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.324675083 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.324728966 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.325500965 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.325562954 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.325576067 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.325624943 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.326378107 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.326427937 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.326456070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.326502085 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.327219963 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.327281952 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.328116894 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.328177929 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.328190088 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.328243017 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.328627110 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.328668118 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.328680038 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.328696012 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.328720093 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.328912973 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.328978062 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.328996897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.329766035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.329826117 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.329838991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.329859972 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.329916000 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.329929113 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.330540895 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.330610991 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.330637932 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.331476927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.331543922 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.331554890 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.331573963 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.331629038 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.332264900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.332359076 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.332379103 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.332442045 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.332920074 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.332962036 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.333029985 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.333029985 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.333038092 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.333045959 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.333097935 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.333884001 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.333957911 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.333962917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.333981991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.334032059 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.334685087 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.334754944 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.334763050 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.334783077 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.335093975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.335484982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.335545063 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.335557938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.335608006 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.336340904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.336407900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.337100029 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.337167025 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.337181091 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.337236881 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.337686062 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.337726116 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.337762117 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.337769985 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.337889910 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.337914944 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.337971926 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.337991953 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.338043928 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.338711023 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.338768005 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.339467049 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.339534998 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.339555025 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.339566946 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.339765072 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.340303898 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.340364933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.340380907 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.340430021 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.341089964 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.341166973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.341655970 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.341696978 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.341727018 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.341733932 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.341809034 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.341829062 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.341886044 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.341906071 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.341959000 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.342319965 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.342401981 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.342576027 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.342643976 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.342653036 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.342672110 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.342720985 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.343399048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.343478918 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.344139099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.344214916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.344214916 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.344235897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.344295025 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.344851971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.344909906 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.344929934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.344981909 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.345705986 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.345707893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.345747948 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.345758915 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.345798016 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.345803976 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.345827103 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.345834017 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.345848083 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.346359015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.346417904 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.346483946 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.346539021 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.346616030 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.346700907 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.346700907 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.346724987 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.346777916 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.347214937 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.347270966 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.347291946 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.347345114 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.347570896 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.347640038 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.347861052 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.347924948 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.348500967 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.348593950 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.348655939 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.348711967 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.348733902 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.348802090 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.349363089 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.349431038 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.349446058 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.350095034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.350156069 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.350183010 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.350203991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.350266933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.350279093 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.350414038 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.350529909 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.350938082 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.351001024 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.351012945 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.351574898 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.351648092 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.351650953 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.351666927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.351712942 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.352401018 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.352467060 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.352479935 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.352529049 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.353055000 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.353113890 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.353708982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.353779078 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.353786945 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.353806973 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.353857040 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.354147911 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.354192972 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.354248047 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.354248047 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.354255915 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.354427099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.354475975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.354505062 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.354559898 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.355154037 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.355211020 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.355928898 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.356004000 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.356007099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.356025934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.356080055 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.356616974 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.356688976 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.356694937 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.356714010 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.356887102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.357305050 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.357371092 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.357733965 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.357821941 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.357847929 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.357853889 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.357896090 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.357954979 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358001947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.358028889 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358078957 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.358695984 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358758926 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.358761072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358766079 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358844042 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358850956 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.358863115 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.358917952 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.359400988 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.359462976 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.359479904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.359532118 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.360094070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.360153913 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.360740900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.360820055 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.360825062 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.360838890 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.360888004 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.361397982 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.361401081 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.361435890 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.361478090 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.361481905 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.361485004 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.361517906 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.361526966 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.361526966 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.361531973 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.361601114 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.362157106 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.362229109 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.362751961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.362821102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.362829924 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.362848043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.362896919 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.363421917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.363481998 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.363498926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.363543987 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.364152908 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.364228964 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.364905119 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.364972115 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.364984989 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365030050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.365418911 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365489006 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.365498066 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365516901 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365617990 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365658998 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365680933 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.365683079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.365704060 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.365715027 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.365947962 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.366123915 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.366178989 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.366751909 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.366828918 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.366831064 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.366849899 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.366899014 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.367465019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.367537975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.367548943 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.368257999 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.368313074 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.368324995 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.368345976 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.368403912 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.368416071 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369076967 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369117975 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369167089 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.369173050 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369179964 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369193077 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.369215965 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.369245052 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.369256973 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369278908 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369324923 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.369335890 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369358063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.369405031 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.369416952 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.370004892 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.370089054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.370145082 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.370157957 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.370193958 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.370203018 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.370214939 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.370264053 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.371001005 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.371057987 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.371078014 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.371134043 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.371969938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372037888 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.372056007 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372139931 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.372148991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372170925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372221947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.372351885 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372395992 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372445107 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.372445107 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.372454882 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372509956 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.372925043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.372992992 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.373006105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.373053074 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.373156071 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.373245955 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.373912096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.373992920 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.373996973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.374011993 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.374057055 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.374083996 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.374138117 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.374785900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.374855042 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.374867916 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.374917984 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.375801086 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.375864983 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.375886917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.375936985 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.375963926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.376014948 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.376339912 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.376393080 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.376444101 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.376444101 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.376451969 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.376671076 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.376727104 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.376749039 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.376797915 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.377612114 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.377670050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.377692938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.377738953 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.377769947 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.377816916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.378593922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.378650904 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.378674030 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.378720999 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.379457951 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.379527092 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.379558086 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.379564047 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.379564047 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.379575968 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.379620075 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.379648924 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.379698992 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.379725933 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.379777908 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.380369902 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.380436897 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.380450010 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.380503893 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.381256104 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.381316900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.381340981 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.381391048 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.381416082 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.381465912 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.383042097 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.383099079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.383127928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.383179903 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.383209944 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.383260012 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.383318901 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.383364916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.383388996 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.383441925 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.384037971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.384139061 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.384215117 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.384232998 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.384246111 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.384295940 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.384877920 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.384947062 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.384957075 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.384975910 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.385027885 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.385718107 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.385795116 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.385807991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.385859013 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.385885954 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.385934114 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.386647940 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.386715889 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.386722088 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.386740923 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.386806011 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387253046 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387311935 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387368917 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387377977 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387427092 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387430906 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387475967 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387495995 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387504101 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387530088 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387538910 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387583017 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387589931 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387629986 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387635946 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387655020 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387706995 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.387732029 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.387780905 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.388319016 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.388488054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.388499022 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.388539076 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.388546944 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.388560057 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.388590097 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.388590097 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.388600111 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.388614893 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.388828039 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.388995886 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.389007092 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.389247894 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.389309883 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.389328957 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.389378071 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.389388084 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.389405966 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.389467001 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.390142918 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.390192986 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.390221119 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.390269041 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.390942097 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.390999079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.391030073 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.391081095 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.391107082 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.391159058 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.391845942 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.391920090 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.391947985 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.391998053 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392380953 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392441034 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392488003 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392488003 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392494917 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392555952 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392658949 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392719984 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392741919 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392750978 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392797947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392817020 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.392818928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.392868996 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.393191099 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.393362999 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.393399954 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.393479109 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.393542051 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.393557072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.393603086 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.394349098 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.394422054 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.394434929 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.394486904 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.394510031 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.394562006 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.395078897 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.395123959 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.395168066 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.395173073 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.395212889 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.395214081 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.395215034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.395267963 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.395288944 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.395339966 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.396048069 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.396133900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.396147966 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.396198988 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.396269083 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.396318913 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.396827936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.396881104 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.396904945 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.396955967 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.397619009 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.397701025 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.397705078 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.397725105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.397773027 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.397799969 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.397861958 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.397937059 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.397989035 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398053885 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.398053885 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.398061037 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398094893 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398106098 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.398121119 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398171902 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.398473024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398528099 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.398556948 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398647070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.398711920 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.398725033 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.399322033 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.399382114 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.399394035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.399414062 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.399466991 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.399477959 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400129080 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400190115 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.400202036 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400222063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400275946 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.400286913 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400305986 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400355101 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.400366068 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400665045 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400712967 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400784016 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.400784016 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.400789976 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.400939941 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401000023 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.401010990 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401031017 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401182890 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.401194096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401753902 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401820898 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.401832104 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401853085 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401906013 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.401916981 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.401942015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.402102947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.402113914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.402599096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.402664900 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.402676105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.402725935 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.402793884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.402805090 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403338909 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403394938 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.403405905 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403426886 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403485060 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.403496027 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403516054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403565884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.403578043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403692961 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403733015 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.403764963 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.403798103 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.403800964 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.404184103 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.404237032 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.404247999 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.404268026 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.404326916 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.404337883 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.404982090 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405045986 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.405061960 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405082941 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405138969 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.405150890 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405179024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405232906 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.405246973 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405699968 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405776978 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405781031 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.405797958 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.405844927 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.406409979 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406454086 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406476021 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.406481028 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406483889 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406537056 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.406562090 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.406565905 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406584978 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406637907 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.406662941 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.406712055 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.407274961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.407349110 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.407356024 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.407373905 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.407423973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408065081 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408133984 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408184052 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408236980 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408261061 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408310890 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408834934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408871889 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408893108 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408905983 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408911943 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.408960104 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408974886 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408974886 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.408982992 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.409528017 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.409591913 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.409631968 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.409682989 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.409687996 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.409702063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.409709930 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.409759998 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.409781933 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.409790039 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.410262108 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.410329103 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.410342932 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.410396099 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.411058903 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.411114931 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.411143064 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.411196947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.411221981 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.411273003 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.411856890 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.411911964 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.411940098 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.411993980 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.412018061 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412168980 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412208080 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412226915 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.412245035 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412280083 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.412280083 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.412576914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412635088 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.412647009 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412667036 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.412714005 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.412725925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.413376093 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.413429022 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.413439989 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.413461924 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.413521051 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.413532019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.413552046 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.413606882 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.413618088 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414081097 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414141893 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414156914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414176941 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414232969 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414541006 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414589882 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414663076 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414663076 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414669991 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414745092 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414796114 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414846897 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414880991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.414932013 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.414958000 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.415005922 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.415612936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.415668964 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.415692091 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.415743113 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.416280985 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.416336060 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.416379929 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.416435957 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.416464090 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.416516066 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.416548014 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.416595936 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.417026997 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.417062998 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.417088985 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.417093992 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.417131901 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.417159081 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.417253017 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.417304993 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.417339087 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.417397976 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.417414904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.417465925 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.418188095 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.418243885 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.418271065 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.418318033 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.418348074 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.418426991 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419230938 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419289112 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419313908 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419364929 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419397116 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419470072 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419471025 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419491053 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419534922 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419673920 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419693947 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419743061 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419744015 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419749975 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419797897 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.419821024 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.419826031 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.420027018 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.420206070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.420258999 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.420293093 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.420361996 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.420368910 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.420388937 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.420429945 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.421025991 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421101093 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.421111107 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421128988 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421180010 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.421207905 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421257973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.421734095 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421782017 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421828985 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.421837091 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.421859980 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.421964884 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.422028065 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.422074080 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.422123909 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.422158003 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.422216892 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.422235966 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.422280073 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.422887087 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.422965050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.422993898 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.423039913 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.423069954 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.423119068 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.423846960 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.423913956 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.423930883 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.423981905 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424014091 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424066067 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424087048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424134970 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424518108 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424539089 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424571037 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424585104 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424680948 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424736023 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424820900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424870968 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424882889 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424904108 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.424951077 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.424962997 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425669909 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425729036 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.425740957 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425760031 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425808907 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.425820112 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425844908 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425923109 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.425976992 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.425990105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426295042 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.426404953 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426440954 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426465034 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.426470995 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426537991 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.426606894 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426666975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.426692963 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426740885 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.426770926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.426819086 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.427673101 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.427747011 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.427792072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.427845955 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.427872896 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.427925110 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.428417921 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.428482056 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.428560019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.428607941 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.428641081 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.428692102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.428719997 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.428777933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.429089069 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429107904 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429157972 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429168940 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.429168940 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.429178953 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429246902 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.429280043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429332018 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.429368019 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429413080 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.429445982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.429492950 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.430094004 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.430166960 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.430202961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.430255890 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.430282116 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.430332899 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431026936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431092024 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431165934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431220055 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431255102 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431308031 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431334972 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431396961 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431677103 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431710958 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431736946 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431744099 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431766033 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431886911 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.431943893 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.431977987 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.432029963 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.432058096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.432127953 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.432813883 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.432867050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.432900906 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.432950020 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.432981014 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433027983 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.433502913 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433521032 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433581114 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.433587074 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433613062 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433684111 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.433700085 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433753014 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.433789015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433909893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.433948994 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.433960915 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.434487104 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.434509993 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.434562922 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.434601068 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.434648991 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.434680939 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.434734106 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.435448885 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.435508013 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.435530901 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.435587883 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.435609102 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.435619116 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.435635090 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.435663939 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436059952 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436079025 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436129093 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436135054 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436153889 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436161995 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436217070 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436261892 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436279058 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436323881 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436347008 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436400890 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436412096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436431885 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.436779976 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.436790943 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437002897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437129021 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437139988 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437153101 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437201023 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437215090 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437267065 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437290907 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437345982 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437685966 CEST	49749	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437701941 CEST	443	49749	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437825918 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437881947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437912941 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.437968969 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.437994957 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.438050032 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.438684940 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.438757896 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.438796043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.438854933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.438883066 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.438934088 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.439474106 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.439536095 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.439585924 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.439676046 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.439698935 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.439711094 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.439763069 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.439783096 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.439841032 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.440293074 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.440370083 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.440423012 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.440474033 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.440501928 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.440557003 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.441112041 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.441190004 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.441201925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.441227913 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.441279888 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.441307068 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.441356897 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.441921949 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.441992044 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.442012072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.442068100 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.442100048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.442154884 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.442179918 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.442233086 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.442714930 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.442785978 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.442805052 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.442857981 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.442884922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.442934990 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.443547964 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.443614006 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.443679094 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.443732977 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.443758965 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.443809986 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.444319963 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.444375038 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.444408894 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.444463015 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.444499016 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.444551945 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.444580078 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.444636106 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.445164919 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.445220947 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.445255995 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.445311069 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.445337057 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.445388079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.445894003 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.445964098 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.445981026 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.446033001 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.446058989 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.446109056 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.446654081 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.446707964 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.446743965 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.446880102 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.446928978 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.446939945 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.446960926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447009087 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.447020054 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447483063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447546959 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.447557926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447578907 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447628975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.447639942 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447665930 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447743893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447794914 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.447808027 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.447868109 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.448482037 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.448546886 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.448571920 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.448627949 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.448659897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.448714018 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.448743105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.448815107 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.449413061 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.449475050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.449534893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.449592113 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.449615955 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.449667931 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.449698925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.449742079 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.449776888 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.449835062 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.450336933 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.450392008 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.450426102 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.450476885 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.450526953 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.450583935 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.450635910 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.450692892 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.451303959 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.451373100 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.451390982 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.451447010 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.451473951 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.451524973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.451550961 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.451597929 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.452197075 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.452261925 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.452322006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.452372074 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.452400923 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.452450037 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.452477932 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.452526093 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.453105927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.453162909 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.453188896 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.453236103 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.453273058 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.453320980 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.453392029 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.453453064 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.454114914 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.454173088 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.454195023 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.454246044 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.454278946 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.454332113 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.454360962 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.454417944 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.454472065 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.454521894 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.454994917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.455049992 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.455082893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.455149889 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.455168962 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.455215931 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.455245972 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.455296993 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.455876112 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.455945969 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.455995083 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.456047058 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.456079006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.456132889 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.456176043 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.456868887 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.456950903 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.456954002 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.456975937 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457027912 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.457092047 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457149029 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.457165956 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457215071 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.457243919 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457300901 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.457771063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457820892 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.457854986 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457906008 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.457933903 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.457987070 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.458009958 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.458058119 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.458636999 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.458697081 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.458739042 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.458801031 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.458864927 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.458933115 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.458944082 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.458964109 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.459016085 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.459450006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.459501982 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.459537983 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.459587097 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.459621906 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.459680080 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.459701061 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.459748983 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.460448027 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.460519075 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.460532904 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.460582972 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.460619926 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.460668087 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.460696936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.460745096 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.461283922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.461342096 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.461402893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.461464882 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.461482048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.461529970 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.461565971 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.461612940 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.461637974 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.461683989 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.462182045 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.462249041 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.462265015 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.462311029 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.462378025 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.462424994 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.462486029 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.462534904 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.462965012 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.463017941 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.463052034 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.463110924 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.463177919 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.463238001 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.463252068 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.463881969 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.463918924 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.463929892 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.463972092 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464021921 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.464034081 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464057922 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464242935 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464279890 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.464299917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464323044 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.464787006 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464858055 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.464869022 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464890003 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464948893 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.464960098 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.464981079 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465029001 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.465039968 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465059996 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465111017 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.465137005 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465604067 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465675116 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.465687037 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465801001 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465887070 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465943098 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.465955973 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.465981007 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.466028929 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.466041088 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.466083050 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.466460943 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.466525078 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.466548920 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.466598988 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.466665030 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.466711044 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.466741085 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.466789007 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.467266083 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.467327118 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.467353106 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.467416048 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.467470884 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.467521906 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.467550039 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.467597008 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.468149900 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.468204975 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.468235016 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.468298912 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.468314886 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.468357086 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.468394041 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.468444109 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469012976 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469078064 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469099045 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469144106 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469182968 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469239950 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469268084 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469319105 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469346046 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469777107 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469814062 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469829082 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469893932 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.469959021 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.469973087 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470019102 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.470022917 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470042944 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470104933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.470134974 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470179081 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.470623016 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470698118 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.470737934 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470783949 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.470823050 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470870018 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.470899105 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.470948935 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.471520901 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.471580029 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.471606970 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.471658945 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.471690893 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.471743107 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.471798897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.471848011 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.472223997 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.472275019 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.472310066 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.472359896 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.472395897 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.472445965 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.472475052 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.472523928 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.473217010 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.473278999 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.473303080 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.473359108 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.473387957 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.473438978 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.473473072 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.473524094 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.473551035 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.473598003 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.474090099 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474153996 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.474219084 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474271059 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.474333048 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474417925 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474500895 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474550962 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.474566936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474590063 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474625111 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.474637985 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.474736929 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.475034952 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.475096941 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.475121975 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.475172043 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.475207090 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.475260973 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.475322008 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.475373030 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.475426912 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.475482941 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.475999117 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.476058960 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.476139069 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.476186037 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.476222992 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.476274014 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.476341963 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.476389885 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.476449013 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.476497889 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.476941109 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.476995945 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.477030039 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.477087021 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.477108955 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.477154970 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.477222919 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.477276087 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.477296114 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.477344036 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.477901936 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.477958918 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.477991104 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.478041887 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.478075027 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.478123903 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.478158951 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.478214979 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.478286028 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.478441954 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.478601933 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.478625059 CEST	443	49748	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.478653908 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.478653908 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.478691101 CEST	49748	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.483083010 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.574218035 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.574281931 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.574342012 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.574793100 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.574822903 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.597934961 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.597995996 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.598045111 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.627538919 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.627604961 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.627748966 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.627979994 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.628011942 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.639519930 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.700750113 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 19, 2024 03:40:39.701905012 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.701931000 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.701966047 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.701972961 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.701992035 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.702004910 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.702013016 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.702022076 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.702033043 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.702040911 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.702073097 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748055935 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748739004 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.748759985 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.748801947 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748809099 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.748827934 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.748847008 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748858929 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748864889 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.748874903 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.748883009 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748898983 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.748915911 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.789561033 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.789582014 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.789623022 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.789628029 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.789666891 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.789674997 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.789690971 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.789705038 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.796318054 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.796993017 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.797004938 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.798257113 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.798928022 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.799067974 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.799102068 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.830579996 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.830626011 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.830667973 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.830674887 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.830705881 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.830715895 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.835243940 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.835320950 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.840835094 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.841238976 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.841281891 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.841635942 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.841949940 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.842031002 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.842134953 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.846965075 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.858947992 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.858998060 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.859040976 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.859050035 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.859076977 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.859138966 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.859210968 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.859744072 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.859759092 CEST	443	49756	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:39.859792948 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.859896898 CEST	49756	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:39.888119936 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.008121014 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.008245945 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.008305073 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.021971941 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.022027016 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.022216082 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.022423983 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.022460938 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.031599045 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.031620979 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.031876087 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.032140017 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.032154083 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.034043074 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.034071922 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.034382105 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.034598112 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.034621954 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.053098917 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.053185940 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.053204060 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.062961102 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.108730078 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.111995935 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.112008095 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.112032890 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.112040997 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.112057924 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.112185001 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.112185955 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.112247944 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.112320900 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.156975985 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.156984091 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.157038927 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.157052994 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.157098055 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.157136917 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.157150984 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.157179117 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.157206059 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.157206059 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.157234907 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.158730030 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.158740997 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.158767939 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.158952951 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.158952951 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.159018040 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.161911964 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.199552059 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.199604988 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.199768066 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.199769020 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.199831963 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.199888945 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.204483986 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.204499960 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.204586983 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.204623938 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.204829931 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.224565029 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.224630117 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.224875927 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.224997997 CEST	443	49757	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.225250959 CEST	49757	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.231276989 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.231329918 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.231498003 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.231694937 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.231724977 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.235683918 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.235924959 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.235941887 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.237425089 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.237485886 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.237745047 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.237823963 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.237845898 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.244513035 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.244528055 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.244610071 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.244631052 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.244689941 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.245507956 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.245753050 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.245767117 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.246241093 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.246735096 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.246839046 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.246855974 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.246874094 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.246889114 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.250710964 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.250997066 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.251008034 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.252233982 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.252530098 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.252655983 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.252660990 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.252671957 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.252698898 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.280256033 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.280267954 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.287669897 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.287698984 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.287749052 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.287758112 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.287823915 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.287868023 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.287868023 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.295804977 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.296130896 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.315938950 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.315956116 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.316008091 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.316045046 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.316108942 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.327159882 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.344115973 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.344129086 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.344250917 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.344310045 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.344378948 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.373243093 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.373258114 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.373339891 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.373399019 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.373578072 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.389713049 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.389743090 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.389780998 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.389796972 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.389830112 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.389851093 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.394464016 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.394536972 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.394561052 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.394598007 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.394804001 CEST	49758	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.394831896 CEST	443	49758	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.398488045 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.398507118 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.398950100 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.399225950 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.399234056 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.431361914 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.431411982 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.431690931 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.431902885 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.431931019 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.446434021 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.446500063 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.446535110 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.452318907 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.452539921 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.452562094 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.453716040 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.453764915 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.453778028 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.453829050 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.453840017 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.453900099 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.454020977 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.454029083 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.454196930 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.454305887 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.454413891 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.454464912 CEST	443	49763	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.454521894 CEST	49763	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.456820011 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.456841946 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.456901073 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.457233906 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.457250118 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.463769913 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.463778973 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.463841915 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.464088917 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.464097977 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.487571001 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.487694979 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.487755060 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.487778902 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.487926960 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.487991095 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.488003969 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.488210917 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.489576101 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.489660978 CEST	49765	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.489687920 CEST	443	49765	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.496134996 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.497015953 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.504416943 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.504481077 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.504564047 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.504626036 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.504648924 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.504664898 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.504676104 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.514803886 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.514846087 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.514859915 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.514867067 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.514905930 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.525186062 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.525232077 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.525250912 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.525259972 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.525290966 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.564222097 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.564268112 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.564338923 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.564783096 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.564802885 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.597539902 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.597574949 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.597640991 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.597881079 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.597898960 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.608365059 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.608436108 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.612683058 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.612713099 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.612724066 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.612766981 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.612773895 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.612819910 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.612951040 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.612958908 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.614111900 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.614156961 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.614444017 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.614518881 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.614607096 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.614612103 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.621381998 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.621418953 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.621442080 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.621448994 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.621726990 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.628834963 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.628885984 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.635339022 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.635385036 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.635391951 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.635396957 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.635432005 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.641129017 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.641168118 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.641180992 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.641185045 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.641223907 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.646900892 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.646950006 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.651813984 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.652023077 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.652045965 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.652183056 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.652226925 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.652230024 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.652240992 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.652515888 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.653268099 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.653583050 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.653700113 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.653716087 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.653740883 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.653764963 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.654722929 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.657342911 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.657387972 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.657423973 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.657429934 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.657736063 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.662537098 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.662585020 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.662585974 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.662597895 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.662715912 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.662734032 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.662791967 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.662803888 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.670150995 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.670420885 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.670438051 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.670908928 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.671246052 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.671334028 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.671565056 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.687903881 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.688138008 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.688154936 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.689809084 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.689866066 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.690762997 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.690845013 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.700294971 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.713548899 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.713637114 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.713825941 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.713835955 CEST	443	49764	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.713848114 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.713884115 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.714117050 CEST	49764	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.715364933 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.716108084 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.735692978 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.735697985 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:40.766969919 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767014980 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767033100 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767045975 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.767081022 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767090082 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.767103910 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767132998 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.767144918 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767163992 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.767187119 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.767452002 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.778979063 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:40.783252954 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.783504963 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.783564091 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.787153959 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.787229061 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.787508011 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.787601948 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.787678003 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.813801050 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.813822031 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.813863993 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.813870907 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.813908100 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.813925028 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.813949108 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.814439058 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.831722021 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.831789017 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.831824064 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.832681894 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.832916975 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.832973957 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.834676027 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.834739923 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.834975958 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.835057974 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.835074902 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.841403961 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.841413975 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.854578018 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.854635954 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.854657888 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.854676962 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.854702950 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.854722023 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.873157024 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.873573065 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.873635054 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.873874903 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.873922110 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.874027967 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.874085903 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.876127005 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.879156113 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.879173994 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.879211903 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:40.879213095 CEST	443	49770	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.879240990 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.879291058 CEST	49770	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.884902954 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.884968042 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.885062933 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.894309998 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.920733929 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:40.935838938 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.935846090 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.935872078 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.935883999 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.935899973 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.935903072 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.935903072 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.935920954 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.935930014 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.935930014 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.935942888 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.936191082 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.941800117 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.941943884 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.942002058 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.942012072 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.942164898 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.942214012 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.942222118 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.942296982 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.942413092 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.942420959 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.953263044 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.953346968 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.953349113 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.953378916 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.953485012 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.964342117 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.964392900 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.964418888 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:40.964710951 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:40.982736111 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.983372927 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.983381033 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.983414888 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.983444929 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.983445883 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.983460903 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.983494043 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.983494997 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.991663933 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991758108 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991774082 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.991792917 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991811037 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991832018 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991848946 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.991861105 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991868019 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.991882086 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991910934 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.991910934 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.991947889 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.991947889 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.998974085 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.998985052 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.999006033 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.999015093 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.999025106 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:40.999041080 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:40.999049902 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.000403881 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.000442028 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.000600100 CEST	443	49775	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.000632048 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.000652075 CEST	49775	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.023478031 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.023535013 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.023575068 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.023578882 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.023612976 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.023612976 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.035593033 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.035639048 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.035739899 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.035739899 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.035772085 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.035851955 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.047398090 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.047457933 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.051100016 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.051156998 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.051201105 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.051251888 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.060630083 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.060683966 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.060709953 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.060862064 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.064302921 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.064316034 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.064368963 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.064373970 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.064408064 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.064408064 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.066569090 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.066767931 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.067603111 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.067648888 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.073739052 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.073786020 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.073827028 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.073879957 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.076311111 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.076358080 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.076404095 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.076404095 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.076427937 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.076442003 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.076464891 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.080743074 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.080791950 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.080830097 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.080878973 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.088262081 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.088325024 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.093385935 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.093434095 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.093471050 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.093518972 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.094742060 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.094780922 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.094806910 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.094813108 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.094821930 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.098995924 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.099045992 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.099081993 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.099127054 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.105133057 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.105211020 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.105216980 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.105236053 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.105287075 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.120512009 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.120557070 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.120589018 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.120608091 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.120628119 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.120811939 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.122984886 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.123003006 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.123044014 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.123050928 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.123063087 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.125128031 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.125240088 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.151449919 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.151534081 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.152288914 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.152304888 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.152379036 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.152379036 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.152386904 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.153594971 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.153649092 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.153695107 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.153707981 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.153742075 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.153942108 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.153990984 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.156379938 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.156440020 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.156464100 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.156512976 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.157655954 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.157742977 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.157839060 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.157845020 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.157900095 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.157932997 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.157959938 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.157978058 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.158313990 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.160825014 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.160885096 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.165254116 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.165304899 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.165333986 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.165394068 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.167247057 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.167262077 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.167309046 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.167346001 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.167346001 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.167351961 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.168064117 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.168139935 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.168498039 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.168514967 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.169420958 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.169495106 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.169507980 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.169558048 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.173537970 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.174776077 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.177361965 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.177421093 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.177484035 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.177531004 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.177611113 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.177814960 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.177866936 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.178338051 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.178402901 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.178431034 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.179143906 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.179188967 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.179209948 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.179231882 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.179250002 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.179250002 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.180206060 CEST	49772	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:41.180214882 CEST	443	49772	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:41.181555986 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.181603909 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.181638956 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.181652069 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.181672096 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.194942951 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.194957972 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.195034027 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.195034027 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.195040941 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.200370073 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.200386047 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.200967073 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.201598883 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.201611042 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.208343029 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.208388090 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.208410978 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.208434105 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.208450079 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.209556103 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.209573030 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.209640026 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.209640026 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.209647894 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.220927000 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.221579075 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.221595049 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.221677065 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.221677065 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.221685886 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.222357035 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.222398043 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.222430944 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.222440004 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.222462893 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.222476006 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.223485947 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.223551989 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.223566055 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.224720955 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.224773884 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.235148907 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.235198975 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.235296011 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.235296011 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.235307932 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.238926888 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.238987923 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.239032984 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.239048004 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.239079952 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.246131897 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.246151924 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.246177912 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.246189117 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.246225119 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.248177052 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.248231888 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.248243093 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.248276949 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.248295069 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.248399019 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.248464108 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.258482933 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.258516073 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.258553982 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.258563042 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.258660078 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.261497974 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.261548996 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.261642933 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.261672020 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.261729002 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.265163898 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.265209913 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.265216112 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.265227079 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.265269041 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.267069101 CEST	49773	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.267088890 CEST	443	49773	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.268142939 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.268162012 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.268263102 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.268270969 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.268328905 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.269548893 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.269603968 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.269609928 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.272512913 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.272567034 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.276850939 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.276894093 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.276958942 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.276958942 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.276968002 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.278997898 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.279042959 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.279052973 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.279061079 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.279160023 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.285487890 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.285531044 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.285546064 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.285553932 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.285659075 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.286478043 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.286494970 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.286537886 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.286545038 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.286572933 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.293409109 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.293457031 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.294226885 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.294246912 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.294329882 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.294329882 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.294337034 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.301182985 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.301225901 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.301254988 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.301264048 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.301306009 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.302794933 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.302813053 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.302968025 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.302977085 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.303997040 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.304121017 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.304127932 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.305649996 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.305691004 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.305733919 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.305742025 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.305783033 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.309597969 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.309634924 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.309660912 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.309672117 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.309690952 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.310726881 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.310776949 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.315803051 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.315861940 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.315885067 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.315893888 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.315937996 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.317069054 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.317087889 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.317127943 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.317135096 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.317178011 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.323210955 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.323230028 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.323272943 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.323280096 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.323323965 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.327902079 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.327929974 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.328078032 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.328296900 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.328314066 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.329054117 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.329072952 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.329137087 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.329143047 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.329191923 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.329958916 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.330091953 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.330102921 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.335550070 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.335587978 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.335666895 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.335675955 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.335700035 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.340864897 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.340883017 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.340922117 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.340929985 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.341245890 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.347011089 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.347033024 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.347105980 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.347105980 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.347112894 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.352706909 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.352725029 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.352763891 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.352771044 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.352807999 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.352857113 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.352941990 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.352947950 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.357336998 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.357372046 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.357414007 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.357420921 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.357448101 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.361953974 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.361985922 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.362020969 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.362027884 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.362063885 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.363338947 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.363364935 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.363507986 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.363673925 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.363686085 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.365236044 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.365391970 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.366424084 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.366427898 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.366449118 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.366465092 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.366488934 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.366503954 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.366504908 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.366509914 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.366528034 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.366553068 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.368628979 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.368690968 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.368699074 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.368714094 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.368756056 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.368974924 CEST	49771	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.368995905 CEST	443	49771	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.371233940 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.371313095 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.375458002 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.375500917 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.375510931 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.375518084 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.375706911 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.379820108 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.379863977 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.379878044 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.379885912 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.379928112 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.383865118 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.383919954 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.387864113 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.387907028 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.387917042 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.387923956 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.388047934 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.391505003 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.391537905 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.391571999 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.391581059 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.391622066 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.395220041 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.398705959 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.398751974 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.398761034 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.398777008 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.398835897 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.398844957 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.402139902 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.402189970 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.402196884 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.405400991 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.405452967 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.405459881 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.405502081 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.405571938 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.405580997 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.408674955 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.408740044 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.408750057 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.408879995 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.408922911 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.409200907 CEST	49776	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.409213066 CEST	443	49776	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.450318098 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.450351000 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.450440884 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.450972080 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.451169968 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.451180935 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.451519966 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.452121973 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.452192068 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.452222109 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.453121901 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.453136921 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.500118017 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.500153065 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.504920006 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.504949093 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.505023003 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.505198002 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.505214930 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.546850920 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.559815884 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.559835911 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.563446999 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.563524008 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.580306053 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.580501080 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.582068920 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.582540989 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.582561016 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.582720041 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.582740068 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.583851099 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.584558010 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.584734917 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.590298891 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.625291109 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.636109114 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.668602943 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.668664932 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.673002005 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.673012972 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.673250914 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.719458103 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.719644070 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.719660997 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.719661951 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.720179081 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.720249891 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.721206903 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.721273899 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.725362062 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.725447893 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.725652933 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.725661039 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.725682974 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.746979952 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.747026920 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.747071028 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.747085094 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.747123003 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.747155905 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.747163057 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.747199059 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.755882025 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.755966902 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.755983114 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.756057024 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.756129026 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.756138086 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.756417036 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.757297993 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.757361889 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.757416964 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.757421970 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.758904934 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.759016991 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.759074926 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.766311884 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.766335011 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.766515017 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.767054081 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.767069101 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.767493010 CEST	49784	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.767505884 CEST	443	49784	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.767749071 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.767822981 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.767827988 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.768954039 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.768969059 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.791678905 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.791763067 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.791825056 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.814701080 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.842343092 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.847944975 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:41.847982883 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:41.848046064 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:41.848345995 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:41.848362923 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:41.848850965 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.851300001 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.851360083 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.851375103 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.851383924 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.851417065 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.855268002 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.855298996 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.855324984 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.855331898 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.855386972 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.864088058 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.864161015 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.870511055 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.870558977 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.870578051 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.870585918 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.870623112 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.876983881 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.877015114 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.877039909 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.877048969 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.877271891 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.882767916 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.882822990 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.888664961 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.888725042 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.888734102 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.888782978 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.892122030 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.893943071 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.894011974 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.894016981 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.894057035 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.895301104 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.895313025 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.895328045 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.895334005 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.895355940 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.895369053 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.895433903 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.895472050 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.895472050 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.895504951 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.899164915 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.899250031 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.904185057 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.904263020 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.904269934 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.904313087 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.936203957 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.936559916 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.936642885 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.936836004 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.936893940 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.936958075 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.937681913 CEST	49788	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:41.937695980 CEST	443	49788	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:41.939711094 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.939734936 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.943211079 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.943232059 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.943300962 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.943358898 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.943418980 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.953840017 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.953984976 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.954044104 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.954097033 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.954112053 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.954123974 CEST	49786	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.954137087 CEST	443	49786	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.955450058 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.955509901 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.956633091 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.956680059 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.956698895 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.956706047 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.956748962 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.961452007 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.961597919 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.965734005 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.965780973 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.965792894 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.965802908 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.965903997 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.970082998 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.970148087 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.970168114 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.970175028 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.970221996 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.972366095 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.972387075 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.972549915 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.972773075 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:41.972784996 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:41.974075079 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.974138975 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.978054047 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.978101969 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.978130102 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.978137016 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.978174925 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.981816053 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.981853008 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.981888056 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.981894016 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.982016087 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.983454943 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.983472109 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.983526945 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.983546972 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:41.983577013 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.983597040 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:41.985517979 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.985579014 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.988982916 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.989027977 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.989034891 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.989073038 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.990278006 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.990561962 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.990581989 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.991770029 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.992115974 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.992234945 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.992302895 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.992455006 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.992496014 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.992501020 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.992517948 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.992558956 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.995738029 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.995784044 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.998956919 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.999017954 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.999022007 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.999072075 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.999257088 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.999263048 CEST	443	49783	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:41.999289989 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.999289989 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:41.999735117 CEST	49783	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.026197910 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.026213884 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.026242018 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.026309013 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.026343107 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.026361942 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.046713114 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.054642916 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.054666996 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.054836035 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.054869890 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.055061102 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.082714081 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.082734108 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.082792997 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.082825899 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.082845926 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.082878113 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.091540098 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.091717005 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.091726065 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.093090057 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.093179941 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.095659018 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.095769882 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.098227024 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.098365068 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.098372936 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.098396063 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.100497007 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.100512028 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.100877047 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.101160049 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.101174116 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.102550983 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.102571011 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.102648020 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.102853060 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.102868080 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.104697943 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.104724884 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.104876995 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.105113029 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.105129004 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.111958027 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.111973047 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.112049103 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.112066984 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.112138033 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.117046118 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.117130041 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.117558956 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.117603064 CEST	443	49785	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.117705107 CEST	49785	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.139260054 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.139267921 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.159634113 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.164995909 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.165020943 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.168562889 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.168644905 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.191220045 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.192734003 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.192852020 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:42.301028967 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.301309109 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.302346945 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.302423954 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.302556992 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.302627087 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.302709103 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.302776098 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.302822113 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.302858114 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.302922964 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.303210020 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.303227901 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.303294897 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.303472996 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.303493023 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.303550005 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.303658962 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.303684950 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.303740978 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.305464029 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.305495024 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.305808067 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.305843115 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.306010008 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.306021929 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.306431055 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.306442022 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.306617975 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.306642056 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.306761980 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.306788921 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.307164907 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.307193041 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.314637899 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.314749002 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.314834118 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.314881086 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.314893961 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.314910889 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.314982891 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.315027952 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.315041065 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.315088034 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.320858002 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.323173046 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.323179960 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.323513031 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.323545933 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.323559999 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.323682070 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.323895931 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.323952913 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.323980093 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.324064016 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.324474096 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.324490070 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.324503899 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.325017929 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.325112104 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.325167894 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.325181007 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.325212955 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.325828075 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.326009989 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.328200102 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.328289032 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.330024004 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.330137014 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.330245018 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.330347061 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.330354929 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.331851959 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:42.331867933 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.332720995 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.333889961 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:42.335452080 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.335508108 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.335521936 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.337980986 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.338088036 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.338140965 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.338155985 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.343561888 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.343655109 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.343667984 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.351727962 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.351788998 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.351802111 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.359970093 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.360053062 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.360093117 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.360121965 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.360297918 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.368175030 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.368233919 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.376108885 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.376466036 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.376517057 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.380108118 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.384386063 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.384470940 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.384504080 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.384511948 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.384556055 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.418832064 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.418886900 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.418900967 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.418971062 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.419027090 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.419039011 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.422544003 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.422559023 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.422593117 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.422605038 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.422636986 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.422647953 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.422656059 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.422705889 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.422732115 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.423348904 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.423424959 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.423437119 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.423566103 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.423809052 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.423867941 CEST	443	49796	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.424017906 CEST	49796	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.430037975 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.430190086 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.430202961 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.431250095 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.436661005 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.436784029 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.436795950 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.436815977 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.436861992 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.436887980 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.442970037 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.443053007 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.443063974 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.443111897 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.443169117 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.443180084 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.444859982 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.444966078 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.445242882 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:42.445821047 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:42.445830107 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.445843935 CEST	49797	443	192.168.2.4	23.33.136.127
Apr 19, 2024 03:40:42.445849895 CEST	443	49797	23.33.136.127	192.168.2.4
Apr 19, 2024 03:40:42.448797941 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.449652910 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.449666977 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.454272985 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.454560995 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.454596996 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.454607964 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.454612970 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.454669952 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.454713106 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.454719067 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.458244085 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.458395004 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.459717035 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.459815025 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.459872961 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.459880114 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.460025072 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.464890003 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.464947939 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.466506958 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.466552973 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.466603994 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.466648102 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.470217943 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.470340014 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.470345974 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.470520973 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.474678040 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.474735975 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.482778072 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.482830048 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.482863903 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.482908010 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.490823984 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.499368906 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.499425888 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.499439001 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.507098913 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.507149935 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.507162094 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.507498026 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.507558107 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.512550116 CEST	49792	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:42.512572050 CEST	443	49792	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:42.523406029 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.523475885 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.523710966 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.523895025 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.524199009 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.524492979 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.524569035 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.524581909 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.524626017 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.524828911 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.524837971 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.526453972 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.529185057 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.529242992 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.531718969 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.531781912 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.531868935 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.533468008 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.533929110 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.533976078 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.534008026 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.534029007 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.536381006 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.536463976 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.536504030 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.536525011 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.536600113 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.538095951 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.538151026 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.538369894 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.538424969 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.538450956 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.538505077 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.542382002 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.542445898 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.546241999 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.546303988 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.546334982 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.546387911 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.547475100 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.547610998 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.547772884 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.547780991 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.547913074 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.548084974 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.548137903 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.549407005 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.549424887 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.549803972 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.549815893 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.549942017 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.549967051 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.550101995 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.550159931 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.550196886 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.550251007 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.551461935 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.551528931 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.553059101 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.553141117 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.553632021 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.553714037 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.553723097 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.553774118 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.558235884 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.558296919 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.558314085 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.558366060 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.560024977 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.560031891 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.560702085 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.560714960 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.560810089 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.560817003 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.560832024 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.560880899 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.560955048 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.561005116 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.563556910 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.563613892 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.563816071 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.563880920 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.564501047 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.564560890 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.564651012 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.564713001 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.566831112 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.566884995 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.566972017 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.567147970 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.567307949 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.599155903 CEST	49801	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:42.599201918 CEST	443	49801	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:42.600802898 CEST	49791	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:42.600852013 CEST	443	49791	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:42.606457949 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.606769085 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.606834888 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.606883049 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.606888056 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.606935024 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.606947899 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.607008934 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.607188940 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.607265949 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.607281923 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.607317924 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.608825922 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.608855009 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.608882904 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.608905077 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.609510899 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.609532118 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.609951019 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.609965086 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.610378981 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.610399008 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.611972094 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.611985922 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.635946989 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636034966 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636054993 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636068106 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.636085987 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636116982 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.636169910 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636189938 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636217117 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.636226892 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636240959 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.636251926 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.636262894 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.653793097 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.653827906 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.653882027 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.653888941 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.653925896 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.654557943 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.654571056 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.655349016 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.655483961 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:42.655591965 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:42.732831955 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.732857943 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.732861042 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.733016014 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.734471083 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.735671043 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.735740900 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.735773087 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.735820055 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.736174107 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.736251116 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.743359089 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.745600939 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764780998 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764817953 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764842033 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764878988 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.764890909 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764910936 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764919996 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.764942884 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.764946938 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.764964104 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.764991999 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765296936 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765315056 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765348911 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765353918 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765364885 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765372038 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765387058 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765388012 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765389919 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765405893 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765425920 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765733957 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765763044 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765784025 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765799999 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765815020 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765827894 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765827894 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765835047 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765855074 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765886068 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765894890 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.765908003 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.765930891 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.772721052 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772757053 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772775888 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772790909 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.772804976 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772821903 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.772825003 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772846937 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772878885 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.772890091 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.772902012 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.772931099 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.774983883 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.775000095 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.775022030 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.775036097 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.775047064 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.775048018 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.775080919 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.775110006 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.775110006 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.775141954 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.834673882 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.840573072 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840615034 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840634108 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840683937 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.840683937 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840708971 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840728998 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.840742111 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840749025 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.840768099 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.840773106 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.840919971 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.880065918 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.880095959 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.880140066 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.880162954 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.880171061 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.880183935 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.880212069 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.880214930 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.880244970 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.880259037 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.880976915 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.881012917 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.881031990 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.881041050 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.881072998 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.881091118 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.881094933 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.881113052 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.881141901 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.881145000 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.881167889 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.881181955 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.886312962 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.886396885 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.886409998 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.886426926 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.886455059 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.886472940 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.887505054 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.887537956 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.887578011 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.887586117 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.887614012 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.887619019 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.887641907 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.887645006 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.887681007 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.889543056 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889560938 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889585972 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889597893 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889605045 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.889621019 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889633894 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889663935 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.889689922 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.889779091 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889794111 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889816999 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889827967 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889847994 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.889875889 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.889902115 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.889921904 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.904896021 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.904973984 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.904984951 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.906789064 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.906847000 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.907850981 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.907866001 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.907923937 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.909219980 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.909271002 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.909307957 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.909358025 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.910934925 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.910969019 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.911015987 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.911166906 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.911166906 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.911206007 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.915235043 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.915299892 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.925307989 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.925373077 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.925415039 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.925440073 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.925470114 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.925487995 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.931848049 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.931910992 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.931965113 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.931978941 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.932013988 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.932028055 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.945549965 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.945568085 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.945594072 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.945631027 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.945636034 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.945668936 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.945688963 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.945741892 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.948164940 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.948261976 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.951375961 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.951447964 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.951724052 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.951786041 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.951874971 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.951927900 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.954454899 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.954582930 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.954628944 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.976129055 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.976202011 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.976222992 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.976243019 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.976277113 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.981899977 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.981942892 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.981957912 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.987413883 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.987477064 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.987493992 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.987540960 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.989362001 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:42.989833117 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.989973068 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:42.990031004 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.011976957 CEST	49803	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.012037039 CEST	443	49803	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.012290955 CEST	49802	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.012300014 CEST	443	49802	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.012901068 CEST	49806	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.012936115 CEST	443	49806	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.013180971 CEST	49807	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.013187885 CEST	443	49807	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.014182091 CEST	49805	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.014226913 CEST	443	49805	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.014349937 CEST	49808	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.014354944 CEST	443	49808	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.014830112 CEST	49810	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.014843941 CEST	443	49810	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.016397953 CEST	49809	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.016415119 CEST	443	49809	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.020853996 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.020867109 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.020914078 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.022183895 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.022197962 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.023226976 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.023303032 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.023367882 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.023951054 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.024029970 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.024085045 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.024333954 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.024377108 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.024966955 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.024985075 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.025033951 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.025933981 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.025969982 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.026154041 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.026170015 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.243803978 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.244019985 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.244029045 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.245388031 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.245641947 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.245745897 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.245752096 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.245836973 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.247294903 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.247473001 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.247504950 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.247601032 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.248131990 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.248192072 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.250654936 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.250708103 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.251049042 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.251167059 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.251177073 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.251194954 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.251394033 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.251485109 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.251843929 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.251944065 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.251950979 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.253984928 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.254204035 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.254237890 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.255808115 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.256473064 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.256798029 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.256810904 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.256922007 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.296113968 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.297794104 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.297821045 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.297843933 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.297909021 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.334414005 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.334491968 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.334558964 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.334717989 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.334734917 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.343554020 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.343590021 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.343646049 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.343807936 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.343816996 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.348475933 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.354885101 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.354942083 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.454989910 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.464637041 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.464694977 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.469885111 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.470979929 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.471046925 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.471075058 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484054089 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484076977 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484112978 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.484122992 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484146118 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.484154940 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484168053 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484178066 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.484196901 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.484203100 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.484215975 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.484241009 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.488557100 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.488571882 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.488611937 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.488645077 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.488668919 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.488755941 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.488756895 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.488756895 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.488756895 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.488828897 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.488893032 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.493758917 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.504496098 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.504563093 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.504611969 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.507565022 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.507586002 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.507635117 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.507843018 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.507848024 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.508719921 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.508773088 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.508836031 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.509063005 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.509078026 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.510102034 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.510183096 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.510246992 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.510562897 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.510601997 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.511009932 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.511037111 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.511086941 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.511416912 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.511432886 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.511744022 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.511776924 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.511816978 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.512294054 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.512310982 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.547442913 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.550795078 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.550854921 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.551275015 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.551914930 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.551987886 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.552054882 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.557776928 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.557980061 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.558037043 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.559658051 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.559715986 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.560009956 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.560106993 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.560122967 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.575181961 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.575237036 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.575256109 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.575268030 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.575299025 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.575328112 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.575328112 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.575357914 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.596122026 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.599622965 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.599647045 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.599677086 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.599689960 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.599719048 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.599720001 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.599737883 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.599744081 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.599780083 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.599822044 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.600068092 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.600163937 CEST	443	49813	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.600214958 CEST	49813	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.603768110 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.603797913 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.603815079 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.603866100 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.603885889 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.603935003 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.603955984 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.603955984 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.603955984 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.603955984 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.604029894 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.604301929 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.608108044 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608557940 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608583927 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608603001 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608618021 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.608634949 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608650923 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608655930 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.608669996 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608689070 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608696938 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.608716011 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.608720064 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.608736992 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.618691921 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618731976 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618766069 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.618794918 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618820906 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.618830919 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618858099 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618877888 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618890047 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.618910074 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.618915081 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.618946075 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.648323059 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.648345947 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.648380041 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.648504972 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.648504972 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.648574114 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.648628950 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.652406931 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652429104 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652446985 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652477026 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.652494907 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652513027 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652518034 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.652529955 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652563095 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.652563095 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.652565956 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.652601957 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.654833078 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.654927015 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.655114889 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.655272007 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.655405998 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.656800032 CEST	49815	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.656816959 CEST	443	49815	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.679786921 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.679837942 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.679857969 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.679877996 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.679883003 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.679914951 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.679948092 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.679948092 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.687063932 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.687089920 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.706008911 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.706058979 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.706085920 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.706115961 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.706116915 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.706123114 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.706146002 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.706178904 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.706198931 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.708425045 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.708496094 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.708563089 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.708856106 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.708903074 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.710925102 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.710989952 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.712456942 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.712492943 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.712532043 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.712538958 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.712557077 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.712573051 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.712593079 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.712598085 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.712610960 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.728230953 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.728620052 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.728677034 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.728799105 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.728975058 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.728987932 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.729684114 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.729732037 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.729756117 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.729769945 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.729818106 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730000019 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.730118036 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.730132103 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730149031 CEST	443	49814	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.730175018 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730175018 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730180979 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.730214119 CEST	49814	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730238914 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730451107 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.730501890 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.730851889 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731065035 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.731152058 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731316090 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.731400967 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731434107 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731457949 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.731494904 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731537104 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731672049 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.731681108 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.731841087 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.731854916 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.732054949 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.732069969 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.732521057 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.732530117 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.733374119 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.733449936 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.734055996 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.734240055 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.734688997 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.734704018 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.735409021 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.735467911 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.735636950 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.735691071 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.735764980 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.735941887 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.736031055 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.736134052 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.736148119 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.736207008 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.736212015 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.736228943 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738415956 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738436937 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738456011 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738472939 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.738500118 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738523960 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.738531113 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738548994 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738583088 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.738615036 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.738641024 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.738658905 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.740339041 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.740364075 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.740410089 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.740792036 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.740803957 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.741163969 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.741236925 CEST	443	49816	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.741292953 CEST	49816	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.756513119 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.756552935 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.756627083 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.756870985 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.756918907 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.770914078 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.770972013 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.771018028 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.771039963 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.776312113 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.776361942 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.776377916 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.783536911 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.783582926 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.783596039 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.790787935 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.790813923 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.790833950 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.790853024 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.790915966 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.797000885 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.797014952 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.797034979 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.797044992 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.797060013 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.797089100 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.797107935 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.797113895 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.797144890 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.797167063 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.798043966 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.798098087 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.804789066 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:43.804826021 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:43.804883957 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:43.805280924 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.805286884 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:43.805305004 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:43.805331945 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.807538033 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:43.807555914 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:43.807624102 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:43.807960987 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:43.807971954 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:43.812527895 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.812577963 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.812592983 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.812644005 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.833559036 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.833631992 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.874974012 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.875508070 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.878554106 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.878699064 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.884711981 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.884717941 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.885267019 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.885281086 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.886029959 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.886076927 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.886121035 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.886138916 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.886746883 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.893238068 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.893390894 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.900574923 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.900635004 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.900681973 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.900696039 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.903032064 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.907885075 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.913100004 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.913114071 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.913178921 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.913228989 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.913252115 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.913283110 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.913341999 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.913341999 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.913355112 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.913391113 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.913606882 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.914992094 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.915010929 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.915333033 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.915352106 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.915821075 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.922317028 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.922435999 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.922935963 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.927112103 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.930847883 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.930859089 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.931021929 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.932149887 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.932216883 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.932250977 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.935522079 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.936283112 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:43.936357975 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:43.936542988 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:43.938652039 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.942065954 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.944000006 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:43.944035053 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:43.944086075 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.944358110 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.944399118 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.944405079 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.944446087 CEST	49820	443	192.168.2.4	142.250.9.139
Apr 19, 2024 03:40:43.944475889 CEST	443	49820	142.250.9.139	192.168.2.4
Apr 19, 2024 03:40:43.944947958 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.945048094 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.945058107 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.945579052 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.958894968 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.959117889 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.959117889 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.959157944 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.959311962 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.959321976 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.959328890 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.960977077 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.963030100 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.963030100 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.963042974 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.963207960 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.965281010 CEST	49822	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.965303898 CEST	443	49822	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.966753960 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:43.968197107 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.968211889 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.968247890 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.968281984 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.968281984 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.968306065 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.968336105 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.968359947 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.968359947 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.968373060 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.968542099 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.971297979 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.971337080 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.971357107 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.971391916 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.971401930 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.971425056 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.971457958 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.971466064 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.971466064 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.971496105 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.971524954 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973252058 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973290920 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973382950 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973387003 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973383904 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973383904 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973402977 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973455906 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973510981 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973587036 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973644018 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973669052 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973710060 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973716974 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973726988 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973747969 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973762989 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973784924 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973786116 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:43.973824024 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.973948956 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:43.976478100 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.977251053 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.977269888 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.978462934 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.979111910 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.979202032 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:43.979239941 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:43.986345053 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:43.986367941 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:43.986495972 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:43.986785889 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:43.986800909 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.012108088 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.012336969 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.012381077 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.014750957 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.014826059 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.014974117 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.018754959 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.018788099 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.019541025 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.020136118 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.020590067 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.020605087 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.020905018 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.021653891 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.021716118 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.021780968 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.021781921 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.021809101 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.023720026 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.024139881 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.024167061 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.025262117 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.027030945 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.027148008 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.027148962 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.027167082 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.027215958 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.029814959 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.049459934 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.049496889 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.049546003 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.049568892 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.049571037 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.049571037 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.049588919 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.049618959 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.049622059 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.049622059 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.049648046 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.049839973 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.083609104 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.083623886 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.083655119 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.083667994 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.083697081 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.083714008 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.083740950 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.083926916 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.086776972 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.086812973 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.086860895 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.086864948 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.086888075 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.086908102 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.086934090 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.086967945 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.086967945 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.087018013 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.088706017 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088728905 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088781118 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088824034 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.088840008 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088876963 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088886023 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088912010 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088942051 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.088951111 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088960886 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.088980913 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.088980913 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.089018106 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.089040041 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.089314938 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.093060970 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.093096972 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.093142033 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.093163013 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.093175888 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.093182087 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.093192101 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.093216896 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.093218088 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.093255997 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.093372107 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.115709066 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.115880013 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.115885973 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.116020918 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.116574049 CEST	49829	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.116601944 CEST	443	49829	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.117646933 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.117712975 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.117713928 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.117742062 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.117773056 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.117794037 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.117819071 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.117841005 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.118431091 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.118455887 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.119640112 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.119734049 CEST	443	49826	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.119810104 CEST	49826	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.121321917 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.121377945 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.121814966 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.121814966 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.121886015 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.131426096 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.131437063 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.131480932 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.131527901 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.131541967 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.131566048 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.131828070 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.133249044 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.133274078 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.133384943 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.133384943 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.133429050 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.134285927 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.136573076 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.136784077 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.136790991 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.136811972 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.136960030 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.139221907 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.140115023 CEST	49830	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.140125990 CEST	443	49830	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.142492056 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.142539978 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.142863035 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.142863989 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.142988920 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.151371002 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.151664019 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.152028084 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.152035952 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.152075052 CEST	443	49828	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.152086020 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.152173996 CEST	49828	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.152177095 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.152542114 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.152574062 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.153027058 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.153187037 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.154645920 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.154680967 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.154726982 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.154737949 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.154767990 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.154776096 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.154784918 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.154803038 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.154858112 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.154866934 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.155685902 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.155740976 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.155895948 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.156797886 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.156797886 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.156840086 CEST	443	49827	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.156990051 CEST	49827	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.159317017 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.162759066 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.162817001 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.163342953 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.167043924 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.167152882 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.167180061 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.167181015 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.167223930 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.169416904 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.169644117 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.169653893 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.179259062 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.179331064 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.179368019 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.179374933 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.179387093 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.179440022 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.179583073 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.179681063 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.179766893 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.179929972 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:44.179939985 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.180334091 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:44.180404902 CEST	443	49774	64.233.176.147	192.168.2.4
Apr 19, 2024 03:40:44.180660963 CEST	49774	443	192.168.2.4	64.233.176.147
Apr 19, 2024 03:40:44.183610916 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.184144020 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.184217930 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.184225082 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.184231043 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.186743021 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.188350916 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.188355923 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.188435078 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.188441038 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.188445091 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.188462973 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.188483000 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.190738916 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.190812111 CEST	443	49825	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.190885067 CEST	49825	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.200918913 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.202745914 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.202754021 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.203320026 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.203783989 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.203783989 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.203803062 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.203888893 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.203912973 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.215365887 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.215428114 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.215688944 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.215688944 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.215751886 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.232214928 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.232908964 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.232928038 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.233933926 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.234023094 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.234597921 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.234668016 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.234704971 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.248109102 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.273469925 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.273500919 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.273580074 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.273612976 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.273644924 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.273644924 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.273644924 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.273680925 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.273727894 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.273727894 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.273727894 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.273735046 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.274085045 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.280108929 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.292423010 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.292490005 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.292551994 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.292551994 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.292599916 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.292629004 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.292823076 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.296006918 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.296134949 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.298747063 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.298845053 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.299258947 CEST	443	49832	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.299304008 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.300092936 CEST	49832	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.301038027 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.301074028 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.301155090 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.301624060 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.301639080 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.306180000 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.306308985 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.306497097 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.306608915 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.306638956 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.306663036 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.306735992 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.314205885 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.314282894 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.314310074 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.314316034 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.314666986 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.320672035 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.320903063 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.320943117 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.320956945 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.320987940 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.321000099 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.321017981 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.321017981 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.321192980 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.324722052 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.324744940 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.325063944 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.325093985 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.325196028 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.325196981 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.325201035 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.325201988 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.325222015 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.325241089 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.327446938 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.336683035 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.339111090 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.339123964 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.339728117 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.344955921 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.356585979 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.356600046 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.356934071 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.357065916 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.358258963 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.358288050 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.358366013 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.358598948 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.358716011 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.358743906 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.360222101 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.360546112 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.360577106 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.361351967 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.361406088 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.361435890 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.361440897 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.361459970 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.361488104 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.361502886 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.361569881 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.362035990 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.362099886 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.362514019 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.362611055 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.362656116 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.364511967 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.364541054 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.364598036 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.364630938 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.364633083 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.364649057 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.365130901 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.370100975 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.370443106 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.370464087 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.374176025 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.374336958 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.374689102 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.374804020 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.374814987 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.374923944 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.374959946 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.374988079 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.375019073 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.375024080 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.375051975 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.385364056 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.385390043 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.385436058 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.385442019 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.385603905 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.388426065 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.388436079 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.388457060 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.388463020 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.400119066 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.400151968 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.401658058 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.402029991 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.402154922 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.402635098 CEST	49838	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.402672052 CEST	443	49838	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.404617071 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.404638052 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.404680014 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.404699087 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.404733896 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.404733896 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.404745102 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.404786110 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.404810905 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.405184984 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.405190945 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.408109903 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.410109997 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.410173893 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.413614035 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.413686037 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.413707018 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.413815022 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.420933962 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.421015024 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.421040058 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.421049118 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.421308994 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.426983118 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.426994085 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.427000999 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.427057981 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.427629948 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.427727938 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.432887077 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.432962894 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.433017969 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.433024883 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.433063030 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.433208942 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.434851885 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.434933901 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.434968948 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.434984922 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.435175896 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.435225010 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.435894966 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.435954094 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.439340115 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.439579964 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.439840078 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.439924955 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.439965963 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.440974951 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.441070080 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.441099882 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.441107035 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.441216946 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.441962957 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.442096949 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.442277908 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.443036079 CEST	49839	443	192.168.2.4	64.233.177.101
Apr 19, 2024 03:40:44.443046093 CEST	443	49839	64.233.177.101	192.168.2.4
Apr 19, 2024 03:40:44.447334051 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.447469950 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.453088045 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.453141928 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.453192949 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.453238964 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.458848953 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.458925009 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.458954096 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.458961010 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.459357023 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.461122036 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.461170912 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.461220026 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.461225986 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.461390972 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.462054014 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.468547106 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.468663931 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.472214937 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.472285986 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.472316027 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.472326040 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.472485065 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.473885059 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.473896980 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.473954916 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.473988056 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.473998070 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.474036932 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.474060059 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.474085093 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.474085093 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.474112988 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.474112988 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.474693060 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.474724054 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.474771976 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.474777937 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.474958897 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.480706930 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.480750084 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.480823994 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.480835915 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.481354952 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.484112978 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.488537073 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.488739967 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.490364075 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.490412951 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.490457058 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.490462065 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.490503073 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.490503073 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.495512009 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.495600939 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.495631933 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.495635986 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.498862982 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.501641989 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.501686096 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.501720905 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.501728058 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.503204107 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.505052090 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.505108118 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.505163908 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.505172014 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.505196095 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.507271051 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.507522106 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.507527113 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.507622957 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.508142948 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.513458014 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.513485909 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.513503075 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.513506889 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.513880014 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.514372110 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.514492989 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.516614914 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.516693115 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.518917084 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.518954039 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.518971920 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.518975973 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.519264936 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.519310951 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.519365072 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.519392014 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.519612074 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.521145105 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.521241903 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.521285057 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.521342993 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.521349907 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.521378040 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.521548986 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.522042036 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.522059917 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.523232937 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.523853064 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.523972988 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.524023056 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.524044037 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.524048090 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.528620958 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.528696060 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.528707981 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.528719902 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.529179096 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.529261112 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.529263020 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.532998085 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.533066988 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.533078909 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.533174038 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.534472942 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.534548998 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.534593105 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.534599066 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.534672022 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.534727097 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.536096096 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.536137104 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.536209106 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.536214113 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.536552906 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.537168026 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.537343979 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.541310072 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.541388988 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.541390896 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.541414022 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.541753054 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.541827917 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.542453051 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.542464018 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.543865919 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.543943882 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.544322968 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.544399977 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.544429064 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.545052052 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.545130014 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.545157909 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.545164108 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.545207977 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.547039986 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.547106028 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.547142029 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.547147989 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.547162056 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.547247887 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.548789978 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.548875093 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.549001932 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.552324057 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.552405119 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.552464962 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.552635908 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.552764893 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.552764893 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.559007883 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.559612036 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.559643984 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.561248064 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.561289072 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.561353922 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.561359882 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.561394930 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.561475992 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.563173056 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.563313961 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.564121008 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.572451115 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.572536945 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.572707891 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.572812080 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.572851896 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.572871923 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.572896004 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.572902918 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.572923899 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.573004961 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.575093031 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.575208902 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.577939034 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.577955008 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.578008890 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.578088045 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:44.578135967 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.578528881 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:44.578603983 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.578622103 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.578648090 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.578651905 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.578655958 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.578660011 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.578680038 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.578687906 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.578701973 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.578723907 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.578733921 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.579272985 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:44.579301119 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.582356930 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.582427025 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.583358049 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.583880901 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.583997011 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.584022999 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.585841894 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.585885048 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.586039066 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.586039066 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.586046934 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.586962938 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.586997032 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.587025881 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.587033033 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.587706089 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.588498116 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588505030 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588540077 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588562012 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588568926 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588598013 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.588598013 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.588613987 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588654041 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.588680983 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.588680983 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.588816881 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.589622021 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.589664936 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.589817047 CEST	443	49840	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.589881897 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.589881897 CEST	49840	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.591253042 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.591331005 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.591336966 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.591450930 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.592108965 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.595383883 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.595470905 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.596617937 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.596659899 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.596740961 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.596740961 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.596751928 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.598345995 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.598457098 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.598463058 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.599433899 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.599489927 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.599539042 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.599543095 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.599683046 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.600152016 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.600249052 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.600255013 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.600712061 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.603280067 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.603302956 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.603348017 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.603353977 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.603452921 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.603673935 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.603785038 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.605067968 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.605196953 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.606854916 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.606942892 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.608181953 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.608241081 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.608305931 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.608313084 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.608328104 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.610493898 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.610567093 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.610724926 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.610728025 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.610888958 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.613949060 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.613972902 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.614162922 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.614168882 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.615883112 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.617044926 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.617058992 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.617142916 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.617151976 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.617177010 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.617194891 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.617248058 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.620382071 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.620484114 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.620488882 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.623486996 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.623589993 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.623596907 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.625077963 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.625101089 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.625109911 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.625129938 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.625159979 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.625166893 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.625655890 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.625662088 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.625706911 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.625706911 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.627985001 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.628065109 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.628129005 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.628134012 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.630728006 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.631259918 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.631361008 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.634485960 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.634500027 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.634620905 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.634639978 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.634646893 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.634646893 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.634665966 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.634670019 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.634722948 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.635262966 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.639975071 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.640045881 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.640074968 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.640079021 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.640688896 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.641429901 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.641457081 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.641469955 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.641642094 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.641642094 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.641653061 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.641864061 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.642611027 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.642704964 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.644915104 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.645045042 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.645070076 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.645140886 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.645308018 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.645382881 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.646738052 CEST	49850	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.646776915 CEST	443	49850	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.649234056 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.649286985 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.649347067 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.649354935 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.649430990 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.655620098 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.655636072 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.655744076 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.655745029 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.655754089 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.662755013 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.662766933 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.662847042 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.662853956 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.663369894 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663408041 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663446903 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663461924 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663485050 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663527012 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.663527012 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.663527012 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.663608074 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663664103 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.663664103 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.663677931 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.663706064 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.663722992 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.664041996 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.664047956 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.664652109 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.665009975 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.665015936 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.665245056 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.666634083 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.666748047 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.667687893 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.667870998 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.668577909 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.668823004 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.669487953 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.669903040 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.674973965 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.675024033 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.675060034 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.675076962 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.675103903 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.676491022 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.676610947 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.676673889 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.676680088 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.676742077 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676770926 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676790953 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676810026 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.676815987 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.676815987 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.676836014 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676862001 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676868916 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.676883936 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676901102 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676917076 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.676939011 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.676963091 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.677273035 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.677558899 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.677679062 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.677711010 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.677715063 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.678086996 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.680088997 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.680165052 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.680252075 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.680268049 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.680376053 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.680376053 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.680386066 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.682486057 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.682724953 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.682729959 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.682754993 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.683080912 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.683080912 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.685389996 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.685403109 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.686146021 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.686153889 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.691205025 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.691219091 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.691262007 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.691293001 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.691293001 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.691302061 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.691396952 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.693820000 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.693849087 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.693938971 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.693938971 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.693948030 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.694308996 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.695894003 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.695955038 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.695992947 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.695998907 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.696053028 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.697407961 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.697468996 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.697527885 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.697582960 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.697793961 CEST	49831	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.697804928 CEST	443	49831	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.700427055 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700452089 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700469971 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700505972 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.700509071 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700530052 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700561047 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.700561047 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.700575113 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700615883 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.700645924 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.700645924 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.707189083 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707220078 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707278967 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707283974 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707290888 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707312107 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707317114 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.707317114 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.707338095 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.707348108 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.707417965 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.723575115 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723598957 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723614931 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723649025 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.723654985 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723675013 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723691940 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.723691940 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723718882 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.723720074 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.723720074 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.723826885 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.724617004 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.724633932 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.725692987 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.725974083 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.725985050 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.732429981 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734018087 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.734023094 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.734186888 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734217882 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734256983 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734256029 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.734292984 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734319925 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.734319925 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.734328985 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734352112 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734421968 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734446049 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.734462023 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.734502077 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.734502077 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.738401890 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.738425016 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.738590002 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.738590002 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.738598108 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.738745928 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.740142107 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.740158081 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.740223885 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.740557909 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.740573883 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.745075941 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.745374918 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.745374918 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.745425940 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.745570898 CEST	443	49842	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.745665073 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.745666027 CEST	49842	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.750608921 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.750638008 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.750677109 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.750714064 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.750813007 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.750824928 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.751041889 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.751594067 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.751671076 CEST	443	49846	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:44.751827002 CEST	49846	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:44.754287958 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.754311085 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.754328966 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.754358053 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.754365921 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.754374981 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.754374981 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.754394054 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.754494905 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.754646063 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.754709005 CEST	443	49851	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.754770994 CEST	49851	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.756375074 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.756475925 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.756570101 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.756598949 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.756604910 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.756623030 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.759139061 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.759282112 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.759459019 CEST	49852	443	192.168.2.4	142.251.15.105
Apr 19, 2024 03:40:44.759469032 CEST	443	49852	142.251.15.105	192.168.2.4
Apr 19, 2024 03:40:44.765270948 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.765301943 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.765377045 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.765614033 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.765629053 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.767237902 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.767260075 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.767298937 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.767318964 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.767337084 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.767337084 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.767354965 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.767359972 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.767390013 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.791615009 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.791649103 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.791685104 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.791692972 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.791713953 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.791717052 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.791759968 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.791769981 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.791779041 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.791867971 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.796247005 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.796331882 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.804491043 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.804512978 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.804570913 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.804589033 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.804589033 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.804619074 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.804667950 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.804668903 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.804668903 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.805754900 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.806117058 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:44.806133986 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.806624889 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.807117939 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:44.807200909 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.807419062 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:44.815315008 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.815336943 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.815370083 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.815402985 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.815402985 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.815413952 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.815494061 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.815500975 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.815541029 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.818861961 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.831327915 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.831368923 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.831389904 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.831423998 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.831428051 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.831428051 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.831455946 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.831484079 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.831578016 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.834830999 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.834963083 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.835058928 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.847925901 CEST	49843	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.847963095 CEST	443	49843	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.848752022 CEST	49847	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.848778963 CEST	443	49847	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.852108002 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:44.884821892 CEST	49834	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.884840012 CEST	443	49834	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.943083048 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.943393946 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.943413019 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.945154905 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.945190907 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.945322037 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.947355986 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.947429895 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.950463057 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.950483084 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.950833082 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.950908899 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.950973988 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.950980902 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.959606886 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.959675074 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.959836960 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.960033894 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.960067034 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.968641043 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.969444990 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.969471931 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.969939947 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.970223904 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.970302105 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.970388889 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.970406055 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.970417023 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.984011889 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.984226942 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.984236956 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.987751961 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.987812042 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.988431931 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.988511086 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:44.988526106 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.988593102 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:44.992291927 CEST	49835	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.992309093 CEST	443	49835	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.993671894 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.993730068 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:44.993798971 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.994457006 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:44.994484901 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.077790976 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.077853918 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.077871084 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.137109995 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.137271881 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.137393951 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.137418985 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.137574911 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.137634039 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.137650013 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.137720108 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.147475004 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.147576094 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.147635937 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.147650003 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.150182962 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.150258064 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.150402069 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.150636911 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.150671959 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.152268887 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.158068895 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.158153057 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.158168077 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.169030905 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.169280052 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.169305086 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.170492887 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.171040058 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.171040058 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.171221018 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181154013 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181176901 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181195974 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181226015 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.181237936 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181256056 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181262016 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.181281090 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.181288958 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.181299925 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.181982994 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.182054996 CEST	443	49858	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.182207108 CEST	49858	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.183645964 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.183937073 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.183976889 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.184880018 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.184912920 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.184981108 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.185025930 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.185642958 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.185667992 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.187591076 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.187659025 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.188093901 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.188309908 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.188769102 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.188787937 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.189114094 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.189156055 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.189225912 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.189483881 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.189506054 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.195030928 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.198329926 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.198450089 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.198492050 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.198503971 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.198687077 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.198741913 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.198748112 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.198846102 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.198889971 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.199364901 CEST	49859	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.199374914 CEST	443	49859	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.203124046 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.203176975 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.203284025 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.203424931 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.203453064 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.208679914 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.208966017 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.208986998 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.209336996 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.209631920 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.209702015 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.209821939 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.209821939 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.209856033 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.224229097 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224257946 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224277020 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224289894 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.224308968 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224327087 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224345922 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224355936 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.224402905 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.224402905 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.224409103 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224451065 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.224759102 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.224818945 CEST	443	49860	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.224875927 CEST	49860	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.226994991 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.227056026 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.227515936 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.227801085 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.227830887 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.228627920 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.228641987 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.228724957 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.228861094 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.228885889 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.231709957 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.231893063 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.241064072 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.241122007 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.241136074 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.241162062 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.241224051 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.241236925 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.245415926 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.245474100 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.245486975 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.245510101 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.245579958 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.245593071 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.254317045 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.254373074 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.254386902 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.261271000 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.261331081 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.261344910 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.261383057 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.261432886 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.261446953 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.268441916 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.268496037 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.268508911 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.268532991 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.268672943 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.268686056 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.274732113 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.274794102 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.274806976 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.282618046 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.282677889 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.282691002 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.282716036 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.282768965 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.282783031 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.286593914 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.286675930 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.286679029 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.286703110 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.286796093 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.292165995 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.292251110 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.304182053 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.304259062 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.304275036 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.304327011 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.345170975 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.345244884 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.345261097 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.345283985 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.345345020 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.347845078 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.347913980 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.350562096 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.350627899 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.355045080 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.355113983 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.355129957 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.355185032 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.359572887 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.359652996 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.359659910 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.359682083 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.360853910 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.363874912 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.363940954 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.368032932 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.368117094 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.368129015 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.368150949 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.368283987 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.372035980 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.372113943 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.372136116 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.372191906 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.375058889 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.375303984 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.375340939 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.375875950 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.375935078 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.376537085 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.376846075 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.376961946 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.377038956 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.379036903 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.379543066 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.379606009 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.379622936 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.379673958 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.383033037 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.383095026 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.383117914 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.386310101 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.386370897 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.386385918 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.386410952 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.386476994 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.386490107 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.389688015 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.389755011 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.389767885 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.389988899 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.390053988 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.390240908 CEST	49856	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.390259027 CEST	443	49856	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.400806904 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.400830984 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.400866032 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.400883913 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.400890112 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.400912046 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.400921106 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.400943995 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.401140928 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.401216984 CEST	443	49861	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.401274920 CEST	49861	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.401634932 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.401721001 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.402122021 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.402162075 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.403181076 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.403258085 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.403505087 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.403579950 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.404917955 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.404934883 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.410413027 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.410888910 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.410904884 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.414658070 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.414742947 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.415021896 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.415143013 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.415153980 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.415251970 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.425904036 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.426913023 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.426959991 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.428075075 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.431024075 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.431111097 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.431128025 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.431432009 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.431454897 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.431493998 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.431516886 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.431545019 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.431574106 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.431596041 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.435457945 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.443559885 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.443681955 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.443774939 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.443810940 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.443957090 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.444082975 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.444153070 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.444787979 CEST	49863	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.444816113 CEST	443	49863	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.446193933 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.446436882 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.446468115 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.447648048 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.447954893 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.448218107 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.448230982 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.448684931 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.448877096 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.449099064 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.449157953 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.449225903 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.449336052 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.449367046 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.449506044 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.449537039 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.449819088 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.449819088 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.449966908 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.472142935 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.492140055 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.506020069 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.506283045 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.506362915 CEST	443	49862	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.506422997 CEST	49862	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.508500099 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.508512020 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.508579016 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.509022951 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.509042978 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.509381056 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.509399891 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.509488106 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.509831905 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.509845018 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.589947939 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.589966059 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.612153053 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.612242937 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.614866018 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.614922047 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.615297079 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.625210047 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.625247955 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.644447088 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.644499063 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.644525051 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.644555092 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.644587994 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.644779921 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.644840956 CEST	443	49867	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.644896030 CEST	49867	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.652699947 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.652726889 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.652746916 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.652785063 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.652811050 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.652831078 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.652863026 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.652863026 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.652864933 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.652863026 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.652915001 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.652915001 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.653559923 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.653640032 CEST	443	49866	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.653703928 CEST	49866	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.656544924 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.656589985 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.656661034 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.656913042 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.656932116 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.657279968 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.657311916 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.657989025 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.658075094 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.658147097 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.658340931 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.658377886 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.670983076 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.671264887 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.671278000 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.671744108 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.672022104 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.672112942 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.672132015 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.679769993 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.679889917 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.679946899 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.679969072 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.680129051 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.680181980 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.680195093 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.680310965 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.680753946 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.680775881 CEST	443	49868	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.680799007 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.681783915 CEST	49868	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.686446905 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686484098 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686495066 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686508894 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686539888 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686549902 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686569929 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686583042 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686587095 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686604977 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686604977 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686620951 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686629057 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.686641932 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686641932 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686652899 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.686666012 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.687092066 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.687160015 CEST	443	49870	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.687223911 CEST	49870	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.688385010 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.688518047 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.688596964 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.688631058 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.688750982 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.688821077 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.688837051 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.688890934 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.699749947 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.699901104 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.701409101 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.701431036 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.708091974 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.708168030 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.708184958 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.720113993 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.729197025 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.729398966 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.729444981 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.729456902 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.729556084 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.729564905 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.730936050 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.731116056 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.731153011 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.731168985 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.731276989 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.731349945 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.731373072 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.731578112 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.731651068 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.731739998 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.731746912 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.731810093 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.731817007 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.735234976 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.735292912 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.735368967 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.735567093 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.735600948 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.766427994 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.766511917 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.766899109 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.766974926 CEST	443	49869	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.767030954 CEST	49869	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.769531012 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.769567013 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.769634962 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.769824982 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.769850016 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.792788029 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.792848110 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.792870998 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.792922020 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.792974949 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.792989016 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.796052933 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.796154976 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.796169043 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.796221972 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.796299934 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.796313047 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.802434921 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.802593946 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.802607059 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.808976889 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.809061050 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.809088945 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.809106112 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.809155941 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.812160969 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.812208891 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.812438011 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.814050913 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.814074039 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.815514088 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.815632105 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.815635920 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.815658092 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.815709114 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.822027922 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.822107077 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.827819109 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.827893972 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.827908993 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.827963114 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.833035946 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.833112001 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.833120108 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.833141088 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.833198071 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.838361979 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.838442087 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.843540907 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.843617916 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.843626022 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.843647957 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.843700886 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.874397039 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.874841928 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.874880075 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.875853062 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.875941038 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.876368046 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.876431942 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.876502991 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.876517057 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.877899885 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.878767014 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.878799915 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.882441044 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.882531881 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.882908106 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.883069038 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.883080959 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.883105993 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.896915913 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.896989107 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.897897005 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.897954941 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.897974968 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.898037910 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.902674913 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.902755022 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.907048941 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.907107115 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.907120943 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.907181978 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.911420107 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.911483049 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.911499023 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.911515951 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.912791014 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.915467024 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.915554047 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.915611029 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.915673018 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.915807962 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.915863037 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.915893078 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.915914059 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.915961027 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.916579008 CEST	49871	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.916608095 CEST	443	49871	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.919405937 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.919469118 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.919470072 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.919486046 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.919538021 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.923111916 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.923165083 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.923186064 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.923199892 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.925118923 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.926846981 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.926918030 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.930279016 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.930349112 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.930361032 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.930416107 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.933796883 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.933835983 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.933861017 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.933875084 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.935794115 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.935810089 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.935818911 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.937134981 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.937175035 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.937195063 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.937272072 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.937472105 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.939018011 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.939095020 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.939138889 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.940452099 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.940510988 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.940731049 CEST	49872	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:45.940749884 CEST	443	49872	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:45.941735983 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.941812992 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.941935062 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.942152023 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.942214012 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.942368031 CEST	49865	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:45.942389965 CEST	443	49865	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:45.945302010 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.945355892 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.945440054 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.945620060 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.945647001 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.953701019 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.956485987 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.956502914 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.957632065 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.961472988 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.961657047 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.961844921 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.961944103 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:45.962033033 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:45.966636896 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.966661930 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.966702938 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.966710091 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.966722012 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.966737986 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.966744900 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.966746092 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.966766119 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.966780901 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.966782093 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.967017889 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.983414888 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.983443022 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.992990017 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.995229006 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.995261908 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.998847961 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.998928070 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.999454975 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.999545097 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:45.999625921 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:45.999677896 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.031541109 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.033190012 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.033209085 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.034307957 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.037277937 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.037373066 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.037384033 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.037456989 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.041527033 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.042540073 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.042680979 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.042862892 CEST	49873	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.042880058 CEST	443	49873	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.084177017 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.084264040 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.084353924 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.086949110 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.086980104 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.087059975 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.087112904 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.087172985 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.088098049 CEST	49874	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.088150024 CEST	443	49874	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.090403080 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.090440989 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.090521097 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.090668917 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.090684891 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.095015049 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.095045090 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.095112085 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.095252037 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.095264912 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116060019 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116082907 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116127014 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116154909 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.116182089 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116206884 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116208076 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.116225958 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116260052 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.116274118 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.116302013 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.116321087 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.117033005 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.117105007 CEST	443	49875	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.117170095 CEST	49875	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.158893108 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.161185980 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.161227942 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.161751986 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.165247917 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.165338039 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.165374041 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.189776897 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.189925909 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.190100908 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.190121889 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.190166950 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.190351009 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.190409899 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.190969944 CEST	49876	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.190993071 CEST	443	49876	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.193373919 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.193397999 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.193473101 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.193764925 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.193779945 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.201971054 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.202156067 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.202240944 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.202269077 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.202327013 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.203681946 CEST	49877	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.203717947 CEST	443	49877	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.205424070 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.205462933 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.205547094 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.205707073 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.205734015 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.207010984 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.207036018 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.207089901 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.207236052 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.207247972 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.212116003 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.241580009 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271013975 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271035910 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271069050 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271110058 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271127939 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271246910 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.271246910 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.271248102 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.271248102 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.271276951 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.271333933 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.304919958 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.305509090 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.305530071 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.306005001 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.307579994 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.307744980 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.307806015 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.307986021 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.308072090 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.308096886 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.308141947 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.308466911 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.308549881 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.308605909 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.349610090 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.349719048 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.349984884 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.350061893 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.350460052 CEST	443	49878	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.350523949 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.350552082 CEST	49878	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.356115103 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.356122971 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.370779991 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.370873928 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.370944977 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.371444941 CEST	49880	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.371479988 CEST	443	49880	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.373979092 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.374056101 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.374140024 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.374331951 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.374365091 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.375199080 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.375274897 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.377558947 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.377741098 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.377775908 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.411501884 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.413111925 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.413125992 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.414273977 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.417171955 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.417171955 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.417191982 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.417354107 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.427413940 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.427437067 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.427750111 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.427764893 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.427862883 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.427884102 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.429035902 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.429347038 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.429436922 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.429457903 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.431837082 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.431883097 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.432143927 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.432228088 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.432235003 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.435834885 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.436975002 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.476106882 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.476118088 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.483902931 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.483910084 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.515166044 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.515292883 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.515361071 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.515469074 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.515686035 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.515892982 CEST	49881	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.515933990 CEST	443	49881	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.518819094 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.518876076 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.518944025 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.519001007 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.519026041 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.519062996 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.519103050 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.519124985 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.519460917 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.519498110 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.519948006 CEST	49882	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.519980907 CEST	443	49882	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.522238970 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.522270918 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.522346020 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.522481918 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.522521973 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.531250954 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.588080883 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.588303089 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.588336945 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.588871956 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.589128971 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.589219093 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.589231968 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.594846010 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.595155954 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.595216990 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.596759081 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.597022057 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.597105980 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.597220898 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.624150991 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.624265909 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.624686003 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.632138968 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.638024092 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.638251066 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.638380051 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.638437986 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.638894081 CEST	49885	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.638909101 CEST	443	49885	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.639084101 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.639262915 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.639398098 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.639456034 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.639663935 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.641824007 CEST	49884	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.641846895 CEST	443	49884	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.644495964 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.644520998 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.644576073 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.644720078 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.644726038 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.645478010 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.645530939 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.645642042 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.645807028 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.645837069 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.647593021 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.647754908 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.647819042 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.647833109 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.647996902 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.648051977 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.648057938 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.648260117 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.648617983 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.648628950 CEST	443	49883	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:46.648673058 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.648778915 CEST	49883	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:46.731973886 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.734880924 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.734904051 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.734960079 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.735426903 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.735439062 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.736994982 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.737270117 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.737287998 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.737668037 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.738037109 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.738116980 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.738195896 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.741019964 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.741246939 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.741281033 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.742610931 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.742974043 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.743089914 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.743105888 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.743161917 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.780148029 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.794322968 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.797971010 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.798055887 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.798144102 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.798197031 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.798814058 CEST	49886	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.798834085 CEST	443	49886	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.801798105 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.801843882 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.801947117 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.802229881 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.802243948 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.803457975 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.803497076 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.803555012 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.803771973 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.803786039 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.806303978 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.806492090 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.806636095 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.806694984 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.807029009 CEST	49887	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.807048082 CEST	443	49887	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.864701986 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.865051985 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.865071058 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.865120888 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.865297079 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.865319014 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.866178989 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.866426945 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.866816998 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.866991997 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.867067099 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.867199898 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.867230892 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.867233992 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.912110090 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.912136078 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.918220043 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.947539091 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.947607040 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.947663069 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:46.947758913 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.948295116 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.948295116 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:46.953917027 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.954102039 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.954116106 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.955296993 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.955946922 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.956238985 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.956351995 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.956438065 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:46.956444025 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:46.993581057 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.016156912 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.016494036 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.016511917 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.016988039 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.017240047 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.017324924 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.017345905 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.018901110 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.018913031 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.018930912 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.018939972 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.018981934 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.019056082 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.019090891 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.019107103 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.019134998 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.021179914 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.021378994 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.021436930 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.021913052 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.022156954 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.022245884 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.022260904 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.060122013 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.064579010 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.064579964 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.064606905 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.073859930 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.074054003 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.074099064 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.074115992 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.074249029 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.074290991 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.074700117 CEST	49892	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.074714899 CEST	443	49892	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097220898 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097347021 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097385883 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097413063 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.097436905 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.097460985 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097492933 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097620010 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097660065 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.097666979 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.097712994 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.098042965 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.098079920 CEST	443	49889	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.098105907 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.098130941 CEST	49889	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.098881006 CEST	49891	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.098898888 CEST	443	49891	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.102833986 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.102902889 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.102971077 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.103281975 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.103307009 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.103349924 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.103543997 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.103578091 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.103666067 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.103678942 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.105282068 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.105320930 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.105376959 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.105551004 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.105566978 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.107522964 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.107558966 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.107621908 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.108251095 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.108282089 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.123112917 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.187504053 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.187670946 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.187732935 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.187760115 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.188024044 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.188076973 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.188085079 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.188278913 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.188334942 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.188652992 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.188664913 CEST	443	49893	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.188703060 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.188713074 CEST	49893	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.190993071 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.191072941 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.191157103 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.191339970 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.191364050 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.226300955 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.230690956 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.230874062 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.230945110 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.230978966 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.231015921 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.231066942 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.231375933 CEST	49895	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.231393099 CEST	443	49895	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248250961 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248261929 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248279095 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248287916 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248323917 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.248351097 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248366117 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.248647928 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.248691082 CEST	443	49894	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.248735905 CEST	49894	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.252533913 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.252569914 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.252625942 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.252898932 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.252906084 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.264410019 CEST	49890	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.264445066 CEST	443	49890	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.318960905 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.319212914 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.319246054 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.320775986 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.320858002 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.320916891 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.321120977 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.321202040 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.321245909 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.321297884 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.321329117 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.321338892 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.321636915 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.321868896 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.321935892 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.321940899 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.324533939 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.324650049 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.324690104 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.324723005 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.324825048 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.324839115 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.325198889 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.325424910 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.325481892 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.325509071 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.326055050 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.326282978 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.326349020 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.326457977 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.359158993 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.359256029 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.359335899 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.359491110 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.359508991 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.364118099 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.372981071 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.419044971 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.419297934 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.419326067 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.420490980 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.421051979 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.421189070 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.421196938 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.421226978 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.424194098 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.424200058 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.424201965 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.468987942 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.469208956 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.469265938 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.470746040 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.470825911 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.471472979 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.471556902 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.471586943 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.516109943 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.529031038 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.529117107 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.529184103 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.529202938 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.529213905 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.529217958 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.529268026 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.529285908 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.530024052 CEST	49896	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.530061960 CEST	443	49896	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.532831907 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.532921076 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.532970905 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.533077002 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.533111095 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.533169031 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.533235073 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.533303976 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.533545017 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.533554077 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.533950090 CEST	49897	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.533988953 CEST	443	49897	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.536108971 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.536118984 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.536161900 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.536180019 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.536431074 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.536439896 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.536461115 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.536557913 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.536617994 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.536644936 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.536691904 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.537188053 CEST	49899	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.537224054 CEST	443	49899	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.565912962 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.565922022 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.565973997 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.566006899 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.566055059 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.566093922 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.566116095 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.576838970 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.577054977 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.577079058 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.580455065 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.580524921 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.581334114 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.581415892 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.581540108 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.581554890 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.626574993 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.626581907 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.644745111 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.644834042 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.645049095 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.645092010 CEST	443	49898	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.645144939 CEST	49898	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.680599928 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.687046051 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.687215090 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.687278986 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.687340021 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.687458038 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.687510967 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.687525988 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.687634945 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.687688112 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.688066959 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.688117027 CEST	443	49900	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:47.688152075 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.688174009 CEST	49900	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:47.702356100 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.702368975 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.702421904 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.702431917 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.702481985 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.702523947 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.702528000 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.702528000 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.702976942 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.703017950 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.703017950 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.703056097 CEST	443	49901	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.703099012 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.703125954 CEST	49901	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.750706911 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.750948906 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.750967979 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.751677036 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.751943111 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.752048969 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.752079964 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.753182888 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.753333092 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.753345966 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.753853083 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.754087925 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.754168034 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.754173994 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.785880089 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.786447048 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.786503077 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.786832094 CEST	49902	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.786859035 CEST	443	49902	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.795672894 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.795672894 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.795706034 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.795722008 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.797178984 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.797223091 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.797282934 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.797580957 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.797622919 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.797677994 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.797782898 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:47.797806978 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:47.797898054 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.797915936 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.897144079 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.897186995 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.897263050 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.897474051 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.897481918 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.960911989 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.961087942 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.961172104 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.961184978 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.961287975 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.961363077 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.961818933 CEST	49903	443	192.168.2.4	31.13.88.13
Apr 19, 2024 03:40:47.961829901 CEST	443	49903	31.13.88.13	192.168.2.4
Apr 19, 2024 03:40:47.967025995 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.967104912 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.967269897 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.967526913 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:47.967581034 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.968602896 CEST	49904	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:47.968607903 CEST	443	49904	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.011174917 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.011436939 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.011468887 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.011832952 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.012118101 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.012187004 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.012222052 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.014527082 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.014827967 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.014884949 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.016000986 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.016328096 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.016434908 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.016447067 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.016504049 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.058480024 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.058484077 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.058501005 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.115113020 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.115374088 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.115402937 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.118976116 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.119060993 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.119281054 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.119410038 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.119448900 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.171700001 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.171720982 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.218100071 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.223870993 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.224097013 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.224155903 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.230727911 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.230824947 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.230844021 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.231173992 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.231283903 CEST	443	49906	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.231352091 CEST	49906	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.236500025 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.236599922 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.236745119 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.236916065 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.236936092 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.248941898 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.248982906 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.249038935 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.249068022 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.249098063 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.249155045 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.249162912 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.249232054 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.249274015 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.250251055 CEST	49905	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:48.250263929 CEST	443	49905	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:48.253226042 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.253309011 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.253408909 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.253566027 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.253583908 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.324385881 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.324765921 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.324924946 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.325489044 CEST	49907	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.325510025 CEST	443	49907	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.454055071 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.454405069 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.454468012 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.455588102 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.455935001 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.456145048 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.456320047 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.466032028 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.466294050 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.466351032 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.467279911 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.467370033 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.467745066 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.467806101 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.468163013 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.468179941 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.500132084 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.513317108 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.663436890 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.663665056 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.663726091 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.670541048 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.670720100 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.670784950 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.671664953 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.671741962 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.675642967 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.675703049 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.675708055 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.675739050 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.675764084 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.675796986 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.675821066 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.762126923 CEST	49909	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.762166023 CEST	443	49909	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:48.766396999 CEST	49908	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:48.766460896 CEST	443	49908	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.108023882 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.108069897 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.108139038 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.110065937 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.110080004 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.322453022 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.377537012 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.505548000 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.505556107 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.505985975 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.506309032 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.506378889 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.506709099 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.506804943 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.506808996 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.650563002 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:49.650610924 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.650702953 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:49.651261091 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:49.651288986 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.757462978 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.757524014 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.757683992 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.757702112 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.757729053 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.867147923 CEST	49910	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:49.867172956 CEST	443	49910	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:49.870389938 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.916418076 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:49.916446924 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.917777061 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.928450108 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:49.928565979 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:49.928723097 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:49.974479914 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:50.082545042 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:50.082720041 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:50.082757950 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:50.082791090 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:50.082837105 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:50.082873106 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:50.082917929 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:50.106148005 CEST	49912	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:50.106230021 CEST	443	49912	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:50.106417894 CEST	49912	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.007091999 CEST	49913	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.007189035 CEST	443	49913	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.007267952 CEST	49913	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.007782936 CEST	49913	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.007812977 CEST	443	49913	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.007992983 CEST	49912	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.008064032 CEST	443	49912	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.034188986 CEST	49911	443	192.168.2.4	31.13.65.7
Apr 19, 2024 03:40:52.034220934 CEST	443	49911	31.13.65.7	192.168.2.4
Apr 19, 2024 03:40:52.085048914 CEST	49914	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.085129976 CEST	443	49914	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.085211039 CEST	49914	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.085423946 CEST	49914	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.085454941 CEST	443	49914	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.149455070 CEST	49915	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:52.149566889 CEST	443	49915	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:52.149646997 CEST	49915	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:52.149930954 CEST	49915	443	192.168.2.4	31.13.88.35
Apr 19, 2024 03:40:52.149969101 CEST	443	49915	31.13.88.35	192.168.2.4
Apr 19, 2024 03:40:52.227978945 CEST	443	49912	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.228228092 CEST	49912	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.228262901 CEST	443	49912	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.229443073 CEST	443	49912	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.229706049 CEST	49912	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.229825974 CEST	443	49912	31.13.65.36	192.168.2.4
Apr 19, 2024 03:40:52.230068922 CEST	49912	443	192.168.2.4	31.13.65.36
Apr 19, 2024 03:40:52.230218887 CEST	49912	443	192.168.2.4	31.13.65.36

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 03:40:36.355772018 CEST	192.168.2.4	1.1.1.1	0x7098	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.356332064 CEST	192.168.2.4	1.1.1.1	0xb04e	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:36.359930992 CEST	192.168.2.4	1.1.1.1	0x555c	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.360182047 CEST	192.168.2.4	1.1.1.1	0x49e4	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:37.326231003 CEST	192.168.2.4	1.1.1.1	0xd24f	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:37.326369047 CEST	192.168.2.4	1.1.1.1	0x7049	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Apr 19, 2024 03:40:40.358563900 CEST	192.168.2.4	1.1.1.1	0x5e6a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.358840942 CEST	192.168.2.4	1.1.1.1	0xb64b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:40.458834887 CEST	192.168.2.4	1.1.1.1	0x8912	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.458998919 CEST	192.168.2.4	1.1.1.1	0xd363	Standard query (0)	static.xx.fbcdn.net	65	IN (0x0001)	false
Apr 19, 2024 03:40:40.491950989 CEST	192.168.2.4	1.1.1.1	0x3dec	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.492142916 CEST	192.168.2.4	1.1.1.1	0x169f	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:41.395853996 CEST	192.168.2.4	1.1.1.1	0xed57	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.396226883 CEST	192.168.2.4	1.1.1.1	0x4c4b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:41.742373943 CEST	192.168.2.4	1.1.1.1	0x3d09	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.742604971 CEST	192.168.2.4	1.1.1.1	0xcba9	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:42.106653929 CEST	192.168.2.4	1.1.1.1	0xf55e	Standard query (0)	scontent-atl3-2.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:42.107044935 CEST	192.168.2.4	1.1.1.1	0x820c	Standard query (0)	scontent-atl3-2.xx.fbcdn.net	65	IN (0x0001)	false
Apr 19, 2024 03:40:43.238142014 CEST	192.168.2.4	1.1.1.1	0x5daa	Standard query (0)	scontent-atl3-2.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:43.238255978 CEST	192.168.2.4	1.1.1.1	0xede4	Standard query (0)	scontent-atl3-2.xx.fbcdn.net	65	IN (0x0001)	false
Apr 19, 2024 03:40:44.216952085 CEST	192.168.2.4	1.1.1.1	0x5284	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.217677116 CEST	192.168.2.4	1.1.1.1	0x7224	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:40:47.253941059 CEST	192.168.2.4	1.1.1.1	0x4ece	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:47.254343987 CEST	192.168.2.4	1.1.1.1	0x5a97	Standard query (0)	scontent.xx.fbcdn.net	65	IN (0x0001)	false
Apr 19, 2024 03:40:47.790682077 CEST	192.168.2.4	1.1.1.1	0x9354	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:47.790810108 CEST	192.168.2.4	1.1.1.1	0x3463	Standard query (0)	scontent.xx.fbcdn.net	65	IN (0x0001)	false
Apr 19, 2024 03:41:12.910742044 CEST	192.168.2.4	1.1.1.1	0xcea6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:12.910877943 CEST	192.168.2.4	1.1.1.1	0xc881	Standard query (0)	play.google.com	65	IN (0x0001)	false
Apr 19, 2024 03:41:55.742230892 CEST	192.168.2.4	1.1.1.1	0xa56c	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:55.742475033 CEST	192.168.2.4	1.1.1.1	0x3ea1	Standard query (0)	www.facebook.com	65	IN (0x0001)	false
Apr 19, 2024 03:41:56.558970928 CEST	192.168.2.4	1.1.1.1	0x5720	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:56.559086084 CEST	192.168.2.4	1.1.1.1	0x180c	Standard query (0)	www.facebook.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 03:40:36.460766077 CEST	1.1.1.1	192.168.2.4	0xb04e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460766077 CEST	1.1.1.1	192.168.2.4	0xb04e	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		108.177.122.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.250.9.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.251.15.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.251.15.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		74.125.138.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.251.15.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.251.15.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		108.177.122.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		108.177.122.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.250.9.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.250.9.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		142.250.9.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		172.217.215.136	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		172.217.215.91	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		172.217.215.93	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.460846901 CEST	1.1.1.1	192.168.2.4	0x7098	No error (0)	youtube-ui.l.google.com		108.177.122.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.464186907 CEST	1.1.1.1	192.168.2.4	0x555c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:36.464186907 CEST	1.1.1.1	192.168.2.4	0x555c	No error (0)	star-mini.c10r.facebook.com		31.13.65.36	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:36.464533091 CEST	1.1.1.1	192.168.2.4	0x49e4	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:37.430483103 CEST	1.1.1.1	192.168.2.4	0xd24f	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:37.430483103 CEST	1.1.1.1	192.168.2.4	0xd24f	No error (0)	scontent.xx.fbcdn.net		31.13.65.7	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:37.430686951 CEST	1.1.1.1	192.168.2.4	0x7049	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:40.462766886 CEST	1.1.1.1	192.168.2.4	0x5e6a	No error (0)	www.google.com		64.233.176.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.462766886 CEST	1.1.1.1	192.168.2.4	0x5e6a	No error (0)	www.google.com		64.233.176.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.462766886 CEST	1.1.1.1	192.168.2.4	0x5e6a	No error (0)	www.google.com		64.233.176.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.462766886 CEST	1.1.1.1	192.168.2.4	0x5e6a	No error (0)	www.google.com		64.233.176.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.462766886 CEST	1.1.1.1	192.168.2.4	0x5e6a	No error (0)	www.google.com		64.233.176.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.462766886 CEST	1.1.1.1	192.168.2.4	0x5e6a	No error (0)	www.google.com		64.233.176.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.463046074 CEST	1.1.1.1	192.168.2.4	0xb64b	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 03:40:40.563127995 CEST	1.1.1.1	192.168.2.4	0x8912	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:40.563127995 CEST	1.1.1.1	192.168.2.4	0x8912	No error (0)	scontent.xx.fbcdn.net		31.13.65.7	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.563515902 CEST	1.1.1.1	192.168.2.4	0xd363	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:40.596113920 CEST	1.1.1.1	192.168.2.4	0x3dec	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:40.596113920 CEST	1.1.1.1	192.168.2.4	0x3dec	No error (0)	star-mini.c10r.facebook.com		31.13.88.35	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:40.596474886 CEST	1.1.1.1	192.168.2.4	0x169f	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:41.500722885 CEST	1.1.1.1	192.168.2.4	0xed57	No error (0)	play.google.com		64.233.177.101	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.500722885 CEST	1.1.1.1	192.168.2.4	0xed57	No error (0)	play.google.com		64.233.177.138	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.500722885 CEST	1.1.1.1	192.168.2.4	0xed57	No error (0)	play.google.com		64.233.177.139	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.500722885 CEST	1.1.1.1	192.168.2.4	0xed57	No error (0)	play.google.com		64.233.177.113	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.500722885 CEST	1.1.1.1	192.168.2.4	0xed57	No error (0)	play.google.com		64.233.177.100	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.500722885 CEST	1.1.1.1	192.168.2.4	0xed57	No error (0)	play.google.com		64.233.177.102	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	www3.l.google.com		142.250.9.139	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	www3.l.google.com		142.250.9.113	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	www3.l.google.com		142.250.9.138	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	www3.l.google.com		142.250.9.101	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	www3.l.google.com		142.250.9.100	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847152948 CEST	1.1.1.1	192.168.2.4	0x3d09	No error (0)	www3.l.google.com		142.250.9.102	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:41.847182035 CEST	1.1.1.1	192.168.2.4	0xcba9	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:40:42.211127996 CEST	1.1.1.1	192.168.2.4	0xf55e	No error (0)	scontent-atl3-2.xx.fbcdn.net		31.13.88.13	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:43.343127966 CEST	1.1.1.1	192.168.2.4	0x5daa	No error (0)	scontent-atl3-2.xx.fbcdn.net		31.13.88.13	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321410894 CEST	1.1.1.1	192.168.2.4	0x5284	No error (0)	www.google.com		142.251.15.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321410894 CEST	1.1.1.1	192.168.2.4	0x5284	No error (0)	www.google.com		142.251.15.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321410894 CEST	1.1.1.1	192.168.2.4	0x5284	No error (0)	www.google.com		142.251.15.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321410894 CEST	1.1.1.1	192.168.2.4	0x5284	No error (0)	www.google.com		142.251.15.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321410894 CEST	1.1.1.1	192.168.2.4	0x5284	No error (0)	www.google.com		142.251.15.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321410894 CEST	1.1.1.1	192.168.2.4	0x5284	No error (0)	www.google.com		142.251.15.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:44.321876049 CEST	1.1.1.1	192.168.2.4	0x7224	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 03:40:47.358725071 CEST	1.1.1.1	192.168.2.4	0x4ece	No error (0)	scontent.xx.fbcdn.net		31.13.88.13	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:40:47.896606922 CEST	1.1.1.1	192.168.2.4	0x9354	No error (0)	scontent.xx.fbcdn.net		31.13.65.7	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:13.015467882 CEST	1.1.1.1	192.168.2.4	0xcea6	No error (0)	play.google.com		142.251.15.138	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:13.015467882 CEST	1.1.1.1	192.168.2.4	0xcea6	No error (0)	play.google.com		142.251.15.102	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:13.015467882 CEST	1.1.1.1	192.168.2.4	0xcea6	No error (0)	play.google.com		142.251.15.100	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:13.015467882 CEST	1.1.1.1	192.168.2.4	0xcea6	No error (0)	play.google.com		142.251.15.139	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:13.015467882 CEST	1.1.1.1	192.168.2.4	0xcea6	No error (0)	play.google.com		142.251.15.113	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:13.015467882 CEST	1.1.1.1	192.168.2.4	0xcea6	No error (0)	play.google.com		142.251.15.101	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:55.846980095 CEST	1.1.1.1	192.168.2.4	0x3ea1	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:41:55.847069979 CEST	1.1.1.1	192.168.2.4	0xa56c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:41:55.847069979 CEST	1.1.1.1	192.168.2.4	0xa56c	No error (0)	star-mini.c10r.facebook.com		31.13.88.35	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:56.664427042 CEST	1.1.1.1	192.168.2.4	0x5720	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 03:41:56.664427042 CEST	1.1.1.1	192.168.2.4	0x5720	No error (0)	star-mini.c10r.facebook.com		31.13.88.35	A (IP address)	IN (0x0001)	false
Apr 19, 2024 03:41:56.664572954 CEST	1.1.1.1	192.168.2.4	0x180c	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:36 UTC	664	OUT	GET /video HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:37 UTC	1136	IN	HTTP/1.1 200 OK Vary: Accept-Encoding accept-ch-lifetime: 4838400 accept-ch: viewport-width,dpr,Sec-CH-Prefers-Color-Scheme,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model Link: <https://www.facebook.com/watch/>; rel="canonical" reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:37 UTC	2238	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 2d 72 65 70 6f 72 74 2d 6f 6e 6c 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 Data Ascii: content-security-policy-report-only: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.fa
2024-04-19 01:40:37 UTC	1979	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:37 UTC	1607	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:37 UTC	6	IN	Data Raw: 35 61 34 38 0d 0a Data Ascii: 5a48
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 5f 39 64 6c 73 20 5f 5f 66 62 2d 6c 69 67 68 74 2d 6d 6f 64 65 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 64 61 74 61 2d 64 65 66 61 75 6c 74 2d 69 63 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 79 54 2f 72 2f 61 47 54 33 67 73 6b 7a 57 42 66 2e 69 63 6f 22 20 64 61 74 61 2d 62 61 64 67 65 64 2d 69 63 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 78 78 2e 66 62 63 64 6e 2e 6e 65 74 2f 72 73 72 63 2e 70 68 70 2f 79 44 2f 72 2f 55 4a 6a 30 74 67 6b 2d 52 72 54 2e 69 63 6f 22 20 72 65 6c Data Ascii: <!DOCTYPE html><html id="facebook" class="_9dls __fb-light-mode" lang="en" dir="ltr"><head><link data-default-icon="https://static.xx.fbcdn.net/rsrc.php/yT/r/aGT3gskzWBf.ico" data-badged-icon="https://static.xx.fbcdn.net/rsrc.php/yD/r/UJj0tgk-RrT.ico" rel
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 72 6f 73 73 6f 72 69 67 69 6e 3d 22 75 73 65 2d 63 72 65 64 65 6e 74 69 61 6c 73 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6c 69 67 68 74 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 46 46 46 46 46 46 22 20 2f 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 6b 4f 59 4b 4e 4d 52 22 3e 3a 72 6f 6f 74 7b 2d 2d 66 64 73 2d 62 6c 61 63 6b 3a 23 30 30 30 30 30 30 3b 2d 2d 66 64 73 2d 62 6c 61 63 6b 2d 61 6c 70 68 61 2d 30 35 3a 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 35 29 3b 2d 2d 66 64 73 2d 62 6c 61 63 6b 2d 61 6c 70 68 61 2d 31 30 3a 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 3b 2d 2d 66 64 Data Ascii: rossorigin="use-credentials" /><meta name="color-scheme" content="light" /><meta name="theme-color" content="#FFFFFF" /><style nonce="tkOYKNMR">:root{--fds-black:#000000;--fds-black-alpha-05:rgba(0, 0, 0, 0.05);--fds-black-alpha-10:rgba(0, 0, 0, 0.1);--fd
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 73 70 65 63 74 72 75 6d 2d 63 68 65 72 72 79 2d 74 69 6e 74 2d 37 30 3a 23 46 42 43 43 44 32 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 75 6d 2d 67 72 61 70 65 2d 74 69 6e 74 2d 37 30 3a 23 44 44 44 35 46 30 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 75 6d 2d 67 72 61 70 65 2d 74 69 6e 74 2d 39 30 3a 23 46 34 46 31 46 41 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 75 6d 2d 6c 65 6d 6f 6e 2d 64 61 72 6b 2d 31 3a 23 46 35 43 33 33 42 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 75 6d 2d 6c 65 6d 6f 6e 2d 74 69 6e 74 2d 37 30 3a 23 46 45 46 32 44 31 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 75 6d 2d 6c 69 6d 65 3a 23 41 33 43 45 37 31 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 75 6d 2d 6c 69 6d 65 2d 74 69 6e 74 2d 37 30 3a 23 45 34 46 30 44 35 3b 2d 2d 66 64 73 2d 73 70 65 63 74 72 Data Ascii: spectrum-cherry-tint-70:#FBCCD2;--fds-spectrum-grape-tint-70:#DDD5F0;--fds-spectrum-grape-tint-90:#F4F1FA;--fds-spectrum-lemon-dark-1:#F5C33B;--fds-spectrum-lemon-tint-70:#FEF2D1;--fds-spectrum-lime:#A3CE71;--fds-spectrum-lime-tint-70:#E4F0D5;--fds-spectr
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 67 72 61 79 2d 39 35 3a 23 46 30 46 32 46 35 3b 2d 2d 61 74 74 61 63 68 6d 65 6e 74 2d 66 6f 6f 74 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 30 46 32 46 35 3b 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 65 65 6d 70 68 61 73 69 7a 65 64 3a 23 46 30 46 32 46 35 3b 2d 2d 62 61 64 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 62 6c 75 65 3a 76 61 72 28 2d 2d 61 63 63 65 6e 74 29 3b 2d 2d 62 61 64 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 64 61 72 6b 2d 67 72 61 79 3a 76 61 72 28 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 69 63 6f 6e 29 3b 2d 2d 62 61 64 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2d 67 72 61 79 3a 76 61 72 28 2d 2d 64 69 73 61 62 6c 65 64 2d 69 63 6f 6e 29 3b 2d 2d 62 61 64 67 65 2d 62 61 63 6b 67 72 Data Ascii: gray-95:#F0F2F5;--attachment-footer-background:#F0F2F5;--background-deemphasized:#F0F2F5;--badge-background-color-blue:var(--accent);--badge-background-color-dark-gray:var(--secondary-icon);--badge-background-color-gray:var(--disabled-icon);--badge-backgr
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 72 2d 69 63 6f 6e 3a 69 6e 76 65 72 74 28 35 39 25 29 20 73 65 70 69 61 28 31 31 25 29 20 73 61 74 75 72 61 74 65 28 32 30 30 25 29 20 73 61 74 75 72 61 74 65 28 31 33 35 25 29 20 68 75 65 2d 72 6f 74 61 74 65 28 31 37 36 64 65 67 29 20 62 72 69 67 68 74 6e 65 73 73 28 39 36 25 29 20 63 6f 6e 74 72 61 73 74 28 39 34 25 29 3b 2d 2d 66 69 6c 74 65 72 2d 70 72 69 6d 61 72 79 2d 61 63 63 65 6e 74 3a 69 6e 76 65 72 74 28 32 37 25 29 20 73 65 70 69 61 28 39 35 25 29 20 73 61 74 75 72 61 74 65 28 33 31 31 36 25 29 20 68 75 65 2d 72 6f 74 61 74 65 28 32 31 32 64 65 67 29 20 62 72 69 67 68 74 6e 65 73 73 28 39 39 25 29 20 63 6f 6e 74 72 61 73 74 28 31 30 35 25 29 3b 2d 2d 66 69 6c 74 65 72 2d 70 72 69 6d 61 72 79 2d 69 63 6f 6e 3a 69 6e 76 65 72 74 28 38 25 29 20 Data Ascii: r-icon:invert(59%) sepia(11%) saturate(200%) saturate(135%) hue-rotate(176deg) brightness(96%) contrast(94%);--filter-primary-accent:invert(27%) sepia(95%) saturate(3116%) hue-rotate(212deg) brightness(99%) contrast(105%);--filter-primary-icon:invert(8%)
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 72 3a 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 3b 2d 2d 6d 65 64 69 61 2d 6f 75 74 65 72 2d 62 6f 72 64 65 72 3a 23 46 46 46 46 46 46 3b 2d 2d 6d 65 64 69 61 2d 70 72 65 73 73 65 64 3a 72 67 62 61 28 36 38 2c 20 37 33 2c 20 38 30 2c 20 30 2e 33 35 29 3b 2d 2d 6d 65 73 73 65 6e 67 65 72 2d 63 61 72 64 2d 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 46 46 46 3b 2d 2d 6d 77 70 2d 68 65 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 6d 65 73 73 65 6e 67 65 72 2d 63 61 72 64 2d 62 61 63 6b 67 72 6f 75 6e 64 29 3b 2d 2d 6d 77 70 2d 68 65 61 64 65 72 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 61 63 63 65 6e 74 29 3b 2d 2d 6d 77 70 2d 6d 65 73 73 61 67 65 2d 72 6f 77 2d 62 61 63 6b 67 72 6f 75 6e Data Ascii: r:rgba(0, 0, 0, 0.1);--media-outer-border:#FFFFFF;--media-pressed:rgba(68, 73, 80, 0.35);--messenger-card-background:#FFFFFF;--mwp-header-background-color:var(--messenger-card-background);--mwp-header-button-color:var(--accent);--mwp-message-row-backgroun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	108.177.122.93	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:36 UTC	802	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:36 UTC	2428	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 01:40:36 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 19-Apr-2024 02:10:36 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=TISbAQ87lBo; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=Bm5Gpp9tStI; Domain=.youtube.com; Expires=Wed, 16-Oct-2024 01:40:36 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgPg%3D%3D; Domain=.youtube.com; Expires=Wed, 16-Oct-2024 01:40:36 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:37 UTC	903	OUT	POST /ajax/qm/?__a=1&__user=0&__comet_req=15&jazoest=2903 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 124 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:37 UTC	124	OUT	Data Raw: 65 76 65 6e 74 5f 69 64 3d 37 33 35 39 33 38 37 31 30 33 39 32 33 37 32 39 32 35 34 26 6d 61 72 6b 65 72 5f 70 61 67 65 5f 74 69 6d 65 3d 31 31 36 37 26 73 63 72 69 70 74 5f 70 61 74 68 3d 58 43 6f 6d 65 74 57 61 74 63 68 43 6f 6e 74 72 6f 6c 6c 65 72 26 77 65 69 67 68 74 3d 30 26 63 6c 69 65 6e 74 5f 73 74 61 72 74 3d 31 26 6c 73 64 3d 41 56 71 32 4c 68 32 6c 30 68 63 Data Ascii: event_id=7359387103923729254&marker_page_time=1167&script_path=XCometWatchController&weight=0&client_start=1&lsd=AVq2Lh2l0hc
2024-04-19 01:40:37 UTC	1995	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 cross-origin-resource-policy: cross-origin Expires: Sat, 01 Jan 2000 00:00:00 GMT Pragma: no-cache nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01} X-Frame-Options: DENY X-Content-Type-Options: nosniff Cache-Control: private, no-cache, no-store, must-revalidate reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}],"group":"network-errors"} cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report" origin-agent-cluster: ?0 Access-Control-Expose-Headers: X-FB-Debug, X-Loader-Length, X-Stack Access-Control-Allow-Methods: OPTIONS Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin Vary: Accept-Encoding Strict-Transport-Security: max-age=15552000; preload X-FB-Debug: Ptm+Zk86mSpc5rhe77Iz3+nxyy6BEbGEKKNN7f+WCpqvSuy1z2ouSwTttyFe625Xn6fmo5Zu0uH+UP1DCvzA/g== Date: Fri, 19 Apr 2024 01:40:37 GMT Transfer-Encoding: chunked X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=10, mss=1277, tbw=3437, tp=-1, tpl=-1, uplat=53, ullat=1 Alt-Svc: h3=":443"; ma=86400 Connection: close
2024-04-19 01:40:37 UTC	4	IN	Data Raw: 66 33 0d 0a Data Ascii: f3
2024-04-19 01:40:37 UTC	250	IN	Data Raw: 66 6f 72 20 28 3b 3b 29 3b 7b 22 5f 5f 61 72 22 3a 31 2c 22 65 72 72 6f 72 22 3a 31 33 35 37 30 30 35 2c 22 65 72 72 6f 72 53 75 6d 6d 61 72 79 22 3a 22 59 6f 75 72 20 52 65 71 75 65 73 74 20 43 6f 75 6c 64 6e 27 74 20 62 65 20 50 72 6f 63 65 73 73 65 64 22 2c 22 65 72 72 6f 72 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 65 72 65 20 77 61 73 20 61 20 70 72 6f 62 6c 65 6d 20 77 69 74 68 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 20 57 65 27 72 65 20 77 6f 72 6b 69 6e 67 20 6f 6e 20 67 65 74 74 69 6e 67 20 69 74 20 66 69 78 65 64 20 61 73 20 73 6f 6f 6e 20 61 73 20 77 65 20 63 61 6e 2e 22 2c 22 70 61 79 6c 6f 61 64 22 3a 6e 75 6c 6c 2c 22 6c 69 64 22 3a 22 37 33 35 39 33 38 37 31 30 38 33 38 33 32 32 30 36 36 37 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: for (;;);{"__ar":1,"error":1357005,"errorSummary":"Your Request Couldn't be Processed","errorDescription":"There was a problem with this request. We're working on getting it fixed as soon as we can.","payload":null,"lid":"7359387108383220667"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:37 UTC	622	OUT	GET /rsrc.php/v3/yb/l/0,cross/YevIHjTZjnO.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:37 UTC	1746	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: mobLFPHAAbf50X5/zQ4C1g== Expires: Fri, 18 Apr 2025 21:41:00 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: 9jhtNeYh8wbf9WVnNPSCjeGqvRpr5WLSiVVu+L1SrRsKPYD3IJFoI160v5uohOLzsnHVOs+ob/GGCV2J8Zmaiw== Date: Fri, 19 Apr 2024 01:40:37 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=7, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 609189
2024-04-19 01:40:37 UTC	1	IN	Data Raw: 66 Data Ascii: f
2024-04-19 01:40:37 UTC	16061	IN	Data Raw: 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 6c 61 62 65 6c 7b 63 6f 6c 6f 72 3a 23 36 30 36 37 37 30 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 6c 61 62 65 6c 20 69 6e 70 75 74 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 7d 74 65 78 74 61 72 65 61 2c 2e 69 6e 70 75 74 74 65 78 74 2c 2e 69 6e 70 75 74 70 61 73 73 77 6f 72 64 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 33 70 78 7d 74 65 78 74 61 72 65 Data Ascii: orm{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textare
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 74 2d 62 6c 6f 63 6b 71 75 6f 74 65 2d 63 6f 6c 6f 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6c 69 6e 65 29 7d 2e 78 31 39 39 39 31 6e 69 7b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 6f 70 61 63 69 74 79 7d 2e 78 31 39 66 36 69 6b 74 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2d 31 36 70 78 7d 2e 78 31 39 6a 64 31 68 30 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 30 64 65 67 29 7d 2e 78 31 39 6c 69 76 66 64 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 77 69 64 74 68 3a 76 61 72 28 2d 2d 63 68 61 74 2d 69 6e 63 6f 6d 69 6e 67 2d 6d 65 73 73 61 67 65 2d 62 6f 72 64 65 72 2d 77 69 64 74 68 2c 30 70 78 29 7d 2e 78 31 39 70 37 65 77 73 7b 62 6f 72 64 65 72 2d 6c 65 66 74 2d 77 69 64 74 68 3a 32 70 78 7d 2e 78 31 39 75 6d 35 34 33 7b 70 61 Data Ascii: t-blockquote-color-background-line)}.x19991ni{transition-property:opacity}.x19f6ikt{margin-right:-16px}.x19jd1h0{transform:rotate(180deg)}.x19livfd{border-top-width:var(--chat-incoming-message-border-width,0px)}.x19p7ews{border-left-width:2px}.x19um543{pa
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 70 65 63 74 2d 72 61 74 69 6f 3a 61 74 74 72 28 77 69 64 74 68 29 20 2f 20 61 74 74 72 28 68 65 69 67 68 74 29 7d 2e 78 75 78 77 31 66 74 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 78 76 38 75 77 32 76 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 32 30 70 78 7d 2e 78 76 39 72 76 78 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 6f 73 69 74 69 76 65 29 7d 2e 78 76 62 68 74 77 38 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 28 76 61 72 28 2d 2d 69 67 2d 70 72 69 6d 61 72 79 2d 62 61 63 6b 67 72 6f 75 6e 64 29 29 7d 2e 78 76 6d 61 36 33 6b 7b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 78 31 37 71 63 65 61 74 2d 42 7d 2e 78 76 6d 61 68 65 6c 7b 2d 77 65 62 6b Data Ascii: pect-ratio:attr(width) / attr(height)}.xuxw1ft{white-space:nowrap}.xv8uw2v{border-top-right-radius:20px}.xv9rvxn{background-color:var(--positive)}.xvbhtw8{background-color:rgb(var(--ig-primary-background))}.xvma63k{animation-name:x17qceat-B}.xvmahel{-webk
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 34 2c 2e 34 34 2c 31 29 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 30 20 31 35 38 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 31 35 38 7d 31 30 30 25 7b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 31 31 38 20 31 35 38 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 78 31 61 75 39 62 74 74 2d 42 7b 30 25 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 30 30 25 29 7d 39 39 25 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 31 30 30 25 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 61 75 74 6f 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 7d 40 6b 65 Data Ascii: 4,.44,1);stroke-dasharray:0 158;stroke-dashoffset:-158}100%{stroke-dasharray:118 158;stroke-dashoffset:0}}@keyframes x1au9btt-B{0%{pointer-events:none;transform:translateY(100%)}99%{pointer-events:none}100%{pointer-events:auto;transform:translateY(0)}}@ke
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 2d 61 62 72 61 2d 73 75 72 66 61 63 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 72 67 62 29 2c 30 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 78 69 6c 69 33 67 70 2d 42 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 31 30 30 25 2c 30 29 7d 31 30 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 78 69 72 73 38 6d 61 2d 42 7b 30 25 7b 68 65 69 67 68 74 3a 30 7d 31 30 30 25 7b 68 65 69 67 68 74 3a 32 32 34 70 78 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 78 69 76 63 70 33 79 2d 42 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 30 30 25 29 7d 31 30 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 30 25 29 7d 7d 40 6b 65 Data Ascii: -abra-surface-background-rgb),0)}}@keyframes xili3gp-B{0%{transform:translate(-100%,0)}100%{transform:translate(0,0)}}@keyframes xirs8ma-B{0%{height:0}100%{height:224px}}@keyframes xivcp3y-B{0%{transform:translateY(100%)}100%{transform:translateY(0%)}}@ke
2024-04-19 01:40:38 UTC	14884	IN	Data Raw: 69 74 79 3a 30 7d 31 30 30 25 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6f 70 61 63 69 74 79 3a 31 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 78 6c 6e 76 68 32 62 2d 42 7b 30 25 7b 6d 61 78 2d 77 69 64 74 68 3a 30 7d 32 30 25 7b 6d 61 78 2d 77 69 64 74 68 3a 32 35 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 7d 38 30 25 7b 6d 61 78 2d 77 69 64 74 68 3a 32 35 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 38 70 78 7d 31 30 30 25 7b 6d 61 78 2d 77 69 64 74 68 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 78 6c 7a 6f 70 35 70 2d 42 7b 30 25 7b 6d 61 78 2d 68 65 69 67 68 74 3a 34 34 70 78 3b 6f 70 61 63 69 74 79 3a 31 7d 31 30 30 25 7b 6d 61 78 2d 68 65 69 67 68 74 3a 30 3b 6f 70 61 63 69 74 79 3a 30 7d 7d 40 6b 65 79 66 72 61 6d 65 73 Data Ascii: ity:0}100%{display:block;opacity:1}}@keyframes xlnvh2b-B{0%{max-width:0}20%{max-width:250px;padding-right:8px}80%{max-width:250px;padding-right:8px}100%{max-width:0}}@keyframes xlzop5p-B{0%{max-height:44px;opacity:1}100%{max-height:0;opacity:0}}@keyframes
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 6f 72 79 7d 2e 78 68 74 61 71 36 35 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 34 70 78 20 73 6f 6c 69 64 20 77 68 69 74 65 7d 2e 78 68 79 79 30 70 61 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 38 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 73 68 61 64 6f 77 2d 38 29 7d 2e 78 68 7a 69 6c 35 7a 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 6e 65 67 61 74 69 76 65 29 7d 2e 78 69 68 77 6c 6a 32 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 68 6f 73 74 65 64 2d 76 69 65 77 2d 73 65 6c 65 63 74 65 64 2d 73 74 61 74 65 29 7d 2e 78 69 6e 79 62 31 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 32 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 77 61 73 68 29 7d 2e 78 69 70 70 36 34 78 Data Ascii: ory}.xhtaq65{border-top:4px solid white}.xhyy0pa{border-bottom:8px solid var(--shadow-8)}.xhzil5z{border-top:1px solid var(--negative)}.xihwlj2{border-bottom:1px solid var(--hosted-view-selected-state)}.xinyb1r{border-bottom:2px solid var(--wash)}.xipp64x
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 78 7d 2e 78 31 32 6b 78 32 67 75 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 32 39 70 78 7d 2e 78 31 32 6c 61 66 73 31 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 6f 73 69 74 69 76 65 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 78 31 32 6d 66 6c 74 6b 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 37 36 70 78 7d 2e 78 31 32 6d 72 75 76 39 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 70 78 7d 2e 78 31 32 6d 79 6c 64 76 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 39 70 78 7d 2e 78 31 32 6e 63 7a 38 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 75 6d 62 6e 61 69 6c 2d 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 78 31 32 6e 73 36 73 68 7b 62 61 Data Ascii: x}.x12kx2gu{border-bottom-left-radius:29px}.x12lafs1{border-top-color:var(--positive-background)}.x12mfltk{margin-left:176px}.x12mruv9{margin-left:2px}.x12myldv{border-top-left-radius:9px}.x12ncz83{background-color:var(--thumbnail-background)}.x12ns6sh{ba
2024-04-19 01:40:38 UTC	14884	IN	Data Raw: 78 31 7a 30 33 34 73 32 2d 42 7d 2e 78 31 37 78 71 64 34 6f 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 23 31 34 37 39 66 62 7d 2e 78 31 37 78 76 31 6a 61 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2d 72 61 64 69 75 73 3a 31 31 2e 35 70 78 7d 2e 78 31 37 7a 38 65 70 77 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 2d 74 65 78 74 2d 6f 6e 2d 6d 65 64 69 61 29 7d 2e 78 31 37 7a 39 71 78 36 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 73 69 7a 65 2d 6e 65 67 61 74 69 76 65 2d 32 30 29 7d 2e 78 31 37 7a 64 30 74 32 7b 63 6f 6c 75 6d 6e 2d 67 61 70 3a 34 70 78 7d 2e 78 31 37 7a 69 66 39 6d 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 34 38 70 78 7d 2e 78 31 37 7a 76 37 33 Data Ascii: x1z034s2-B}.x17xqd4o{border-right-color:#1479fb}.x17xv1ja{border-bottom-right-radius:11.5px}.x17z8epw{color:var(--primary-text-on-media)}.x17z9qx6{margin-right:var(--size-negative-20)}.x17zd0t2{column-gap:4px}.x17zif9m{border-top-left-radius:48px}.x17zv73

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:37 UTC	599	OUT	GET /rsrc.php/v3/yb/r/G3Nm7rYDpD0.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:37 UTC	1762	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: OISQwDx3eeB9yyWA7r/uwg== Expires: Fri, 18 Apr 2025 02:44:20 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: iBd8AT11Wq0tPCEu5oF6bu+4NyfCsaShnz+Q3zsKwTwdU9xqsqMkJv/3lv3SzKNyOnNo9jxi2m9ZNJTnnBL/tQ== Date: Fri, 19 Apr 2024 01:40:37 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=4, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 278291
2024-04-19 01:40:37 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:37 UTC	16054	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 54 68 69 73 7c 7c 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 73 65 6c 66 7c 7c 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 67 6c 6f 62 61 6c 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 41 62 6f 72 74 43 6f 6e 74 72 6f 6c 6c 65 72 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 74 68 69 73 2e 5f 5f 6c 69 73 74 65 6e Data Ascii: /FB_PKG_DELIM/"use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis\|\|typeof self!=="undefined"&&self\|\|typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listen
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 62 6c 65 7c 7c 21 31 3b 64 2e 63 6f 6e 66 69 67 75 72 61 62 6c 65 3d 21 30 3b 22 76 61 6c 75 65 22 69 6e 20 64 26 26 28 64 2e 77 72 69 74 61 62 6c 65 3d 21 30 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 64 2e 6b 65 79 2c 64 29 7d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 2c 63 2c 64 29 7b 63 26 26 61 28 62 2e 70 72 6f 74 6f 74 79 70 65 2c 63 29 3b 64 26 26 61 28 62 2c 64 29 3b 72 65 74 75 72 6e 20 62 7d 7d 28 29 3b 62 2e 69 6e 68 65 72 69 74 73 4c 6f 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 61 2c 62 29 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 62 26 26 62 2e 70 72 6f 74 6f 74 79 70 65 29 3b 61 2e 70 72 6f 74 6f 74 79 Data Ascii: ble\|\|!1;d.configurable=!0;"value"in d&&(d.writable=!0);Object.defineProperty(a,d.key,d)}}return function(b,c,d){c&&a(b.prototype,c);d&&a(b,d);return b}}();b.inheritsLoose=function(a,b){Object.assign(a,b);a.prototype=Object.create(b&&b.prototype);a.prototy
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 6d 73 3d 66 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 53 74 72 69 6e 67 28 61 29 7d 29 3b 6e 2e 74 61 61 6c 4f 70 63 6f 64 65 73 3d 5b 63 28 22 66 62 2d 65 72 72 6f 72 2d 6c 69 74 65 22 29 2e 54 41 41 4c 4f 70 63 6f 64 65 2e 50 52 45 56 49 4f 55 53 5f 46 52 41 4d 45 5d 3b 6e 2e 73 74 61 63 6b 3b 74 68 72 6f 77 20 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 69 28 61 2c 62 29 7b 76 61 72 20 64 3d 22 4d 69 6e 69 66 69 65 64 20 69 6e 76 61 72 69 61 6e 74 20 23 22 2b 61 2b 22 3b 20 25 73 22 3b 62 2e 6c 65 6e 67 74 68 3e 30 26 26 28 64 2b 3d 22 20 50 61 72 61 6d 73 3a 20 22 2b 62 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 22 25 73 22 7d 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 29 3b 61 3d 28 68 7c 7c 28 68 3d 63 28 22 Data Ascii: ms=f.map(function(a){return String(a)});n.taalOpcodes=[c("fb-error-lite").TAALOpcode.PREVIOUS_FRAME];n.stack;throw n}}function i(a,b){var d="Minified invariant #"+a+"; %s";b.length>0&&(d+=" Params: "+b.map(function(a){return"%s"}).join(", "));a=(h\|\|(h=c("
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 6e 61 6d 65 3d 65 3d 3d 3d 63 26 26 65 2e 6e 61 6d 65 21 3d 6e 75 6c 6c 26 26 65 2e 6e 61 6d 65 21 3d 3d 22 22 3f 65 2e 6e 61 6d 65 3a 74 79 70 65 6f 66 20 28 63 3d 3d 3d 6e 75 6c 6c 7c 7c 63 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 63 2e 6e 61 6d 65 29 3d 3d 3d 22 73 74 72 69 6e 67 22 26 26 63 2e 6e 61 6d 65 21 3d 3d 22 22 3f 63 2e 6e 61 6d 65 3a 64 21 3d 6e 75 6c 6c 26 26 64 2e 6c 65 6e 67 74 68 3e 30 3f 22 55 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 57 69 74 68 5f 22 2b 64 2e 6a 6f 69 6e 28 22 5f 22 29 3a 22 55 6e 68 61 6e 64 6c 65 64 52 65 6a 65 63 74 69 6f 6e 5f 22 2b 28 63 3d 3d 3d 6e 75 6c 6c 3f 22 6e 75 6c 6c 22 3a 74 79 70 65 6f 66 20 63 29 3b 74 72 79 7b 66 3d 63 3d 3d 3d 6e 75 6c 6c 7c 7c 63 3d 3d 3d 76 6f 69 64 20 30 3f 76 Data Ascii: name=e===c&&e.name!=null&&e.name!==""?e.name:typeof (c===null\|\|c===void 0?void 0:c.name)==="string"&&c.name!==""?c.name:d!=null&&d.length>0?"UnhandledRejectionWith_"+d.join("_"):"UnhandledRejection_"+(c===null?"null":typeof c);try{f=c===null\|\|c===void 0?v
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 74 68 69 73 2e 24 41 72 62 69 74 65 72 45 76 65 6e 74 48 6f 6c 64 65 72 31 5b 61 5d 7d 3b 63 2e 68 6f 6c 64 45 76 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 2e 24 41 72 62 69 74 65 72 45 76 65 6e 74 48 6f 6c 64 65 72 31 5b 61 5d 3b 63 21 3d 3d 22 70 65 72 73 69 73 74 65 6e 74 22 26 26 74 68 69 73 2e 24 41 72 62 69 74 65 72 45 76 65 6e 74 48 6f 6c 64 65 72 32 28 61 29 3b 69 66 28 63 21 3d 3d 22 65 76 65 6e 74 22 29 7b 76 61 72 20 64 3b 66 6f 72 28 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 66 3d 6e 65 77 20 41 72 72 61 79 28 65 3e 31 3f 65 2d 31 3a 30 29 2c 67 3d 31 3b 67 3c 65 3b 67 2b 2b 29 66 5b 67 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 67 5d 3b 72 65 74 75 72 6e 28 64 3d 62 2e 70 72 6f 74 Data Ascii: this.$ArbiterEventHolder1[a]};c.holdEvent=function(a){var c=this.$ArbiterEventHolder1[a];c!=="persistent"&&this.$ArbiterEventHolder2(a);if(c!=="event"){var d;for(var e=arguments.length,f=new Array(e>1?e-1:0),g=1;g<e;g++)f[g-1]=arguments[g];return(d=b.prot
2024-04-19 01:40:38 UTC	14884	IN	Data Raw: 6f 6e 20 62 28 29 7b 72 65 74 75 72 6e 7b 62 6c 6f 63 6b 69 6e 67 3a 6e 65 77 20 4d 61 70 28 29 2c 6e 6f 6e 62 6c 6f 63 6b 69 6e 67 3a 6e 65 77 20 4d 61 70 28 29 2c 22 64 65 66 61 75 6c 74 22 3a 6e 65 77 20 4d 61 70 28 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 64 28 61 29 7b 6e 2e 61 64 64 28 61 29 7d 66 75 6e 63 74 69 6f 6e 20 65 28 61 29 7b 6e 5b 22 64 65 6c 65 74 65 22 5d 28 61 29 2c 6d 2e 69 6e 66 6f 72 6d 28 68 2c 61 2c 22 70 65 72 73 69 73 74 65 6e 74 22 29 7d 66 75 6e 63 74 69 6f 6e 20 66 28 61 2c 62 29 7b 6f 2e 61 64 64 28 70 28 61 2c 62 29 29 7d 66 75 6e 63 74 69 6f 6e 20 71 28 61 2c 62 2c 63 29 7b 6d 2e 69 6e 66 6f 72 6d 28 70 28 61 2c 62 29 2c 63 2c 22 70 65 72 73 69 73 74 65 6e 74 22 29 7d 66 75 6e 63 74 69 6f 6e 20 72 28 61 29 7b 6d 2e 69 6e 66 6f Data Ascii: on b(){return{blocking:new Map(),nonblocking:new Map(),"default":new Map()}}function d(a){n.add(a)}function e(a){n["delete"](a),m.inform(h,a,"persistent")}function f(a,b){o.add(p(a,b))}function q(a,b,c){m.inform(p(a,b),c,"persistent")}function r(a){m.info
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 74 50 72 6f 70 73 3a 62 2c 73 74 72 69 6e 67 50 72 6f 70 73 3a 67 2c 76 65 63 74 6f 72 50 72 6f 70 73 3a 68 7d 7d 3b 61 2e 63 6f 6d 62 69 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3b 61 21 3d 6e 75 6c 6c 26 26 62 21 3d 6e 75 6c 6c 3f 28 61 2e 73 74 72 69 6e 67 50 72 6f 70 73 3d 62 61 62 65 6c 48 65 6c 70 65 72 73 5b 22 65 78 74 65 6e 64 73 22 5d 28 7b 7d 2c 62 2e 73 74 72 69 6e 67 50 72 6f 70 73 2c 61 2e 73 74 72 69 6e 67 50 72 6f 70 73 29 2c 61 2e 73 65 74 50 72 6f 70 73 3d 62 61 62 65 6c 48 65 6c 70 65 72 73 5b 22 65 78 74 65 6e 64 73 22 5d 28 7b 7d 2c 62 2e 73 65 74 50 72 6f 70 73 2c 61 2e 73 65 74 50 72 6f 70 73 29 2c 63 3d 61 29 3a 61 21 3d 6e 75 6c 6c 3f 63 3d 61 3a 62 21 3d 6e 75 6c 6c 26 26 28 63 3d 62 29 3b 72 65 74 75 72 Data Ascii: tProps:b,stringProps:g,vectorProps:h}};a.combine=function(a,b){var c;a!=null&&b!=null?(a.stringProps=babelHelpers["extends"]({},b.stringProps,a.stringProps),a.setProps=babelHelpers["extends"]({},b.setProps,a.setProps),c=a):a!=null?c=a:b!=null&&(c=b);retur
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 55 72 69 4e 65 65 64 52 61 77 51 75 65 72 79 53 56 43 68 65 63 6b 65 72 22 29 2e 69 73 44 6f 6d 61 69 6e 4e 65 65 64 52 61 77 51 75 65 72 79 2c 63 28 22 50 48 50 51 75 65 72 79 53 65 72 69 61 6c 69 7a 65 72 4e 6f 45 6e 63 6f 64 69 6e 67 22 29 29 7d 3b 65 2e 74 6f 53 74 72 69 6e 67 50 72 65 73 65 72 76 65 51 75 65 72 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 50 72 65 73 65 72 76 65 51 75 65 72 79 2e 63 61 6c 6c 28 74 68 69 73 2c 63 28 22 55 72 69 4e 65 65 64 52 61 77 51 75 65 72 79 53 56 43 68 65 63 6b 65 72 22 29 2e 69 73 44 6f 6d 61 69 6e 4e 65 65 64 52 61 77 51 75 65 72 79 2c 63 28 22 50 48 50 51 75 65 72 79 53 65 72 69 61 6c 69 7a 65 72 4e 6f 45 6e 63 6f 64 69 6e 67 22 29 29 Data Ascii: UriNeedRawQuerySVChecker").isDomainNeedRawQuery,c("PHPQuerySerializerNoEncoding"))};e.toStringPreserveQuery=function(){return a.prototype.toStringPreserveQuery.call(this,c("UriNeedRawQuerySVChecker").isDomainNeedRawQuery,c("PHPQuerySerializerNoEncoding"))
2024-04-19 01:40:38 UTC	14884	IN	Data Raw: 61 5d 3b 62 28 6c 29 7d 6b 3d 5b 5d 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 74 68 69 73 2e 24 31 3d 61 7d 76 61 72 20 65 3d 61 2e 70 72 6f 74 6f 74 79 70 65 3b 65 2e 67 65 74 4d 6f 64 75 6c 65 49 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2e 24 31 3b 72 65 74 75 72 6e 20 61 7d 3b 65 2e 67 65 74 4d 6f 64 75 6c 65 49 64 41 73 52 65 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 31 7d 3b 65 2e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2c 63 3d 74 68 69 73 2e 24 32 3b 64 28 22 4a 53 52 65 73 6f 75 72 63 65 45 76 65 6e 74 73 22 29 2e 6e 6f 74 69 66 79 28 74 68 69 73 2e 24 31 2c 63 2c 22 4c 4f 41 44 45 44 22 29 3b 76 61 72 20 65 3d 6e 65 77 28 69 7c 7c 28 69 3d Data Ascii: a];b(l)}k=[]};function a(a){this.$1=a}var e=a.prototype;e.getModuleId=function(){var a=this.$1;return a};e.getModuleIdAsRef=function(){return this.$1};e.load=function(){var a=this,c=this.$2;d("JSResourceEvents").notify(this.$1,c,"LOADED");var e=new(i\|\|(i=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:37 UTC	929	OUT	GET /rsrc.php/v3ifhN4/yX/l/en_US/nChwAUT1aUgDYvatkvPhoORf7s0WJvHMPn1wRO-dUcIoL9XF0wO0ej9ML-m_DiQrfXi0ByZrEbi6c-BC0lRf3kmQVAblIutlJuDu8FjJ2mAf5cwjSvgZCKCmXkp8GwrOMn7m1Rdzuzi16ygkVEIahZX1XqpI1Q50zl6ZBgWvsJpQFrYrGc1wa-Oq19cr_l1DuzAtWVDh4cn1CMxub3y91qmloYqXsrAa0b9bMzu_eJMlvvhSHqOL8xCqhxFHLp55HfXW__mMgFRlCsGN0FHzi95_wmB-51YxoStyBz2gE2pEQn4HVER6vHpPn3-WFWVy-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:37 UTC	1762	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 8P39zqsaIJ1XjJZ/b0pKnw== Expires: Sat, 19 Apr 2025 01:40:37 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: J0nzafurjUojOGVii05tMcRlSWKT9ra6FHT5HAqDciuER2scAhO9RPUwVs3ryANtdDQQiCRTuK9+YYBAk2Z1jQ== Date: Fri, 19 Apr 2024 01:40:37 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=27, ullat=0 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 215291
2024-04-19 01:40:37 UTC	1002	IN	Data Raw: 3b 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 51 75 69 63 6b 4c 6f 67 41 63 74 69 6f 6e 54 79 70 65 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 61 3d 4f 62 6a 65 63 74 2e 66 72 65 65 7a 65 28 7b 53 54 41 52 54 3a 31 2c 53 55 43 43 45 53 53 3a 32 2c 46 41 49 4c 3a 33 2c 43 41 4e 43 45 4c 3a 34 2c 44 52 41 57 5f 43 4f 4d 50 4c 45 54 45 3a 35 2c 4f 4e 5f 52 45 53 55 4d 45 3a 36 2c 41 43 54 49 56 49 54 59 5f 43 52 45 41 54 45 44 3a 37 2c 43 4f 4e 53 49 53 54 45 4e 43 59 5f 4d 4f 44 45 4c 5f 55 50 44 41 54 45 52 3a 38 2c 53 45 4e 44 5f 4d 45 53 53 41 47 45 3a 39 2c 53 55 43 43 45 53 53 5f 43 4f 4c 44 3a 31 30 2c 53 55 43 43 45 53 53 5f 57 41 52 4d 3a 31 31 2c 55 49 5f 49 44 4c 45 3a 31 32 2c 50 Data Ascii: ;/FB_PKG_DELIM/__d("QuickLogActionType",[],(function(a,b,c,d,e,f){a=Object.freeze({START:1,SUCCESS:2,FAIL:3,CANCEL:4,DRAW_COMPLETE:5,ON_RESUME:6,ACTIVITY_CREATED:7,CONSISTENCY_MODEL_UPDATER:8,SEND_MESSAGE:9,SUCCESS_COLD:10,SUCCESS_WARM:11,UI_IDLE:12,P
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 55 43 43 45 53 53 3a 35 35 2c 51 55 45 55 45 49 4e 47 5f 46 41 49 4c 3a 35 36 2c 4d 45 53 53 41 47 45 5f 55 50 44 41 54 45 5f 53 54 41 52 54 3a 35 37 2c 4d 45 53 53 41 47 45 5f 55 50 44 41 54 45 5f 45 4e 44 3a 35 38 2c 50 48 4f 54 4f 5f 43 41 50 54 55 52 45 44 3a 35 39 2c 4d 45 44 49 41 5f 50 52 45 56 49 45 57 5f 56 49 53 49 42 4c 45 3a 36 30 2c 43 4f 55 4e 54 45 52 3a 36 31 2c 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4c 4f 41 44 5f 54 49 4d 45 4c 49 4e 45 5f 48 45 41 44 45 52 3a 36 32 2c 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4c 4f 41 44 5f 45 56 45 4e 54 5f 50 45 52 4d 41 4c 49 4e 4b 3a 36 33 2c 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4c 4f 41 44 5f 47 52 4f 55 50 53 5f 46 45 45 44 3a 36 34 2c 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4c 4f 41 44 5f 50 41 47 45 5f 48 45 Data Ascii: UCCESS:55,QUEUEING_FAIL:56,MESSAGE_UPDATE_START:57,MESSAGE_UPDATE_END:58,PHOTO_CAPTURED:59,MEDIA_PREVIEW_VISIBLE:60,COUNTER:61,INTERACTION_LOAD_TIMELINE_HEADER:62,INTERACTION_LOAD_EVENT_PERMALINK:63,INTERACTION_LOAD_GROUPS_FEED:64,INTERACTION_LOAD_PAGE_HE
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 43 4f 4e 54 45 58 54 3a 31 32 30 2c 48 45 41 44 45 52 5f 44 41 54 41 5f 4c 4f 41 44 45 44 3a 31 32 31 2c 43 41 52 44 5f 44 41 54 41 5f 4c 4f 41 44 45 44 3a 31 32 32 2c 56 49 45 57 5f 57 49 4c 4c 5f 41 50 50 45 41 52 5f 42 45 47 49 4e 3a 31 32 33 2c 56 49 45 57 5f 44 49 44 5f 4c 4f 41 44 5f 42 45 47 49 4e 3a 31 32 34 2c 43 4f 4d 50 4f 4e 45 4e 54 53 5f 44 41 54 41 5f 53 4f 55 52 43 45 5f 57 49 4c 4c 5f 42 45 47 49 4e 5f 55 50 44 41 54 45 53 3a 31 32 35 2c 43 4f 4d 50 4f 4e 45 4e 54 53 5f 44 41 54 41 5f 53 4f 55 52 43 45 5f 44 49 44 5f 45 4e 44 5f 55 50 44 41 54 45 53 3a 31 32 36 2c 4c 4f 41 44 5f 56 49 45 57 5f 42 45 47 49 4e 3a 31 32 37 2c 52 54 4d 50 5f 46 49 52 53 54 5f 4b 45 59 5f 46 52 41 4d 45 5f 52 45 43 45 49 56 45 44 3a 31 32 38 2c 4d 45 53 53 45 Data Ascii: CONTEXT:120,HEADER_DATA_LOADED:121,CARD_DATA_LOADED:122,VIEW_WILL_APPEAR_BEGIN:123,VIEW_DID_LOAD_BEGIN:124,COMPONENTS_DATA_SOURCE_WILL_BEGIN_UPDATES:125,COMPONENTS_DATA_SOURCE_DID_END_UPDATES:126,LOAD_VIEW_BEGIN:127,RTMP_FIRST_KEY_FRAME_RECEIVED:128,MESSE
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 3a 31 38 31 2c 43 4f 56 45 52 5f 50 48 4f 54 4f 5f 43 4f 4d 50 4c 45 54 45 3a 31 38 32 2c 43 4f 4d 50 4f 4e 45 4e 54 5f 57 49 4c 4c 5f 43 52 45 41 54 45 3a 31 38 33 2c 43 4f 4d 50 4f 4e 45 4e 54 5f 44 49 44 5f 43 52 45 41 54 45 3a 31 38 34 2c 43 4f 4d 50 4f 4e 45 4e 54 5f 57 49 4c 4c 5f 4c 41 59 4f 55 54 3a 31 38 35 2c 43 4f 4d 50 4f 4e 45 4e 54 5f 44 49 44 5f 4c 41 59 4f 55 54 3a 31 38 36 2c 43 4f 4d 50 4f 4e 45 4e 54 5f 57 49 4c 4c 5f 4d 4f 55 4e 54 3a 31 38 37 2c 43 4f 4d 50 4f 4e 45 4e 54 5f 44 49 44 5f 4d 4f 55 4e 54 3a 31 38 38 2c 50 52 45 43 41 4c 43 55 4c 41 54 45 5f 45 44 47 45 53 3a 31 38 39 2c 55 49 5f 54 48 52 45 41 44 5f 44 45 51 55 45 55 45 3a 31 39 30 2c 43 41 4c 4c 42 41 43 4b 53 5f 43 4f 4d 50 4c 45 54 45 3a 31 39 31 2c 43 41 4c 4c 42 41 Data Ascii: :181,COVER_PHOTO_COMPLETE:182,COMPONENT_WILL_CREATE:183,COMPONENT_DID_CREATE:184,COMPONENT_WILL_LAYOUT:185,COMPONENT_DID_LAYOUT:186,COMPONENT_WILL_MOUNT:187,COMPONENT_DID_MOUNT:188,PRECALCULATE_EDGES:189,UI_THREAD_DEQUEUE:190,CALLBACKS_COMPLETE:191,CALLBA
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 55 52 45 3a 32 34 39 2c 52 45 54 55 52 4e 5f 45 58 43 45 50 54 49 4f 4e 5f 54 4f 5f 43 41 4c 4c 45 52 3a 32 35 30 2c 53 55 52 46 41 43 45 5f 54 45 58 54 55 52 45 5f 41 56 41 49 4c 41 42 4c 45 3a 32 35 31 2c 4e 45 57 53 5f 46 45 45 44 5f 46 52 41 47 4d 45 4e 54 3a 32 35 32 2c 48 45 41 44 45 52 5f 43 41 43 48 45 5f 46 45 54 43 48 5f 53 54 41 52 54 45 44 3a 32 35 33 2c 43 48 41 4e 47 45 53 45 54 5f 45 4e 51 55 45 55 45 44 3a 32 35 38 2c 52 54 43 5f 42 52 4f 41 44 43 41 53 54 5f 49 4e 49 54 49 41 4c 49 5a 45 44 3a 32 35 39 2c 52 54 43 5f 53 54 52 45 41 4d 49 4e 47 5f 49 4e 49 54 49 41 4c 49 5a 45 44 3a 32 36 30 2c 52 54 43 5f 53 54 52 45 41 4d 49 4e 47 5f 53 54 41 52 54 45 44 3a 32 36 31 2c 43 41 4d 45 52 41 5f 56 49 44 45 4f 5f 4f 55 54 50 55 54 5f 53 57 49 Data Ascii: URE:249,RETURN_EXCEPTION_TO_CALLER:250,SURFACE_TEXTURE_AVAILABLE:251,NEWS_FEED_FRAGMENT:252,HEADER_CACHE_FETCH_STARTED:253,CHANGESET_ENQUEUED:258,RTC_BROADCAST_INITIALIZED:259,RTC_STREAMING_INITIALIZED:260,RTC_STREAMING_STARTED:261,CAMERA_VIDEO_OUTPUT_SWI
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 54 45 52 5f 43 4f 4e 4e 45 43 54 3a 33 32 36 2c 4d 45 53 53 45 4e 47 45 52 5f 44 41 59 5f 55 4e 49 54 5f 44 49 53 50 4c 41 59 45 44 3a 33 32 37 2c 44 41 54 41 5f 4c 4f 41 44 5f 45 4e 44 3a 33 32 38 2c 56 49 45 57 5f 44 49 44 5f 42 45 43 4f 4d 45 5f 56 49 53 49 42 4c 45 3a 33 32 39 2c 44 45 4c 54 41 5f 41 50 50 4c 49 43 41 54 49 4f 4e 5f 49 4e 54 45 52 52 55 50 54 45 44 3a 33 33 30 2c 44 45 4c 54 41 5f 42 41 54 43 48 5f 41 50 50 4c 49 43 41 54 49 4f 4e 5f 43 4f 4d 50 4c 45 54 45 44 3a 33 33 31 2c 4d 45 53 53 41 47 45 5f 4c 49 53 54 5f 44 49 44 5f 55 50 44 41 54 45 3a 33 33 32 2c 4d 45 53 53 41 47 45 5f 4c 49 53 54 5f 57 49 4c 4c 5f 55 50 44 41 54 45 3a 33 33 33 2c 53 55 43 43 45 53 53 5f 5a 45 52 4f 5f 57 41 49 54 5f 54 49 4d 45 3a 33 33 34 2c 55 53 45 52 Data Ascii: TER_CONNECT:326,MESSENGER_DAY_UNIT_DISPLAYED:327,DATA_LOAD_END:328,VIEW_DID_BECOME_VISIBLE:329,DELTA_APPLICATION_INTERRUPTED:330,DELTA_BATCH_APPLICATION_COMPLETED:331,MESSAGE_LIST_DID_UPDATE:332,MESSAGE_LIST_WILL_UPDATE:333,SUCCESS_ZERO_WAIT_TIME:334,USER
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 4c 5f 53 54 41 52 54 3a 34 34 33 2c 51 52 43 4f 44 45 5f 53 43 41 4e 4e 45 52 5f 53 43 41 4e 5f 53 55 43 43 45 53 53 3a 34 34 34 2c 51 52 43 4f 44 45 5f 53 43 41 4e 4e 45 52 5f 53 43 41 4e 5f 46 41 49 4c 55 52 45 3a 34 34 35 2c 41 50 50 5f 43 52 45 41 54 45 44 5f 4d 41 49 4e 5f 50 52 4f 43 45 53 53 3a 34 34 36 2c 46 49 4e 49 53 48 5f 52 45 47 49 53 54 45 52 49 4e 47 5f 4a 53 5f 4e 41 54 49 56 45 5f 4d 4f 44 55 4c 45 53 3a 34 34 37 2c 4e 4f 4e 5f 41 4e 52 3a 34 34 38 2c 46 49 4e 49 53 48 5f 49 4e 49 54 49 41 4c 49 5a 49 4e 47 5f 4a 53 5f 42 52 49 44 47 45 3a 34 34 39 2c 46 49 4e 49 53 48 5f 49 4e 4a 45 43 54 49 4e 47 5f 4a 53 5f 48 4f 4f 4b 53 3a 34 35 30 2c 46 49 4e 49 53 48 5f 52 55 4e 4e 49 4e 47 5f 4a 53 5f 49 4e 49 54 49 41 4c 49 5a 45 52 3a 34 35 31 Data Ascii: L_START:443,QRCODE_SCANNER_SCAN_SUCCESS:444,QRCODE_SCANNER_SCAN_FAILURE:445,APP_CREATED_MAIN_PROCESS:446,FINISH_REGISTERING_JS_NATIVE_MODULES:447,NON_ANR:448,FINISH_INITIALIZING_JS_BRIDGE:449,FINISH_INJECTING_JS_HOOKS:450,FINISH_RUNNING_JS_INITIALIZER:451
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 49 41 5f 52 45 4e 44 45 52 45 44 3a 35 30 35 2c 46 49 52 53 54 5f 43 41 43 48 45 44 5f 4d 45 44 49 41 5f 52 45 4e 44 45 52 45 44 3a 35 30 36 2c 43 41 4d 45 52 41 5f 49 4e 49 54 49 41 4c 49 5a 45 44 3a 35 30 37 2c 48 54 54 50 5f 54 52 41 4e 53 41 43 54 49 4f 4e 5f 53 54 41 52 54 45 44 3a 35 30 38 2c 52 45 4d 4f 54 45 5f 50 52 4f 43 45 53 53 3a 35 30 39 2c 50 52 45 5f 52 45 51 55 45 53 54 5f 53 45 4e 44 5f 43 41 4c 4c 45 44 3a 35 31 30 2c 42 52 49 44 47 45 5f 53 54 41 52 54 55 50 5f 57 49 4c 4c 5f 53 54 41 52 54 3a 35 31 31 2c 42 52 49 44 47 45 5f 53 54 41 52 54 55 50 5f 44 49 44 5f 46 49 4e 49 53 48 3a 35 31 32 2c 43 4f 56 45 52 5f 50 48 4f 54 4f 5f 4c 4f 57 5f 52 45 53 3a 35 31 33 2c 43 4f 56 45 52 5f 50 48 4f 54 4f 5f 48 49 47 48 5f 52 45 53 3a 35 31 34 Data Ascii: IA_RENDERED:505,FIRST_CACHED_MEDIA_RENDERED:506,CAMERA_INITIALIZED:507,HTTP_TRANSACTION_STARTED:508,REMOTE_PROCESS:509,PRE_REQUEST_SEND_CALLED:510,BRIDGE_STARTUP_WILL_START:511,BRIDGE_STARTUP_DID_FINISH:512,COVER_PHOTO_LOW_RES:513,COVER_PHOTO_HIGH_RES:514
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 52 54 3a 35 37 34 2c 52 4f 4f 54 5f 51 55 45 52 59 5f 53 55 43 43 45 53 53 3a 35 37 35 2c 52 4f 4f 54 5f 51 55 45 52 59 5f 46 41 49 4c 3a 35 37 36 2c 43 41 43 48 45 5f 49 4e 49 54 49 41 4c 49 5a 45 44 3a 35 37 37 2c 46 45 54 43 48 5f 42 45 47 49 4e 3a 35 37 38 2c 46 45 54 43 48 5f 46 49 4e 49 53 48 45 44 3a 35 37 39 2c 50 41 52 53 49 4e 47 5f 46 49 4e 49 53 48 45 44 3a 35 38 30 2c 4c 4f 41 44 5f 56 49 45 57 5f 45 4e 44 3a 35 38 31 2c 4c 4f 41 44 5f 55 52 4c 5f 42 45 47 49 4e 3a 35 38 32 2c 4c 4f 41 44 5f 55 52 4c 5f 45 4e 44 3a 35 38 33 2c 53 48 4f 55 4c 44 5f 4c 4f 41 44 5f 55 52 4c 5f 42 45 47 49 4e 3a 35 39 38 2c 53 48 4f 55 4c 44 5f 4c 4f 41 44 5f 55 52 4c 5f 45 4e 44 3a 35 39 39 2c 42 4c 4f 43 4b 49 4e 47 5f 52 45 53 4f 55 52 43 45 53 5f 4c 4f 41 44 Data Ascii: RT:574,ROOT_QUERY_SUCCESS:575,ROOT_QUERY_FAIL:576,CACHE_INITIALIZED:577,FETCH_BEGIN:578,FETCH_FINISHED:579,PARSING_FINISHED:580,LOAD_VIEW_END:581,LOAD_URL_BEGIN:582,LOAD_URL_END:583,SHOULD_LOAD_URL_BEGIN:598,SHOULD_LOAD_URL_END:599,BLOCKING_RESOURCES_LOAD
2024-04-19 01:40:37 UTC	1500	IN	Data Raw: 45 53 54 5f 43 41 43 48 45 5f 43 48 45 43 4b 5f 53 54 41 52 54 3a 36 36 31 2c 56 49 44 45 4f 5f 46 45 54 43 48 5f 52 45 51 55 45 53 54 5f 43 41 43 48 45 5f 43 48 45 43 4b 5f 45 4e 44 3a 36 36 32 2c 56 49 44 45 4f 5f 46 45 54 43 48 5f 52 45 51 55 45 53 54 5f 44 49 44 5f 41 54 54 41 43 48 5f 54 4f 5f 4e 45 54 57 4f 52 4b 5f 52 45 51 55 45 53 54 3a 36 36 33 2c 53 45 4c 45 43 54 5f 50 48 4f 54 4f 53 5f 46 41 49 4c 45 44 5f 53 43 4f 52 45 3a 36 36 34 2c 53 45 4c 45 43 54 5f 50 48 4f 54 4f 53 5f 46 41 49 4c 45 44 5f 54 49 4d 45 53 54 41 4d 50 3a 36 36 35 2c 49 4e 54 45 52 41 43 54 49 4f 4e 5f 43 4c 49 43 4b 3a 36 36 36 2c 56 49 44 45 4f 5f 53 43 52 55 42 42 45 52 5f 46 49 52 53 54 5f 54 48 55 4d 42 4e 41 49 4c 5f 53 48 4f 57 4e 3a 36 36 37 2c 56 49 44 45 4f 5f Data Ascii: EST_CACHE_CHECK_START:661,VIDEO_FETCH_REQUEST_CACHE_CHECK_END:662,VIDEO_FETCH_REQUEST_DID_ATTACH_TO_NETWORK_REQUEST:663,SELECT_PHOTOS_FAILED_SCORE:664,SELECT_PHOTOS_FAILED_TIMESTAMP:665,INTERACTION_CLICK:666,VIDEO_SCRUBBER_FIRST_THUMBNAIL_SHOWN:667,VIDEO_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:38 UTC	665	OUT	GET /rsrc.php/v3iwN74/yD/l/en_US/APoqa-iIOjvrn_I8kVuFfvi1Qie0qdVBFdoHo8RmQG6EroQ9FNgpiRhTLojQtsFNcs.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:38 UTC	1763	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: V+nbBux2ggcCgy6Y2Bpf+A== Expires: Sat, 19 Apr 2025 01:40:38 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: +WQVUgJyaXuHJ8j9L4uy8EslRaUVfIzWZYFYaykXLp5Xx1lQQ8MkKV8yvpqa72TBUbnMQmY+/ZUwsJTKNFAtoQ== Date: Fri, 19 Apr 2024 01:40:38 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=63, ullat=0 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1201212
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 3b 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 53 65 74 44 65 6e 73 65 4d 6f 64 65 4d 75 74 61 74 69 6f 6e 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 34 34 38 36 31 34 35 32 36 34 38 32 30 37 38 31 22 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 53 65 74 44 65 6e 73 65 4d 6f 64 65 4d 75 74 61 74 69 6f 6e 2e 67 72 61 70 68 71 6c 22 2c 5b 22 43 6f 6d 65 74 53 65 74 44 65 6e 73 65 4d 6f 64 65 4d 75 74 61 74 69 6f 6e 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 Data Ascii: ;/FB_PKG_DELIM/__d("CometSetDenseModeMutation_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="4486145264820781"}),null);__d("CometSetDenseModeMutation.graphql",["CometSetDenseModeMutation_facebookRelayOperation"],(function(a,b,c,d,e,f){"
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 6f 6e 43 6f 6e 74 65 78 74 46 72 61 67 6d 65 6e 74 22 7d 5d 2c 74 79 70 65 3a 22 51 75 65 72 79 22 2c 61 62 73 74 72 61 63 74 4b 65 79 3a 6e 75 6c 6c 7d 3b 65 2e 65 78 70 6f 72 74 73 3d 61 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 75 73 65 43 41 41 53 61 76 65 64 41 63 63 6f 75 6e 74 73 46 72 61 67 6d 65 6e 74 2e 67 72 61 70 68 71 6c 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 6e 61 6d 65 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 3b 72 65 74 75 72 6e 7b 61 72 67 75 6d Data Ascii: onContextFragment"}],type:"Query",abstractKey:null};e.exports=a}),null);__d("useCAASavedAccountsFragment.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null};return{argum
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 6c 65 5f 61 63 63 6f 75 6e 74 73 2e 64 65 76 69 63 65 5f 75 73 65 72 2e 61 79 6d 68 5f 75 73 65 72 5f 66 69 65 6c 64 73 22 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 5b 7b 6b 69 6e 64 3a 22 4c 69 74 65 72 61 6c 22 2c 6e 61 6d 65 3a 22 61 70 70 5f 6e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 66 61 63 65 62 6f 6f 6b 22 7d 2c 7b 6b 69 6e 64 3a 22 4c 69 74 65 72 61 6c 22 2c 6e 61 6d 65 3a 22 69 73 5f 61 79 6d 68 5f 66 6c 6f 77 22 2c 76 61 6c 75 65 3a 21 31 7d 5d 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 4c 6f 67 67 65 64 4f 75 74 41 63 63 6f 75 6e 74 53 77 69 74 63 68 65 72 41 63 63 6f 75 6e 74 46 6f 72 6d 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 66 6f 72 6d 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 Data Ascii: le_accounts.device_user.aymh_user_fields"},{alias:null,args:[{kind:"Literal",name:"app_name",value:"facebook"},{kind:"Literal",name:"is_aymh_flow",value:!1}],concreteType:"LoggedOutAccountSwitcherAccountForm",kind:"LinkedField",name:"form",plural:!1,selec
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 77 69 64 74 68 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 68 65 69 67 68 74 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 62 72 6f 61 64 63 61 73 74 65 72 5f 6f 72 69 67 69 6e 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 Data Ascii: lias:null,args:null,kind:"ScalarField",name:"width",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"broadcaster_origin",storageKey:null},{alias:null,args:null,kind:"Sc
2024-04-19 01:40:38 UTC	455	IN	Data Raw: 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 62 72 6f 61 64 63 61 73 74 5f 6c 61 74 65 6e 63 79 5f 73 65 6e 73 69 74 69 76 69 74 79 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 5d 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 4c 69 76 65 50 6c 61 79 62 61 63 6b 49 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 43 6f 6e 66 69 67 50 61 72 61 6d 73 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 6c 69 76 65 5f 70 6c 61 79 62 61 63 6b 5f 69 6e 73 74 72 75 6d 65 6e 74 61 74 69 6f 6e 5f 63 6f 6e 66 69 67 73 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c Data Ascii: nd:"ScalarField",name:"broadcast_latency_sensitivity",storageKey:null}],storageKey:null},{alias:null,args:null,concreteType:"LivePlaybackInstrumentationConfigParams",kind:"LinkedField",name:"live_playback_instrumentation_configs",plural:!1,selections:[{al
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 70 65 72 6d 61 6c 69 6e 6b 5f 75 72 6c 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 61 70 74 69 6f 6e 73 5f 75 72 6c 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 5b 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 22 70 6c 61 79 65 72 5f 6f 72 69 67 69 6e 22 2c 76 61 72 69 61 62 6c 65 4e 61 6d 65 3a 22 56 69 64 65 6f 50 6c 61 79 65 72 52 65 6c 61 79 5f 76 69 64 65 6f 24 70 6c 61 79 65 72 4f 72 69 67 69 6e 22 7d 2c 7b 6b 69 Data Ascii: rgs:null,kind:"ScalarField",name:"permalink_url",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"captions_url",storageKey:null},{alias:null,args:[{kind:"Variable",name:"player_origin",variableName:"VideoPlayerRelay_video$playerOrigin"},{ki
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 79 22 2c 76 61 6c 75 65 3a 22 48 44 22 7d 5d 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 70 6c 61 79 61 62 6c 65 5f 75 72 6c 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 27 70 6c 61 79 61 62 6c 65 5f 75 72 6c 28 71 75 61 6c 69 74 79 3a 22 48 44 22 29 27 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 53 70 68 65 72 69 63 61 6c 56 69 64 65 6f 46 61 6c 6c 62 61 63 6b 55 72 6c 73 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 73 70 68 65 72 69 63 61 6c 5f 76 69 64 65 6f 5f 66 61 6c 6c 62 61 63 6b 5f 75 72 6c 73 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a Data Ascii: y",value:"HD"}],kind:"ScalarField",name:"playable_url",storageKey:'playable_url(quality:"HD")'},{alias:null,args:null,concreteType:"SphericalVideoFallbackUrls",kind:"LinkedField",name:"spherical_video_fallback_urls",plural:!1,selections:[{alias:null,args:
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 61 6d 65 3a 22 69 6e 69 74 22 2c 6b 69 6e 64 3a 22 4d 6f 64 75 6c 65 49 6d 70 6f 72 74 22 7d 5d 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 76 69 64 65 6f 5f 70 6c 61 79 65 72 5f 73 68 61 6b 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 5f 6c 6f 67 67 65 72 5f 73 68 6f 75 6c 64 5f 73 61 6d 70 6c 65 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 22 76 69 64 65 6f 5f 70 6c 61 79 65 72 5f 73 68 61 6b 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 5f 6c 6f 67 67 65 72 5f 69 6e 69 74 32 22 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 56 69 64 65 6f 50 6c 61 79 65 72 Data Ascii: ame:"init",kind:"ModuleImport"}],storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"video_player_shaka_performance_logger_should_sample",storageKey:null},{alias:"video_player_shaka_performance_logger_init2",args:null,concreteType:"VideoPlayer
2024-04-19 01:40:38 UTC	1500	IN	Data Raw: 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 56 69 64 65 6f 48 69 76 65 43 6f 6d 6d 75 6e 69 74 79 49 6e 66 6f 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 6f 6d 6d 75 6e 69 74 79 5f 69 6e 66 6f 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 6f 6d 6d 75 6e 69 74 79 5f 69 64 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 6f 6d 6d 75 6e 69 74 79 5f 6e Data Ascii: as:null,args:null,concreteType:"VideoHiveCommunityInfo",kind:"LinkedField",name:"community_info",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"community_id",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"community_n
2024-04-19 01:40:38 UTC	910	IN	Data Raw: 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 61 70 74 69 6f 6e 73 5f 74 65 78 74 5f 63 6f 6c 6f 72 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 61 70 74 69 6f 6e 73 5f 74 65 78 74 5f 73 69 7a 65 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 61 5d 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 56 69 64 65 6f 42 72 6f 61 64 63 61 73 74 4c 6f 77 4c 61 74 65 6e 63 79 43 6f 6e 66 69 67 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 62 72 Data Ascii: calarField",name:"captions_text_color",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"captions_text_size",storageKey:null},a],storageKey:null},{alias:null,args:null,concreteType:"VideoBroadcastLowLatencyConfig",kind:"LinkedField",name:"br

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:38 UTC	610	OUT	GET /rsrc.php/v3iHrB4/y-/l/en_US/Sd6LZm7F8MR.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:38 UTC	1738	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: kdWhSDpIEZ8PNwgkVt8EIw== Expires: Fri, 18 Apr 2025 18:38:20 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: 0STZbRxnUUG2SvoZRO3cUi4JpIi8KiHlxBEeCtbHbDLARvTNfnc5B+n2vZg/c4JPaAeiSjPh8GJfgJwmPR5OxA== Date: Fri, 19 Apr 2024 01:40:38 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=16, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1096243
2024-04-19 01:40:38 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:38 UTC	16069	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 53 74 79 6c 65 58 44 61 72 6b 54 68 65 6d 65 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 7b 22 66 64 73 2d 62 6c 61 63 6b 22 3a 22 62 6c 61 63 6b 22 2c 22 66 64 73 2d 62 6c 61 63 6b 2d 61 6c 70 68 61 2d 30 35 22 3a 22 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 35 29 22 2c 22 66 64 73 2d 62 6c 61 63 6b 2d 61 6c 70 68 61 2d 31 30 22 3a 22 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 29 22 2c 22 66 64 73 2d 62 6c 61 63 6b 2d 61 6c 70 68 61 2d 31 35 22 3a 22 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 35 29 22 2c 22 66 64 73 2d 62 6c 61 63 6b 2d 61 6c 70 68 61 2d 32 30 22 3a 22 72 67 62 Data Ascii: /FB_PKG_DELIM/__d("CometStyleXDarkTheme",[],(function(a,b,c,d,e,f){e.exports={"fds-black":"black","fds-black-alpha-05":"rgba(0, 0, 0, 0.05)","fds-black-alpha-10":"rgba(0, 0, 0, 0.1)","fds-black-alpha-15":"rgba(0, 0, 0, 0.15)","fds-black-alpha-20":"rgb
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 2c 20 73 61 6e 73 2d 73 65 72 69 66 22 2c 22 68 65 61 64 6c 69 6e 65 33 2d 66 6f 6e 74 2d 73 69 7a 65 22 3a 22 31 2e 30 36 32 35 72 65 6d 22 2c 22 68 65 61 64 6c 69 6e 65 33 2d 66 6f 6e 74 2d 77 65 69 67 68 74 22 3a 22 37 30 30 22 2c 22 68 65 61 64 6c 69 6e 65 33 2d 6c 69 6e 65 2d 68 65 69 67 68 74 22 3a 22 31 2e 32 39 34 31 22 2c 22 6d 65 74 61 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 22 3a 22 50 6c 61 63 65 68 6f 6c 64 65 72 20 46 6f 6e 74 22 2c 22 6d 65 74 61 2d 66 6f 6e 74 2d 73 69 7a 65 22 3a 22 30 2e 38 31 32 35 72 65 6d 22 2c 22 6d 65 74 61 2d 66 6f 6e 74 2d 77 65 69 67 68 74 22 3a 22 34 30 30 22 2c 22 6d 65 74 61 2d 6c 69 6e 65 2d 68 65 69 67 68 74 22 3a 22 31 2e 33 38 34 36 22 2c 22 6d 65 74 61 2d 65 6d 70 68 61 73 69 7a 65 64 2d 66 6f 6e 74 2d 66 61 Data Ascii: , sans-serif","headline3-font-size":"1.0625rem","headline3-font-weight":"700","headline3-line-height":"1.2941","meta-font-family":"Placeholder Font","meta-font-size":"0.8125rem","meta-font-weight":"400","meta-line-height":"1.3846","meta-emphasized-font-fa
2024-04-19 01:40:38 UTC	16384	IN	Data Raw: 2d 61 64 64 6f 6e 22 3a 22 31 36 70 78 22 2c 22 6e 75 78 2d 63 61 72 64 2d 62 6f 64 79 2d 70 61 64 64 69 6e 67 2d 65 6e 64 22 3a 22 32 34 70 78 22 2c 22 70 61 67 65 2d 66 6f 6f 74 65 72 2d 70 61 64 64 69 6e 67 2d 76 65 72 74 69 63 61 6c 22 3a 22 31 36 70 78 22 2c 22 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 61 64 64 4f 6e 45 6e 64 2d 6d 61 72 67 69 6e 2d 68 6f 72 69 7a 6f 6e 74 61 6c 22 3a 22 38 70 78 22 2c 22 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 61 64 64 4f 6e 53 74 61 72 74 2d 6d 61 72 67 69 6e 2d 68 6f 72 69 7a 6f 6e 74 61 6c 22 3a 22 31 32 70 78 22 2c 22 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 61 64 64 4f 6e 45 6e 64 2d 62 75 74 74 6f 6e 2d 70 61 64 64 69 6e 67 2d 68 6f 72 69 7a 6f 6e 74 61 6c 22 3a 22 30 70 78 22 2c 22 73 65 63 74 69 Data Ascii: -addon":"16px","nux-card-body-padding-end":"24px","page-footer-padding-vertical":"16px","section-header-addOnEnd-margin-horizontal":"8px","section-header-addOnStart-margin-horizontal":"12px","section-header-addOnEnd-button-padding-horizontal":"0px","secti
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 74 68 69 73 2e 67 65 74 44 6f 6d 61 69 6e 28 29 26 26 21 74 68 69 73 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 3f 21 30 3a 5b 22 68 74 74 70 73 22 2c 22 68 74 74 70 22 5d 2e 69 6e 64 65 78 4f 66 28 74 68 69 73 2e 67 65 74 50 72 6f 74 6f 63 6f 6c 28 29 29 21 3d 3d 2d 31 26 26 6d 2e 74 65 73 74 28 74 68 69 73 2e 67 65 74 44 6f 6d 61 69 6e 28 29 29 7d 3b 62 2e 69 73 47 65 6e 65 72 69 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 73 47 65 6e 65 72 69 63 50 72 6f 74 6f 63 6f 6c 7d 3b 62 2e 69 73 53 61 6d 65 4f 72 69 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 63 28 22 69 73 53 61 6d 65 4f 72 69 67 69 6e 22 29 28 74 68 69 73 2c 61 29 7d 3b 62 2e 69 73 53 75 62 64 6f 6d 61 69 6e 4f 66 44 6f 6d 61 69 6e 3d Data Ascii: this.getDomain()&&!this.getProtocol()?!0:["https","http"].indexOf(this.getProtocol())!==-1&&m.test(this.getDomain())};b.isGeneric=function(){return this.isGenericProtocol};b.isSameOrigin=function(a){return c("isSameOrigin")(this,a)};b.isSubdomainOfDomain=
2024-04-19 01:40:39 UTC	1500	IN	Data Raw: 78 74 28 7b 61 64 64 43 75 73 74 6f 6d 43 6f 6d 6d 61 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 7d 2c 63 68 65 63 6b 46 6f 72 4b 65 79 43 6f 6d 6d 61 6e 64 43 6f 6e 66 6c 69 63 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 5b 5d 7d 2c 64 69 73 61 62 6c 65 43 75 73 74 6f 6d 43 6f 6d 6d 61 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 7d 2c 67 65 74 41 72 65 53 69 6e 67 6c 65 4b 65 79 73 44 69 73 61 62 6c 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 28 22 43 6f 6d 65 74 43 75 73 74 6f 6d 4b 65 79 43 6f 6d 6d 61 6e 64 73 22 29 2e 61 72 65 53 69 6e 67 6c 65 4b 65 79 73 44 69 73 61 62 6c 65 64 7d 2c 67 65 74 43 75 73 74 6f 6d 43 6f 6d 6d 61 6e 64 73 4d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 Data Ascii: xt({addCustomCommand:function(a){},checkForKeyCommandConflict:function(a){return[]},disableCustomCommand:function(a){},getAreSingleKeysDisabled:function(){return c("CometCustomKeyCommands").areSingleKeysDisabled},getCustomCommandsMap:function(){return new
2024-04-19 01:40:39 UTC	14884	IN	Data Raw: 22 29 28 22 6c 6f 67 67 65 72 3a 43 6f 6d 65 74 4b 65 79 43 6f 6d 6d 61 6e 64 73 4c 6f 67 67 65 72 43 6f 6e 66 69 67 22 29 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 61 72 65 4b 65 79 43 6f 6d 62 69 6e 61 74 69 6f 6e 73 45 71 75 61 6c 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3d 3d 6e 75 6c 6c 7c 7c 62 3d 3d 6e 75 6c 6c 3f 61 3d 3d 3d 62 3a 61 2e 6b 65 79 21 3d 3d 22 22 26 26 62 2e 6b 65 79 21 3d 3d 22 22 26 26 61 2e 6b 65 79 3d 3d 3d 62 2e 6b 65 79 26 26 61 2e 61 6c 74 3d 3d 3d 21 30 3d 3d 3d 28 62 2e 61 6c 74 3d 3d 3d 21 30 29 26 26 61 2e 63 6f 6d 6d 61 6e 64 3d 3d 3d 21 30 3d 3d 3d 28 62 2e 63 6f 6d Data Ascii: ")("logger:CometKeyCommandsLoggerConfig")}),null);__d("areKeyCombinationsEqual",[],(function(a,b,c,d,e,f){"use strict";function a(a,b){return a==null\|\|b==null?a===b:a.key!==""&&b.key!==""&&a.key===b.key&&a.alt===!0===(b.alt===!0)&&a.command===!0===(b.com
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 32 39 34 31 35 39 22 29 2e 5f 5f 53 45 43 52 45 54 5f 49 4e 54 45 52 4e 41 4c 53 5f 44 4f 5f 4e 4f 54 5f 55 53 45 5f 4f 52 5f 59 4f 55 5f 57 49 4c 4c 5f 42 45 5f 46 49 52 45 44 3b 67 2e 5f 5f 44 4f 4d 5f 49 4e 54 45 52 4e 41 4c 53 5f 44 4f 5f 4e 4f 54 5f 55 53 45 5f 4f 52 5f 57 41 52 4e 5f 55 53 45 52 53 5f 54 48 45 59 5f 43 41 4e 4e 4f 54 5f 55 50 47 52 41 44 45 3d 62 28 22 63 72 3a 31 32 39 34 31 35 39 22 29 2e 5f 5f 44 4f 4d 5f 49 4e 54 45 52 4e 41 4c 53 5f 44 4f 5f 4e 4f 54 5f 55 53 45 5f 4f 52 5f 57 41 52 4e 5f 55 53 45 52 53 5f 54 48 45 59 5f 43 41 4e 4e 4f 54 5f 55 50 47 52 41 44 45 3b 67 2e 76 65 72 73 69 6f 6e 3d 62 28 22 63 72 3a 31 32 39 34 31 35 39 22 29 2e 76 65 72 73 69 6f 6e 3b 67 2e 75 73 65 46 6f 72 6d 53 74 61 74 75 73 3d 62 28 22 63 72 Data Ascii: 294159").__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED;g.__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE=b("cr:1294159").__DOM_INTERNALS_DO_NOT_USE_OR_WARN_USERS_THEY_CANNOT_UPGRADE;g.version=b("cr:1294159").version;g.useFormStatus=b("cr
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 3b 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 62 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 48 69 64 64 65 6e 53 75 62 74 72 65 65 50 61 73 73 69 76 65 43 6f 6e 74 65 78 74 22 2c 5b 22 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 3b 61 3d 68 7c 7c 64 28 22 72 65 61 63 74 22 29 3b 62 3d 61 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 7b 67 65 74 43 75 72 72 65 6e 74 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 65 64 3a 21 31 2c 68 69 64 64 65 6e 3a 21 31 2c 68 69 64 64 65 6e 4f 72 42 61 63 6b 67 72 6f 75 6e 64 65 64 3a 21 31 2c 68 69 64 64 65 6e 4f 72 42 61 63 6b 67 72 6f 75 6e 64 65 64 5f 46 49 58 4d Data Ascii: ;g["default"]=b}),98);__d("HiddenSubtreePassiveContext",["react"],(function(a,b,c,d,e,f,g){"use strict";var h;a=h\|\|d("react");b=a.createContext({getCurrentState:function(){return{backgrounded:!1,hidden:!1,hiddenOrBackgrounded:!1,hiddenOrBackgrounded_FIXM
2024-04-19 01:40:39 UTC	1500	IN	Data Raw: 6a 73 78 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 22 78 32 62 6a 32 6e 79 20 78 31 78 71 73 71 6c 35 20 78 31 73 6e 34 30 78 73 20 78 31 67 6b 75 77 31 36 20 78 67 31 79 65 69 32 20 78 31 6e 70 61 71 35 6a 20 78 31 63 38 33 70 35 65 20 78 31 65 6e 6a 62 30 62 20 78 31 39 39 31 35 38 76 20 78 31 33 66 75 76 32 30 20 78 75 33 6a 35 62 33 20 78 31 71 30 71 38 6d 35 20 78 32 36 75 37 71 69 20 78 31 37 38 78 74 38 7a 20 78 6d 38 31 76 73 34 20 78 73 6f 30 33 31 6c 20 78 79 38 30 63 6c 76 20 78 64 6b 37 70 74 20 78 31 34 6a 75 35 35 36 20 78 31 6e 6e 33 76 30 6a 20 78 67 38 33 6c 78 79 20 78 67 38 6a 33 7a 62 20 78 31 6b 32 6a 30 36 6d 20 78 31 30 6c 36 74 71 6b 20 78 31 78 63 35 35 76 7a 20 78 71 64 33 6c 36 32 20 78 31 6f 72 7a 73 71 34 20 78 74 Data Ascii: jsx("div",{className:"x2bj2ny x1xqsql5 x1sn40xs x1gkuw16 xg1yei2 x1npaq5j x1c83p5e x1enjb0b x199158v x13fuv20 xu3j5b3 x1q0q8m5 x26u7qi x178xt8z xm81vs4 xso031l xy80clv xdk7pt x14ju556 x1nn3v0j xg83lxy xg8j3zb x1k2j06m x10l6tqk x1xc55vz xqd3l62 x1orzsq4 xt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:38 UTC	599	OUT	GET /rsrc.php/v3/yA/r/OMXgFqU76kP.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:38 UTC	1735	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: A8CcFOVoIuTFTRxOcX0REA== Expires: Fri, 18 Apr 2025 21:45:08 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: mxC0wXJz/NPyUaWPFyuTKnQ6/8/+fXeksFoWdDKh4e6o0WzNt1At+cCpDzl7XpkQijEcw5eC1XQpuSkzQW7CTw== Date: Fri, 19 Apr 2024 01:40:38 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 48634
2024-04-19 01:40:38 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:39 UTC	16082	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 4f 62 6a 65 63 74 46 69 74 43 6f 6e 74 61 69 6e 65 72 2e 72 65 61 63 74 22 2c 5b 22 63 72 3a 39 36 34 35 33 38 22 2c 22 69 73 53 74 72 69 6e 67 4e 75 6c 6c 4f 72 45 6d 70 74 79 22 2c 22 72 65 61 63 74 22 2c 22 73 74 79 6c 65 78 22 2c 22 75 6e 72 65 63 6f 76 65 72 61 62 6c 65 56 69 6f 6c 61 74 69 6f 6e 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 2c 69 2c 6a 3d 69 7c 7c 64 28 22 72 65 61 63 74 22 29 3b 62 3d 6a 2e 66 6f 72 77 61 72 64 52 65 66 28 61 29 3b 76 61 72 20 6b 3d 7b 69 6e 6e 65 72 3a 7b 68 65 69 67 68 74 3a 22 78 35 79 72 32 31 64 22 2c 70 6f 73 69 74 69 6f 6e 3a 22 78 31 Data Ascii: /FB_PKG_DELIM/__d("CometObjectFitContainer.react",["cr:964538","isStringNullOrEmpty","react","stylex","unrecoverableViolation"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i\|\|d("react");b=j.forwardRef(a);var k={inner:{height:"x5yr21d",position:"x1
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 75 61 6c 69 74 79 43 6f 6e 74 65 78 74 29 7d 66 75 6e 63 74 69 6f 6e 20 50 28 29 7b 72 65 74 75 72 6e 20 6b 28 28 69 7c 7c 28 69 3d 64 28 22 56 69 64 65 6f 50 6c 61 79 65 72 43 6f 6e 74 65 78 74 73 22 29 29 29 2e 43 75 72 72 65 6e 74 56 69 64 65 6f 54 72 61 63 6b 49 44 43 6f 6e 74 65 78 74 29 7d 66 75 6e 63 74 69 6f 6e 20 51 28 29 7b 72 65 74 75 72 6e 20 6b 28 28 69 7c 7c 28 69 3d 64 28 22 56 69 64 65 6f 50 6c 61 79 65 72 43 6f 6e 74 65 78 74 73 22 29 29 29 2e 53 65 6c 65 63 74 65 64 56 69 64 65 6f 51 75 61 6c 69 74 79 43 6f 6e 74 65 78 74 29 7d 66 75 6e 63 74 69 6f 6e 20 52 28 29 7b 72 65 74 75 72 6e 20 6b 28 28 69 7c 7c 28 69 3d 64 28 22 56 69 64 65 6f 50 6c 61 79 65 72 43 6f 6e 74 65 78 74 73 22 29 29 29 2e 54 61 72 67 65 74 41 75 64 69 6f 54 72 61 63 Data Ascii: ualityContext)}function P(){return k((i\|\|(i=d("VideoPlayerContexts"))).CurrentVideoTrackIDContext)}function Q(){return k((i\|\|(i=d("VideoPlayerContexts"))).SelectedVideoQualityContext)}function R(){return k((i\|\|(i=d("VideoPlayerContexts"))).TargetAudioTrac
2024-04-19 01:40:39 UTC	16167	IN	Data Raw: 6f 72 65 56 69 64 65 6f 50 6c 61 79 65 72 46 69 74 50 61 72 65 6e 74 43 6f 6e 74 61 69 6e 65 72 2e 72 65 61 63 74 22 2c 5b 22 44 4f 4d 43 6f 6e 74 61 69 6e 65 72 2e 72 65 61 63 74 22 2c 22 63 72 3a 39 36 34 35 33 38 22 2c 22 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 2c 69 3d 68 7c 7c 64 28 22 72 65 61 63 74 22 29 3b 62 3d 69 2e 66 6f 72 77 61 72 64 52 65 66 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 61 2e 63 68 69 6c 64 72 65 6e 2c 64 3d 61 2e 64 65 62 75 67 52 6f 6c 65 3b 64 3d 61 2e 74 65 73 74 69 64 3b 72 65 74 75 72 6e 20 69 2e 6a 73 78 28 22 64 69 76 22 2c 62 61 62 65 6c 48 65 6c 70 65 72 73 5b 22 65 78 74 65 6e 64 73 22 Data Ascii: oreVideoPlayerFitParentContainer.react",["DOMContainer.react","cr:964538","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h\|\|d("react");b=i.forwardRef(function(a,b){var c=a.children,d=a.debugRole;d=a.testid;return i.jsx("div",babelHelpers["extends"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49756	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:39 UTC	709	OUT	GET /rsrc.php/v3ic_A4/yy/l/en_US/SV3JvfEjy-HECsg6rc0g3Q_nx0QPfkJnvo7kHHAR2WLloFvVgikQZOAlimUDEtcYdfpXFYHV90WF8xsw_y3zVOBS5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:39 UTC	1761	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 2YQpjESGvRQRylp0Uyi5dw== Expires: Fri, 18 Apr 2025 20:36:27 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: px+jj+6+wJ5vUiZEaGgnnWmreChoYGNbowRGA1XFD5DXHchlCaU6DntFRF5lRFavKYJ9AfBCCn8xPNO0H+WVjQ== Date: Fri, 19 Apr 2024 01:40:39 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 81188
2024-04-19 01:40:39 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:39 UTC	15946	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 75 73 65 50 61 72 74 69 61 6c 56 69 65 77 49 6d 70 72 65 73 73 69 6f 6e 22 2c 5b 22 75 73 65 56 69 73 69 62 69 6c 69 74 79 4f 62 73 65 72 76 65 72 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 61 2e 6f 6e 49 6d 70 72 65 73 73 69 6f 6e 45 6e 64 3b 61 3d 61 2e 6f 6e 49 6d 70 72 65 73 73 69 6f 6e 53 74 61 72 74 3b 72 65 74 75 72 6e 20 63 28 22 75 73 65 56 69 73 69 62 69 6c 69 74 79 4f 62 73 65 72 76 65 72 22 29 28 7b 6f 6e 48 69 64 64 65 6e 3a 62 2c 6f 6e 56 69 73 69 62 6c 65 3a 61 2c 6f 70 74 69 6f 6e 73 3a 7b 68 69 64 64 65 6e 57 68 65 6e 43 53 53 53 74 Data Ascii: /FB_PKG_DELIM/__d("usePartialViewImpression",["useVisibilityObserver"],(function(a,b,c,d,e,f,g){"use strict";function a(a){var b=a.onImpressionEnd;a=a.onImpressionStart;return c("useVisibilityObserver")({onHidden:b,onVisible:a,options:{hiddenWhenCSSSt
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 31 37 34 7c 7c 61 3d 3d 3d 38 34 38 32 7d 3b 61 2e 69 73 5a 57 4a 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 38 32 30 35 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 65 2e 65 78 70 6f 72 74 73 3d 61 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 47 48 4c 42 6f 78 22 2c 5b 22 46 42 4c 6f 67 67 65 72 22 2c 22 47 68 6c 54 65 6e 6e 69 73 4b 6e 6f 62 73 43 6f 6e 66 69 67 22 2c 22 50 72 6f 6d 69 73 65 22 2c 22 57 65 62 53 74 6f 72 61 67 65 22 2c 22 67 6b 78 22 2c 22 72 65 71 75 69 72 65 44 65 66 65 72 72 65 64 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 2c 69 2c 6a 3d 63 28 22 72 65 71 75 69 72 65 44 65 66 65 72 72 65 64 22 29 28 22 6a 73 6f 6e Data Ascii: 174\|\|a===8482};a.isZWJ=function(a){return a===8205};return a}();e.exports=a}),null);__d("GHLBox",["FBLogger","GhlTennisKnobsConfig","Promise","WebStorage","gkx","requireDeferred"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=c("requireDeferred")("json
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 52 65 73 6f 6c 76 65 50 61 79 6c 6f 61 64 3b 61 3d 61 2e 72 65 71 75 65 73 74 50 61 72 61 6d 73 3b 76 61 72 20 64 3d 61 2e 70 65 72 66 54 72 61 63 65 41 50 49 3b 61 3d 62 2e 66 65 74 63 68 43 61 63 68 65 28 61 29 3b 64 26 26 64 2e 61 64 64 4d 61 72 6b 65 72 50 6f 69 6e 74 28 22 63 61 63 68 65 64 52 65 73 70 6f 6e 73 65 22 2c 22 41 70 70 54 69 6d 69 6e 67 22 29 3b 63 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 2c 5b 62 5d 29 7d 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 75 73 65 42 61 73 65 54 79 70 65 61 68 65 61 64 44 61 74 61 53 6f 75 72 63 65 46 65 74 63 68 52 65 73 6f 6c 76 65 72 4e 65 74 77 6f 72 6b 22 2c 5b 22 70 72 6f 6d 69 73 65 44 6f 6e 65 22 2c 22 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c Data Ascii: ResolvePayload;a=a.requestParams;var d=a.perfTraceAPI;a=b.fetchCache(a);d&&d.addMarkerPoint("cachedResponse","AppTiming");c(a);return a},[b])}g["default"]=a}),98);__d("useBaseTypeaheadDataSourceFetchResolverNetwork",["promiseDone","react"],(function(a,b,
2024-04-19 01:40:39 UTC	16384	IN	Data Raw: 70 45 78 70 65 72 69 6d 65 6e 74 29 3d 3d 3d 21 30 3b 76 61 72 20 66 3d 63 28 22 75 73 65 43 6f 6d 65 74 52 6f 75 74 65 72 44 69 73 70 61 74 63 68 65 72 22 29 28 29 2c 67 3d 69 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3b 61 3d 63 28 22 58 4c 6f 67 69 6e 43 6f 6e 74 72 6f 6c 6c 65 72 52 6f 75 74 65 42 75 69 6c 64 65 72 22 29 2e 62 75 69 6c 64 55 72 69 28 7b 6e 65 78 74 3a 65 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 28 61 3d 65 2e 75 72 6c 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 61 2e 74 6f 53 74 72 69 6e 67 28 29 7d 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 76 61 72 20 62 3d 7b 72 65 70 6c 61 63 65 3a 21 30 7d 3b 66 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 66 2e 67 6f 28 61 2c 62 29 7d 2c 5b 65 2c 66 5d 29 2c 68 3d 63 28 22 75 73 65 43 6f 6d Data Ascii: pExperiment)===!0;var f=c("useCometRouterDispatcher")(),g=i(function(){var a;a=c("XLoginControllerRouteBuilder").buildUri({next:e==null?void 0:(a=e.url)==null?void 0:a.toString()}).toString();var b={replace:!0};f==null?void 0:f.go(a,b)},[e,f]),h=c("useCom
2024-04-19 01:40:39 UTC	1500	IN	Data Raw: 6e 75 6c 6c 2c 63 68 69 6c 64 72 65 6e 3a 6a 2e 6a 73 78 28 63 28 22 42 61 73 65 43 6f 6e 74 65 78 74 75 61 6c 4c 61 79 65 72 2e 72 65 61 63 74 22 29 2c 62 61 62 65 6c 48 65 6c 70 65 72 73 5b 22 65 78 74 65 6e 64 73 22 5d 28 7b 61 6c 69 67 6e 3a 22 6d 69 64 64 6c 65 22 2c 63 6f 6e 74 65 78 74 52 65 66 3a 46 2c 68 69 64 64 65 6e 3a 21 4b 26 26 50 2c 69 6d 70 65 72 61 74 69 76 65 52 65 66 3a 47 2c 72 65 66 3a 48 2c 78 73 74 79 6c 65 3a 21 4b 26 26 4d 3f 71 2e 64 69 73 61 62 6c 65 50 6f 69 6e 74 65 72 45 76 65 6e 74 73 3a 76 6f 69 64 20 30 7d 2c 73 2c 7b 63 68 69 6c 64 72 65 6e 3a 6a 2e 6a 73 78 28 63 28 22 48 69 64 64 65 6e 53 75 62 74 72 65 65 43 6f 6e 74 65 78 74 50 72 6f 76 69 64 65 72 2e 72 65 61 63 74 22 29 2c 7b 69 73 48 69 64 64 65 6e 3a 21 4b 26 26 Data Ascii: null,children:j.jsx(c("BaseContextualLayer.react"),babelHelpers["extends"]({align:"middle",contextRef:F,hidden:!K&&P,imperativeRef:G,ref:H,xstyle:!K&&M?q.disablePointerEvents:void 0},s,{children:j.jsx(c("HiddenSubtreeContextProvider.react"),{isHidden:!K&&
2024-04-19 01:40:39 UTC	14589	IN	Data Raw: 6d 65 74 52 65 6c 61 79 22 29 2e 45 6e 74 72 79 50 6f 69 6e 74 43 6f 6e 74 61 69 6e 65 72 2c 7b 65 6e 74 72 79 50 6f 69 6e 74 52 65 66 65 72 65 6e 63 65 3a 62 2c 70 72 6f 70 73 3a 65 7d 29 7d 29 29 7d 6e 2e 64 69 73 70 6c 61 79 4e 61 6d 65 3d 6e 2e 6e 61 6d 65 2b 22 20 5b 66 72 6f 6d 20 22 2b 66 2e 69 64 2b 22 5d 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 72 65 76 65 6e 74 4e 65 73 74 65 64 3b 62 3d 62 3d 3d 3d 76 6f 69 64 20 30 3f 21 31 3a 62 3b 76 61 72 20 65 3d 62 61 62 65 6c 48 65 6c 70 65 72 73 2e 6f 62 6a 65 63 74 57 69 74 68 6f 75 74 50 72 6f 70 65 72 74 69 65 73 4c 6f 6f 73 65 28 61 2c 5b 22 70 72 65 76 65 6e 74 4e 65 73 74 65 64 22 5d 29 2c 66 3d 6b 28 63 28 22 43 6f 6d 65 74 48 6f 76 65 72 63 61 72 64 53 65 74 74 Data Ascii: metRelay").EntryPointContainer,{entryPointReference:b,props:e})}))}n.displayName=n.name+" [from "+f.id+"]";function a(a){var b=a.preventNested;b=b===void 0?!1:b;var e=babelHelpers.objectWithoutPropertiesLoose(a,["preventNested"]),f=k(c("CometHovercardSett

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:39 UTC	610	OUT	GET /rsrc.php/v3iCjQ4/yT/l/en_US/-cuErFyZKsI.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1735	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: KAVhU/uo9+qL5W5E8MX71Q== Expires: Thu, 17 Apr 2025 19:10:54 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: JmJaQut4b53dSg+5W7UdRuU/JyglwIREUlUmcMCe+92YJighcRqvBsVxBuRo9a3V2lgJs0RHtOfr6lHs8m+ufg== Date: Fri, 19 Apr 2024 01:40:39 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 55735
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:40 UTC	16072	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 54 65 78 74 57 69 74 68 45 6e 74 69 74 69 65 73 52 65 6c 61 79 5f 65 6e 74 69 74 79 2e 67 72 61 70 68 71 6c 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 69 64 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 62 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 57 6f 72 6b 46 6f 72 65 69 67 6e 45 6e 74 69 74 79 49 6e 66 6f 22 2c 6b 69 Data Ascii: /FB_PKG_DELIM/__d("CometTextWithEntitiesRelay_entity.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},b={alias:null,args:null,concreteType:"WorkForeignEntityInfo",ki
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 67 3d 66 2e 76 61 6c 75 65 7d 67 3d 67 3b 76 61 72 20 68 3d 67 2e 65 6e 74 69 74 79 2c 69 3d 67 2e 65 6e 74 69 74 79 5f 74 79 70 65 2c 6a 3d 67 2e 6c 65 6e 67 74 68 3b 67 3d 67 2e 6f 66 66 73 65 74 3b 67 21 3d 6e 75 6c 6c 26 26 6a 21 3d 6e 75 6c 6c 26 26 68 21 3d 6e 75 6c 6c 26 26 68 2e 5f 5f 74 79 70 65 6e 61 6d 65 21 3d 6e 75 6c 6c 26 26 28 67 3c 62 3f 28 63 2e 70 75 73 68 28 7b 65 6e 74 69 74 79 3a 68 2c 65 6e 74 69 74 79 5f 74 79 70 65 3a 69 2c 6c 65 6e 67 74 68 3a 6a 2c 6f 66 66 73 65 74 3a 67 7d 29 2c 67 2b 6a 3e 62 26 26 64 2e 70 75 73 68 28 7b 65 6e 74 69 74 79 3a 68 2c 65 6e 74 69 74 79 5f 74 79 70 65 3a 69 2c 6c 65 6e 67 74 68 3a 67 2b 6a 2d 62 2c 6f 66 66 73 65 74 3a 30 7d 29 29 3a 64 2e 70 75 73 68 28 7b 65 6e 74 69 74 79 3a 68 2c 65 6e 74 69 Data Ascii: g=f.value}g=g;var h=g.entity,i=g.entity_type,j=g.length;g=g.offset;g!=null&&j!=null&&h!=null&&h.__typename!=null&&(g<b?(c.push({entity:h,entity_type:i,length:j,offset:g}),g+j>b&&d.push({entity:h,entity_type:i,length:g+j-b,offset:0})):d.push({entity:h,enti
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 2d 31 2e 37 35 20 30 76 2d 36 2e 38 32 37 63 30 2d 2e 34 38 34 2e 33 39 32 2d 2e 38 37 35 2e 38 37 35 2d 2e 38 37 35 7a 6d 30 2d 31 2e 32 37 35 63 2e 38 33 33 20 30 20 31 2e 32 35 2d 2e 34 30 35 20 31 2e 32 35 2d 31 2e 30 31 32 43 31 33 2e 32 35 20 36 2e 34 30 35 20 31 32 2e 38 33 33 20 36 20 31 32 20 36 73 2d 31 2e 32 35 2e 34 30 35 2d 31 2e 32 35 20 31 2e 30 31 31 63 30 20 2e 36 30 37 2e 34 31 37 20 31 2e 30 31 32 20 31 2e 32 35 20 31 2e 30 31 32 7a 22 7d 29 5d 7d 29 29 7d 61 2e 64 69 73 70 6c 61 79 4e 61 6d 65 3d 61 2e 6e 61 6d 65 2b 22 20 5b 66 72 6f 6d 20 22 2b 66 2e 69 64 2b 22 5d 22 3b 61 2e 5f 69 73 53 56 47 3d 21 30 3b 62 3d 61 3b 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 62 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 43 41 41 47 65 6e 65 72 69 63 45 72 Data Ascii: -1.75 0v-6.827c0-.484.392-.875.875-.875zm0-1.275c.833 0 1.25-.405 1.25-1.012C13.25 6.405 12.833 6 12 6s-1.25.405-1.25 1.011c0 .607.417 1.012 1.25 1.012z"})]}))}a.displayName=a.name+" [from "+f.id+"]";a._isSVG=!0;b=a;g["default"]=b}),98);__d("CAAGenericEr
2024-04-19 01:40:40 UTC	6894	IN	Data Raw: 69 6e 73 65 74 22 29 72 65 74 75 72 6e 20 6b 2e 6a 73 78 28 63 28 22 46 44 53 43 61 6c 6c 6f 75 74 49 6e 73 65 74 2e 72 65 61 63 74 22 29 2c 7b 6f 6e 4f 75 74 73 69 64 65 43 6c 69 63 6b 3a 72 2c 74 79 70 65 3a 74 2c 78 73 74 79 6c 65 3a 61 2c 63 68 69 6c 64 72 65 6e 3a 71 7d 29 3b 72 65 74 75 72 6e 20 62 3d 3d 3d 22 65 64 67 65 22 3f 6b 2e 6a 73 78 28 63 28 22 46 44 53 43 61 6c 6c 6f 75 74 45 64 67 65 2e 72 65 61 63 74 22 29 2c 7b 6f 6e 4f 75 74 73 69 64 65 43 6c 69 63 6b 3a 72 2c 74 79 70 65 3a 74 2c 78 73 74 79 6c 65 3a 61 2c 63 68 69 6c 64 72 65 6e 3a 71 7d 29 3a 6b 2e 6a 73 78 28 63 28 22 43 6f 6d 65 74 45 72 72 6f 72 42 6f 75 6e 64 61 72 79 2e 72 65 61 63 74 22 29 2c 7b 66 61 6c 6c 62 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: inset")return k.jsx(c("FDSCalloutInset.react"),{onOutsideClick:r,type:t,xstyle:a,children:q});return b==="edge"?k.jsx(c("FDSCalloutEdge.react"),{onOutsideClick:r,type:t,xstyle:a,children:q}):k.jsx(c("CometErrorBoundary.react"),{fallback:function(){return

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49758	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:39 UTC	610	OUT	GET /rsrc.php/v3iQbs4/yg/l/en_US/EX6jmVQkY6L.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1736	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: pY3OC7s7dvT9aFLDX1mb5A== Expires: Fri, 18 Apr 2025 01:44:12 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: Q59dcbI37lfMRMCwgl2ln1UzjETg0kA4/jG3OYy9pzOLulX4Q6P1aQzO4sjsFDg4GE8Fd8HWhcgkiTxA//vonA== Date: Fri, 19 Apr 2024 01:40:39 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=3, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 133933
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:40 UTC	16070	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 49 6d 61 67 65 46 72 6f 6d 49 58 56 61 6c 75 65 52 65 6c 61 79 57 72 61 70 70 65 72 5f 73 70 72 69 74 65 2e 67 72 61 70 68 71 6c 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 7b 61 72 67 75 6d 65 6e 74 44 65 66 69 6e 69 74 69 6f 6e 73 3a 5b 5d 2c 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 22 2c 6d 65 74 61 64 61 74 61 3a 6e 75 6c 6c 2c 6e 61 6d 65 3a 22 43 6f 6d 65 74 49 6d 61 67 65 46 72 6f 6d 49 58 56 61 6c 75 65 52 65 6c 61 79 57 72 61 70 70 65 72 5f 73 70 72 69 74 65 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a Data Ascii: /FB_PKG_DELIM/__d("CometImageFromIXValueRelayWrapper_sprite.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometImageFromIXValueRelayWrapper_sprite",selections:[{alias:null,args:null,kind:
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 33 38 34 22 3a 31 2c 22 31 66 33 38 35 22 3a 31 2c 22 31 66 33 38 35 5f 31 66 33 66 62 22 3a 31 2c 22 31 66 33 38 35 5f 31 66 33 66 63 22 3a 31 2c 22 31 66 33 38 35 5f 31 66 33 66 64 22 3a 31 2c 22 31 66 33 38 35 5f 31 66 33 66 65 22 3a 31 2c 22 31 66 33 38 35 5f 31 66 33 66 66 22 3a 31 2c 22 31 66 33 38 36 22 3a 31 2c 22 31 66 33 38 37 22 3a 31 2c 22 31 66 33 38 38 22 3a 31 2c 22 31 66 33 38 39 22 3a 31 2c 22 31 66 33 38 61 22 3a 31 2c 22 31 66 33 38 62 22 3a 31 2c 22 31 66 33 38 63 22 3a 31 2c 22 31 66 33 38 64 22 3a 31 2c 22 31 66 33 38 65 22 3a 31 2c 22 31 66 33 38 66 22 3a 31 2c 22 31 66 33 39 30 22 3a 31 2c 22 31 66 33 39 31 22 3a 31 2c 22 31 66 33 39 32 22 3a 31 2c 22 31 66 33 39 33 22 3a 31 2c 22 31 66 33 39 36 22 3a 31 2c 22 31 66 33 39 37 22 3a Data Ascii: 384":1,"1f385":1,"1f385_1f3fb":1,"1f385_1f3fc":1,"1f385_1f3fd":1,"1f385_1f3fe":1,"1f385_1f3ff":1,"1f386":1,"1f387":1,"1f388":1,"1f389":1,"1f38a":1,"1f38b":1,"1f38c":1,"1f38d":1,"1f38e":1,"1f38f":1,"1f390":1,"1f391":1,"1f392":1,"1f393":1,"1f396":1,"1f397":
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 36 39 5f 31 66 33 66 66 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 33 65 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 37 33 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 39 33 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 61 34 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 61 38 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 65 62 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 33 65 64 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 34 36 36 5f 31 66 33 66 66 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 66 5f 32 30 30 64 5f 31 66 34 Data Ascii: 69_1f3ff":1,"1f469_1f3ff_200d_1f33e":1,"1f469_1f3ff_200d_1f373":1,"1f469_1f3ff_200d_1f393":1,"1f469_1f3ff_200d_1f3a4":1,"1f469_1f3ff_200d_1f3a8":1,"1f469_1f3ff_200d_1f3eb":1,"1f469_1f3ff_200d_1f3ed":1,"1f469_1f3ff_200d_1f466_1f3ff":1,"1f469_1f3ff_200d_1f4
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 66 33 66 63 5f 32 30 30 64 5f 32 36 34 32 22 3a 31 2c 22 31 66 39 33 38 5f 31 66 33 66 64 5f 32 30 30 64 5f 32 36 34 30 22 3a 31 2c 22 31 66 39 33 38 5f 31 66 33 66 64 5f 32 30 30 64 5f 32 36 34 32 22 3a 31 2c 22 31 66 39 33 38 5f 31 66 33 66 65 5f 32 30 30 64 5f 32 36 34 30 22 3a 31 2c 22 31 66 39 33 38 5f 31 66 33 66 65 5f 32 30 30 64 5f 32 36 34 32 22 3a 31 2c 22 31 66 39 33 38 5f 31 66 33 66 66 5f 32 30 30 64 5f 32 36 34 30 22 3a 31 2c 22 31 66 39 33 38 5f 31 66 33 66 66 5f 32 30 30 64 5f 32 36 34 32 22 3a 31 2c 22 31 66 39 33 38 5f 32 30 30 64 5f 32 36 34 30 22 3a 31 2c 22 31 66 39 33 38 5f 32 30 30 64 5f 32 36 34 32 22 3a 31 2c 22 31 66 39 33 39 22 3a 31 2c 22 31 66 39 33 39 5f 31 66 33 66 62 22 3a 31 2c 22 31 66 39 33 39 5f 31 66 33 66 63 22 3a 31 Data Ascii: f3fc_200d_2642":1,"1f938_1f3fd_200d_2640":1,"1f938_1f3fd_200d_2642":1,"1f938_1f3fe_200d_2640":1,"1f938_1f3fe_200d_2642":1,"1f938_1f3ff_200d_2640":1,"1f938_1f3ff_200d_2642":1,"1f938_200d_2640":1,"1f938_200d_2642":1,"1f939":1,"1f939_1f3fb":1,"1f939_1f3fc":1
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 33 66 64 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 38 5f 31 66 33 66 63 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 38 5f 31 66 33 66 65 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 38 5f 31 66 33 66 66 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 39 5f 31 66 33 66 62 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 39 5f 31 66 33 66 63 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 39 5f 31 66 33 66 65 22 3a 31 2c Data Ascii: 3fd_200d_1f91d_200d_1f468_1f3fc":1,"1f469_1f3fd_200d_1f91d_200d_1f468_1f3fe":1,"1f469_1f3fd_200d_1f91d_200d_1f468_1f3ff":1,"1f469_1f3fd_200d_1f91d_200d_1f469_1f3fb":1,"1f469_1f3fd_200d_1f91d_200d_1f469_1f3fc":1,"1f469_1f3fd_200d_1f91d_200d_1f469_1f3fe":1,
2024-04-19 01:40:40 UTC	14884	IN	Data Raw: 66 64 5f 32 30 30 64 5f 32 37 36 34 5f 32 30 30 64 5f 31 66 34 38 62 5f 32 30 30 64 5f 31 66 34 36 39 5f 31 66 33 66 64 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 32 37 36 34 5f 32 30 30 64 5f 31 66 34 38 62 5f 32 30 30 64 5f 31 66 34 36 39 5f 31 66 33 66 65 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 64 5f 32 30 30 64 5f 32 37 36 34 5f 32 30 30 64 5f 31 66 34 38 62 5f 32 30 30 64 5f 31 66 34 36 39 5f 31 66 33 66 66 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 33 37 63 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 36 38 5f 31 66 33 66 62 22 3a 31 2c 22 31 66 34 36 39 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 39 31 64 5f 32 30 30 64 5f 31 66 34 Data Ascii: fd_200d_2764_200d_1f48b_200d_1f469_1f3fd":1,"1f469_1f3fd_200d_2764_200d_1f48b_200d_1f469_1f3fe":1,"1f469_1f3fd_200d_2764_200d_1f48b_200d_1f469_1f3ff":1,"1f469_1f3fe_200d_1f37c":1,"1f469_1f3fe_200d_1f91d_200d_1f468_1f3fb":1,"1f469_1f3fe_200d_1f91d_200d_1f4
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 33 61 38 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 33 65 62 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 33 65 64 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 34 62 62 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 34 62 63 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 35 32 37 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 35 32 63 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 36 38 30 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 5f 31 66 36 39 32 22 3a 31 2c 22 31 66 39 64 31 5f 31 66 33 66 65 5f 32 30 30 64 Data Ascii: 1_1f3fe_200d_1f3a8":1,"1f9d1_1f3fe_200d_1f3eb":1,"1f9d1_1f3fe_200d_1f3ed":1,"1f9d1_1f3fe_200d_1f4bb":1,"1f9d1_1f3fe_200d_1f4bc":1,"1f9d1_1f3fe_200d_1f527":1,"1f9d1_1f3fe_200d_1f52c":1,"1f9d1_1f3fe_200d_1f680":1,"1f9d1_1f3fe_200d_1f692":1,"1f9d1_1f3fe_200d
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 70 2e 69 64 3b 76 61 72 20 41 3d 70 2e 6e 61 6d 65 3b 61 3d 6b 28 63 28 22 50 72 6f 66 69 6c 65 43 6f 6d 65 74 4c 69 6e 6b 43 6f 6e 74 65 78 74 22 29 29 3b 61 3d 61 2e 67 72 6f 75 70 49 44 3b 76 61 72 20 42 3d 6b 28 63 28 22 50 61 67 65 73 43 6f 6d 65 74 4c 69 6e 6b 43 6f 6e 74 65 78 74 22 29 29 3b 42 3d 42 2e 73 68 6f 75 6c 64 48 6f 73 74 49 6e 57 61 74 63 68 3b 76 61 72 20 43 3d 70 2e 75 72 6c 2c 44 2c 45 3d 63 28 22 75 73 65 41 63 74 6f 72 53 74 6f 72 79 53 74 61 74 75 73 22 29 28 70 29 2c 46 3d 21 31 3b 67 26 26 45 2e 73 74 61 74 75 73 21 3d 3d 22 6e 6f 6e 65 22 3f 28 43 3d 63 28 22 58 43 6f 6d 65 74 53 74 6f 72 69 65 73 43 6f 6e 74 72 6f 6c 6c 65 72 52 6f 75 74 65 42 75 69 6c 64 65 72 22 29 2e 62 75 69 6c 64 55 52 4c 28 7b 62 75 63 6b 65 74 5f 69 64 Data Ascii: p.id;var A=p.name;a=k(c("ProfileCometLinkContext"));a=a.groupID;var B=k(c("PagesCometLinkContext"));B=B.shouldHostInWatch;var C=p.url,D,E=c("useActorStoryStatus")(p),F=!1;g&&E.status!=="none"?(C=c("XCometStoriesControllerRouteBuilder").buildURL({bucket_id
2024-04-19 01:40:40 UTC	14884	IN	Data Raw: 75 72 6e 20 72 28 61 2c 62 29 3b 63 61 73 65 22 73 77 69 74 63 68 22 3a 72 65 74 75 72 6e 20 73 28 61 2c 62 29 3b 63 61 73 65 22 6d 6f 72 65 22 3a 72 65 74 75 72 6e 20 74 28 61 2c 62 29 3b 63 61 73 65 22 63 6c 6f 73 65 22 3a 72 65 74 75 72 6e 20 74 28 61 2c 62 29 3b 63 61 73 65 22 62 6f 64 79 22 3a 72 65 74 75 72 6e 20 61 2e 61 64 64 4f 6e 7d 7d 3b 67 2e 67 65 74 45 6e 64 41 64 64 4f 6e 3d 61 7d 29 2c 32 32 36 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 4c 69 73 74 43 65 6c 6c 53 74 72 69 63 74 2e 72 65 61 63 74 22 2c 5b 22 42 61 73 65 49 73 44 65 63 6f 72 61 74 69 76 65 43 6f 6e 74 65 78 74 22 2c 22 43 6f 6d 65 74 43 6f 6d 70 6f 73 69 74 65 53 74 72 75 63 74 75 72 65 43 6f 6e 74 65 78 74 22 2c 22 43 6f 6d 65 74 44 65 6e 73 69 74 79 41 77 61 72 65 6e 65 73 73 Data Ascii: urn r(a,b);case"switch":return s(a,b);case"more":return t(a,b);case"close":return t(a,b);case"body":return a.addOn}};g.getEndAddOn=a}),226);__d("CometListCellStrict.react",["BaseIsDecorativeContext","CometCompositeStructureContext","CometDensityAwareness

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49763	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	611	OUT	GET /rsrc.php/v3/yo/r/RBVykxDUbUn.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1693	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: X/gzo+ApbHvl4TBBPW8EMQ== Expires: Fri, 18 Apr 2025 16:51:09 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: gI5tPaQF+WilQWPlvyGj2z8t35L9uumEB4Ac4NhwAXokGegQUwpvQR6ptrj87ID+EKYa4Jv1pLD9C04jnltr+Q== Date: Fri, 19 Apr 2024 01:40:40 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 7303
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:40 UTC	7302	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 bd 00 00 00 b1 08 03 00 00 00 a6 cb 4c 79 00 00 02 fa 50 4c 54 45 47 70 4c 03 03 03 02 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 00 00 00 00 00 00 02 02 02 06 06 06 00 00 00 00 00 00 00 00 00 02 02 02 ff ff ff 01 01 01 04 04 04 00 00 00 00 00 00 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 03 03 ff ff ff 01 01 01 00 00 00 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 04 04 00 00 00 00 00 00 02 02 02 08 08 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 05 05 00 00 00 00 00 00 00 00 00 01 01 01 00 00 00 01 01 01 02 02 02 01 01 01 00 00 00 00 00 00 01 01 01 01 01 01 04 04 04 04 04 04 00 00 Data Ascii: PNGIHDRLyPLTEGpL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49764	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	919	OUT	POST /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 688 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	688	OUT	Data Raw: 72 6f 75 74 65 5f 75 72 6c 73 5b 30 5d 3d 25 32 46 76 69 64 65 6f 26 72 6f 75 74 69 6e 67 5f 6e 61 6d 65 73 70 61 63 65 3d 66 62 5f 63 6f 6d 65 74 26 5f 5f 61 61 69 64 3d 30 26 5f 5f 75 73 65 72 3d 30 26 5f 5f 61 3d 31 26 5f 5f 72 65 71 3d 31 26 5f 5f 68 73 3d 31 39 38 33 32 2e 48 59 50 25 33 41 63 6f 6d 65 74 5f 6c 6f 67 67 65 64 6f 75 74 5f 70 6b 67 2e 32 2e 31 2e 2e 30 2e 30 26 64 70 72 3d 31 26 5f 5f 63 63 67 3d 47 4f 4f 44 26 5f 5f 72 65 76 3d 31 30 31 32 38 38 38 37 36 32 26 5f 5f 73 3d 71 33 66 68 77 37 25 33 41 32 63 64 32 32 38 25 33 41 71 67 64 33 6f 34 26 5f 5f 68 73 69 3d 37 33 35 39 33 38 37 31 30 33 39 32 33 37 32 39 32 35 34 26 5f 5f 64 79 6e 3d 37 78 65 55 6d 77 6c 45 6e 77 6e 38 4b 32 57 6d 68 30 63 6d 35 55 34 65 30 79 6f 57 33 71 33 32 Data Ascii: route_urls[0]=%2Fvideo&routing_namespace=fb_comet&__aaid=0&__user=0&__a=1&__req=1&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&dpr=1&__ccg=GOOD&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__hsi=7359387103923729254&__dyn=7xeUmwlEnwn8K2Wmh0cm5U4e0yoW3q32
2024-04-19 01:40:40 UTC	942	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:40 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:40 UTC	1807	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:40 UTC	6	IN	Data Raw: 33 35 65 64 0d 0a Data Ascii: 35ed
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 66 6f 72 20 28 3b 3b 29 3b 7b 22 70 61 79 6c 6f 61 64 22 3a 7b 22 70 61 79 6c 6f 61 64 73 22 3a 7b 22 2f 76 69 64 65 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 72 6f 75 74 65 5f 64 65 66 69 6e 69 74 69 6f 6e 22 2c 22 65 78 70 6f 72 74 73 22 3a 7b 22 61 63 74 6f 72 49 44 22 3a 22 30 22 2c 22 72 6f 6f 74 56 69 65 77 22 3a 7b 22 61 6c 6c 52 65 73 6f 75 72 63 65 73 22 3a 5b 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 4c 4f 45 48 6f 6d 65 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 4c 4f 45 48 6f 6d 65 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 Data Ascii: for (;;);{"payload":{"payloads":{"/video":{"error":false,"result":{"type":"route_definition","exports":{"actorID":"0","rootView":{"allResources":[{"__jsr":"CometVideoHomeLOEHomeRoot.react"},{"__jsr":"CometVideoHomeLOEHomeRoot.entrypoint"},{"__jsr":"CometV
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 52 49 4e 47 22 7d 2c 22 63 6f 6d 6d 65 6e 74 5f 69 64 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 72 65 66 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 76 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 Data Ascii: RING"},"comment_id":{"legacyNames":[],"default":null,"path":false,"significant":false,"coercibleType":"STRING"},"ref":{"legacyNames":[],"default":null,"path":false,"significant":true,"coercibleType":"STRING"},"v":{"legacyNames":[],"default":null,"path":fa
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 31 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 32 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 Data Ascii: true,"hash":null},"7742":{"result":false,"hash":null},"20919":{"result":true,"hash":null},"20929":{"result":true,"hash":null},"20935":{"result":true,"hash":null},"20936":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":fa
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 36 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 35 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 35 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 35 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 35 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 35 34 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 35 35 22 3a 7b 22 72 65 Data Ascii: t":true,"hash":null},"20865":{"result":false,"hash":null},"21050":{"result":false,"hash":null},"21051":{"result":false,"hash":null},"21052":{"result":false,"hash":null},"21053":{"result":false,"hash":null},"21054":{"result":false,"hash":null},"21055":{"re
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 32 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 32 37 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 32 38 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 30 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 30 34 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 30 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 38 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a Data Ascii: true,"hash":null},"20926":{"result":true,"hash":null},"20927":{"result":true,"hash":null},"20928":{"result":true,"hash":null},"21003":{"result":false,"hash":null},"21004":{"result":false,"hash":null},"21005":{"result":false,"hash":null},"21086":{"result":
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 33 34 30 34 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 33 32 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 39 38 36 31 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 36 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 36 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 36 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 36 39 22 3a 7b 22 72 65 73 75 Data Ascii: t":false,"hash":null},"23404":{"result":false,"hash":null},"7329":{"result":false,"hash":null},"9861":{"result":false,"hash":null},"21062":{"result":false,"hash":null},"21063":{"result":false,"hash":null},"21065":{"result":true,"hash":null},"21069":{"resu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	919	OUT	POST /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 818 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	818	OUT	Data Raw: 72 6f 75 74 65 5f 75 72 6c 73 5b 30 5d 3d 25 32 46 26 72 6f 75 74 65 5f 75 72 6c 73 5b 31 5d 3d 25 32 46 6c 6f 67 69 6e 25 32 46 64 65 76 69 63 65 2d 62 61 73 65 64 25 32 46 72 65 67 75 6c 61 72 25 32 46 6c 6f 67 69 6e 25 32 46 25 33 46 6c 6f 67 69 6e 5f 61 74 74 65 6d 70 74 25 33 44 31 25 32 36 6e 65 78 74 25 33 44 68 74 74 70 73 25 32 35 33 41 25 32 35 32 46 25 32 35 32 46 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 25 32 35 32 46 76 69 64 65 6f 26 72 6f 75 74 69 6e 67 5f 6e 61 6d 65 73 70 61 63 65 3d 66 62 5f 63 6f 6d 65 74 26 5f 5f 61 61 69 64 3d 30 26 5f 5f 75 73 65 72 3d 30 26 5f 5f 61 3d 31 26 5f 5f 72 65 71 3d 32 26 5f 5f 68 73 3d 31 39 38 33 32 2e 48 59 50 25 33 41 63 6f 6d 65 74 5f 6c 6f 67 67 65 64 6f 75 74 5f 70 6b 67 2e 32 2e 31 2e 2e 30 Data Ascii: route_urls[0]=%2F&route_urls[1]=%2Flogin%2Fdevice-based%2Fregular%2Flogin%2F%3Flogin_attempt%3D1%26next%3Dhttps%253A%252F%252Fwww.facebook.com%252Fvideo&routing_namespace=fb_comet&__aaid=0&__user=0&__a=1&__req=2&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0
2024-04-19 01:40:40 UTC	942	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:40 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:40 UTC	1806	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:40 UTC	5	IN	Data Raw: 31 35 33 0d 0a Data Ascii: 153
2024-04-19 01:40:40 UTC	346	IN	Data Raw: 66 6f 72 20 28 3b 3b 29 3b 7b 22 70 61 79 6c 6f 61 64 22 3a 7b 22 70 61 79 6c 6f 61 64 73 22 3a 7b 22 2f 22 3a 7b 22 65 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 72 65 73 75 6c 74 22 3a 6e 75 6c 6c 7d 2c 22 2f 6c 6f 67 69 6e 2f 64 65 76 69 63 65 2d 62 61 73 65 64 2f 72 65 67 75 6c 61 72 2f 6c 6f 67 69 6e 2f 3f 6c 6f 67 69 6e 5f 61 74 74 65 6d 70 74 3d 31 26 6e 65 78 74 3d 68 74 74 70 73 5c 75 30 30 32 35 33 41 5c 75 30 30 32 35 32 46 5c 75 30 30 32 35 32 46 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 75 30 30 32 35 32 46 76 69 64 65 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 72 65 73 75 6c 74 22 3a 6e 75 6c 6c 7d 7d 2c 22 73 72 5f 70 61 79 6c 6f 61 64 22 3a 7b 22 68 73 72 70 22 3a 7b 22 68 62 6c 70 22 3a 7b 22 63 6f 6e 73 69 73 74 65 6e Data Ascii: for (;;);{"payload":{"payloads":{"/":{"error":false,"result":null},"/login/device-based/regular/login/?login_attempt=1&next=https\u00253A\u00252F\u00252Fwww.facebook.com\u00252Fvideo":{"error":false,"result":null}},"sr_payload":{"hsrp":{"hblp":{"consisten

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49770	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	610	OUT	GET /rsrc.php/v3iFd24/yd/l/en_US/dj10Ym9OUFW.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1761	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: X73tkKGvDmQDZ0g8o4uM2Q== Expires: Fri, 18 Apr 2025 20:36:27 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: Pm+RYDg/1sBoLv8vdEKkHPZrMj+pu8i7bK2c+kOJgWAjbkjvGlKpJbnzjDssIh226/ysBaKGZJwPAkobNlM0TQ== Date: Fri, 19 Apr 2024 01:40:40 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 52436
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:40 UTC	16045	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 75 73 65 43 6f 6d 65 74 54 65 78 74 44 69 72 65 63 74 69 6f 6e 22 2c 5b 22 55 6e 69 63 6f 64 65 42 69 64 69 22 2c 22 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 2c 69 3d 28 68 7c 7c 64 28 22 72 65 61 63 74 22 29 29 2e 75 73 65 4d 65 6d 6f 2c 6a 3d 7b 4c 54 52 3a 22 6c 74 72 22 2c 4e 45 55 54 52 41 4c 3a 22 61 75 74 6f 22 2c 52 54 4c 3a 22 72 74 6c 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 69 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 3d 64 28 22 55 6e 69 63 6f 64 65 42 69 64 69 22 29 2e 67 65 74 44 69 72 65 63 74 69 6f 6e 28 61 2c 62 29 Data Ascii: /FB_PKG_DELIM/__d("useCometTextDirection",["UnicodeBidi","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=(h\|\|d("react")).useMemo,j={LTR:"ltr",NEUTRAL:"auto",RTL:"rtl"};function a(a,b){return i(function(){var c=d("UnicodeBidi").getDirection(a,b)
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 70 65 61 68 65 61 64 53 74 61 74 65 44 69 73 70 61 74 63 68 65 72 22 29 28 29 3b 76 61 72 20 68 3d 61 2e 64 69 73 70 61 74 63 68 41 63 74 69 76 65 45 6e 74 72 69 65 73 3b 61 3d 63 28 22 75 73 65 42 61 73 65 54 79 70 65 61 68 65 61 64 44 61 74 61 53 6f 75 72 63 65 46 65 74 63 68 22 29 28 7b 64 61 74 61 53 6f 75 72 63 65 3a 64 2c 64 61 74 61 53 6f 75 72 63 65 46 65 74 63 68 43 6f 6e 66 69 67 50 61 72 61 6d 73 3a 65 2c 6f 6e 52 65 73 6f 6c 76 65 50 61 79 6c 6f 61 64 3a 6a 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3b 61 3d 61 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 62 2e 69 73 54 72 61 63 65 43 6f 6d 70 6c 65 74 65 3b 62 3d 62 2e 73 6f 75 72 63 65 3b 68 28 28 63 3d 61 29 21 3d 6e 75 6c 6c 3f 63 3a 5b 5d 29 3b 66 26 26 66 28 61 29 3b 67 Data Ascii: peaheadStateDispatcher")();var h=a.dispatchActiveEntries;a=c("useBaseTypeaheadDataSourceFetch")({dataSource:d,dataSourceFetchConfigParams:e,onResolvePayload:j(function(a,b){var c;a=a.entries;var d=b.isTraceComplete;b=b.source;h((c=a)!=null?c:[]);f&&f(a);g
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 63 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 64 6f 63 75 6d 65 6e 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 63 29 7d 7d 2c 5b 63 5d 29 7d 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 54 79 70 65 61 68 65 61 64 56 69 65 77 53 74 72 61 74 65 67 79 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 2e 72 65 61 63 74 22 2c 5b 22 72 65 61 63 74 22 2c 22 75 73 65 43 6f 6d 65 74 54 79 70 65 61 68 65 61 64 56 69 65 77 53 74 72 61 74 65 67 79 4f 75 74 73 69 64 65 43 6c 69 63 6b 4c 69 73 74 65 6e 65 72 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 Data Ascii: entListener("click",c);return function(){document.removeEventListener("click",c)}},[c])}g["default"]=a}),98);__d("CometTypeaheadViewStrategyEventListener.react",["react","useCometTypeaheadViewStrategyOutsideClickListener"],(function(a,b,c,d,e,f,g){"use s
2024-04-19 01:40:40 UTC	3622	IN	Data Raw: 72 61 54 65 78 74 2e 72 65 61 63 74 22 2c 22 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 2c 69 3d 68 7c 7c 64 28 22 72 65 61 63 74 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 61 2e 65 6e 74 72 79 2c 65 3d 61 2e 69 73 41 63 74 69 76 65 2c 66 3d 61 2e 71 75 65 72 79 53 74 72 69 6e 67 3b 61 3d 62 61 62 65 6c 48 65 6c 70 65 72 73 2e 6f 62 6a 65 63 74 57 69 74 68 6f 75 74 50 72 6f 70 65 72 74 69 65 73 4c 6f 6f 73 65 28 61 2c 5b 22 65 6e 74 72 79 22 2c 22 69 73 41 63 74 69 76 65 22 2c 22 71 75 65 72 79 53 74 72 69 6e 67 22 5d 29 3b 72 65 74 75 72 6e 20 69 2e 6a 73 78 28 63 28 22 43 6f 6d 65 74 54 79 70 65 61 68 65 61 64 56 69 65 Data Ascii: raText.react","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h\|\|d("react");function a(a){var b=a.entry,e=a.isActive,f=a.queryString;a=babelHelpers.objectWithoutPropertiesLoose(a,["entry","isActive","queryString"]);return i.jsx(c("CometTypeaheadVie

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49771	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	819	OUT	GET /rsrc.php/v3iMBH4/ym/l/en_US/PM0yz8J0_9eatA4AbcUXJ_xGj4GgHf6uoyMXsyMcajeZkbHSqEKHvKE5vIR6Z6_fPD4wyD5Ym16tXudcxB4NWZK-0RNSBe8qSPG4UpY82FpGVUugonw1necxJMJfxNSBC0jRQvPTG6MYkFOrTRdkwmU8Y3mM84SfiWlvqtZjCyJ63My3zlOMrO0CLM5TVwEj1ba-rOSQb0hClwF360PJEynPfrjI.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1762	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: sqwvVyPKFMBemQMGhScT5Q== Expires: Fri, 18 Apr 2025 22:38:23 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: 5R6X4FNIDbR/91pGU9Flcc+xZvDmE0qEKIQnoOAUDY09TWcnO1lYukJzyfp/kJqmeZI/qvRtnlSxyKjjkznerA== Date: Fri, 19 Apr 2024 01:40:40 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=8, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 511338
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:40 UTC	15834	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 49 58 54 46 61 63 65 62 6f 6f 6b 43 6f 6e 74 65 6e 74 54 72 69 67 67 65 72 52 6f 6f 74 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 37 33 31 30 36 38 33 35 34 39 30 32 35 32 35 36 22 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 49 58 54 46 61 63 65 62 6f 6f 6b 43 6f 6e 74 65 6e 74 54 72 69 67 67 65 72 52 6f 6f 74 51 75 65 72 79 24 50 61 72 61 6d 65 74 65 72 73 22 2c 5b 22 43 6f 6d 65 74 49 58 54 46 61 63 65 62 6f 6f 6b 43 6f 6e 74 65 6e 74 54 72 69 67 67 65 72 52 6f 6f 74 51 75 65 72 79 5f 66 61 63 65 62 Data Ascii: /FB_PKG_DELIM/__d("CometIXTFacebookContentTriggerRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7310683549025256"}),null);__d("CometIXTFacebookContentTriggerRootQuery$Parameters",["CometIXTFacebookContentTriggerRootQuery_faceb
2024-04-19 01:40:40 UTC	16384	IN	Data Raw: 20 69 2e 6a 73 78 28 63 28 22 43 6f 6d 65 74 46 65 65 64 43 6c 69 63 6b 45 76 65 6e 74 73 4c 6f 67 67 65 72 43 6f 6e 74 65 78 74 22 29 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 61 2c 63 68 69 6c 64 72 65 6e 3a 62 7d 29 7d 61 2e 64 69 73 70 6c 61 79 4e 61 6d 65 3d 61 2e 6e 61 6d 65 2b 22 20 5b 66 72 6f 6d 20 22 2b 66 2e 69 64 2b 22 5d 22 3b 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 73 68 61 6c 6c 6f 77 45 71 75 61 6c 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 67 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 66 75 6e 63 74 69 6f 6e 20 68 28 61 2c 62 29 7b 69 66 28 61 Data Ascii: i.jsx(c("CometFeedClickEventsLoggerContext").Provider,{value:a,children:b})}a.displayName=a.name+" [from "+f.id+"]";g["default"]=a}),98);__d("shallowEqual",[],(function(a,b,c,d,e,f){"use strict";var g=Object.prototype.hasOwnProperty;function h(a,b){if(a
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 2e 75 73 65 43 61 73 74 69 6e 67 52 65 63 65 69 76 65 72 46 72 69 65 6e 64 6c 79 4e 61 6d 65 3d 6f 3b 67 2e 75 73 65 49 73 43 61 73 74 69 6e 67 50 68 6f 74 6f 45 78 70 65 72 69 65 6e 63 65 3d 70 3b 67 2e 75 73 65 43 61 73 74 69 6e 67 49 73 41 6c 62 75 6d 50 61 75 73 65 64 3d 71 3b 67 2e 75 73 65 43 61 73 74 69 6e 67 49 73 41 6c 62 75 6d 50 6c 61 79 69 6e 67 3d 72 3b 67 2e 75 73 65 43 61 73 74 69 6e 67 41 6c 62 75 6d 41 73 73 65 74 49 44 3d 73 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 56 69 64 65 6f 50 6c 61 79 65 72 49 6e 74 65 72 61 63 74 69 6f 6e 4f 76 65 72 6c 61 79 2e 72 65 61 63 74 22 2c 5b 22 56 69 64 65 6f 50 6c 61 79 65 72 48 6f 6f 6b 73 22 2c 22 63 72 65 61 74 65 56 69 64 65 6f 53 74 61 74 65 48 6f 6f 6b 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 4e Data Ascii: .useCastingReceiverFriendlyName=o;g.useIsCastingPhotoExperience=p;g.useCastingIsAlbumPaused=q;g.useCastingIsAlbumPlaying=r;g.useCastingAlbumAssetID=s}),98);__d("VideoPlayerInteractionOverlay.react",["VideoPlayerHooks","createVideoStateHook","performanceN
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 31 7d 3b 62 2e 67 65 74 54 79 70 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 32 7d 3b 62 2e 67 65 74 55 75 69 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 33 7d 3b 62 2e 67 65 74 53 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 24 34 7d 3b 62 2e 69 6e 73 70 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 7b 20 73 69 7a 65 3a 20 22 2b 74 68 69 73 2e 24 31 2b 22 2c 20 74 79 70 65 3a 20 22 2b 74 68 69 73 2e 24 32 2b 22 20 7d 22 7d 3b 72 65 74 75 72 6e 20 61 7d 28 29 3b 66 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c 36 36 29 3b 0a 5f 5f 64 28 22 4d 70 34 Data Ascii: ze=function(){return this.$1};b.getType=function(){return this.$2};b.getUuid=function(){return this.$3};b.getStart=function(){return this.$4};b.inspect=function(){return"{ size: "+this.$1+", type: "+this.$2+" }"};return a}();f["default"]=a}),66);__d("Mp4
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 78 74 54 69 74 6c 65 22 2c 6b 69 6e 64 3a 22 4d 6f 64 75 6c 65 49 6d 70 6f 72 74 22 7d 5d 2c 74 79 70 65 3a 22 43 6f 6d 65 74 46 65 65 64 53 74 6f 72 79 47 72 6f 75 70 73 54 61 62 44 69 72 65 63 74 65 64 54 69 74 6c 65 53 74 72 61 74 65 67 79 22 2c 61 62 73 74 72 61 63 74 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 72 67 73 3a 6e 75 6c 6c 2c 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3a 22 43 6f 6d 65 74 46 65 65 64 53 74 6f 72 79 54 69 74 6c 65 53 65 63 74 69 6f 6e 4d 61 74 63 68 52 65 6e 64 65 72 65 72 5f 73 74 6f 72 79 22 2c 66 72 61 67 6d 65 6e 74 4e 61 6d 65 3a 22 47 65 6d 69 6e 69 46 65 65 64 53 74 6f 72 79 44 69 72 65 63 74 65 64 54 69 74 6c 65 57 69 74 68 43 Data Ascii: xtTitle",kind:"ModuleImport"}],type:"CometFeedStoryGroupsTabDirectedTitleStrategy",abstractKey:null},{kind:"InlineFragment",selections:[{args:null,documentName:"CometFeedStoryTitleSectionMatchRenderer_story",fragmentName:"GeminiFeedStoryDirectedTitleWithC
2024-04-19 01:40:41 UTC	14884	IN	Data Raw: 2c 74 79 70 65 3a 22 43 6f 6d 65 74 46 65 65 64 53 74 6f 72 79 54 69 74 6c 65 57 69 74 68 41 63 74 6f 72 53 74 72 61 74 65 67 79 22 2c 61 62 73 74 72 61 63 74 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 72 67 73 3a 6e 75 6c 6c 2c 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3a 22 43 6f 6d 65 74 46 65 65 64 53 74 6f 72 79 54 69 74 6c 65 53 65 63 74 69 6f 6e 4d 61 74 63 68 52 65 6e 64 65 72 65 72 5f 73 74 6f 72 79 22 2c 66 72 61 67 6d 65 6e 74 4e 61 6d 65 3a 22 43 6f 6d 65 74 46 65 65 64 53 74 6f 72 79 44 65 66 61 75 6c 74 54 69 74 6c 65 53 74 72 61 74 65 67 79 5f 63 6f 6e 74 65 78 74 54 69 74 6c 65 22 2c 66 72 61 67 6d 65 6e 74 50 72 6f 70 4e 61 6d 65 3a 22 63 6f 6e 74 Data Ascii: ,type:"CometFeedStoryTitleWithActorStrategy",abstractKey:null},{kind:"InlineFragment",selections:[{args:null,documentName:"CometFeedStoryTitleSectionMatchRenderer_story",fragmentName:"CometFeedStoryDefaultTitleStrategy_contextTitle",fragmentPropName:"cont
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 5f 42 55 54 54 4f 4e 5f 34 3a 33 34 34 2c 47 48 4f 53 54 5f 4f 57 4c 5f 47 45 4e 45 52 49 43 5f 43 41 4c 4c 5f 54 4f 5f 41 43 54 49 4f 4e 5f 42 55 54 54 4f 4e 5f 35 3a 33 34 35 2c 47 48 4f 53 54 5f 4f 57 4c 5f 47 45 4e 45 52 49 43 5f 43 41 4c 4c 5f 54 4f 5f 41 43 54 49 4f 4e 5f 42 55 54 54 4f 4e 5f 36 3a 33 34 36 2c 47 48 4f 53 54 5f 4f 57 4c 5f 47 45 4e 45 52 49 43 5f 43 41 4c 4c 5f 54 4f 5f 41 43 54 49 4f 4e 5f 42 55 54 54 4f 4e 5f 37 3a 33 34 37 2c 47 48 4f 53 54 5f 4f 57 4c 5f 47 45 4e 45 52 49 43 5f 43 41 4c 4c 5f 54 4f 5f 41 43 54 49 4f 4e 5f 42 55 54 54 4f 4e 5f 38 3a 33 34 38 2c 47 48 4f 53 54 5f 4f 57 4c 5f 47 45 4e 45 52 49 43 5f 43 41 4c 4c 5f 54 4f 5f 41 43 54 49 4f 4e 5f 42 55 54 54 4f 4e 5f 39 3a 33 34 39 2c 47 48 4f 53 54 5f 4f 57 4c 5f 47 Data Ascii: _BUTTON_4:344,GHOST_OWL_GENERIC_CALL_TO_ACTION_BUTTON_5:345,GHOST_OWL_GENERIC_CALL_TO_ACTION_BUTTON_6:346,GHOST_OWL_GENERIC_CALL_TO_ACTION_BUTTON_7:347,GHOST_OWL_GENERIC_CALL_TO_ACTION_BUTTON_8:348,GHOST_OWL_GENERIC_CALL_TO_ACTION_BUTTON_9:349,GHOST_OWL_G
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 75 6d 35 20 78 31 65 35 35 38 72 34 22 2c 72 65 66 3a 61 2e 72 65 61 63 74 69 6f 6e 54 61 72 67 65 74 52 65 66 2c 63 68 69 6c 64 72 65 6e 3a 65 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 67 3d 61 2e 6e 6f 64 65 3b 69 66 28 67 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 68 3d 67 2e 64 79 6e 61 6d 69 63 52 65 61 63 74 69 6f 6e 49 63 6f 6e 2c 69 3d 67 2e 69 64 3b 67 3d 67 2e 6c 6f 63 61 6c 69 7a 65 64 4e 61 6d 65 3b 76 61 72 20 6a 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 20 30 3a 6a 3d 71 2e 66 69 72 73 74 52 65 61 63 74 69 6f 6e 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 6a 3d 71 2e 73 65 63 6f 6e 64 52 65 61 63 74 69 6f 6e 3b 62 72 65 Data Ascii: um5 x1e558r4",ref:a.reactionTargetRef,children:e.map(function(a,e){if(a==null)return null;var g=a.node;if(g==null)return null;var h=g.dynamicReactionIcon,i=g.id;g=g.localizedName;var j;switch(e){case 0:j=q.firstReaction;break;case 1:j=q.secondReaction;bre
2024-04-19 01:40:41 UTC	14884	IN	Data Raw: 74 56 50 56 44 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 3d 61 2e 72 65 61 64 28 29 3b 61 2e 63 6c 65 61 72 28 29 3b 72 65 74 75 72 6e 20 62 7d 2c 77 72 69 74 65 52 65 63 65 6e 74 56 50 56 44 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 66 2c 67 29 7b 76 61 72 20 69 3d 64 28 22 43 6f 6d 65 74 52 65 6c 61 79 22 29 2e 72 65 61 64 49 6e 6c 69 6e 65 44 61 74 61 28 68 21 3d 3d 76 6f 69 64 20 30 3f 68 3a 68 3d 62 28 22 43 6f 6d 65 74 4e 65 77 73 46 65 65 64 56 50 56 44 53 74 6f 72 65 5f 6e 65 77 73 46 65 65 64 45 64 67 65 2e 67 72 61 70 68 71 6c 22 29 2c 66 29 3b 69 66 28 21 6e 2e 72 65 61 64 28 29 2e 69 6e 63 6c 75 64 65 73 28 28 66 3d 69 2e 66 65 65 64 5f 62 61 63 6b 65 6e 64 5f 64 61 74 61 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 66 2e 76 73 69 64 29 Data Ascii: tVPVDs:function(){var b=a.read();a.clear();return b},writeRecentVPVD:function(e,f,g){var i=d("CometRelay").readInlineData(h!==void 0?h:h=b("CometNewsFeedVPVDStore_newsFeedEdge.graphql"),f);if(!n.read().includes((f=i.feed_backend_data)==null?void 0:f.vsid)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49772	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	920	OUT	POST /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1026 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1026	OUT	Data Raw: 72 6f 75 74 65 5f 75 72 6c 73 5b 30 5d 3d 25 32 46 77 61 74 63 68 26 72 6f 75 74 65 5f 75 72 6c 73 5b 31 5d 3d 25 32 46 77 61 74 63 68 25 32 46 6c 69 76 65 25 32 46 25 33 46 72 65 66 25 33 44 77 61 74 63 68 26 72 6f 75 74 65 5f 75 72 6c 73 5b 32 5d 3d 25 32 46 72 65 65 6c 26 72 6f 75 74 65 5f 75 72 6c 73 5b 33 5d 3d 25 32 46 77 61 74 63 68 25 32 46 73 68 6f 77 73 26 72 6f 75 74 65 5f 75 72 6c 73 5b 34 5d 3d 25 32 46 77 61 74 63 68 25 32 46 74 6f 70 69 63 26 72 6f 75 74 65 5f 75 72 6c 73 5b 35 5d 3d 25 32 46 70 72 69 76 61 63 79 25 32 46 70 6f 6c 69 63 79 25 32 46 25 33 46 65 6e 74 72 79 5f 70 6f 69 6e 74 25 33 44 63 6f 6d 65 74 5f 64 72 6f 70 64 6f 77 6e 26 72 6f 75 74 65 5f 75 72 6c 73 5b 36 5d 3d 25 32 46 70 6f 6c 69 63 69 65 73 25 33 46 72 65 66 25 33 Data Ascii: route_urls[0]=%2Fwatch&route_urls[1]=%2Fwatch%2Flive%2F%3Fref%3Dwatch&route_urls[2]=%2Freel&route_urls[3]=%2Fwatch%2Fshows&route_urls[4]=%2Fwatch%2Ftopic&route_urls[5]=%2Fprivacy%2Fpolicy%2F%3Fentry_point%3Dcomet_dropdown&route_urls[6]=%2Fpolicies%3Fref%3
2024-04-19 01:40:40 UTC	942	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:40 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:40 UTC	1807	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:40 UTC	6	IN	Data Raw: 63 38 30 65 0d 0a Data Ascii: c80e
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 66 6f 72 20 28 3b 3b 29 3b 7b 22 70 61 79 6c 6f 61 64 22 3a 7b 22 70 61 79 6c 6f 61 64 73 22 3a 7b 22 2f 77 61 74 63 68 22 3a 7b 22 65 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 72 6f 75 74 65 5f 64 65 66 69 6e 69 74 69 6f 6e 22 2c 22 65 78 70 6f 72 74 73 22 3a 7b 22 61 63 74 6f 72 49 44 22 3a 22 30 22 2c 22 72 6f 6f 74 56 69 65 77 22 3a 7b 22 61 6c 6c 52 65 73 6f 75 72 63 65 73 22 3a 5b 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 4c 4f 45 48 6f 6d 65 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 4c 4f 45 48 6f 6d 65 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 Data Ascii: for (;;);{"payload":{"payloads":{"/watch":{"error":false,"result":{"type":"route_definition","exports":{"actorID":"0","rootView":{"allResources":[{"__jsr":"CometVideoHomeLOEHomeRoot.react"},{"__jsr":"CometVideoHomeLOEHomeRoot.entrypoint"},{"__jsr":"CometV
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 52 49 4e 47 22 7d 2c 22 63 6f 6d 6d 65 6e 74 5f 69 64 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 72 65 66 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 76 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 Data Ascii: RING"},"comment_id":{"legacyNames":[],"default":null,"path":false,"significant":false,"coercibleType":"STRING"},"ref":{"legacyNames":[],"default":null,"path":false,"significant":true,"coercibleType":"STRING"},"v":{"legacyNames":[],"default":null,"path":fa
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 70 73 65 6c 6c 43 6f 6e 66 69 67 22 3a 7b 22 73 75 72 66 61 63 65 22 3a 22 77 61 74 63 68 5f 66 65 65 64 22 2c 22 74 79 70 65 22 3a 22 6c 6f 67 69 6e 5f 75 70 73 65 6c 6c 22 2c 22 69 73 44 69 73 6d 69 73 73 69 62 6c 65 22 3a 74 72 75 65 2c 22 64 65 62 75 67 53 65 72 76 65 72 55 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 7d 2c 22 63 61 6e 6f 6e 69 63 61 6c 55 72 6c 22 3a 6e 75 6c 6c 7d 2c 22 72 6f 75 74 65 5f 6d 61 74 63 68 5f 69 6e 66 6f 73 22 3a 5b 7b 22 69 6e 73 74 61 6e 63 65 50 61 72 61 6d 73 22 3a 7b 22 65 78 74 69 64 22 3a 6e 75 6c 6c 2c 22 6d 69 62 65 78 74 69 64 22 3a 6e 75 6c 6c 2c 22 73 68 61 72 65 5f 75 72 6c 22 Data Ascii: psellConfig":{"surface":"watch_feed","type":"login_upsell","isDismissible":true,"debugServerUri":"https://www.facebook.com/ajax/bulk-route-definitions/"},"canonicalUrl":null},"route_match_infos":[{"instanceParams":{"extid":null,"mibextid":null,"share_url"
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 65 65 6c 22 7d 2c 22 65 6e 74 69 74 79 5f 69 64 22 3a 7b 22 73 6f 75 72 63 65 22 3a 22 70 61 72 61 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 69 64 65 6f 5f 69 64 22 7d 7d 2c 22 68 6f 73 74 61 62 6c 65 56 69 65 77 22 3a 7b 22 61 6c 6c 52 65 73 6f 75 72 63 65 73 22 3a 5b 7b 22 5f 5f 6a 73 72 22 3a 22 46 42 52 65 65 6c 73 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 46 42 52 65 65 6c 73 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 5d 2c 22 72 65 73 6f 75 72 63 65 22 3a 7b 22 5f 5f 6a 73 72 22 3a 22 46 42 52 65 65 6c 73 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 22 70 72 6f 70 73 22 3a 7b 7d 2c 22 65 6e 74 72 79 50 6f 69 6e 74 22 3a 7b 22 5f 5f 64 72 22 3a 22 46 42 52 65 65 6c 73 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 7d 2c Data Ascii: eel"},"entity_id":{"source":"param","value":"video_id"}},"hostableView":{"allResources":[{"__jsr":"FBReelsRoot.react"},{"__jsr":"FBReelsRoot.entrypoint"}],"resource":{"__jsr":"FBReelsRoot.react"},"props":{},"entryPoint":{"__dr":"FBReelsRoot.entrypoint"}},
2024-04-19 01:40:40 UTC	1500	IN	Data Raw: 22 7d 5d 7d 7d 2c 22 2f 77 61 74 63 68 2f 73 68 6f 77 73 22 3a 7b 22 65 72 72 6f 72 22 3a 66 61 6c 73 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 74 79 70 65 22 3a 22 72 6f 75 74 65 5f 64 65 66 69 6e 69 74 69 6f 6e 22 2c 22 65 78 70 6f 72 74 73 22 3a 7b 22 61 63 74 6f 72 49 44 22 3a 22 30 22 2c 22 72 6f 6f 74 56 69 65 77 22 3a 7b 22 61 6c 6c 52 65 73 6f 75 72 63 65 73 22 3a 5b 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 43 61 74 61 6c 6f 67 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 43 61 74 61 6c 6f 67 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 52 6f 6f 74 2e 72 65 61 63 74 22 7d 5d Data Ascii: "}]}},"/watch/shows":{"error":false,"result":{"type":"route_definition","exports":{"actorID":"0","rootView":{"allResources":[{"__jsr":"CometVideoHomeCatalogRoot.react"},{"__jsr":"CometVideoHomeCatalogRoot.entrypoint"},{"__jsr":"CometVideoHomeRoot.react"}]
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 48 61 73 68 74 61 67 44 69 72 65 63 74 6f 72 79 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 7d 2c 22 74 72 61 63 65 50 6f 6c 69 63 79 22 3a 22 63 6f 6d 65 74 2e 77 61 74 63 68 2e 68 61 73 68 74 61 67 64 69 72 65 63 74 6f 72 79 22 2c 22 6d 65 74 61 22 3a 7b 22 74 69 74 6c 65 22 3a 22 49 6e 74 65 72 65 73 74 20 74 6f 70 69 63 20 64 69 72 65 63 74 6f 72 79 20 69 6e 20 56 69 64 65 6f 22 2c 22 61 63 63 65 73 73 6f 72 79 22 3a 6e 75 6c 6c 2c 22 66 61 76 69 63 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 70 72 65 66 65 74 63 68 61 62 6c 65 22 3a 74 72 75 65 2c 22 68 6f 73 74 61 62 6c 65 56 69 65 77 22 3a 7b 22 61 6c 6c 52 65 73 6f 75 72 63 65 73 22 3a 5b 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f Data Ascii: :"CometVideoHomeHashtagDirectoryRoot.entrypoint"}},"tracePolicy":"comet.watch.hashtagdirectory","meta":{"title":"Interest topic directory in Video","accessory":null,"favicon":null},"prefetchable":true,"hostableView":{"allResources":[{"__jsr":"CometVideoHo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49773	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	610	OUT	GET /rsrc.php/v3ifWF4/yt/l/en_US/3KWduJcmUWu.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1678	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: 8iVwr7sWep2Ew41cGUiDLw== Expires: Sat, 12 Apr 2025 15:13:42 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: eDx+up+gQnKj9MZbYjMGh8Sbex3qf/72znnH+BAJQhGquft+pKdOl6NTCnso5pLS2PbWiIqM6peRT7ZE1WGq2Q== Date: Fri, 19 Apr 2024 01:40:40 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=4, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 156170
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:40 UTC	16128	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 55 46 49 53 68 61 72 65 41 63 74 69 6f 6e 4c 69 6e 6b 4d 65 6e 75 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 36 36 34 35 33 30 30 38 37 32 32 33 30 30 32 37 22 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 55 46 49 53 68 61 72 65 41 63 74 69 6f 6e 4c 69 6e 6b 4d 65 6e 75 51 75 65 72 79 24 50 61 72 61 6d 65 74 65 72 73 22 2c 5b 22 43 6f 6d 65 74 55 46 49 53 68 61 72 65 41 63 74 69 6f 6e 4c 69 6e 6b 4d 65 6e 75 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 5d 2c 28 Data Ascii: /FB_PKG_DELIM/__d("CometUFIShareActionLinkMenuQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6645300872230027"}),null);__d("CometUFIShareActionLinkMenuQuery$Parameters",["CometUFIShareActionLinkMenuQuery_facebookRelayOperation"],(
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 3d 61 2e 5f 6f 62 73 65 72 76 65 72 3b 69 66 28 6e 75 6c 6c 21 3d 3d 62 29 7b 76 61 72 20 63 3d 62 2e 74 61 6b 65 52 65 63 6f 72 64 73 28 29 3b 77 62 28 61 2c 63 2c 62 29 3b 7d 7d 66 75 6e 63 74 69 6f 6e 20 45 62 28 61 29 7b 30 3d 3d 3d 73 62 26 26 46 62 28 61 29 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 74 65 78 74 49 6e 70 75 74 22 2c 74 62 2c 21 30 29 3b 61 2e 5f 6f 62 73 65 72 76 65 72 3d 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 77 62 28 61 2c 62 2c 63 29 3b 7d 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 47 62 28 61 2c 62 29 7b 76 61 72 20 63 3d 61 2e 5f 5f 6d 6f 64 65 2c 64 3d 61 2e 5f 5f 66 6f 72 6d 61 74 3b 61 3d 61 2e 5f 5f 73 74 79 6c 65 3b 76 61 72 20 65 3d 62 2e 5f 5f 6d 6f Data Ascii: =a._observer;if(null!==b){var c=b.takeRecords();wb(a,c,b);}}function Eb(a){0===sb&&Fb(a).addEventListener("textInput",tb,!0);a._observer=new MutationObserver(function(b,c){wb(a,b,c);});}function Gb(a,b){var c=a.__mode,d=a.__format;a=a.__style;var e=b.__mo
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 74 79 6c 65 28 29 29 3a 22 65 6c 65 6d 65 6e 74 22 21 3d 3d 6b 2e 74 79 70 65 7c 7c 6e 7c 7c 28 6b 3d 6b 2e 67 65 74 4e 6f 64 65 28 29 2c 6b 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 64 26 26 30 3d 3d 3d 6b 2e 67 65 74 43 68 69 6c 64 72 65 6e 53 69 7a 65 28 29 3f 68 2e 66 6f 72 6d 61 74 3d 6b 2e 67 65 74 54 65 78 74 46 6f 72 6d 61 74 28 29 3a 68 2e 66 6f 72 6d 61 74 3d 30 2c 68 2e 73 74 79 6c 65 3d 22 22 29 3b 7d 65 6c 73 65 7b 76 61 72 20 6c 3d 6b 2e 6b 65 79 2c 72 3d 68 2e 66 6f 63 75 73 2e 6b 65 79 3b 6b 3d 68 2e 67 65 74 4e 6f 64 65 73 28 29 3b 6d 3d 6b 2e 6c 65 6e 67 74 68 3b 76 61 72 20 77 3d 68 2e 69 73 42 61 63 6b 77 61 72 64 28 29 3b 71 3d 77 3f 67 3a 65 3b 6e 3d 77 3f 65 3a 67 3b 76 61 72 20 5f 41 3d 77 3f 72 3a 6c 3b 6c 3d 77 3f 6c 3a 72 3b 72 3d Data Ascii: tyle()):"element"!==k.type\|\|n\|\|(k=k.getNode(),k instanceof Sd&&0===k.getChildrenSize()?h.format=k.getTextFormat():h.format=0,h.style="");}else{var l=k.key,r=h.focus.key;k=h.getNodes();m=k.length;var w=h.isBackward();q=w?g:e;n=w?e:g;var _A=w?r:l;l=w?l:r;r=
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 62 72 65 61 6b 3b 5f 72 65 66 31 34 3d 5f 69 38 2e 76 61 6c 75 65 3b 7d 76 61 72 20 65 3d 5f 72 65 66 31 34 3b 61 3d 61 2e 69 6e 73 65 72 74 41 66 74 65 72 28 65 29 3b 7d 7d 76 61 72 0a 69 65 3d 66 75 6e 63 74 69 6f 6e 28 5f 65 65 29 7b 62 61 62 65 6c 48 65 6c 70 65 72 73 2e 69 6e 68 65 72 69 74 73 4c 6f 6f 73 65 28 69 65 2c 5f 65 65 29 3b 69 65 2e 67 65 74 54 79 70 65 3d 66 75 6e 63 74 69 6f 6e 20 67 65 74 54 79 70 65 28 29 7b 72 65 74 75 72 6e 22 6c 69 6e 65 62 72 65 61 6b 22 3b 7d 3b 69 65 2e 63 6c 6f 6e 65 3d 66 75 6e 63 74 69 6f 6e 20 63 6c 6f 6e 65 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 69 65 28 61 2e 5f 5f 6b 65 79 29 3b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 65 28 61 29 7b 72 65 74 75 72 6e 20 5f 65 65 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 7c Data Ascii: break;_ref14=_i8.value;}var e=_ref14;a=a.insertAfter(e);}}varie=function(_ee){babelHelpers.inheritsLoose(ie,_ee);ie.getType=function getType(){return"linebreak";};ie.clone=function clone(a){return new ie(a.__key);};function ie(a){return _ee.call(this,a)\|
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 65 63 74 69 6f 6e 3d 74 68 69 73 3b 74 68 69 73 2e 5f 63 61 63 68 65 64 4e 6f 64 65 73 3d 6e 75 6c 6c 3b 74 68 69 73 2e 66 6f 72 6d 61 74 3d 63 3b 74 68 69 73 2e 73 74 79 6c 65 3d 64 3b 74 68 69 73 2e 64 69 72 74 79 3d 21 31 3b 7d 76 61 72 20 5f 70 72 6f 74 6f 37 3d 55 65 2e 70 72 6f 74 6f 74 79 70 65 3b 5f 70 72 6f 74 6f 37 2e 67 65 74 43 61 63 68 65 64 4e 6f 64 65 73 3d 66 75 6e 63 74 69 6f 6e 20 67 65 74 43 61 63 68 65 64 4e 6f 64 65 73 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 63 61 63 68 65 64 4e 6f 64 65 73 3b 7d 3b 5f 70 72 6f 74 6f 37 2e 73 65 74 43 61 63 68 65 64 4e 6f 64 65 73 3d 66 75 6e 63 74 69 6f 6e 20 73 65 74 43 61 63 68 65 64 4e 6f 64 65 73 28 61 29 7b 74 68 69 73 2e 5f 63 61 63 68 65 64 4e 6f 64 65 73 3d 61 3b 7d 3b 5f 70 72 6f 74 Data Ascii: ection=this;this._cachedNodes=null;this.format=c;this.style=d;this.dirty=!1;}var _proto7=Ue.prototype;_proto7.getCachedNodes=function getCachedNodes(){return this._cachedNodes;};_proto7.setCachedNodes=function setCachedNodes(a){this._cachedNodes=a;};_prot
2024-04-19 01:40:41 UTC	14884	IN	Data Raw: 6d 65 6e 74 22 21 3d 3d 65 2e 74 79 70 65 7c 7c 65 2e 6f 66 66 73 65 74 3d 3d 3d 64 2e 6f 66 66 73 65 74 29 6c 3d 67 3c 68 3f 6c 2e 73 6c 69 63 65 28 67 2c 68 29 3a 6c 2e 73 6c 69 63 65 28 68 2c 67 29 3b 7d 65 6c 73 65 20 6c 3d 66 3f 6c 2e 73 6c 69 63 65 28 67 29 3a 6c 2e 73 6c 69 63 65 28 68 29 3b 7d 65 6c 73 65 20 6e 3d 3d 3d 63 26 26 28 6c 3d 66 3f 6c 2e 73 6c 69 63 65 28 30 2c 68 29 3a 6c 2e 73 6c 69 63 65 28 30 2c 67 29 29 3b 6b 2b 3d 6c 3b 7d 65 6c 73 65 21 79 28 6e 29 26 26 21 47 63 28 6e 29 7c 7c 6e 3d 3d 3d 63 26 26 74 68 69 73 2e 69 73 43 6f 6c 6c 61 70 73 65 64 28 29 7c 7c 28 6b 2b 3d 0a 6e 2e 67 65 74 54 65 78 74 43 6f 6e 74 65 6e 74 28 29 29 3b 7d 72 65 74 75 72 6e 20 6b 3b 7d 3b 5f 70 72 6f 74 6f 37 2e 61 70 70 6c 79 44 4f 4d 52 61 6e 67 65 Data Ascii: ment"!==e.type\|\|e.offset===d.offset)l=g<h?l.slice(g,h):l.slice(h,g);}else l=f?l.slice(g):l.slice(h);}else n===c&&(l=f?l.slice(0,h):l.slice(0,g));k+=l;}else!y(n)&&!Gc(n)\|\|n===c&&this.isCollapsed()\|\|(k+=n.getTextContent());}return k;};_proto7.applyDOMRange
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 29 3b 7d 65 6c 73 65 20 72 65 74 75 72 6e 20 61 2e 63 6c 6f 6e 65 28 29 3b 63 3d 57 65 28 65 2c 67 2c 66 2c 62 2c 63 2c 61 29 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 63 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 5f 63 3d 63 2c 68 3d 5f 63 5b 30 5d 2c 6b 3d 5f 63 5b 31 5d 3b 72 65 74 75 72 6e 20 6e 65 77 20 55 65 28 68 2c 6b 2c 43 28 61 29 3f 61 2e 66 6f 72 6d 61 74 3a 0a 30 2c 43 28 61 29 3f 61 2e 73 74 79 6c 65 3a 22 22 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 75 28 29 7b 72 65 74 75 72 6e 20 62 63 28 29 2e 5f 73 65 6c 65 63 74 69 6f 6e 3b 7d 66 75 6e 63 74 69 6f 6e 20 6f 63 28 29 7b 72 65 74 75 72 6e 20 46 28 29 2e 5f 65 64 69 74 6f 72 53 74 61 74 65 2e 5f 73 65 6c 65 63 74 69 6f 6e 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 64 65 28 61 2c 62 2c 63 2c 64 29 7b 69 Data Ascii: );}else return a.clone();c=We(e,g,f,b,c,a);if(null===c)return null;var _c=c,h=_c[0],k=_c[1];return new Ue(h,k,C(a)?a.format:0,C(a)?a.style:"");}function u(){return bc()._selection;}function oc(){return F()._editorState._selection;}function de(a,b,c,d){i
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 43 68 69 6c 64 28 29 2c 42 28 61 29 7c 7c 45 28 61 29 29 29 72 65 74 75 72 6e 20 61 2e 73 65 6c 65 63 74 28 29 3b 0a 76 6f 69 64 20 30 3d 3d 3d 64 26 26 28 64 3d 66 29 3b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 66 29 3b 66 3d 74 68 69 73 2e 5f 5f 6b 65 79 3b 69 66 28 43 28 63 29 29 63 2e 61 6e 63 68 6f 72 2e 73 65 74 28 66 2c 64 2c 22 65 6c 65 6d 65 6e 74 22 29 2c 63 2e 66 6f 63 75 73 2e 73 65 74 28 66 2c 65 2c 22 65 6c 65 6d 65 6e 74 22 29 2c 63 2e 64 69 72 74 79 3d 21 30 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 77 65 28 66 2c 64 2c 66 2c 65 2c 22 65 6c 65 6d 65 6e 74 22 2c 22 65 6c 65 6d 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 63 3b 7d 3b 5f 70 72 6f 74 6f 39 2e 73 65 6c 65 63 74 53 74 61 72 74 3d 66 75 6e 63 74 69 6f 6e 20 73 65 6c 65 63 74 53 74 61 Data Ascii: Child(),B(a)\|\|E(a)))return a.select();void 0===d&&(d=f);void 0===e&&(e=f);f=this.__key;if(C(c))c.anchor.set(f,d,"element"),c.focus.set(f,e,"element"),c.dirty=!0;else return we(f,d,f,e,"element","element");return c;};_proto9.selectStart=function selectSta
2024-04-19 01:40:41 UTC	14884	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 42 28 61 29 7c 7c 47 63 28 61 29 7c 7c 79 28 61 29 3b 7d 3b 65 78 70 6f 72 74 73 2e 24 69 73 4c 69 6e 65 42 72 65 61 6b 4e 6f 64 65 3d 47 63 3b 65 78 70 6f 72 74 73 2e 24 69 73 4e 6f 64 65 53 65 6c 65 63 74 69 6f 6e 3d 58 64 3b 65 78 70 6f 72 74 73 2e 24 69 73 50 61 72 61 67 72 61 70 68 4e 6f 64 65 3d 76 64 3b 65 78 70 6f 72 74 73 2e 24 69 73 52 61 6e 67 65 53 65 6c 65 63 74 69 6f 6e 3d 43 3b 65 78 70 6f 72 74 73 2e 24 69 73 52 6f 6f 74 4e 6f 64 65 3d 4c 3b 65 78 70 6f 72 74 73 2e 24 69 73 52 6f 6f 74 4f 72 53 68 61 64 6f 77 52 6f 6f 74 3d 79 63 3b 65 78 70 6f 72 74 73 2e 24 69 73 54 61 62 4e 6f 64 65 3d 4e 65 3b 65 78 70 6f 72 74 73 2e 24 69 73 54 65 78 74 4e 6f 64 65 3d 42 3b 0a 65 78 70 6f 72 74 Data Ascii: function(a){return B(a)\|\|Gc(a)\|\|y(a);};exports.$isLineBreakNode=Gc;exports.$isNodeSelection=Xd;exports.$isParagraphNode=vd;exports.$isRangeSelection=C;exports.$isRootNode=L;exports.$isRootOrShadowRoot=yc;exports.$isTabNode=Ne;exports.$isTextNode=B;export

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49775	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	375	OUT	GET /rsrc.php/v3/yo/r/RBVykxDUbUn.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:40 UTC	1693	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: X/gzo+ApbHvl4TBBPW8EMQ== Expires: Fri, 18 Apr 2025 16:51:09 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: gI5tPaQF+WilQWPlvyGj2z8t35L9uumEB4Ac4NhwAXokGegQUwpvQR6ptrj87ID+EKYa4Jv1pLD9C04jnltr+Q== Date: Fri, 19 Apr 2024 01:40:40 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 7303
2024-04-19 01:40:40 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:40 UTC	7302	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 bd 00 00 00 b1 08 03 00 00 00 a6 cb 4c 79 00 00 02 fa 50 4c 54 45 47 70 4c 03 03 03 02 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 00 00 00 00 00 00 02 02 02 06 06 06 00 00 00 00 00 00 00 00 00 02 02 02 ff ff ff 01 01 01 04 04 04 00 00 00 00 00 00 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 03 03 ff ff ff 01 01 01 00 00 00 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 04 04 00 00 00 00 00 00 02 02 02 08 08 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 05 05 00 00 00 00 00 00 00 00 00 01 01 01 00 00 00 01 01 01 02 02 02 01 01 01 00 00 00 00 00 00 01 01 01 01 01 01 04 04 04 04 04 04 00 00 Data Ascii: PNGIHDRLyPLTEGpL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49776	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:40 UTC	368	OUT	GET /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:41 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuZ.AWXg241u3QQ; expires=Thu, 18-Jul-2024 01:40:41 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:41 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:41 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:41 UTC	2551	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 49 47 72 6c 6e 54 37 65 42 73 68 5f 6b 73 76 51 64 63 77 6d 76 56 66 6f 79 39 52 73 73 70 75 73 69 58 45 57 48 75 79 73 58 71 73 6b 6a 68 7a 30 4d 42 30 78 42 70 45 64 42 58 2d 41 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4c 6a 35 6c 2d 6b 79 7a 55 32 57 64 71 5a 49 50 75 6a 49 75 65 75 36 35 70 35 61 55 73 5f 55 51 76 63 74 46 4f 65 6d 76 62 77 79 52 77 47 6f 33 5a 41 79 59 76 6d 66 72 5f 31 35 32 4e 2d 34 4b 37 75 47 38 77 77 61 42 50 51 37 4d 71 59 5f 6f 34 37 51 39 49 66 71 61 52 58 39 48 41 57 5f 70 79 6f 5a 48 34 6a 67 5f 4a 53 6b 57 41 2d 6c 77 22 3b 20 65 5f 66 62 5f Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcIGrlnT7eBsh_ksvQdcwmvVfoy9RsspusiXEWHuysXqskjhz0MB0xBpEdBX-A"; e_clientaddr="AcLj5l-kyzU2WdqZIPujIueu65p5aUs_UQvctFOemvbwyRwGo3ZAyYvmfr_152N-4K7uG8wwaBPQ7MqY_o47Q9IfqaRX9HAW_pyoZH4jg_JSkWA-lw"; e_fb_
2024-04-19 01:40:41 UTC	165	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 33 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 35 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 39 38 2c 20 75 6c 6c 61 74 3d 34 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=98, ullat=4Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:40:41 UTC	1335	IN	Data Raw: 63 35 39 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 57 4c 75 69 39 76 76 42 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: c593<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="WLui9vvB">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 6e 6f 79 64 69 72 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: een and (max-width: 640px)" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><meta name="robots" content="noodp,noydir" /><meta property="o
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c Data Ascii: 0935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"20936":{"result":false,"hash":null},
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 2c 5b 5d 2c 7b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 3a 22 59 30 77 76 52 5f 32 63 33 32 45 54 Data Ascii: {"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce",[],{"ServerNonce":"Y0wvR_2c32ET
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 67 46 72 6f 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 Data Ascii: gFromTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translationRetries":[200,500],"translationR
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 6f 2d 75 37 51 54 6e 4d 34 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 72 22 3a 31 2c 22 6d 61 6e 69 66 65 73 74 5f 62 61 73 65 5f 75 72 69 22 3a 22 68 74 74 70 73 3a Data Ascii: DOMAIN":false},270],["LSD",[],{"token":"AVo-u7QTnM4"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0..0.0","pr":1,"manifest_base_uri":"https:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49783	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:41 UTC	368	OUT	GET /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:41 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=08tYrEllOTxZIgVIa..BmIcuZ..AAA.0.0.BmIcuZ.AWVIsZslkTc; expires=Thu, 18-Jul-2024 01:40:41 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:41 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:41 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:41 UTC	2551	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 49 78 57 6a 51 69 6a 6c 73 53 5a 44 6d 2d 61 44 64 5a 42 6f 63 76 56 6e 66 39 6e 78 52 51 30 57 75 47 35 69 6b 44 6f 70 6f 6d 42 41 2d 47 39 36 34 45 75 53 6e 46 48 70 6f 39 5f 41 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4a 34 79 4b 47 4c 4b 6c 50 6a 2d 72 43 45 76 42 5a 70 75 53 47 47 6f 77 77 49 68 68 34 32 76 74 6d 57 4a 65 72 45 52 68 65 52 46 39 52 6e 68 67 6d 32 5a 6f 78 5a 76 5a 72 45 63 53 76 71 56 6a 5a 69 54 44 6a 7a 43 44 34 38 43 6e 33 50 33 43 64 64 31 59 71 5f 37 46 72 4f 76 4e 42 34 30 6e 54 67 4e 62 39 56 48 43 4e 5f 46 32 42 48 22 3b 20 65 5f 66 62 5f 76 69 Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcIxWjQijlsSZDm-aDdZBocvVnf9nxRQ0WuG5ikDopomBA-G964EuSnFHpo9_A"; e_clientaddr="AcJ4yKGLKlPj-rCEvBZpuSGGowwIhh42vtmWJerERheRF9Rnhgm2ZoxZvZrEcSvqVjZiTDjzCD48Cn3P3Cdd1Yq_7FrOvNB40nTgNb9VHCN_F2BH"; e_fb_vi
2024-04-19 01:40:41 UTC	165	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 34 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 36 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 37 34 2c 20 75 6c 6c 61 74 3d 30 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=74, ullat=0Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:40:41 UTC	1335	IN	Data Raw: 64 38 66 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 54 49 33 55 6f 6c 32 6e 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: d8f5<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="TI3Uol2n">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 6e 6f 79 64 69 72 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: een and (max-width: 640px)" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><meta name="robots" content="noodp,noydir" /><meta property="o
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c Data Ascii: 0935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"20936":{"result":false,"hash":null},
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 2c 5b 5d 2c 7b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 3a 22 30 44 34 53 46 47 35 6a 6c 65 6b 74 Data Ascii: {"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce",[],{"ServerNonce":"0D4SFG5jlekt
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 67 46 72 6f 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 Data Ascii: gFromTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translationRetries":[200,500],"translationR
2024-04-19 01:40:41 UTC	1500	IN	Data Raw: 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 6f 37 68 66 33 72 5f 76 63 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 72 22 3a 31 2c 22 6d 61 6e 69 66 65 73 74 5f 62 61 73 65 5f 75 72 69 22 3a 22 68 74 74 70 73 3a Data Ascii: DOMAIN":false},270],["LSD",[],{"token":"AVo7hf3r_vc"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0..0.0","pr":1,"manifest_base_uri":"https:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49784	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:41 UTC	611	OUT	GET /rsrc.php/v3/yR/r/4TRsPp18HYl.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:41 UTC	1693	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: bnE4nuSXfbFYt0pUHdQ3GQ== Expires: Fri, 18 Apr 2025 16:57:14 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: V5nHNTgGYTDCSBFeL6nFzUG6qZEQUbGWNuYsvfBWn32GCU6+iyRfFhMk1U53PRKICcb5VB9ihYIeR/Ra/GF9Ng== Date: Fri, 19 Apr 2024 01:40:41 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 3656
2024-04-19 01:40:41 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:41 UTC	3655	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 19 00 00 02 51 08 03 00 00 00 87 a3 ec 79 00 00 01 80 50 4c 54 45 47 70 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRQyPLTEGpL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49785	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:41 UTC	610	OUT	GET /rsrc.php/v3i7Vo4/y6/l/en_US/LznjGi-Mcyn.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:41 UTC	1704	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: n/uN8qK5y/DnGHwi93IO/A== Expires: Sun, 13 Apr 2025 00:38:05 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: 4Ay9Iu/TAWOL0/vbbzyfg7aJhvKi5K6hEo+n8Ry+sfbw/nSu19Vj3LJLm9HkGnHiUGMuqZToYnuVj8csEpqCSQ== Date: Fri, 19 Apr 2024 01:40:41 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 120679
2024-04-19 01:40:41 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:41 UTC	16102	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 55 46 49 43 6f 6d 6d 65 6e 74 4c 69 73 74 52 65 6e 64 65 72 65 72 46 6f 72 43 6f 6d 6d 65 6e 74 73 41 50 49 54 61 68 6f 65 5f 72 65 6e 64 65 72 65 72 24 6e 6f 72 6d 61 6c 69 7a 61 74 69 6f 6e 2e 67 72 61 70 68 71 6c 22 2c 5b 22 43 6f 6d 65 74 54 65 78 74 57 69 74 68 45 6e 74 69 74 69 65 73 52 65 6c 61 79 5f 74 65 78 74 57 69 74 68 45 6e 74 69 74 69 65 73 24 6e 6f 72 6d 61 6c 69 7a 61 74 69 6f 6e 2e 67 72 61 70 68 71 6c 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 61 61 2c 62 2c 63 2c 64 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a Data Ascii: /FB_PKG_DELIM/__d("CometUFICommentListRendererForCommentsAPITahoe_renderer$normalization.graphql",["CometTextWithEntitiesRelay_textWithEntities$normalization.graphql"],(function(a,aa,b,c,d,e){"use strict";a=function(){var a={alias:null,args:null,kind:
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 74 55 46 49 43 6f 6d 70 6f 73 65 72 50 6c 75 67 69 6e 73 5f 66 65 65 64 62 61 63 6b 22 2c 66 72 61 67 6d 65 6e 74 4e 61 6d 65 3a 22 63 6f 6d 65 74 55 46 49 43 6f 6d 70 6f 73 65 72 47 72 6f 75 70 41 6e 73 77 65 72 41 67 65 6e 74 46 6f 6c 6c 6f 77 75 70 50 6c 75 67 69 6e 5f 70 6c 75 67 69 6e 22 2c 66 72 61 67 6d 65 6e 74 50 72 6f 70 4e 61 6d 65 3a 22 70 6c 75 67 69 6e 22 2c 6b 69 6e 64 3a 22 4d 6f 64 75 6c 65 49 6d 70 6f 72 74 22 7d 5d 2c 74 79 70 65 3a 22 58 46 42 43 6f 6d 6d 65 6e 74 43 6f 6d 70 6f 73 65 72 47 72 6f 75 70 41 6e 73 77 65 72 41 67 65 6e 74 46 6f 6c 6c 6f 77 75 70 50 6c 75 67 69 6e 22 2c 61 62 73 74 72 61 63 74 4b 65 79 3a 6e 75 6c 6c 7d 5d 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 3b 78 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 Data Ascii: tUFIComposerPlugins_feedback",fragmentName:"cometUFIComposerGroupAnswerAgentFollowupPlugin_plugin",fragmentPropName:"plugin",kind:"ModuleImport"}],type:"XFBCommentComposerGroupAnswerAgentFollowupPlugin",abstractKey:null}],storageKey:null};x={alias:null,ar
2024-04-19 01:40:41 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 73 43 6f 6e 6e 65 63 74 69 6f 6e 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 74 6f 70 5f 72 65 61 63 74 69 6f 6e 73 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 54 6f 70 52 65 61 63 74 69 6f 6e 73 45 64 67 65 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 65 64 67 65 73 22 2c 70 6c 75 72 61 6c 3a 21 30 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 76 69 73 69 62 6c 65 5f 69 6e 5f 62 6c 69 6e 67 5f 62 61 72 Data Ascii: ctionsConnection",kind:"LinkedField",name:"top_reactions",plural:!1,selections:[{alias:null,args:null,concreteType:"TopReactionsEdge",kind:"LinkedField",name:"edges",plural:!0,selections:[{alias:null,args:null,kind:"ScalarField",name:"visible_in_bling_bar
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 65 6c 65 63 74 69 6f 6e 73 3a 79 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 3b 49 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 69 73 5f 64 69 73 61 62 6c 65 64 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 3b 42 3d 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 57 6f 72 6b 41 4d 41 55 46 49 41 6e 73 77 65 72 65 64 45 76 65 6e 74 43 6f 6d 6d 65 6e 74 4d 6f 64 75 6c 65 52 65 6e 64 65 72 65 72 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 77 6f 72 6b 5f 61 6e 73 77 65 72 65 64 5f 65 76 65 6e 74 5f 63 6f 6d 6d 65 6e 74 5f 72 65 6e 64 65 72 65 72 22 2c Data Ascii: elections:y,storageKey:null};I={alias:null,args:null,kind:"ScalarField",name:"is_disabled",storageKey:null};B={alias:null,args:null,concreteType:"WorkAMAUFIAnsweredEventCommentModuleRenderer",kind:"LinkedField",name:"work_answered_event_comment_renderer",
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 64 43 61 72 64 51 75 65 72 79 2e 67 72 61 70 68 71 6c 22 2c 5b 22 43 6f 6d 65 74 54 61 68 6f 65 55 70 4e 65 78 74 45 6e 64 43 61 72 64 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 7b 64 65 66 61 75 6c 74 56 61 6c 75 65 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 4c 6f 63 61 6c 41 72 67 75 6d 65 6e 74 22 2c 6e 61 6d 65 3a 22 63 75 72 72 65 6e 74 49 44 22 7d 2c 63 3d 7b 64 65 66 61 75 6c 74 56 61 6c 75 65 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 4c 6f 63 61 6c 41 72 67 75 6d 65 6e 74 22 2c 6e 61 6d 65 3a 22 73 63 61 6c 65 22 7d 2c 64 3d 7b 64 65 66 61 75 6c 74 Data Ascii: dCardQuery.graphql",["CometTahoeUpNextEndCardQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a={defaultValue:null,kind:"LocalArgument",name:"currentID"},c={defaultValue:null,kind:"LocalArgument",name:"scale"},d={default
2024-04-19 01:40:42 UTC	14884	IN	Data Raw: 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 22 43 49 58 53 63 72 65 65 6e 22 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 63 69 78 5f 73 63 72 65 65 6e 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 63 6f 6e 63 72 65 74 65 54 79 70 65 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 4c 69 6e 6b 65 64 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 76 69 65 77 5f 6d 6f 64 65 6c 22 2c 70 6c 75 72 61 6c 3a 21 31 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 69 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 61 72 67 73 3a 6e 75 6c 6c 2c 64 6f 63 75 6d 65 6e 74 4e 61 6d 65 3a 22 43 6f 6d 65 74 56 69 64 65 Data Ascii: ,concreteType:"CIXScreen",kind:"LinkedField",name:"cix_screen",plural:!1,selections:[{alias:null,args:null,concreteType:null,kind:"LinkedField",name:"view_model",plural:!1,selections:[i,{kind:"InlineFragment",selections:[{args:null,documentName:"CometVide
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 69 73 5f 6c 69 76 65 5f 73 74 72 65 61 6d 69 6e 67 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 69 73 5f 70 72 6f 66 69 6c 65 5f 76 69 64 65 6f 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 61 5d 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b 61 6c 69 61 73 3a 6e 75 6c 6c 2c 61 72 67 73 3a 6e 75 6c 6c 2c 6b 69 6e 64 3a 22 53 63 61 6c 61 72 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 22 76 69 64 65 6f 5f 76 69 65 77 5f 63 6f 75 6e 74 22 2c 73 74 6f 72 61 67 65 4b 65 79 3a 6e 75 6c 6c 7d 2c 7b Data Ascii: rgs:null,kind:"ScalarField",name:"is_live_streaming",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"is_profile_video",storageKey:null},a],storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"video_view_count",storageKey:null},{
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 69 5f 74 6f 6b 65 6e 3b 69 66 28 66 21 3d 6e 75 6c 6c 26 26 61 21 3d 6e 75 6c 6c 29 7b 61 3d 63 28 22 58 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 6c 69 73 74 43 6f 6e 74 72 6f 6c 6c 65 72 52 6f 75 74 65 42 75 69 6c 64 65 72 22 29 2e 62 75 69 6c 64 55 52 4c 28 7b 69 64 6f 72 76 61 6e 69 74 79 3a 61 7d 29 3b 79 3d 6c 2e 6a 73 78 28 63 28 22 43 6f 6d 65 74 4c 69 6e 6b 2e 72 65 61 63 74 22 29 2c 7b 68 72 65 66 3a 61 2c 6f 6e 43 6c 69 63 6b 3a 77 2c 63 68 69 6c 64 72 65 6e 3a 68 2e 5f 28 22 53 65 65 20 6d 6f 72 65 20 66 72 6f 6d 20 7b 70 61 67 65 20 6e 61 6d 65 7d 20 69 6e 20 56 69 64 65 6f 2e 22 2c 5b 68 2e 5f 70 61 72 61 6d 28 22 70 61 67 65 20 6e 61 6d 65 22 2c 66 29 5d 29 7d 29 7d 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3e 30 3f 6c 2e 6a Data Ascii: i_token;if(f!=null&&a!=null){a=c("XCometVideoHomePlaylistControllerRouteBuilder").buildURL({idorvanity:a});y=l.jsx(c("CometLink.react"),{href:a,onClick:w,children:h._("See more from {page name} in Video.",[h._param("page name",f)])})}return e.length>0?l.j
2024-04-19 01:40:42 UTC	6272	IN	Data Raw: 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 2c 6a 2c 6b 3d 6a 7c 7c 64 28 22 72 65 61 63 74 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 61 3d 61 2e 76 69 64 65 6f 3b 61 3d 64 28 22 43 6f 6d 65 74 52 65 6c 61 79 22 29 2e 75 73 65 46 72 61 67 6d 65 6e 74 28 69 21 3d 3d 76 6f 69 64 20 30 3f 69 3a 69 3d 62 28 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 72 6f 64 75 63 74 54 61 67 54 68 75 6d 62 6e 61 69 6c 4f 76 65 72 6c 61 79 5f 76 69 64 65 6f 2e 67 72 61 70 68 71 6c 22 29 2c 61 29 3b 61 3d 28 28 61 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 61 2e 70 72 6f 64 75 63 74 5f 74 61 67 73 29 7c 7c 5b 5d 29 2e 6c 65 6e 67 74 68 3e 30 3b 72 65 Data Ascii: react"],(function(a,b,c,d,e,f,g,h){"use strict";var i,j,k=j\|\|d("react");function a(a){a=a.video;a=d("CometRelay").useFragment(i!==void 0?i:i=b("CometVideoHomeProductTagThumbnailOverlay_video.graphql"),a);a=((a==null?void 0:a.product_tags)\|\|[]).length>0;re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49788	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:41 UTC	1084	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 642 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:41 UTC	642	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 31 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 33 39 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,1,0,0,0]]],558,[["1713490839000",null,null,nu
2024-04-19 01:40:41 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA; expires=Sat, 19-Oct-2024 01:40:41 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:40:41 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 19 Apr 2024 01:40:41 GMT Connection: close Transfer-Encoding: chunked
2024-04-19 01:40:41 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:40:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49786	23.33.136.127	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:41 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 01:40:41 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0758) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=192225 Date: Fri, 19 Apr 2024 01:40:41 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49791	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:41 UTC	434	OUT	GET /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuZ.AWXg241u3QQ
2024-04-19 01:40:42 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ; expires=Thu, 18-Jul-2024 01:40:42 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:42 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:42 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:42 UTC	2550	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 4b 43 31 30 55 53 52 36 72 50 57 31 45 34 66 6d 6d 31 6f 73 44 58 47 33 33 31 58 74 47 34 50 53 64 5a 77 46 39 5a 6b 33 66 56 59 30 4b 46 38 4a 41 30 2d 57 55 4d 4b 52 66 50 67 51 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 49 50 56 63 58 71 69 4e 66 33 71 5f 52 4c 59 32 6d 51 48 2d 4b 59 7a 62 6d 45 39 5f 69 70 38 61 67 41 6a 34 75 53 55 65 38 6d 66 4b 4f 55 2d 79 30 66 35 61 42 77 41 35 58 34 45 6c 4c 5f 75 6f 58 5f 30 42 66 6a 59 39 50 61 76 73 78 59 49 45 35 52 65 59 51 47 71 59 48 41 54 79 4f 41 39 4e 45 41 49 5f 34 64 4f 33 72 46 48 4b 66 76 22 3b 20 65 5f 66 62 5f 76 69 Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcKC10USR6rPW1E4fmm1osDXG331XtG4PSdZwF9Zk3fVY0KF8JA0-WUMKRfPgQ"; e_clientaddr="AcIPVcXqiNf3q_RLY2mQH-KYzbmE9_ip8agAj4uSUe8mfKOU-y0f5aBwA5X4ElL_uoX_0BfjY9PavsxYIE5ReYQGqYHATyOA9NEAI_4dO3rFHKfv"; e_fb_vi
2024-04-19 01:40:42 UTC	166	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 34 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 36 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 31 30 39 2c 20 75 6c 6c 61 74 3d 31 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=10, mss=1277, tbw=3406, tp=-1, tpl=-1, uplat=109, ullat=1Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:40:42 UTC	1334	IN	Data Raw: 64 38 66 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 32 45 6d 6e 71 44 4f 6e 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: d8f3<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="2EmnqDOn">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 6e 6f 79 64 69 72 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 Data Ascii: reen and (max-width: 640px)" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><meta name="robots" content="noodp,noydir" /><meta property="
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 32 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d Data Ascii: 20935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"20936":{"result":false,"hash":null}
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 2c 5b 5d 2c 7b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 3a 22 31 70 72 74 52 58 48 6f 35 47 37 Data Ascii: ,{"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce",[],{"ServerNonce":"1prtRXHo5G7
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 6e 67 46 72 6f 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e Data Ascii: ngFromTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translationRetries":[200,500],"translation
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 5f 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 70 4b 67 52 4d 6a 55 53 51 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 72 22 3a 31 2c 22 6d 61 6e 69 66 65 73 74 5f 62 61 73 65 5f 75 72 69 22 3a 22 68 74 74 70 73 Data Ascii: _DOMAIN":false},270],["LSD",[],{"token":"AVpKgRMjUSQ"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0..0.0","pr":1,"manifest_base_uri":"https

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49792	142.250.9.139	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	1320	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-744840401&timestamp=1713490840509 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=TISbAQ87lBo; VISITOR_INFO1_LIVE=Bm5Gpp9tStI; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgPg%3D%3D
2024-04-19 01:40:42 UTC	1849	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pC4xgVWCouM3LVZS4ouKXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 01:40:42 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjUtDikmJw1ZBikPj6kkkLiJ3SZ7CGAHHyv_OspUAsxMMxa3r7RjaBAzc6WxkBczoRaA" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 37 36 61 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 70 43 34 78 67 56 57 43 6f 75 4d 33 4c 56 5a 53 34 6f 75 4b 58 77 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 76a0<html><head><script nonce="pC4xgVWCouM3LVZS4ouKXw">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 3d 3d 3d 61 29 7b 69 66 28 69 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e Data Ascii: ternet Explorer"===a){if(ia())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 63 74 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 7c 7c 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 64 3d 41 28 61 29 3b 69 66 28 64 26 31 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 28 62 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 62 29 3f 62 2e 69 6e 63 6c 75 64 65 73 28 63 29 3a 62 2e 68 61 73 28 63 29 29 29 29 72 65 74 75 72 6e 21 31 3b 41 61 28 61 2c 64 7c 31 29 3b 72 65 74 75 72 6e 21 30 7d 2c 42 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 72 72 6f 72 28 22 69 6e 74 33 32 22 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 7c 7c 28 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f Data Ascii: ct},B=function(a,b,c){if(!Array.isArray(a)\|\|a.length)return!1;var d=A(a);if(d&1)return!0;if(!(b&&(Array.isArray(b)?b.includes(c):b.has(c))))return!1;Aa(a,d\|1);return!0},Ba=function(){var a=Error("int32");a.__closure__error__context__984382\|\|(a.__closure__
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 21 3d 0a 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 61 3d 42 28 61 2c 76 6f 69 64 20 30 2c 30 29 3f 76 6f 69 64 20 30 3a 65 26 26 41 28 61 29 26 32 3f 61 3a 49 61 28 61 2c 62 2c 63 2c 76 6f 69 64 20 30 21 3d 3d 64 2c 65 29 3b 65 6c 73 65 20 69 66 28 7a 61 28 61 29 29 7b 76 61 72 20 66 3d 7b 7d 2c 68 3b 66 6f 72 28 68 20 69 6e 20 61 29 66 5b 68 5d 3d 4a 61 28 61 5b 68 5d 2c 62 2c 63 2c 64 2c 65 29 3b 61 3d 66 7d 65 6c 73 65 20 61 3d 62 28 61 2c 64 29 3b 72 65 74 75 72 6e 20 61 7d 7d 2c 49 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 66 3d 64 7c 7c 63 3f 41 28 61 29 3a 30 3b 64 3d 64 3f 21 21 28 66 26 33 32 29 3a 76 6f 69 64 20 30 3b 61 Data Ascii: on(a,b,c,d,e){if(null!=a){if(Array.isArray(a))a=B(a,void 0,0)?void 0:e&&A(a)&2?a:Ia(a,b,c,void 0!==d,e);else if(za(a)){var f={},h;for(h in a)f[h]=Ja(a[h],b,c,d,e);a=f}else a=b(a,d);return a}},Ia=function(a,b,c,d,e){var f=d\|\|c?A(a):0;d=d?!!(f&32):void 0;a
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 68 7d 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 7d 3b 76 61 72 20 63 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 64 3d 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 62 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 63 2b 28 66 7c 7c 22 22 29 2b 22 5f 22 2b 64 2b 2b 2c 66 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 0a 45 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 Data Ascii: rable:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.g};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e)throw new TypeError("b");return new b(c+(f\|\|"")+"_"+d++,f)};return e});E("Symbol.iter
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 3b 4f 62 6a 65 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 64 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 72 29 7b 72 65 74 Data Ascii: ;Object.isExtensible(m)&&d(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=Object.seal({}),m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(r){ret
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 2c 67 2e 6c 2e 68 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 75 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: ,g.l.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].u=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value};c.prototype.entries=function(){retu
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 45 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c 4f 62 6a 65 63 74 Data Ascii: tion(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});E("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|Object
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 53 63 72 69 70 74 28 22 76 61 72 20 22 2b 61 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 2e 6c 65 6e 67 74 68 26 26 28 64 3d 61 2e 73 68 69 66 74 28 29 29 3b 29 61 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 62 3f 63 5b 64 5d 26 26 63 5b 64 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 41 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 61 2e 65 61 3d 66 75 Data Ascii: Script("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c[d]&&c[d]!==Object.prototype[d]?c=c[d]:c=c[d]={}:c[d]=b},I=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.ea=fu
2024-04-19 01:40:42 UTC	1849	IN	Data Raw: 62 65 72 2c 66 69 6c 65 4e 61 6d 65 3a 61 2e 66 69 6c 65 4e 61 6d 65 2c 73 74 61 63 6b 3a 62 7d 3a 28 63 3d 61 2e 6d 65 73 73 61 67 65 2c 6e 75 6c 6c 3d 3d 63 26 26 28 63 3d 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 75 6e 63 74 69 6f 6e 3f 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 27 2b 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3f 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 62 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 29 2b 27 22 27 3a 22 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 75 6e 6b 6e 6f 77 6e 20 74 79 70 65 22 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 2e 74 6f 53 74 72 69 Data Ascii: ber,fileName:a.fileName,stack:b}:(c=a.message,null==c&&(c=a.constructor&&a.constructor instanceof Function?'Unknown Error of type "'+(a.constructor.name?a.constructor.name:tb(a.constructor))+'"':"Unknown Error of unknown type","function"===typeof a.toStri

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49796	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	375	OUT	GET /rsrc.php/v3/yR/r/4TRsPp18HYl.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	1693	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: bnE4nuSXfbFYt0pUHdQ3GQ== Expires: Fri, 18 Apr 2025 16:57:14 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: V5nHNTgGYTDCSBFeL6nFzUG6qZEQUbGWNuYsvfBWn32GCU6+iyRfFhMk1U53PRKICcb5VB9ihYIeR/Ra/GF9Ng== Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=109, rtx=0, c=14, mss=1277, tbw=3411, tp=-1, tpl=-1, uplat=7, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 3656
2024-04-19 01:40:42 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:42 UTC	3655	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 19 00 00 02 51 08 03 00 00 00 87 a3 ec 79 00 00 01 80 50 4c 54 45 47 70 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRQyPLTEGpL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49801	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	1232	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=4&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 566 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqf6zJg8EvP2BGnzU sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=08tYrEllOTxZIgVIa..BmIcuZ..AAA.0.0.BmIcuZ.AWVIsZslkTc
2024-04-19 01:40:42 UTC	566	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 71 66 36 7a 4a 67 38 45 76 50 32 42 47 6e 7a 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 30 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 71 66 36 7a 4a 67 38 45 76 50 32 42 47 6e 7a 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 32 32 30 33 39 31 37 38 38 32 30 30 38 39 32 22 2c 22 70 6f 73 74 73 22 3a 5b 5b 22 72 65 71 75 69 72 65 5f 63 6f 6e 64 5f 65 78 70 6f 73 75 72 65 5f 6c 6f 67 67 Data Ascii: ------WebKitFormBoundaryqf6zJg8EvP2BGnzUContent-Disposition: form-data; name="ts"1713490840786------WebKitFormBoundaryqf6zJg8EvP2BGnzUContent-Disposition: form-data; name="q"[{"app_id":"2220391788200892","posts":[["require_cond_exposure_logg
2024-04-19 01:40:42 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:42 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:42 UTC	1817	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49803	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	599	OUT	GET /rsrc.php/v3/yy/r/q9P8VRdD1Am.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	1702	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: vahGwn08mkRUkAoCU/0AHQ== Expires: Wed, 16 Apr 2025 04:34:32 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: ovgpcBOi8WOeX8XzsRnAGMu9n/Lse4CYx18Qudi9mdKArzx5GPz7iZ0HC5RHiaIAjGb6HuuiM9LFIoysyI4fXA== Date: Fri, 19 Apr 2024 01:40:42 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 4098
2024-04-19 01:40:42 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:42 UTC	4097	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 43 61 74 61 6c 6f 67 52 6f 6f 74 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 37 34 32 37 34 38 39 31 37 34 30 30 34 36 35 37 22 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 43 61 74 61 6c 6f 67 52 6f 6f 74 51 75 65 72 79 24 50 61 72 61 6d 65 74 65 72 73 22 2c 5b 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 43 61 74 61 6c 6f 67 52 6f 6f 74 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 22 53 74 6f 72 69 65 73 Data Ascii: /FB_PKG_DELIM/__d("CometVideoHomeCatalogRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7427489174004657"}),null);__d("CometVideoHomeCatalogRootQuery$Parameters",["CometVideoHomeCatalogRootQuery_facebookRelayOperation","Stories

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49802	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	610	OUT	GET /rsrc.php/v3iNTg4/yA/l/en_US/2obelxd4ucH.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	1761	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: Bm0ARdm87+AvO4h1ZXpRZg== Expires: Fri, 18 Apr 2025 04:31:51 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: 5fAs5DcCcb0Iquvrw9IFq+S8tGY5IPVH71BR2Mye8LO9l85zN2R/ympUQNlFCuGbKsh2CbL0+h3DvMPtYVjHBg== Date: Fri, 19 Apr 2024 01:40:42 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 22248
2024-04-19 01:40:42 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:42 UTC	16045	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 46 42 52 65 65 6c 73 52 6f 6f 74 57 69 74 68 45 6e 74 72 79 70 6f 69 6e 74 51 75 65 72 79 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 37 32 39 35 35 33 30 35 31 37 32 33 33 34 34 30 22 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 46 42 52 65 65 6c 73 52 6f 6f 74 57 69 74 68 45 6e 74 72 79 70 6f 69 6e 74 51 75 65 72 79 24 50 61 72 61 6d 65 74 65 72 73 22 2c 5b 22 43 6f 6d 65 74 55 46 49 52 65 61 63 74 69 6f 6e 73 45 6e 61 62 6c 65 53 68 6f 72 74 4e 61 6d 65 2e 72 65 6c 61 79 70 72 6f 76 69 64 65 72 22 2c 22 46 42 52 65 65 6c 73 52 6f 6f 74 57 69 74 Data Ascii: /FB_PKG_DELIM/__d("FBReelsRootWithEntrypointQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7295530517233440"}),null);__d("FBReelsRootWithEntrypointQuery$Parameters",["CometUFIReactionsEnableShortName.relayprovider","FBReelsRootWit
2024-04-19 01:40:42 UTC	6202	IN	Data Raw: 6e 7b 63 6c 69 65 6e 74 5f 70 61 67 65 5f 70 6f 73 69 74 69 6f 6e 3a 53 74 72 69 6e 67 28 62 29 2c 66 6f 6c 6c 6f 77 5f 6c 6f 63 61 74 69 6f 6e 3a 63 2c 66 6f 6c 6c 6f 77 65 65 5f 69 64 3a 64 2c 74 72 61 63 6b 69 6e 67 3a 65 7d 7d 29 7d 29 7d 2c 5b 5d 29 2c 74 3d 69 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2c 63 3d 61 2e 65 6e 74 72 79 2c 64 3d 61 2e 6d 65 64 69 61 5f 69 64 2c 65 3d 61 2e 74 72 61 63 6b 69 6e 67 3b 6b 2e 6f 6e 52 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 6c 6f 67 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 64 65 73 74 69 6e 61 74 69 6f 6e 3a 62 2c 65 6e 74 72 79 3a 63 2c 6d 65 64 69 61 5f 69 64 3a 64 2c 74 72 61 63 6b 69 6e 67 5f 6b 65 Data Ascii: n{client_page_position:String(b),follow_location:c,followee_id:d,tracking:e}})})},[]),t=i(function(a){var b=a.destination,c=a.entry,d=a.media_id,e=a.tracking;k.onReady(function(a){return a.log(function(){return{destination:b,entry:c,media_id:d,tracking_ke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49797	23.33.136.127	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 01:40:42 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0rcGnYgAAAAANOnx9vccHTr21ROgX9ESTU0pDRURHRTAzMDkAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=192174 Date: Fri, 19 Apr 2024 01:40:42 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 01:40:42 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49805	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	826	OUT	GET /v/t15.5256-10/434846145_750354690635123_5825280892337708034_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=VY_PguNQYqkAb4vYZ4J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAA-dZ2FVoVBFW58UvtffQQCH__zs3TaqlqaDmOBrIH9A&oe=66278A45 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 19:01:36 GMT X-Needle-Checksum: 2035894263 thrift_fmhk: GBCkfoWpSnSWD/eVYDXrMc+/FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3555184730 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 54252
2024-04-19 01:40:42 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:42 UTC	15150	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 62 37 31 39 30 30 30 30 66 66 33 34 30 30 30 30 37 31 33 36 30 30 30 30 39 65 33 38 30 30 30 30 65 63 34 38 30 30 30 30 64 63 37 31 30 30 30 30 30 38 37 38 30 30 30 30 35 32 37 62 30 30 30 30 66 62 37 65 30 30 30 30 65 63 64 33 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000b7190000ff340000713600009e380000ec480000dc71000008780000527b0000fb7e0000ecd30000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: fd 35 95 9f 9b eb e6 db af 96 c3 49 e6 ac 78 6a 76 5a dd ea ec 56 d5 7d 75 3e f3 4e c3 c5 b5 9f 57 6e ab ab 6b aa fe 19 26 d7 68 f8 4e 50 a6 0f ba 25 8d 44 23 eb 0c 8d a3 49 76 4e 02 31 59 04 ca 34 5d e1 0b e2 70 1c 13 a3 d6 59 b4 0b 73 4d c5 c1 02 85 56 d9 8a c2 3d 64 a6 7b 23 b3 f4 d4 cb dd 0a 73 04 73 08 de d1 eb 25 37 db 69 df 97 54 9f a2 63 9d f3 84 40 92 3d 64 af a2 cf 56 5a df d1 84 a6 b9 d2 49 13 9a 01 8d 81 c9 34 3a 6c 9e 7d 64 a3 a8 6c 56 fd 38 47 19 36 e0 83 85 a3 81 53 54 12 63 94 a7 c5 fd 65 c9 d2 ac 86 c5 57 73 b2 72 63 a6 5a e4 e6 54 a5 33 92 33 c5 1f 30 7d 01 c9 f0 15 f6 33 5d 0a e8 56 88 d8 0e 0e 26 16 10 20 34 c2 73 9c 65 1f 2d 23 34 da 8d 10 0e 7d 0a 81 05 ae bc f7 98 1e e8 28 5e 41 c8 8f 26 ef 70 aa 6c b6 9d 31 24 a0 d6 46 eb 61 0c 59 Data Ascii: 5IxjvZV}u>NWnk&hNP%D#IvN1Y4]pYsMV=d{#ss%7iTc@=dVZI4:l}dlV8G6STceWsrcZT330}3]V& 4se-#4}(^A&pl1$FaY
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 47 af ff c4 00 1f 11 00 03 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 01 11 10 20 21 30 31 41 40 51 61 ff da 00 08 01 02 01 01 3f 10 dd 75 5d 98 ff 00 0c 5a e4 4c 18 b9 12 83 f0 62 57 a1 14 b9 9a 4d d9 08 25 07 7e 0b ce 70 a3 f0 e2 88 3b 16 8f a1 e5 09 10 58 5e 0f c1 e1 f5 bc ae a7 95 8a 2c 26 78 38 f6 2c 12 3e b7 86 e6 0f 9c 10 23 97 3e 17 6c e6 d2 09 8e 47 24 5e 96 31 1a 11 d0 91 fe 88 48 e3 c0 b9 43 12 a3 ef b7 d5 5c 8b a9 8c 63 75 60 20 31 f4 f1 84 a8 47 3a 17 e0 63 44 22 c1 05 a3 e1 fe 96 88 3c 2c 99 e0 59 f9 26 f0 4b 13 08 7b 07 fb 10 98 42 d5 07 b5 0f df d2 79 42 44 c4 12 84 1a 1c 6c f4 5f ad 66 d1 63 58 7c da 41 4e 9b f9 94 7e 0a 5d ab f0 7a 29 69 59 8c 8c f8 c5 f3 a9 3f 12 c2 20 53 e0 f1 84 ea 62 da f5 51 31 32 88 92 f0 65 c0 7d 6c 5b 48 b7 4b Data Ascii: G !01A@Qa?u]ZLbWM%~p;X^,&x8,>#>lG$^1HC\cu` 1G:cD"<,Y&K{ByBDl_fcX\|AN~]z)iY? SbQ12e}l[HK
2024-04-19 01:40:42 UTC	6333	IN	Data Raw: aa 8b 7b 1d 5b 62 c8 58 ae e0 f4 e5 4b 6a 6d ca 58 c3 f3 0d 8d f0 62 f9 94 5c 5e a5 4a 76 22 98 ca a7 cc bd 55 4e 0b e6 3d 01 d6 3d c8 85 43 55 4e 3b 19 b7 b1 0d 01 e3 b9 47 cb f1 28 29 ae 23 5a f3 0b 9c 47 6b c6 44 5d 4e 98 3b 72 a8 5e 5d 42 c7 29 9c 90 7e 67 28 36 7d c5 a7 0b a2 2f 55 01 61 f9 55 f7 29 84 28 2f b9 45 3d c1 e4 c8 14 a9 69 f3 04 79 83 41 07 63 77 5c c7 b9 c8 dc 20 04 0d 1b 22 6c ef f2 f2 41 bb a3 88 17 f3 10 f5 71 d5 54 ec a9 9e ee 1d 65 13 2b 23 e6 8a 70 86 d5 73 3f 51 9c 08 9b 0f 53 6b d4 b6 f3 21 4e 3d ca 4f 88 5c 43 9e e0 2c 5e 66 92 31 2a b4 f0 c2 bd 2e fd ca a4 35 d5 c0 d9 7f 29 ad c0 cc b7 a9 53 49 8c 61 77 68 6d f0 4b d6 fe e0 96 be 27 2a 38 8a a9 53 93 46 40 8c a9 60 70 8a c8 28 95 b5 73 43 0e 62 b9 75 cc 5b 25 d4 5b 0d 23 16 ec Data Ascii: {[bXKjmXb\^Jv"UN==CUN;G()#ZGkD]N;r^]B)~g(6}/UaU)(/E=iyAcw\ "lAqTe+#ps?QSk!N=O\C,^f1.5)SIawhmK'8SF@`p(sCbu[%[#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49810	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	901	OUT	GET /v/t15.5256-10/438043668_951275763118012_9085738709733793549_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Ag36yU8NZ2YAb6DVjhK&_nc_oc=AdhGlZK-sKtqhfza7ml_SykynPBUSx2UizoL0jq-Q1WsBlq6hBHetpwRDqkENWqjVAg&_nc_ht=scontent-atl3-2.xx&oh=00_AfA66vG8Ma9yADhKUsRHkt3rFZiZhApEGqODDzKsb816Dw&oe=6627B1A4 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 17 Apr 2024 22:24:10 GMT X-Needle-Checksum: 3379381119 thrift_fmhk: GBBBjC5SPrA1kovx1LtYpNFvFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3664347727 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 43734
2024-04-19 01:40:42 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:42 UTC	15143	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 35 37 31 63 30 30 30 30 36 33 33 34 30 30 30 30 31 35 33 61 30 30 30 30 36 66 34 30 30 30 30 30 32 66 34 39 30 30 30 30 32 31 36 35 30 30 30 30 37 31 36 62 30 30 30 30 36 62 37 32 30 30 30 30 36 31 37 39 30 30 30 30 64 36 61 61 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a70010000571c000063340000153a00006f4000002f49000021650000716b00006b72000061790000d6aa0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 7b 70 3e ca bf 55 e5 e0 6b 91 8f 26 0d 1c 3f c9 93 26 6e c7 ec 53 f3 66 89 76 60 97 1d 95 7e ab c8 97 9b 62 da 48 61 6e ec 63 63 f6 29 23 23 25 6c 18 30 54 f3 76 55 f3 79 0d 72 60 68 8c 1b 65 3e 16 0a b5 14 21 93 d5 4f 39 29 eb f3 c4 8e a2 97 83 26 7d 88 ac 21 da 68 56 46 0a d2 4a 47 55 0e ba 3a e3 a8 99 d4 23 19 31 c7 6f 93 6a c9 b0 d8 28 08 d5 bf f1 de 9d 67 12 9d 45 35 c7 b1 05 97 7c 15 38 ba 44 be 58 b6 4e 4d b3 23 be 9e 9e e6 6d c1 52 24 f8 23 96 28 18 c5 ab c3 74 30 6c 25 1c 5a 9c dc 1f 05 3a ca 5d f0 8e 15 d1 58 ab aa 84 38 3d 74 bf 04 3e 23 24 f9 25 aa 85 5a 7c 12 ed a1 0c 45 23 05 46 2a 79 23 15 1b 3b 32 a4 30 4a 23 89 81 3c 14 ab fe 1f 66 47 2e 48 f8 be 0a dd 94 22 fc 93 1d e8 c7 74 d2 23 c0 d8 c4 c7 23 70 e4 66 d3 8e 49 53 1c 07 11 db 4f 53 77 Data Ascii: {p>Uk&?&nSfv`~bHancc)##%l0TvUyr`he>!O9)&}!hVFJGU:#1oj(gE5\|8DXNM#mR$#(t0l%Z:]X8=t>#$%Z\|E#F*y#;20J#<fG.H"t##pfISOSw
2024-04-19 01:40:42 UTC	12206	IN	Data Raw: 72 e5 cb 97 2e 5c b9 71 66 5c b8 52 56 7a e9 52 a6 28 8e 0d ca c1 72 25 ee d8 95 0f 12 e5 cb 87 be 81 52 a5 41 f9 1f 99 ff 00 7b bc a8 72 ff 00 cc 10 fd 88 c5 55 00 86 2a 42 b2 ff 00 88 22 52 cc b7 5e fa b2 d9 6c ce 97 3d 27 a4 f4 74 26 04 8d c0 f4 3a 69 84 ba 07 06 c8 3c 24 83 9d db f5 7f dc c4 97 2e 5e a5 a2 dc b9 72 e5 cb fd 02 e5 cb 97 2e 5c ae 9d d8 b9 81 41 08 fb 5d e2 0d 6a af de 5f bc 4f 79 49 4e 8f fb 7c b2 e2 1b 8d f9 84 a5 84 58 5b e8 8d 41 48 d1 8f 96 47 a8 80 cb 1b 1b f3 17 0a 79 ba f2 4a 95 2a 57 89 51 25 4a 95 2b a0 d5 49 8a 06 86 86 18 8b 10 ac e8 6a dd e6 d1 d4 07 75 aa 8e 80 ef 0e ad df a5 72 e0 f4 0a 4b 94 98 3e e3 0a 58 65 47 94 bd 57 ca 5a 79 22 fb cf 67 43 bf 08 9f 98 b6 ff 00 e9 d1 52 ed fe 11 fd c8 31 2a 2a c5 fc cb d1 58 1e 57 5a Data Ascii: r.\qf\RVzR(r%RA{rUB"R^l='t&:i<$.^r.\A]j_OyIN\|X[AHGyJWQ%J+IjurK>XeGWZy"gCR1**XWZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49806	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	826	OUT	GET /v/t15.5256-10/437942529_992446696222628_1543467553494358279_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=AcwWWyFNr0wAb46GRke&_nc_ht=scontent-atl3-2.xx&oh=00_AfCufZFJTsYS1oCzs70XhJ1l36Gl75o7UJvA_kTMwh_8Eg&oe=6627949F HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sat, 13 Apr 2024 17:31:37 GMT X-Needle-Checksum: 2023820743 thrift_fmhk: GBDDSlVb/+uMcf8gyRToJqiQFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2713098503 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=4, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 37458
2024-04-19 01:40:42 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:42 UTC	15143	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 61 39 31 38 30 30 30 30 39 30 32 62 30 30 30 30 33 32 32 65 30 30 30 30 62 63 33 31 30 30 30 30 66 63 34 30 30 30 30 30 34 35 35 38 30 30 30 30 38 66 35 65 30 30 30 30 66 33 36 31 30 30 30 30 36 65 36 36 30 30 30 30 35 32 39 32 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000a9180000902b0000322e0000bc310000fc400000455800008f5e0000f36100006e66000052920000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 82 4b 0c 17 3a 78 3b 71 a2 f7 6e b9 c6 11 17 82 d4 11 ca 22 55 84 60 11 df 50 3d c2 c6 a2 15 c0 d3 df 4d 65 88 b6 25 b5 6a ef e3 46 5b 18 d2 6b 66 63 f4 67 ba ae 6e b9 4c 2c 31 84 c2 46 2a 3c f7 ef ae 73 6b a4 b6 9d 2c ad de 2a 2b b5 82 de 36 8c 60 28 ef ab 96 93 48 92 66 d5 bb 85 44 f2 ac 4a 62 18 18 ef a5 bb fa 38 a5 8d 70 31 bc 56 ae 65 69 b6 fe 25 49 34 ed ae 67 e2 7a 23 a2 3c 44 b4 12 c9 09 3c 74 1c 50 6b 89 a5 9b 1f 6c fa d5 e8 af b0 cd 75 12 26 c2 23 83 93 be b3 a5 c8 1c 48 1c 28 c7 69 10 90 85 d4 72 71 ba 83 63 1e a5 a3 b5 88 48 54 64 e5 b1 5f e5 17 ff 00 90 57 37 92 2c 4f 90 31 9f 8d 2d ab c2 36 ed 8c 0d 54 f0 ce 9a 24 5e 23 39 f5 b9 a4 bc 74 4e 6a c7 1c 7a dd 0d 38 d4 a6 be c9 f5 69 f2 e8 af ae e7 cb 3b 96 47 c3 c7 dc 37 d5 c5 ca 4c c9 a7 22 35 Data Ascii: K:x;qn"U`P=Me%jF[kfcgnL,1F<sk,+6`(HfDJb8p1Vei%I4gz#<D<tPklu&#H(irqcHTd_W7,O1-6T$^#9tNjz8i;G7L"5
2024-04-19 01:40:42 UTC	5930	IN	Data Raw: 49 db 6d ae 62 86 b7 cd 34 b4 5c 62 a5 16 bb 0a e1 76 b0 87 fd 46 fe cc 08 79 89 89 1c b3 d9 29 f8 1a 88 51 e8 76 aa 59 13 5f 2d a7 0d f9 22 50 29 ca 4a 82 4b 6f 68 91 e3 84 bb 36 e5 f9 63 49 5a 49 41 08 9a 7b 24 23 05 b9 b7 8b 7a 76 8b 1b 1e 79 62 68 68 37 31 cb 81 fd 10 dc c2 db ad c8 70 43 5b f2 4c c3 69 85 29 0f 92 46 91 26 e0 b8 64 d5 ed ed be 12 87 5e d4 40 bd 32 69 f6 27 e3 73 1b 43 ce d3 94 55 e7 39 39 13 69 d9 1a be 2a a2 12 78 35 46 f2 1a fd 1f 32 12 3d 3d 1c 61 ad 09 c3 27 a5 28 c3 70 25 38 24 26 84 b0 dc 88 68 1c 43 15 12 21 68 e4 26 84 8f 78 f3 0f a7 07 82 3c 91 a5 42 95 a3 7a d1 a3 18 99 41 0f 01 a5 d1 68 44 63 94 c5 d1 be 50 ba d1 ac 4c 8c 2e 85 40 a9 7b 1b 63 6c 3c 7c 86 c2 a0 b3 ea 1e 17 c9 e9 ee 49 32 72 24 bd 8d 3d 7d 0a 84 31 04 d9 b5 Data Ascii: Imb4\bvFy)QvY_-"P)JKoh6cIZIA{$#zvybhh71pC[Li)F&d^@2i'sCU99i*x5F2==a'(p%8$&hC!h&x<BzAhDcPL.@{cl<\|I2r$=}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49809	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	827	OUT	GET /v/t15.5256-10/437105006_1102269597670542_4976784059220029358_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Q8Y5BK9l_XIAb4Cr9pt&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-I28Z40HUGosKs6OU1VaGQD7MbfRLpHLFa4by2T23cA&oe=6627854D HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 15:18:53 GMT X-Needle-Checksum: 2844707571 thrift_fmhk: GBCRHotY3z55w+GbGB/Yv4FKFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2425666237 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 70232
2024-04-19 01:40:42 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 31 66 31 39 30 30 30 30 34 62 34 33 30 30 30 30 66 62 34 33 30 30 30 30 36 65 34 34 30 30 30 30 33 35 35 64 30 30 30 30 38 63 39 66 30 30 30 30 63 33 61 35 30 30 30 30 64 38 61 37 30 30 30 30 66 32 61 39 30 30 30 30 35 38 31 32 30 31 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e0100001f1900004b430000fb4300006e440000355d00008c9f0000c3a50000d8a70000f2a9000058120100C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:42 UTC	16332	IN	Data Raw: a2 a0 e8 9b 06 8e 02 55 63 e9 50 75 26 0f 8a 96 36 2a 2b 6d 36 36 2a e1 b6 9b 19 6b 83 22 e0 d8 a8 36 d3 06 da a0 c8 ba 19 79 39 b3 5d 0e 72 6f 3d d9 6b b9 a6 50 eb 67 37 44 ef 5c f4 44 8e f9 68 bc f1 34 cc c5 2b 32 69 03 94 ad f2 b9 93 7d 26 3b d7 66 4a d2 26 7b 6d 8a 23 85 e9 4b 46 af 4a 65 18 aa 1d 13 07 96 7b 1d 13 07 44 c1 c4 8b 1b 13 63 a2 aa 9d 15 07 44 d8 e8 9b 1b 15 63 62 a0 cb 54 1d 15 21 b3 3e 15 e9 e1 c3 33 d4 ed 65 37 26 8d 4c e4 3d 75 ae 62 75 19 08 52 ca 06 41 2f 11 b1 d1 15 2e 89 9a 8d 35 9e a9 e0 a8 68 5a 68 6d 2d c0 d7 4b 59 c1 bf 53 be 3c 4b fd d1 9e 16 73 d8 68 45 09 71 35 4f 2c f6 3e 22 c7 c4 58 e2 ce 43 a2 60 e8 98 3a d1 63 ef 39 c3 62 68 7c 44 34 52 a8 71 61 4c bd 0c 88 63 4b ad 0c 97 2b 9f 76 53 93 19 75 26 58 ea 4a 8d 54 9b b1 b1 Data Ascii: UcPu&6+m66k"6y9]ro=kPg7D\Dh4+2i}&;fJ&{m#KFJe{DcDcbT!>3e7&L=ubuRA/.5hZhm-KYS<KshEq5O,>"XC`:c9bh\|D4RqaLcK+vSu&XJT
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: c6 29 d2 9f 6b 08 99 29 a5 69 cd 52 bd 3a 51 54 fe a5 5e 14 36 65 7b ad e4 92 49 1d 10 84 19 08 20 83 9b 49 24 92 84 a0 9e 26 a5 3a 52 94 4c d4 bf 7f 35 1f f5 db ab 35 ae 29 43 1f 4f 4a 7d a6 33 5b 20 98 46 4b b2 2a 8f a4 d5 a8 64 c7 ea 24 92 4c f3 6e 08 42 0d a4 1c 92 49 29 67 19 2a 5f 63 4d 29 4f ab 9b bc 75 f7 5e 3f 40 c9 f2 6b 5c fa 1a 69 44 b6 79 5b 6b 5f 12 9a 63 f8 cf 0a 26 af ba c9 92 31 ea 6b 5c fa 1a 69 4e 84 4f b3 8a 51 cf da 42 1a 93 f8 3c 26 fe bc 27 46 9a 14 d5 84 35 66 a3 42 25 23 f5 2d 5c af f1 d8 4d c6 57 ec 68 a5 4f ea d5 ec 86 8a 13 ad aa 38 51 e9 b5 34 ad 3a 0c d3 65 c9 e1 e3 a5 6d 95 12 f8 55 71 c6 fd 54 e0 df 51 8a 6a ca 99 eb 64 c2 77 53 56 b5 31 c7 dc 75 c1 fd 45 a5 4d 3f 83 62 8c 67 a9 8c 08 97 64 11 2c e3 1e 62 e4 c6 44 c1 e2 30 Data Ascii: )k)iR:QT^6e{I I$&:RL55)COJ}3[ FKd$LnBI)g_cM)Ou^?@k\iDy[k_c&1k\iNOQB<&'F5fB%#-\MWhO8Q4:emUqTQjdwSV1uEM?bgd,bD0
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: a8 36 63 4b a5 0f 12 62 68 fe 45 d3 4e 89 13 e2 84 56 a6 5a 8d 89 da 23 72 99 8d 5c cd 55 e0 d8 c9 3b cc 70 4d 2c 34 7e 60 cb ac 0f ac 73 a6 d1 2b b6 98 dd 58 93 14 bb 6d 31 9b 4a 2f 81 0c 2f 72 38 4c cc 33 90 50 75 6f a2 7a 69 93 28 60 2a 6e 25 21 bc c4 c7 24 4e a4 84 dc 02 1d 06 86 18 73 72 86 5d b9 5d 10 be 41 93 e4 b4 08 34 e9 83 41 62 e3 98 6b a4 f6 86 7b 18 c9 ea 1f 04 86 b2 00 b7 c1 62 de ac 5a 86 49 d7 ee 41 73 fd 90 62 7b 1d 90 9e ad 95 bb 6c 91 6d a5 c8 a6 40 a9 47 02 5a 4e 21 4d a0 c7 04 c3 80 49 2c eb 71 bd b4 8d 0d ee d1 3e 43 e1 26 8b 21 6e 0d 72 37 a4 fe 45 70 71 d1 a8 0a 3d 93 14 f4 3e 58 a2 69 2f 81 03 c7 d8 8a 2e ef 92 98 c7 63 d4 20 aa 08 e7 72 69 48 1b 3d 88 a9 a9 36 83 d5 02 e6 93 e8 88 7f 81 02 2c 4d b1 9e c9 16 97 a1 4f 4a d8 5a 71 Data Ascii: 6cKbhENVZ#r\U;pM,4~`s+Xm1J//r8L3Puozi(`*n%!$Nsr]]A4Abk{bZIAsb{lm@GZN!MI,q>C&!nr7Epq=>Xi/.c riH=6,MOJZq
2024-04-19 01:40:42 UTC	14935	IN	Data Raw: e2 7f 72 d8 51 e8 df f7 2a 6f e3 ea 16 5c e9 54 0f 88 8a 31 8e 61 fc 47 6a ef 48 8d 72 bf 26 73 e9 e1 26 3f a0 0c 69 56 4f 77 28 73 42 85 a7 89 78 84 91 73 44 1d 4d e1 81 70 b7 c4 02 35 39 aa 20 4b 1e 40 94 c8 47 32 b5 6b e9 80 25 d1 cb 86 64 ea 1e 62 f9 74 f1 48 b5 d2 e3 22 57 54 3d 4b d0 42 9a a5 bc e6 54 00 07 b5 84 82 26 26 c7 c8 87 62 0f 55 2d 56 d0 0d d6 79 8c 0d e0 eb 38 03 14 89 57 eb 28 70 3e 18 34 28 f3 a2 55 1e f6 da 45 e9 ec 2c 4b 10 9e 88 87 61 fb 66 61 23 bb b0 92 8d 78 2e 5b 0a be 39 8e 70 0f 44 2d 43 ce e5 47 14 77 60 99 26 df 35 06 6c a8 8a d9 ea a3 a6 c9 e6 07 32 5a 1c 0f 34 9a f8 80 2b b9 6b 52 d4 a6 a6 81 cc 73 05 3c 25 cf a6 56 66 7f 75 71 2c b6 7d d7 7f 77 13 7c 4c 1e b6 79 65 91 68 22 f4 18 1d 97 01 a0 1d 6a 61 2c ae 46 e5 c0 97 1a Data Ascii: rQ*o\T1aGjHr&s&?iVOw(sBxsDMp59 K@G2k%dbtH"WT=KBT&&bU-Vy8W(p>4(UE,Kafa#x.[9pD-CGw`&5l2Z4+kRs<%Vfuq,}w\|Lyeh"ja,F
2024-04-19 01:40:42 UTC	1500	IN	Data Raw: 0c 01 ba 80 d7 46 d1 06 cb c7 27 fa 60 82 5a d3 6c c6 e1 c8 0f a4 a0 61 34 18 20 18 73 e6 62 15 f8 20 da 3f 34 a0 b4 3c ce 00 7d 43 1a b8 61 44 6f 66 9e 25 73 9b 97 ba 88 5a 37 55 2a 58 ab af 70 2b a2 f3 10 b6 38 1a 89 59 f6 dc 05 e9 2f 2c c5 74 47 7c b0 2e 43 da c6 b0 3a dd 0a 89 d8 1e 11 2a 94 2d 9e d8 20 35 da a1 44 36 ab 7e 20 9b 6b f2 4d 6d a7 98 56 46 a0 05 59 4b d6 18 1c 9a 89 37 5b 1c d3 ed 81 30 5f cb 2a da 1d 30 02 84 33 68 43 bc 70 7c 10 76 03 80 03 f7 29 09 1a 2a 6f 95 c5 c0 4c b7 2c c7 aa 63 13 e6 a1 e7 68 3a 9a be 61 4d 90 4c 05 27 71 21 cc cd b4 70 2a 7f 58 11 1b 23 51 77 35 95 98 b6 0b 97 44 3b 10 41 56 3c c6 5c 28 1e 9c 42 aa 9b 8b b8 1f 2c 20 c9 4f 98 47 28 35 ba 5b 6b 78 05 4f 89 50 fd d1 f1 13 b5 4d 52 8b 2a 09 be d4 db 1a e2 ea 1b 4b Data Ascii: F'`Zla4 sb ?4<}CaDof%sZ7UXp+8Y/,tG\|.C:- 5D6~ kMmVFYK7[0_03hCp\|v)oL,ch:aML'q!pX#Qw5D;AV<\(B, OG(5[kxOPMRK
2024-04-19 01:40:42 UTC	3196	IN	Data Raw: 8c 6a 54 ab 69 f2 d4 f5 a1 78 18 32 c0 e1 af ee 04 bd b1 b8 d6 7a 5c 34 2c 1e f9 80 55 b9 c6 f8 db 97 65 33 2f 76 28 0a bc ac 32 46 b5 00 8e ab 55 41 a3 fc b0 36 4b 39 0c 78 a8 97 e9 2e 15 a8 b9 01 43 ee 19 55 76 18 46 6d 15 79 b8 9e 85 c9 b9 a3 3c ec 5d 7a 76 93 60 9e 81 08 59 df 07 f5 15 d8 31 6d 67 cc 45 42 bc 00 c6 16 83 a4 8a 92 83 7c a4 75 7e 28 5b 06 ef b4 40 ae 5d b3 32 29 e2 1f 3d 16 1b dc 78 35 16 a6 57 da 72 53 d0 04 03 22 6a 7c 13 0f 6f 90 fa 8a 14 f6 0a 63 43 44 7b 08 03 49 f7 1b 92 67 40 ee 0a ac 4d 16 30 13 19 ce 10 08 31 c2 81 f5 01 8c 86 50 3e 18 3e 65 10 f1 d7 58 7a ca f7 15 bf 0f 10 ec 41 b6 4b 82 39 68 3e 66 09 8f 69 03 4b 1e d1 94 0b 01 b1 61 13 9f 5d 0a 51 6e d5 3a 11 82 94 c0 ac a8 9b 60 25 2e e1 c4 dc 41 da 4b bc e1 05 a6 15 d2 2f Data Ascii: jTix2z\4,Ue3/v(2FUA6K9x.CUvFmy<]zv`Y1mgEB\|u~([@]2)=x5WrS"j\|ocCD{Ig@M01P>>eXzAK9h>fiKa]Qn:`%.AK/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49807	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	826	OUT	GET /v/t15.5256-10/426704283_408014474976170_8736400465975078399_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ld6EvftXIT0Ab47SqER&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGwovxP7ofS8GVbz5awfT4XOcqHTKR7fDAa7B5m_KB7g&oe=6627A8C4 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 19 Feb 2024 20:26:21 GMT X-Needle-Checksum: 1444227046 thrift_fmhk: GBCRr2pC/xZMqOvTy7/2LwCPFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=526804753 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 52250
2024-04-19 01:40:42 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:42 UTC	15117	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 30 66 31 36 30 30 30 30 62 35 33 30 30 30 30 30 64 33 33 31 30 30 30 30 31 39 33 33 30 30 30 30 34 64 34 66 30 30 30 30 38 31 37 38 30 30 30 30 33 35 37 65 30 30 30 30 37 38 38 30 30 30 30 30 39 63 38 32 30 30 30 30 31 61 63 63 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f0100000f160000b5300000d3310000193300004d4f000081780000357e0000788000009c8200001acc0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 6b 6e 0d ec 3d 15 0c b3 52 89 64 20 60 68 1a 9b 73 55 35 32 c1 b8 6b c0 01 b7 54 8e a8 bb a9 f1 71 46 39 a1 bb d9 38 29 07 8b 79 28 aa 69 06 ed b5 0c 21 cd 0a 86 69 a9 5b 2b ec dc 2d d2 ee b7 34 68 b6 85 13 22 7b 9b 76 d9 32 96 7b 48 d8 b1 34 62 f0 55 0c a1 d9 ec 91 cd 3f 15 c7 f6 4d da 94 4d dd 4a de d5 bf 9a 6f de ff 00 a9 3f 6a ed 06 6f 8e 91 b1 0a 7a da 08 c4 52 1b 02 06 8a 7a 02 ec 51 8e 38 ef e0 a8 e7 91 a1 d1 bb e1 3a ea 5a 48 45 99 56 5a 45 90 96 91 ac 0f a3 78 c5 61 ff 00 9e 4a aa b2 56 35 d2 ce e3 86 e2 fe 4b e0 6c f3 53 59 7c dd 6b 80 14 f4 f5 94 62 19 d8 2f 90 b2 6d 23 a0 6e 27 17 11 2f 3d 13 e9 a2 a6 0d 92 39 47 c5 07 32 a1 8d 94 e2 a6 be 5f 14 e8 a6 d9 f8 2b 47 64 b7 c1 35 f5 4c 32 44 1d 7c 23 9e 68 51 d4 d0 45 13 5e cc 4d 03 3c 95 75 3b 7e Data Ascii: kn=Rd `hsU52kTqF98)y(i!i[+-4h"{v2{H4bU?MMJo?jozRzQ8:ZHEVZExaJV5KlSY\|kb/m#n'/=9G2_+Gd5L2D\|#hQE^M<u;~
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: 64 91 42 02 18 05 fe fd 6a 93 d3 8a 02 a3 b5 db 2b 9e f9 d4 1e 79 45 df b1 b7 20 20 ea 75 93 df a9 3c 72 4a 1e 60 d3 49 ad 15 0d e5 d9 59 c6 7c 32 86 fc ce 08 d5 ec 69 b1 30 01 c9 8d 24 51 15 37 dd 49 53 d7 fa a0 88 66 21 8f 79 32 cd 0c 5b 49 24 62 01 01 b7 49 55 06 9d ab 4e a9 44 32 b2 08 af 9e 28 99 9a b0 22 02 18 52 4c 41 e7 fb fb 6b 94 30 a6 7a ff 00 35 d4 f1 a2 09 e4 b2 0c 18 c3 cc 3c e6 f9 53 b0 f0 88 52 4b 05 c7 d3 79 67 00 9c ff 00 62 2c e0 8b e4 80 d2 65 d4 1e b9 d6 21 e8 93 d2 65 77 9b 5d e7 18 c2 6a 8f 10 60 80 59 c6 5b 43 86 f6 37 bc 0e 34 b1 1d 15 46 95 5d f5 aa b2 d6 cd 10 00 56 51 25 a6 85 c9 eb d6 e3 44 5c 94 4f 49 a6 52 55 48 68 a3 1b 0e 2c 71 9c 5b 8f a1 64 0a ee 2c 03 14 21 27 cb 15 57 96 6f 78 e2 cc c0 ce 34 73 83 ff 00 bb 12 82 60 50 Data Ascii: dBj+yE u<rJ`IY\|2i0$Q7ISf!y2[I$bIUND2("RLAk0z5<SRKygb,e!ew]j`Y[C74F]VQ%D\OIRUHh,q[d,!'Wox4s`P
2024-04-19 01:40:42 UTC	4364	IN	Data Raw: 88 4c c3 96 42 09 cc 42 5f b8 5b 68 b1 c6 4c 4b f2 46 a1 83 2f 5d a5 ab 6f e2 59 b3 b8 ea 52 6b 57 e8 ea 08 38 7e c7 0c c5 93 97 12 f2 ec 99 5f 51 40 86 51 45 25 ac 1f a4 4d a6 e3 58 3d c5 6e ce d0 06 22 71 1c b9 a9 01 d0 8d bb 8f 09 e8 c4 5c f8 51 8c 74 16 b9 4b 45 94 5d 62 52 ac 73 3f a2 3a 50 c4 e5 49 b2 0d c3 b2 a0 a8 a2 25 23 03 30 94 18 04 1e 11 ac 0b 75 0d 15 72 dd 95 0c 05 67 92 0e 2f 98 aa e6 28 70 30 c1 6b 41 0e a2 19 a9 6e 3a f7 10 a7 12 ed 44 5e e1 12 1d 09 8e a2 fa 59 50 aa 81 a4 ab a8 af 4c 77 11 7b 89 65 51 1a ad 40 aa e4 f7 1d 15 11 2f 11 aa f7 35 18 33 13 19 e6 54 82 47 bc 23 78 80 1c c6 28 4b 88 6e 0a 65 17 dc bc 7a 80 c7 52 cc e0 40 61 b2 51 0b 35 dc b2 53 39 08 0c 8d 39 99 fc 3c 11 86 22 06 8b 28 ca de ee 58 53 3e 66 38 66 b6 39 85 5d Data Ascii: LBB_[hLKF/]oYRkW8~_Q@QE%MX=n"q\QtKE]bRs?:PI%#0urg/(p0kAn:D^YPLw{eQ@/53TG#x(KnezR@aQ5S99<"(XS>f8f9]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49808	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:42 UTC	826	OUT	GET /v/t15.5256-10/438193268_922912702947462_7506581556452730663_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=F1f1WyXRCfUAb5H7pg3&_nc_ht=scontent-atl3-2.xx&oh=00_AfDB1zgmFI527f9DlANisuRmydguLRC3xydmlEEaw4wURA&oe=6627B6C7 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:42 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 15:06:35 GMT X-Needle-Checksum: 1176455884 thrift_fmhk: GBBxz7y8Oh5fzXGIpQRNPe7BFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2662965947 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:42 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 40329
2024-04-19 01:40:42 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:42 UTC	15084	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 31 30 31 30 30 30 30 39 61 31 33 30 30 30 30 36 62 32 39 30 30 30 30 35 61 32 62 30 30 30 30 65 33 32 64 30 30 30 30 32 36 33 65 30 30 30 30 32 66 35 64 30 30 30 30 36 64 36 33 30 30 30 30 32 37 36 36 30 30 30 30 36 39 36 39 30 30 30 30 38 39 39 64 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a710100009a1300006b2900005a2b0000e32d0000263e00002f5d00006d6300002766000069690000899d0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:42 UTC	16384	IN	Data Raw: a5 a6 ad 8d 96 ea a8 97 a3 a2 ae a5 d5 55 15 41 54 12 5c 94 83 95 55 86 14 9a b2 e4 a7 3a 2a 7f d5 70 d4 b8 57 5b d8 51 9b 5c da bd 90 12 a8 47 b3 68 19 8c c9 25 34 c2 91 a5 55 1a b8 2a b5 a9 ae 3f 99 4b 08 ee 55 0a ae 21 54 92 ac 55 82 a6 55 70 ae 30 aa 9b 55 75 ae af 8d 1d 85 b1 9c f0 de 5f f9 c2 ae 2a 85 54 34 85 40 42 b9 52 9e 22 54 41 cf df 40 b4 51 0d b1 85 55 05 30 ba b2 a6 1b 58 d9 6d 2d c5 e1 aa 37 f9 c2 e5 5c aa cc a0 03 10 68 a0 18 66 3c 53 9a ee 2a e5 51 f8 4b 35 f8 82 a5 9a 61 51 f2 c7 60 4f ea ab 30 54 f3 2b d3 0b 95 75 7c 6d ad 35 41 f5 c2 c2 4a 81 59 7e 60 a8 56 d5 f0 d9 be 34 5b a4 a9 48 2d d5 94 0f ac f0 9a b2 a2 9f 15 32 ab fc 2d 96 ad a2 82 9f 73 79 e1 9c f0 c3 2b 2c b2 70 6d f5 6a 15 26 3e 16 cc 45 b4 d0 aa d5 50 55 d4 85 bb f9 2a 4f Data Ascii: UAT\U:pW[Q\Gh%4U?KU!TUUp0Uu_T4@BR"TA@QU0Xm-7\hf<SQK5aQ`O0T+u\|m5AJY~`V4[H-2-sy+,pmj&>EPU*O
2024-04-19 01:40:42 UTC	8860	IN	Data Raw: 56 51 ed 94 6c 20 cd 34 8c 47 62 50 67 04 4a 83 44 4f 0d 40 14 45 c5 5e 61 12 92 77 73 3b cc eb 2e 14 31 be 59 33 16 21 5c 4a ab 83 74 c1 76 87 92 51 b5 10 71 64 52 ee 5c e6 36 63 4b 5c 1e c1 a4 80 fc d8 28 0b e0 9b a5 d1 b7 d1 51 f5 01 a3 b0 f7 5b 96 31 20 3b 92 9f 24 0e 14 cc 99 02 5b 86 05 cc 17 88 4f 80 94 94 ee 2f b9 d8 cb 79 88 38 7d 0e e8 af 61 e8 f6 25 85 37 b2 28 f8 79 c3 12 e9 3d 30 0e 0c ae 80 7c 4b 85 95 15 a5 c1 37 3e 78 4b 95 81 f1 7e f1 7d 8f ac 51 bf a8 83 b0 26 8a 03 dc d0 56 42 14 f8 f5 34 c8 9c 91 c8 24 e8 c4 5b 04 51 ba 89 58 82 5c c7 2b 06 3c 44 48 e2 78 09 6b 44 72 a2 a2 0d c2 0a 97 65 45 c0 9e 12 9e 91 0e 14 a3 0b 69 76 3a 98 86 89 c0 38 56 5d 5e 62 dc 56 70 6d 85 60 c2 10 83 28 3f 2c a1 71 fb 24 01 85 82 75 03 96 67 82 08 d4 18 c0 Data Ascii: VQl 4GbPgJDO@E^aws;.1Y3!\JtvQqdR\6cK\(Q[1 ;$[O/y8}a%7(y=0\|K7>xK~}Q&VB4$[QX\+<DHxkDreEiv:8V]^bVpm`(?,q$ug

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49813	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	826	OUT	GET /v/t15.5256-10/436859318_962909741584758_3870588264605380752_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=s7KXFq-dOKwAb6FUqMa&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-GpW_tvCHQBURGYoJaXuwYk2uRI3TGoOELVJq2jzi8A&oe=6627A99F HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Fri, 12 Apr 2024 13:13:46 GMT X-Needle-Checksum: 2594005369 thrift_fmhk: GBCZReYEnjz0ukfDYH9tYMuaFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2753918392 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 31621
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15113	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 33 66 31 38 30 30 30 30 66 61 32 39 30 30 30 30 64 38 32 63 30 30 30 30 34 37 33 30 30 30 30 30 61 61 33 34 30 30 30 30 62 37 34 38 30 30 30 30 35 61 34 66 30 30 30 30 39 36 35 33 30 30 30 30 38 33 35 38 30 30 30 30 38 35 37 62 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f0100003f180000fa290000d82c000047300000aa340000b74800005a4f00009653000083580000857b0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 83 d0 a9 5c f3 e6 98 84 94 fd 0a 1b 6d 95 26 ce 7a 1f fc 0b 30 2d 0d 6b e5 0f 91 36 3d c7 c0 ef 3a 34 cf 06 4c 64 35 b3 c1 6f 47 a4 6c bf 6f bc dc 66 88 2c 9a 06 ae ac 2b 63 44 27 07 d8 84 f3 0d 5a 5b 10 1e b8 72 52 30 8e 21 9e 41 f4 55 c4 ba 38 48 ec 6e da 21 85 78 38 23 f8 66 9d e2 ea 3e 75 54 f4 7f eb 3c 2b 69 f6 12 48 b1 fa a8 6a 36 98 b0 44 3b bf 9e 08 42 ae 36 39 28 1a 57 0a 36 cb b3 88 95 cb c2 35 61 3f 03 f0 15 dc 4f 99 89 cb a4 cd 94 6a cb 2c 0b 5d 45 95 70 3a 37 39 90 c4 e3 1e 13 63 d5 42 77 e4 4b e8 87 d2 6a 90 f9 c4 09 1e 40 ca 98 a6 21 70 58 3b a3 9e b8 42 65 48 bb fa 61 ed 13 3f d8 84 4c 42 94 9e 3b a9 46 e1 8f 97 08 af 39 0d 11 b1 f7 6a 95 7a 1b be 45 6e 08 06 17 a8 61 c9 36 36 e8 90 9e 8a b3 7a ba 02 72 7d 05 f0 e0 7a e9 51 c4 6b c2 12 92 Data Ascii: \m&z0-k6=:4Ld5oGlof,+cD'Z[rR0!AU8Hn!x8#f>uT<+iHj6D;B69(W65a?Oj,]Ep:79cBwKj@!pX;BeHa?LB;F9jzEna66zr}zQk
2024-04-19 01:40:43 UTC	123	IN	Data Raw: 48 79 01 73 e0 10 83 85 70 6f e1 34 7c ea 95 2a 57 15 2b e6 0f 05 27 e6 57 93 f1 2b 2b 0c a1 f4 87 00 cf 91 38 42 08 1e 3d fc 26 8f e1 2a 54 a9 5c 2a 57 8f d8 f8 a6 16 96 96 96 84 92 49 e3 44 1c 04 1a 86 58 6a 77 cf 52 9f 52 9f 52 a5 78 1a 25 43 e1 af 92 a5 4a 95 28 95 2a 54 a9 52 a5 72 54 a9 52 a5 4a 80 b8 04 10 20 82 1d 40 83 30 21 0e 1d 4e f9 eb e0 34 70 73 ff d9 Data Ascii: Hyspo4\|W+'W++8B=&T\WIDXjwRRRx%CJ(TRrTRJ @0!N4ps

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49816	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	827	OUT	GET /v/t51.29350-10/438882269_729999509341792_5681810228876178213_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rx4uzBlOIl8Ab6ytXk7&_nc_ht=scontent-atl3-2.xx&oh=00_AfAvO6SJOH5Y80LRz1OMs2wXXZ5sp1gyOizIOTgXp7L6GA&oe=66279CD1 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	662	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 15:04:03 GMT X-Needle-Checksum: 3628258601 thrift_fmhk: GBBkMFD5Cns/eBElW45VxP/mFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=4087443857 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=33, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 65489
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	1500	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 31 30 31 30 30 30 30 61 33 31 64 30 30 30 30 38 61 33 65 30 30 30 30 65 65 34 32 30 30 30 30 34 31 34 36 30 30 30 30 37 32 36 31 30 30 30 30 34 62 39 33 30 30 30 30 37 37 39 39 30 30 30 30 64 62 61 30 30 30 30 30 36 66 61 37 30 30 30 30 64 31 66 66 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a71010000a31d00008a3e0000ee42000041460000726100004b93000077990000dba000006fa70000d1ff0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:43 UTC	16332	IN	Data Raw: d0 aa af 36 9d 45 e4 6d 11 19 30 77 15 3e 2f 33 bb c4 0c e9 57 6d c7 1c eb ac cf 9b d8 e5 74 ea 35 df 45 a1 6d 37 d4 15 6a cf 78 5d 65 5a 25 e9 a7 42 26 da 53 52 a8 cc 06 b4 5d 9a 6b 99 e4 fd 76 6b 9f 9f d1 f4 3f 24 b4 e7 68 b0 e5 d3 33 6d b4 38 55 77 b8 da e1 5e 9a bb 4a ab b5 2c cb a6 cf 3d ea b9 97 9f 09 5c 6f c5 de 1d 50 a3 cf 6f 98 5a f4 97 79 de c1 5a 73 ed 64 57 6b 19 74 55 7d 74 a8 b5 2e 96 d1 8a 76 5d 48 75 a6 cc dc a5 ae bd 9c d1 35 e9 2e e0 74 c5 31 59 60 f8 ab d1 b1 55 7a f3 09 ae 70 d9 96 b1 e7 74 30 6d df 8f a1 6a 58 06 b7 50 aa fc ba 03 56 9c 77 a7 be b8 25 ec d3 9a f5 56 22 54 37 c6 d9 c2 98 ad 4a bf 39 e9 6b 4f e7 db 0e 1c bb 37 d9 87 6c 5d fc de b5 c9 f3 f7 5f 19 96 bb 2f 29 2d bb 72 3c 76 3f 74 97 82 57 a6 bd b8 f9 b8 7b 39 6e 3c f6 9d Data Ascii: 6Em0w>/3Wmt5Em7jx]eZ%B&SR]kvk?$h3m8Uw^J,=\oPoZyZsdWktU}t.v]Hu5.t1Y`Uzpt0mjXPVw%V"T7J9kO7l]_/)-r<v?tW{9n<
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 0e 27 b2 c2 dd e2 8a 1e b1 e2 7b 2c 2d 98 f8 57 13 e7 7c 49 e1 8b 67 c0 b7 7c 51 e1 7c ef 16 2c 3d 63 b5 e5 f0 2d de 56 95 98 f0 be 05 95 a3 c5 0b 6a 16 eb 0f 9d f1 ad 97 dc 5c 17 c2 b4 5c ab 7a 2b 81 6c b9 16 cb 17 ba 16 cb e9 2e 05 84 3f b0 b8 57 d3 5c 1f ff c4 00 40 10 00 01 03 02 03 04 07 05 07 03 04 02 03 01 00 00 01 00 02 11 03 21 12 31 41 10 22 51 61 13 20 30 32 40 50 71 04 42 52 81 a1 14 23 62 72 91 b1 c1 33 82 92 34 43 73 d1 a2 c2 63 90 e1 f0 ff da 00 08 01 01 00 06 3f 02 ff 00 e8 32 cb 9e cb 1f 3f bf 5a 1d 70 a4 65 e7 76 57 3d 84 66 10 23 ce 38 9d b7 eb 66 af b2 c5 4f 9a dd 5b b6 1c 3c d6 ee f9 78 0e 63 cc f9 e8 15 fc 03 c7 99 db 3f 02 e1 cb cc 9c 4e 40 22 7c 0c 79 94 0f 04 df 32 60 f0 43 cc a9 bb 4f 05 3e 12 c1 68 a1 d6 2b 31 b2 26 ea de 23 d1 Data Ascii: '{,-W\|Ig\|Q\|,=c-Vj\\z+l.?W\@!1A"Qa 02@PqBR#br34Csc?2?ZpevW=f#8fO[<xc?N@"\|y2`CO>h+1&#
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 8c 43 69 cf 9d a6 4d 14 b0 75 ea 54 86 e8 48 26 87 9d 5f 91 3a a8 fe d8 3b 62 e6 bc c1 7e 06 4e 7a ee 2a 1e 77 a3 bf da 2e 2c 02 f8 ef f8 9e 05 0d 77 db fd fe 23 ee 5d 4b 4c 3a 97 a6 3a 55 cd 57 f1 72 ab af 2b dd f5 36 ea 97 b1 ba a8 1f a1 56 4c db 2c 35 e2 18 4a c8 b9 7e 23 da 36 f3 3f b4 c1 a8 45 85 4b 41 a9 48 37 55 94 7e bc c6 77 69 19 4b 35 2c 68 b6 03 4d c8 39 42 66 22 00 e5 34 59 f6 89 dc 5f b3 fc 13 f3 51 68 ff 00 5c 7f 1a 6a 0d 7e a7 7c 3f 07 5c 5d f3 7c 3c 32 f8 ea 66 ad 85 bf f1 2d 7c e4 ea 31 33 17 d8 7a 46 b9 12 5f 40 ee 66 b2 52 d6 fe d1 53 59 01 d3 b1 97 21 76 7d a3 d8 8b a6 e0 4d 0a c0 f5 0a 69 75 2c 73 6c 56 ea 35 50 a8 1b ed 89 39 14 1d 0b 07 07 09 bd 9d 7f 13 bd b8 be 56 9f da 61 0a 4a 55 b2 7b 48 e7 96 e6 90 da 94 74 08 a3 5c 76 73 6c Data Ascii: CiMuTH&_:;b~Nz*w.,w#]KL::UWr+6VL,5J~#6?EKAH7U~wiK5,hM9Bf"4Y_Qh\j~\|?\]\|<2f-\|13zF_@fRSY!v}Miu,slV5P9VaJU{Ht\vsl
2024-04-19 01:40:43 UTC	14888	IN	Data Raw: 64 aa 34 1d 4b ac 77 3e 44 50 4a 49 cc b0 8e 7b 9f 59 91 99 d1 20 62 41 96 b5 71 9a 1a 2e 93 5f 49 aa b3 1f e6 22 af 3e 04 a6 38 cb ee 2b cb 77 2c 37 55 18 28 b0 a5 52 d9 fb 88 9d 46 e6 d6 a5 47 a6 98 62 2b 53 0c c0 e7 1d 4b 35 63 8d 34 c5 0f 1b 20 d6 b8 45 82 d0 d2 c7 d4 42 38 22 f5 4e c7 b9 a0 fb 99 be 22 39 67 03 e1 a8 0c c2 89 d0 30 ff 00 11 29 25 05 a9 6a 98 f1 b1 02 ac 29 2e 70 d5 ea 6c 9e ff 00 09 9c c0 ca 1d f8 97 1b 53 f9 41 a2 51 61 32 25 37 1d 5a 44 0d 1d 3f 07 4a fc 7e e5 99 91 be 25 ad 95 f7 0f 72 a3 2e 33 71 dc 34 a2 5e 7d 47 1b 90 ec 95 b9 98 3d 46 0b 72 ec 58 a8 d4 1a 95 f1 ca 0f 87 5e aa df 44 b0 51 4d 86 f1 a6 2a 61 b5 74 30 fc 33 61 88 3c e1 72 f3 aa 60 c0 6b 70 73 f5 50 8e 0c 4d cd b3 dc 65 ec ad cc c0 cc 6f 42 07 a3 39 98 99 e7 f1 00 Data Ascii: d4Kw>DPJI{Y bAq._I">8+w,7U(RFGb+SK5c4 EB8"N"9g0)%j).plSAQa2%7ZD?J~%r.3q4^}G=FrX^DQM*at03a<r`kpsPMeoB9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49815	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	827	OUT	GET /v/t15.5256-10/435585243_1336893433647196_6208832241633396260_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=elYzPYAIG9kAb6SZKEF&_nc_ht=scontent-atl3-2.xx&oh=00_AfCvf0SUTHuy36cSdF56yN534pHFsf_uSWdDHk8TaBveJA&oe=6627852B HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 17 Apr 2024 19:23:37 GMT X-Needle-Checksum: 653023462 thrift_fmhk: GBDemtRQ+JPFe8igL1mkJabVFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=287571640 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 49949
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15146	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 61 35 31 39 30 30 30 30 36 36 33 35 30 30 30 30 32 65 33 37 30 30 30 30 33 31 33 39 30 30 30 30 34 61 34 32 30 30 30 30 36 35 36 61 30 30 30 30 39 65 37 30 30 30 30 30 66 62 37 33 30 30 30 30 66 62 37 37 30 30 30 30 31 64 63 33 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000a5190000663500002e370000313900004a420000656a00009e700000fb730000fb7700001dc30000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 17 52 eb a1 48 bc 6a a3 f9 c5 14 be 3b 14 69 eb 54 bf 38 54 59 45 d8 95 05 4d 72 8a 20 b3 44 2e 5c b9 72 e5 e5 42 e5 6a 50 a1 55 2e 3e 87 69 f3 a9 dc 4b 17 29 15 a7 14 93 04 38 17 02 2c 94 41 44 93 61 a6 45 27 b9 b3 e6 37 a2 be a5 e3 48 50 e3 da aa 95 df 4f c9 cf 51 95 45 44 51 a2 11 30 26 35 13 02 89 a1 6e 65 1f 4a c3 cd c7 85 15 4a 43 0a 42 98 98 85 17 2e 93 59 25 0e 5d 04 5e b5 4c 3c ee 38 c9 34 9d 52 56 2c 5b 05 66 b5 10 4e 23 9b 41 1d 7c eb 37 a3 b1 62 da 5e 65 39 97 40 9b 54 fb ea f7 e2 e5 c8 49 ae 27 1b 4e b0 c5 63 a9 d4 ba 97 88 e6 53 9d 4e 75 39 ce 73 9c e7 43 9e 13 9a 13 a1 d0 e8 74 3a 16 42 c8 74 3f 4f e4 fd 3f 93 a1 64 fc 89 bc 89 41 21 85 19 0b 1c a7 22 9c 8a 36 ce 21 f6 51 7e 0e 48 84 a6 ce 2f c1 f4 e2 fc 0f 0a 8b fd 87 55 85 08 95 12 e7 0a Data Ascii: RHj;iT8TYEMr D.\rBjPU.>iK)8,ADaE'7HPOQEDQ0&5neJJCB.Y%]^L<84RV,[fN#A\|7b^e9@TI'NcSNu9sCt:Bt?O?dA!"6!Q~H/U
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 13 0c ff 00 c1 15 22 74 79 d7 8b f0 a0 c3 29 89 35 78 28 9c 84 18 7d cb af 85 53 2a 65 ce 6a b3 fe cf 17 15 49 fe 67 f7 e1 71 73 14 40 b5 9d 24 bd a7 e6 3b 92 15 ec 83 7b 81 81 db fe c2 81 e9 05 7c 04 dc 08 91 3c d4 4c ca f5 e4 18 9a 54 c4 67 c7 66 09 ca 98 89 f1 07 1e 47 83 c8 7f 11 ba 58 2f d4 0a bb 49 fb 99 19 bc c0 8f 3f c0 83 14 78 cd 7f 82 5c b5 ad c7 98 a0 2d 0f 91 87 fb 84 49 60 b1 97 14 bf f1 3b 97 2e 2c 58 c6 35 53 9d 2a 01 64 cc 05 04 e5 49 b9 0a 83 23 dc b0 20 e0 f4 4e 21 e1 8e 88 97 d6 27 f0 a9 a4 48 87 ba a8 0e 7d 11 c1 98 86 72 a3 47 f7 a3 fa a1 12 d0 20 e8 5b 9f f9 10 77 81 a5 a1 88 8d 25 43 c8 7f 12 58 8f 31 d3 2a cf ee 6a 47 98 8a 8a a2 bf 0b 08 78 6b 63 c1 1c 20 9a 21 b5 07 3e 2b 59 7b 5f 24 58 a4 ad 7b 7f dc b9 71 62 cc 1c c4 81 50 c2 Data Ascii: "ty)5x(}SejIgqs@$;{\|<LTgfGX/I?x\-I`;.,X5SdI# N!'H}rG [w%CX1*jGxkc !>+Y{_$X{qbP
2024-04-19 01:40:43 UTC	2034	IN	Data Raw: 7c 58 6e 6c 94 4b 04 c4 dc 1f 0c 17 32 d6 58 22 2a d7 b0 a8 a2 e8 44 f1 45 61 2d 3a 93 20 e0 81 51 cf a8 ea c4 82 ac 45 b6 2e 7c 60 54 53 65 85 c6 66 66 a5 23 2f a9 ae 28 f7 05 3e d2 65 0c 0f 51 0e 5c c6 cc b8 86 7d ca 33 a2 21 cc e7 8c 4d bf ca 05 14 3c 98 35 58 11 cb 98 c3 eb 0e d1 b9 51 97 2c 4b 2c ab 25 1a 83 a9 66 3e 92 db 8a 8e 18 8b 3a 88 a4 a1 8b ca 69 00 17 2f 60 67 b3 2c d5 c4 e1 fb 4e 03 f9 4d 3a 80 b2 59 37 57 d4 1b c8 4e a2 cd 20 fc c1 b2 40 e9 87 74 a7 70 7c 30 d4 2a 02 cc 62 ab 63 9c 28 53 93 dc be f4 09 84 46 5c 1a 96 89 ac b3 6c 15 08 ac 48 a4 68 41 6b 51 03 58 91 39 2b 50 bb f0 6d 38 8e 63 b0 54 36 d5 b1 a1 58 c4 5b 6e 5d 66 07 99 77 e3 ea 19 e2 05 73 17 d4 bc 47 7e 09 8a aa 38 94 11 6e 03 c2 fc b3 dd 05 79 65 03 31 02 84 ac 5e a5 93 50 Data Ascii: \|XnlK2X"DEa-: QE.\|`TSeff#/(>eQ\}3!M<5XQ,K,%f>:i/`g,NM:Y7WN @tp\|0bc(SF\lHhAkQX9+Pm8cT6X[n]fwsG~8nye1^P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49814	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	826	OUT	GET /v/t15.5256-10/435297039_1622642408563885_856096703543016407_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=GWAVaQ02VJ8Ab6-Thma&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGNYDZ7rzrA5aOKLdOlSZvN9nxTDaGyE2PI0T-WhTcwA&oe=6627AC74 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 15:39:54 GMT X-Needle-Checksum: 1116073295 thrift_fmhk: GBB6+OknO22ht9eU8TqxLs7EFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1061052477 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=6, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 78051
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	1500	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 34 30 31 64 30 30 30 30 61 61 34 39 30 30 30 30 36 31 34 63 30 30 30 30 35 62 35 30 30 30 30 30 32 37 37 64 30 30 30 30 62 34 62 62 30 30 30 30 66 33 63 31 30 30 30 30 37 35 63 36 30 30 30 30 36 34 63 63 30 30 30 30 65 33 33 30 30 31 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000401d0000aa490000614c00005b500000277d0000b4bb0000f3c1000075c6000064cc0000e3300100C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:43 UTC	16332	IN	Data Raw: 2e 6f 7f 3d 73 9a d8 de 6f ab 56 5f 31 af 6e a4 d8 00 2a 29 d8 6d e1 f4 92 c7 57 66 2c 5e 3c 47 58 a0 69 d0 6e e0 ef e6 a4 72 63 62 ec af 17 6a ba a6 61 6a 49 1d 2d 77 4b cb c3 d7 d5 8e 5e 2d aa 91 8d 36 8d 4c c7 47 2b 39 da b6 59 0e 73 a8 57 77 09 33 9a de 69 df 02 cb 69 21 75 b2 90 bc 57 c6 fa 51 ae 47 21 1d 3d f5 0b 27 af 2a d5 45 91 d6 43 6a 38 ed bd 63 15 ba 6e f3 fa 99 1d d3 d2 6f 2f ef c7 4b 97 9b ab d2 3f 63 3d f6 63 d3 d3 cc e1 d4 14 05 45 3a 9e 9f 91 eb 17 41 8e 6e 2f 18 a8 a8 a0 ea de de e7 7a 29 4c dd 2e 7a 20 8b 1d dd 31 72 08 20 d6 74 ef e2 4c 6d 4f cd bf 3a e9 9d ce d9 cd db 86 95 bc 6b 36 97 47 14 98 0f db ad ca 67 c5 6b 3f 9c 96 5a 77 b1 1f 24 4f e6 78 c3 36 77 c0 d2 cb e0 59 65 74 0e 2c 35 95 cb 49 cf e6 76 cf 54 ce 59 37 3a 89 f8 db 91 Data Ascii: .o=soV_1n)mWf,^<GXinrcbjajI-wK^-6LG+9YsWw3ii!uWQG!='ECj8cno/K?c=cE:An/z)L.z 1r tLmO:k6Ggk?Zw$Ox6wYet,5IvTY7:
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 83 dd 2c 34 1d a5 a1 6a 7c 6e 63 ac 9a df 76 2b 15 88 45 a2 d1 86 f1 d9 8b d8 ae d5 21 6d b2 0b 20 b2 59 2b fd db 95 72 ab 0f 6f d9 b9 5e e5 ee 56 71 11 e5 8f 75 62 ac 54 81 62 b1 58 ac 42 00 72 7b 57 b5 7b 55 da a3 73 78 f2 0b 20 b2 4f 2b 25 75 dd 77 50 f7 a8 6d 4c 31 aa d3 23 da fa 86 f1 cd 8e 50 48 21 6e 6a 69 8b 1b 52 5b 22 a3 2d 89 b1 54 c7 22 a6 7c ad 92 aa 48 65 58 a6 b7 df 80 58 b5 59 a8 e3 66 3a 3e 3e 48 d7 2c 4b 9e 24 f9 e3 5e a6 25 ea e3 5e ae 35 eb 23 5e ad b9 fa d6 af 5a 14 d3 f2 ac 97 b9 59 ea e6 d9 21 93 95 ca 8d af 91 d1 c5 24 8d f7 2e eb dc bd ca 3b ab 2b 2c 54 8d f6 06 8b 62 16 2d 56 62 bb 04 99 c6 b9 22 5c d1 2f 51 12 65 4c 60 7a a8 97 ab 89 7a b8 93 ea e3 23 d6 b1 7a d6 af 58 bd 62 a5 a8 ca a6 56 89 63 0f c9 54 ca dc aa 25 77 aa 96 21 Data Ascii: ,4j\|ncv+E!m Y+ro^VqubTbXBr{W{Usx O+%uwPmL1#PH!njiR["-T"\|HeXXYf:>>H,K$^%^5#^ZY!$.;+,Tb-Vb"\/QeL`zz#zXbVcT%w!
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 0f 59 bb 0f 1a 72 5b e1 ee 8d 1e 71 6c ba b9 7c 56 3e 86 ac fb ca 60 52 e3 ca 35 45 93 70 fe 83 e2 5b f6 04 c6 54 8d e0 58 40 d6 2d 82 58 a6 ea 7a 84 3c 0b ec 85 df 6a 05 d1 47 76 19 55 b1 f7 21 9c 31 35 ca 5f 02 69 c2 1b 70 44 bb 94 a1 c8 d3 31 81 fa 9e c2 8b 9f b9 14 be c3 17 84 83 a4 37 78 11 b3 61 db 60 62 6b f5 0c 98 cd 5a 1f 60 4c 09 47 50 93 d9 41 55 8d 51 71 60 48 e5 3f 67 22 ab c0 d5 26 ca 32 df bc 09 aa bc 0f ec dd 2b 1b 5e d3 a2 0c 93 e9 84 fe 0b a3 8b c8 aa 76 db 17 dc 53 f1 fd ae aa 4d 0d 56 7a cf 5d 21 3f 68 75 7d 81 a2 ce c9 fd 7c 08 ef dd b3 82 73 1b 56 1b 3d 88 96 d3 af 0f 42 1d a4 e8 f9 c3 19 49 27 f2 37 7e ae 66 8a 6d 9e ce 42 21 13 90 49 22 bc 84 7f 20 4a 54 3f 62 c6 f6 26 5a 62 6e 46 af ee 21 77 0e 11 12 96 b6 37 19 67 6c a7 74 64 46 Data Ascii: Yr[ql\|V>`R5Ep[TX@-Xz<jGvU!15_ipD17xa`bkZ`LGPAUQq`H?g"&2+^vSMVz]!?hu}\|sV=BI'7~fmB!I" JT?b&ZbnF!w7gltdF
2024-04-19 01:40:43 UTC	14935	IN	Data Raw: 48 9f d9 2e ee 7b ff 00 83 a1 15 ed 0e 8b 97 7a 6b f1 9d a7 a8 97 fe 1d 86 7f b0 c1 f8 89 3e 90 90 65 ec 55 86 45 89 44 8e eb 44 82 29 48 c8 42 10 84 12 e1 04 75 63 2a 91 d2 b4 28 eb ec f7 68 30 ad 46 75 a0 ee b5 2b 3b 3b 23 21 0e c8 c8 f1 08 4f 0a 44 26 c2 64 21 08 4c 84 21 08 42 10 84 21 08 51 5c c0 98 9c 04 c4 27 00 91 08 42 10 9f d4 a9 4a 52 94 a5 e5 4a 52 ff 00 47 5e 28 42 10 84 21 08 42 10 84 21 08 42 10 84 21 3f c6 df 3b d6 5f 2c 1a e6 dc d2 94 a5 29 4a 52 94 b9 d9 d9 de 52 94 a5 29 4f ff c4 00 24 11 00 03 00 02 03 01 00 02 01 05 00 00 00 00 00 00 00 01 11 10 21 20 31 41 51 30 61 40 50 71 81 91 b1 ff da 00 08 01 02 01 01 3f 10 fe 1c b8 42 10 84 21 08 42 10 45 21 04 88 41 22 10 48 84 21 08 42 10 86 8d 0e 15 0e 79 c5 08 34 52 2b 97 09 8a 88 0a c5 b1 Data Ascii: H.{zk>eUEDD)HBuc*(h0Fu+;;#!OD&d!L!B!Q\'BJRJRG^(B!B!B!?;_,)JRR)O$! 1AQ0a@Pq?B!BE!A"H!By4R+
2024-04-19 01:40:43 UTC	1500	IN	Data Raw: 80 dd ce fc da bf da 5d 5a ad d2 7f 89 9a 8f 8b bf f5 45 2d 47 37 6a 87 ac 08 5f 26 22 a8 ce 1b 2d e0 ea 24 28 b1 b5 ab fa 97 68 76 94 ee 51 6b 41 4b ba f1 e6 25 92 c0 e4 10 fe 53 35 78 31 a0 b7 bc 46 55 5f 23 d7 7e a1 f0 57 90 07 d4 cc a8 57 82 9f de 3a 10 33 c9 30 44 dc a2 50 e7 24 b0 b7 3f 55 31 77 f5 00 a3 4b 5b 8c 69 95 3b dc 32 a0 a5 2d 88 c6 66 9f b7 6d f8 7e f1 69 28 8e 55 8e 5a 48 9c ac b2 16 98 80 ea b4 4b be 8f b8 45 98 74 4a 86 e5 cb 8f c1 73 11 59 8d 4a f8 b8 df d3 82 00 cc e4 fb 97 ab 2d 28 d1 cc 0a fa 3b 5e 5e df c4 23 7f d9 0d 0a 8c 0e aa 05 b8 78 7a 81 41 63 83 c7 fb 4b a4 b5 df 57 b7 e8 84 c2 81 29 8d fd a1 fa 88 aa ba 17 97 96 5c ad 56 8e a6 ed ab 65 ee 03 01 3b 71 00 80 d3 58 96 1b e8 19 42 9f 92 43 47 04 6f 5b 87 40 ef 89 42 82 f8 6f Data Ascii: ]ZE-G7j_&"-$(hvQkAK%S5x1FU_#~WW:30DP$?U1wK[i;2-fm~i(UZHKEtJsYJ-(;^^#xzAcKW)\Ve;qXBCGo[@Bo
2024-04-19 01:40:43 UTC	11015	IN	Data Raw: b6 45 20 0b 8f da 2a 80 48 96 d2 ce 05 9b 1b 09 74 b2 68 0e 1f 2c 54 42 d4 51 b5 39 8d cd 2e 11 dc 9b 09 b1 d9 be e5 c0 8b db 80 83 52 ce 5a 15 ee 61 15 8d 63 f3 5b 54 40 0c a3 65 23 ee 5d 01 47 0b 3f 0c 29 2e f7 9a 01 a0 7b 10 66 80 f2 b5 03 e7 16 8c 1f 56 c4 7f 2c 8f e8 a9 58 c5 4a 6b f7 61 06 8a af 0b 97 f8 83 15 ab 22 1a f3 16 c6 8e ad fc cc e8 79 a3 ff 00 48 b4 d4 01 25 df 86 62 35 c4 b5 f0 2d f1 c4 7d 11 87 35 ab e2 5f c3 98 fb 62 10 5a 0b 4e 3d 4a a3 6d f9 bc 45 a5 54 da fb 94 6e dd a7 f1 2e 38 a9 da 8e 49 cd cd ab 72 b2 5b d9 18 d5 31 b8 73 18 bb 15 8e 5e e2 44 77 cb 10 e4 2a aa c4 6a b1 94 76 40 96 85 e9 3b 60 82 a2 78 40 83 08 0a 73 a9 57 72 1e 31 73 62 06 04 5a f0 db 33 7a 0b 37 ed 35 8e b9 ee 07 c1 af b5 a4 20 b7 99 ca 62 02 82 e9 8d c4 28 07 Data Ascii: E Hth,TBQ9.RZac[T@e#]G?).{fV,XJka"yH%b5-}5_bZN=JmETn.8Ir[1s^Dwjv@;`x@sWr1sbZ3z75 b(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49820	142.250.9.139	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	1321	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1434896875&timestamp=1713490842131 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: YSC=TISbAQ87lBo; VISITOR_INFO1_LIVE=Bm5Gpp9tStI; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgPg%3D%3D
2024-04-19 01:40:43 UTC	1850	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hWTw880vRtTMA4iGVUvLdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 19 Apr 2024 01:40:43 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Resource-Policy: cross-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjUtDikmLw0ZBikPj6kkkLiJ3SZ7CGAHHyv_OspUAsxMMxe3r7RjaBF9dWXGYCAHYlEgQ" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 37 36 61 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 68 57 54 77 38 38 30 76 52 74 54 4d 41 34 69 47 56 55 76 4c 64 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 Data Ascii: 76a0<html><head><script nonce="hWTw880vRtTMA4iGVUvLdg">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){("unde
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 3d 3d 3d 61 29 7b 69 66 28 69 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 22 37 2e 30 22 3d 3d 63 5b 31 5d 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 Data Ascii: ernet Explorer"===a){if(ia())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),"7.0"==c[1])if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 7d 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 7c 7c 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 64 3d 41 28 61 29 3b 69 66 28 64 26 31 29 72 65 74 75 72 6e 21 30 3b 69 66 28 21 28 62 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 62 29 3f 62 2e 69 6e 63 6c 75 64 65 73 28 63 29 3a 62 2e 68 61 73 28 63 29 29 29 29 72 65 74 75 72 6e 21 31 3b 41 61 28 61 2c 64 7c 31 29 3b 72 65 74 75 72 6e 21 30 7d 2c 42 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 72 72 6f 72 28 22 69 6e 74 33 32 22 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 7c 7c 28 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 Data Ascii: },B=function(a,b,c){if(!Array.isArray(a)\|\|a.length)return!1;var d=A(a);if(d&1)return!0;if(!(b&&(Array.isArray(b)?b.includes(c):b.has(c))))return!1;Aa(a,d\|1);return!0},Ba=function(){var a=Error("int32");a.__closure__error__context__984382\|\|(a.__closure__er
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 21 3d 0a 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 61 3d 42 28 61 2c 76 6f 69 64 20 30 2c 30 29 3f 76 6f 69 64 20 30 3a 65 26 26 41 28 61 29 26 32 3f 61 3a 49 61 28 61 2c 62 2c 63 2c 76 6f 69 64 20 30 21 3d 3d 64 2c 65 29 3b 65 6c 73 65 20 69 66 28 7a 61 28 61 29 29 7b 76 61 72 20 66 3d 7b 7d 2c 68 3b 66 6f 72 28 68 20 69 6e 20 61 29 66 5b 68 5d 3d 4a 61 28 61 5b 68 5d 2c 62 2c 63 2c 64 2c 65 29 3b 61 3d 66 7d 65 6c 73 65 20 61 3d 62 28 61 2c 64 29 3b 72 65 74 75 72 6e 20 61 7d 7d 2c 49 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 66 3d 64 7c 7c 63 3f 41 28 61 29 3a 30 3b 64 3d 64 3f 21 21 28 66 26 33 32 29 3a 76 6f 69 64 20 30 3b 61 3d 41 72 Data Ascii: a,b,c,d,e){if(null!=a){if(Array.isArray(a))a=B(a,void 0,0)?void 0:e&&A(a)&2?a:Ia(a,b,c,void 0!==d,e);else if(za(a)){var f={},h;for(h in a)f[h]=Ja(a[h],b,c,d,e);a=f}else a=b(a,d);return a}},Ia=function(a,b,c,d,e){var f=d\|\|c?A(a):0;d=d?!!(f&32):void 0;a=Ar
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 68 7d 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 7d 3b 76 61 72 20 63 3d 22 6a 73 63 6f 6d 70 5f 73 79 6d 62 6f 6c 5f 22 2b 28 31 45 39 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 64 3d 30 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 69 66 28 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 62 22 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 28 63 2b 28 66 7c 7c 22 22 29 2b 22 5f 22 2b 64 2b 2b 2c 66 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 0a 45 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 Data Ascii: e:!0,writable:!0,value:h})};b.prototype.toString=function(){return this.g};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e)throw new TypeError("b");return new b(c+(f\|\|"")+"_"+d++,f)};return e});E("Symbol.iterator
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 63 74 2e 69 73 45 78 74 65 6e 73 69 62 6c 65 28 6d 29 26 26 64 28 6d 29 3b 72 65 74 75 72 6e 20 6c 28 6d 29 7d 29 7d 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 21 4f 62 6a 65 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 6e 65 77 20 61 28 5b 5b 6b 2c 32 5d 2c 5b 6c 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6d 2e 67 65 74 28 6b 29 7c 7c 33 21 3d 6d 2e 67 65 74 28 6c 29 29 72 65 74 75 72 6e 21 31 3b 6d 2e 64 65 6c 65 74 65 28 6b 29 3b 6d 2e 73 65 74 28 6c 2c 34 29 3b 72 65 74 75 72 6e 21 6d 2e 68 61 73 28 6b 29 26 26 34 3d 3d 6d 2e 67 65 74 28 6c 29 7d 63 61 74 63 68 28 72 29 7b 72 65 74 75 72 6e 21 31 Data Ascii: ct.isExtensible(m)&&d(m);return l(m)})}if(function(){if(!a\|\|!Object.seal)return!1;try{var k=Object.seal({}),l=Object.seal({}),m=new a([[k,2],[l,3]]);if(2!=m.get(k)\|\|3!=m.get(l))return!1;m.delete(k);m.set(l,4);return!m.has(k)&&4==m.get(l)}catch(r){return!1
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 65 61 64 3d 0a 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 75 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 21 21 64 28 74 68 69 73 2c 67 29 2e 6c 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 28 67 3d 64 28 74 68 69 73 2c 67 29 2e 6c 29 26 26 67 2e 76 61 6c 75 65 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 Data Ascii: ead=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].u=f();this.size=0};c.prototype.has=function(g){return!!d(this,g).l};c.prototype.get=function(g){return(g=d(this,g).l)&&g.value};c.prototype.entries=function(){return e(t
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 45 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 74 68 69 73 3b 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 53 74 72 69 6e 67 26 26 28 64 3d 53 74 72 69 6e 67 28 64 29 29 3b 76 61 72 20 65 3d 64 2e 6c 65 6e 67 74 68 3b 63 3d 63 7c 7c 30 3b 66 6f 72 28 30 3e 63 26 26 28 63 3d 4d 61 74 68 2e 6d 61 78 28 63 2b 65 2c 30 29 29 3b 63 3c 65 3b 63 2b 2b 29 7b 76 61 72 20 66 3d 64 5b 63 5d 3b 69 66 28 66 3d 3d 3d 62 7c 7c 4f 62 6a 65 63 74 2e 69 73 28 66 2c 62 Data Ascii: c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});E("Array.prototype.includes",function(a){return a?a:function(b,c){var d=this;d instanceof String&&(d=String(d));var e=d.length;c=c\|\|0;for(0>c&&(c=Math.max(c+e,0));c<e;c++){var f=d[c];if(f===b\|\|Object.is(f,b
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 76 61 72 20 22 2b 61 5b 30 5d 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 2e 6c 65 6e 67 74 68 26 26 28 64 3d 61 2e 73 68 69 66 74 28 29 29 3b 29 61 2e 6c 65 6e 67 74 68 7c 7c 76 6f 69 64 20 30 3d 3d 3d 62 3f 63 5b 64 5d 26 26 63 5b 64 5d 21 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 5b 64 5d 3f 63 3d 63 5b 64 5d 3a 63 3d 63 5b 64 5d 3d 7b 7d 3a 63 5b 64 5d 3d 62 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 41 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 3b 61 2e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 64 Data Ascii: var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c[d]&&c[d]!==Object.prototype[d]?c=c[d]:c=c[d]={}:c[d]=b},I=function(a,b){function c(){}c.prototype=b.prototype;a.A=b.prototype;a.prototype=new c;a.prototype.constructor=a;a.ea=function(d
2024-04-19 01:40:43 UTC	1850	IN	Data Raw: 61 6d 65 3a 61 2e 66 69 6c 65 4e 61 6d 65 2c 73 74 61 63 6b 3a 62 7d 3a 28 63 3d 61 2e 6d 65 73 73 61 67 65 2c 6e 75 6c 6c 3d 3d 63 26 26 28 63 3d 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 26 26 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 6e 73 74 61 6e 63 65 6f 66 20 46 75 6e 63 74 69 6f 6e 3f 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 27 2b 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3f 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 62 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 29 2b 27 22 27 3a 22 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 75 6e 6b 6e 6f 77 6e 20 74 79 70 65 22 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 61 2e 74 6f 53 74 72 69 6e 67 26 26 4f 62 6a 65 63 Data Ascii: ame:a.fileName,stack:b}:(c=a.message,null==c&&(c=a.constructor&&a.constructor instanceof Function?'Unknown Error of type "'+(a.constructor.name?a.constructor.name:tb(a.constructor))+'"':"Unknown Error of unknown type","function"===typeof a.toString&&Objec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49822	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	590	OUT	GET /v/t15.5256-10/437942529_992446696222628_1543467553494358279_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=AcwWWyFNr0wAb46GRke&_nc_ht=scontent-atl3-2.xx&oh=00_AfCufZFJTsYS1oCzs70XhJ1l36Gl75o7UJvA_kTMwh_8Eg&oe=6627949F HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sat, 13 Apr 2024 17:31:37 GMT X-Needle-Checksum: 2023820743 thrift_fmhk: GBDDSlVb/+uMcf8gyRToJqiQFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2713098503 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 37458
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15143	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 61 39 31 38 30 30 30 30 39 30 32 62 30 30 30 30 33 32 32 65 30 30 30 30 62 63 33 31 30 30 30 30 66 63 34 30 30 30 30 30 34 35 35 38 30 30 30 30 38 66 35 65 30 30 30 30 66 33 36 31 30 30 30 30 36 65 36 36 30 30 30 30 35 32 39 32 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000a9180000902b0000322e0000bc310000fc400000455800008f5e0000f36100006e66000052920000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:43 UTC	16384	IN	Data Raw: 82 4b 0c 17 3a 78 3b 71 a2 f7 6e b9 c6 11 17 82 d4 11 ca 22 55 84 60 11 df 50 3d c2 c6 a2 15 c0 d3 df 4d 65 88 b6 25 b5 6a ef e3 46 5b 18 d2 6b 66 63 f4 67 ba ae 6e b9 4c 2c 31 84 c2 46 2a 3c f7 ef ae 73 6b a4 b6 9d 2c ad de 2a 2b b5 82 de 36 8c 60 28 ef ab 96 93 48 92 66 d5 bb 85 44 f2 ac 4a 62 18 18 ef a5 bb fa 38 a5 8d 70 31 bc 56 ae 65 69 b6 fe 25 49 34 ed ae 67 e2 7a 23 a2 3c 44 b4 12 c9 09 3c 74 1c 50 6b 89 a5 9b 1f 6c fa d5 e8 af b0 cd 75 12 26 c2 23 83 93 be b3 a5 c8 1c 48 1c 28 c7 69 10 90 85 d4 72 71 ba 83 63 1e a5 a3 b5 88 48 54 64 e5 b1 5f e5 17 ff 00 90 57 37 92 2c 4f 90 31 9f 8d 2d ab c2 36 ed 8c 0d 54 f0 ce 9a 24 5e 23 39 f5 b9 a4 bc 74 4e 6a c7 1c 7a dd 0d 38 d4 a6 be c9 f5 69 f2 e8 af ae e7 cb 3b 96 47 c3 c7 dc 37 d5 c5 ca 4c c9 a7 22 35 Data Ascii: K:x;qn"U`P=Me%jF[kfcgnL,1F<sk,+6`(HfDJb8p1Vei%I4gz#<D<tPklu&#H(irqcHTd_W7,O1-6T$^#9tNjz8i;G7L"5
2024-04-19 01:40:43 UTC	5930	IN	Data Raw: 49 db 6d ae 62 86 b7 cd 34 b4 5c 62 a5 16 bb 0a e1 76 b0 87 fd 46 fe cc 08 79 89 89 1c b3 d9 29 f8 1a 88 51 e8 76 aa 59 13 5f 2d a7 0d f9 22 50 29 ca 4a 82 4b 6f 68 91 e3 84 bb 36 e5 f9 63 49 5a 49 41 08 9a 7b 24 23 05 b9 b7 8b 7a 76 8b 1b 1e 79 62 68 68 37 31 cb 81 fd 10 dc c2 db ad c8 70 43 5b f2 4c c3 69 85 29 0f 92 46 91 26 e0 b8 64 d5 ed ed be 12 87 5e d4 40 bd 32 69 f6 27 e3 73 1b 43 ce d3 94 55 e7 39 39 13 69 d9 1a be 2a a2 12 78 35 46 f2 1a fd 1f 32 12 3d 3d 1c 61 ad 09 c3 27 a5 28 c3 70 25 38 24 26 84 b0 dc 88 68 1c 43 15 12 21 68 e4 26 84 8f 78 f3 0f a7 07 82 3c 91 a5 42 95 a3 7a d1 a3 18 99 41 0f 01 a5 d1 68 44 63 94 c5 d1 be 50 ba d1 ac 4c 8c 2e 85 40 a9 7b 1b 63 6c 3c 7c 86 c2 a0 b3 ea 1e 17 c9 e9 ee 49 32 72 24 bd 8d 3d 7d 0a 84 31 04 d9 b5 Data Ascii: Imb4\bvFy)QvY_-"P)JKoh6cIZIA{$#zvybhh71pC[Li)F&d^@2i'sCU99i*x5F2==a'(p%8$&hC!h&x<BzAhDcPL.@{cl<\|I2r$=}1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49827	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	590	OUT	GET /v/t15.5256-10/426704283_408014474976170_8736400465975078399_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ld6EvftXIT0Ab47SqER&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGwovxP7ofS8GVbz5awfT4XOcqHTKR7fDAa7B5m_KB7g&oe=6627A8C4 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 19 Feb 2024 20:26:21 GMT X-Needle-Checksum: 1444227046 thrift_fmhk: GBCRr2pC/xZMqOvTy7/2LwCPFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=526804753 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=5, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 52250
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15117	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 30 66 31 36 30 30 30 30 62 35 33 30 30 30 30 30 64 33 33 31 30 30 30 30 31 39 33 33 30 30 30 30 34 64 34 66 30 30 30 30 38 31 37 38 30 30 30 30 33 35 37 65 30 30 30 30 37 38 38 30 30 30 30 30 39 63 38 32 30 30 30 30 31 61 63 63 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f0100000f160000b5300000d3310000193300004d4f000081780000357e0000788000009c8200001acc0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 6b 6e 0d ec 3d 15 0c b3 52 89 64 20 60 68 1a 9b 73 55 35 32 c1 b8 6b c0 01 b7 54 8e a8 bb a9 f1 71 46 39 a1 bb d9 38 29 07 8b 79 28 aa 69 06 ed b5 0c 21 cd 0a 86 69 a9 5b 2b ec dc 2d d2 ee b7 34 68 b6 85 13 22 7b 9b 76 d9 32 96 7b 48 d8 b1 34 62 f0 55 0c a1 d9 ec 91 cd 3f 15 c7 f6 4d da 94 4d dd 4a de d5 bf 9a 6f de ff 00 a9 3f 6a ed 06 6f 8e 91 b1 0a 7a da 08 c4 52 1b 02 06 8a 7a 02 ec 51 8e 38 ef e0 a8 e7 91 a1 d1 bb e1 3a ea 5a 48 45 99 56 5a 45 90 96 91 ac 0f a3 78 c5 61 ff 00 9e 4a aa b2 56 35 d2 ce e3 86 e2 fe 4b e0 6c f3 53 59 7c dd 6b 80 14 f4 f5 94 62 19 d8 2f 90 b2 6d 23 a0 6e 27 17 11 2f 3d 13 e9 a2 a6 0d 92 39 47 c5 07 32 a1 8d 94 e2 a6 be 5f 14 e8 a6 d9 f8 2b 47 64 b7 c1 35 f5 4c 32 44 1d 7c 23 9e 68 51 d4 d0 45 13 5e cc 4d 03 3c 95 75 3b 7e Data Ascii: kn=Rd `hsU52kTqF98)y(i!i[+-4h"{v2{H4bU?MMJo?jozRzQ8:ZHEVZExaJV5KlSY\|kb/m#n'/=9G2_+Gd5L2D\|#hQE^M<u;~
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 64 91 42 02 18 05 fe fd 6a 93 d3 8a 02 a3 b5 db 2b 9e f9 d4 1e 79 45 df b1 b7 20 20 ea 75 93 df a9 3c 72 4a 1e 60 d3 49 ad 15 0d e5 d9 59 c6 7c 32 86 fc ce 08 d5 ec 69 b1 30 01 c9 8d 24 51 15 37 dd 49 53 d7 fa a0 88 66 21 8f 79 32 cd 0c 5b 49 24 62 01 01 b7 49 55 06 9d ab 4e a9 44 32 b2 08 af 9e 28 99 9a b0 22 02 18 52 4c 41 e7 fb fb 6b 94 30 a6 7a ff 00 35 d4 f1 a2 09 e4 b2 0c 18 c3 cc 3c e6 f9 53 b0 f0 88 52 4b 05 c7 d3 79 67 00 9c ff 00 62 2c e0 8b e4 80 d2 65 d4 1e b9 d6 21 e8 93 d2 65 77 9b 5d e7 18 c2 6a 8f 10 60 80 59 c6 5b 43 86 f6 37 bc 0e 34 b1 1d 15 46 95 5d f5 aa b2 d6 cd 10 00 56 51 25 a6 85 c9 eb d6 e3 44 5c 94 4f 49 a6 52 55 48 68 a3 1b 0e 2c 71 9c 5b 8f a1 64 0a ee 2c 03 14 21 27 cb 15 57 96 6f 78 e2 cc c0 ce 34 73 83 ff 00 bb 12 82 60 50 Data Ascii: dBj+yE u<rJ`IY\|2i0$Q7ISf!y2[I$bIUND2("RLAk0z5<SRKygb,e!ew]j`Y[C74F]VQ%D\OIRUHh,q[d,!'Wox4s`P
2024-04-19 01:40:44 UTC	4364	IN	Data Raw: 88 4c c3 96 42 09 cc 42 5f b8 5b 68 b1 c6 4c 4b f2 46 a1 83 2f 5d a5 ab 6f e2 59 b3 b8 ea 52 6b 57 e8 ea 08 38 7e c7 0c c5 93 97 12 f2 ec 99 5f 51 40 86 51 45 25 ac 1f a4 4d a6 e3 58 3d c5 6e ce d0 06 22 71 1c b9 a9 01 d0 8d bb 8f 09 e8 c4 5c f8 51 8c 74 16 b9 4b 45 94 5d 62 52 ac 73 3f a2 3a 50 c4 e5 49 b2 0d c3 b2 a0 a8 a2 25 23 03 30 94 18 04 1e 11 ac 0b 75 0d 15 72 dd 95 0c 05 67 92 0e 2f 98 aa e6 28 70 30 c1 6b 41 0e a2 19 a9 6e 3a f7 10 a7 12 ed 44 5e e1 12 1d 09 8e a2 fa 59 50 aa 81 a4 ab a8 af 4c 77 11 7b 89 65 51 1a ad 40 aa e4 f7 1d 15 11 2f 11 aa f7 35 18 33 13 19 e6 54 82 47 bc 23 78 80 1c c6 28 4b 88 6e 0a 65 17 dc bc 7a 80 c7 52 cc e0 40 61 b2 51 0b 35 dc b2 53 39 08 0c 8d 39 99 fc 3c 11 86 22 06 8b 28 ca de ee 58 53 3e 66 38 66 b6 39 85 5d Data Ascii: LBB_[hLKF/]oYRkW8~_Q@QE%MX=n"q\QtKE]bRs?:PI%#0urg/(p0kAn:D^YPLw{eQ@/53TG#x(KnezR@aQ5S99<"(XS>f8f9]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49828	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	590	OUT	GET /v/t15.5256-10/434846145_750354690635123_5825280892337708034_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=VY_PguNQYqkAb4vYZ4J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAA-dZ2FVoVBFW58UvtffQQCH__zs3TaqlqaDmOBrIH9A&oe=66278A45 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 19:01:36 GMT X-Needle-Checksum: 2035894263 thrift_fmhk: GBCkfoWpSnSWD/eVYDXrMc+/FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3555184730 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 54252
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15150	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 62 37 31 39 30 30 30 30 66 66 33 34 30 30 30 30 37 31 33 36 30 30 30 30 39 65 33 38 30 30 30 30 65 63 34 38 30 30 30 30 64 63 37 31 30 30 30 30 30 38 37 38 30 30 30 30 35 32 37 62 30 30 30 30 66 62 37 65 30 30 30 30 65 63 64 33 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000b7190000ff340000713600009e380000ec480000dc71000008780000527b0000fb7e0000ecd30000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: fd 35 95 9f 9b eb e6 db af 96 c3 49 e6 ac 78 6a 76 5a dd ea ec 56 d5 7d 75 3e f3 4e c3 c5 b5 9f 57 6e ab ab 6b aa fe 19 26 d7 68 f8 4e 50 a6 0f ba 25 8d 44 23 eb 0c 8d a3 49 76 4e 02 31 59 04 ca 34 5d e1 0b e2 70 1c 13 a3 d6 59 b4 0b 73 4d c5 c1 02 85 56 d9 8a c2 3d 64 a6 7b 23 b3 f4 d4 cb dd 0a 73 04 73 08 de d1 eb 25 37 db 69 df 97 54 9f a2 63 9d f3 84 40 92 3d 64 af a2 cf 56 5a df d1 84 a6 b9 d2 49 13 9a 01 8d 81 c9 34 3a 6c 9e 7d 64 a3 a8 6c 56 fd 38 47 19 36 e0 83 85 a3 81 53 54 12 63 94 a7 c5 fd 65 c9 d2 ac 86 c5 57 73 b2 72 63 a6 5a e4 e6 54 a5 33 92 33 c5 1f 30 7d 01 c9 f0 15 f6 33 5d 0a e8 56 88 d8 0e 0e 26 16 10 20 34 c2 73 9c 65 1f 2d 23 34 da 8d 10 0e 7d 0a 81 05 ae bc f7 98 1e e8 28 5e 41 c8 8f 26 ef 70 aa 6c b6 9d 31 24 a0 d6 46 eb 61 0c 59 Data Ascii: 5IxjvZV}u>NWnk&hNP%D#IvN1Y4]pYsMV=d{#ss%7iTc@=dVZI4:l}dlV8G6STceWsrcZT330}3]V& 4se-#4}(^A&pl1$FaY
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 47 af ff c4 00 1f 11 00 03 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 01 11 10 20 21 30 31 41 40 51 61 ff da 00 08 01 02 01 01 3f 10 dd 75 5d 98 ff 00 0c 5a e4 4c 18 b9 12 83 f0 62 57 a1 14 b9 9a 4d d9 08 25 07 7e 0b ce 70 a3 f0 e2 88 3b 16 8f a1 e5 09 10 58 5e 0f c1 e1 f5 bc ae a7 95 8a 2c 26 78 38 f6 2c 12 3e b7 86 e6 0f 9c 10 23 97 3e 17 6c e6 d2 09 8e 47 24 5e 96 31 1a 11 d0 91 fe 88 48 e3 c0 b9 43 12 a3 ef b7 d5 5c 8b a9 8c 63 75 60 20 31 f4 f1 84 a8 47 3a 17 e0 63 44 22 c1 05 a3 e1 fe 96 88 3c 2c 99 e0 59 f9 26 f0 4b 13 08 7b 07 fb 10 98 42 d5 07 b5 0f df d2 79 42 44 c4 12 84 1a 1c 6c f4 5f ad 66 d1 63 58 7c da 41 4e 9b f9 94 7e 0a 5d ab f0 7a 29 69 59 8c 8c f8 c5 f3 a9 3f 12 c2 20 53 e0 f1 84 ea 62 da f5 51 31 32 88 92 f0 65 c0 7d 6c 5b 48 b7 4b Data Ascii: G !01A@Qa?u]ZLbWM%~p;X^,&x8,>#>lG$^1HC\cu` 1G:cD"<,Y&K{ByBDl_fcX\|AN~]z)iY? SbQ12e}l[HK
2024-04-19 01:40:44 UTC	6333	IN	Data Raw: aa 8b 7b 1d 5b 62 c8 58 ae e0 f4 e5 4b 6a 6d ca 58 c3 f3 0d 8d f0 62 f9 94 5c 5e a5 4a 76 22 98 ca a7 cc bd 55 4e 0b e6 3d 01 d6 3d c8 85 43 55 4e 3b 19 b7 b1 0d 01 e3 b9 47 cb f1 28 29 ae 23 5a f3 0b 9c 47 6b c6 44 5d 4e 98 3b 72 a8 5e 5d 42 c7 29 9c 90 7e 67 28 36 7d c5 a7 0b a2 2f 55 01 61 f9 55 f7 29 84 28 2f b9 45 3d c1 e4 c8 14 a9 69 f3 04 79 83 41 07 63 77 5c c7 b9 c8 dc 20 04 0d 1b 22 6c ef f2 f2 41 bb a3 88 17 f3 10 f5 71 d5 54 ec a9 9e ee 1d 65 13 2b 23 e6 8a 70 86 d5 73 3f 51 9c 08 9b 0f 53 6b d4 b6 f3 21 4e 3d ca 4f 88 5c 43 9e e0 2c 5e 66 92 31 2a b4 f0 c2 bd 2e fd ca a4 35 d5 c0 d9 7f 29 ad c0 cc b7 a9 53 49 8c 61 77 68 6d f0 4b d6 fe e0 96 be 27 2a 38 8a a9 53 93 46 40 8c a9 60 70 8a c8 28 95 b5 73 43 0e 62 b9 75 cc 5b 25 d4 5b 0d 23 16 ec Data Ascii: {[bXKjmXb\^Jv"UN==CUN;G()#ZGkD]N;r^]B)~g(6}/UaU)(/E=iyAcw\ "lAqTe+#ps?QSk!N=O\C,^f1.5)SIawhmK'8SF@`p(sCbu[%[#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49829	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	590	OUT	GET /v/t15.5256-10/438193268_922912702947462_7506581556452730663_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=F1f1WyXRCfUAb5H7pg3&_nc_ht=scontent-atl3-2.xx&oh=00_AfDB1zgmFI527f9DlANisuRmydguLRC3xydmlEEaw4wURA&oe=6627B6C7 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 15:06:35 GMT X-Needle-Checksum: 1176455884 thrift_fmhk: GBBxz7y8Oh5fzXGIpQRNPe7BFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2662965947 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=3, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 40329
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15084	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 31 30 31 30 30 30 30 39 61 31 33 30 30 30 30 36 62 32 39 30 30 30 30 35 61 32 62 30 30 30 30 65 33 32 64 30 30 30 30 32 36 33 65 30 30 30 30 32 66 35 64 30 30 30 30 36 64 36 33 30 30 30 30 32 37 36 36 30 30 30 30 36 39 36 39 30 30 30 30 38 39 39 64 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a710100009a1300006b2900005a2b0000e32d0000263e00002f5d00006d6300002766000069690000899d0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: a5 a6 ad 8d 96 ea a8 97 a3 a2 ae a5 d5 55 15 41 54 12 5c 94 83 95 55 86 14 9a b2 e4 a7 3a 2a 7f d5 70 d4 b8 57 5b d8 51 9b 5c da bd 90 12 a8 47 b3 68 19 8c c9 25 34 c2 91 a5 55 1a b8 2a b5 a9 ae 3f 99 4b 08 ee 55 0a ae 21 54 92 ac 55 82 a6 55 70 ae 30 aa 9b 55 75 ae af 8d 1d 85 b1 9c f0 de 5f f9 c2 ae 2a 85 54 34 85 40 42 b9 52 9e 22 54 41 cf df 40 b4 51 0d b1 85 55 05 30 ba b2 a6 1b 58 d9 6d 2d c5 e1 aa 37 f9 c2 e5 5c aa cc a0 03 10 68 a0 18 66 3c 53 9a ee 2a e5 51 f8 4b 35 f8 82 a5 9a 61 51 f2 c7 60 4f ea ab 30 54 f3 2b d3 0b 95 75 7c 6d ad 35 41 f5 c2 c2 4a 81 59 7e 60 a8 56 d5 f0 d9 be 34 5b a4 a9 48 2d d5 94 0f ac f0 9a b2 a2 9f 15 32 ab fc 2d 96 ad a2 82 9f 73 79 e1 9c f0 c3 2b 2c b2 70 6d f5 6a 15 26 3e 16 cc 45 b4 d0 aa d5 50 55 d4 85 bb f9 2a 4f Data Ascii: UAT\U:pW[Q\Gh%4U?KU!TUUp0Uu_T4@BR"TA@QU0Xm-7\hf<SQK5aQ`O0T+u\|m5AJY~`V4[H-2-sy+,pmj&>EPU*O
2024-04-19 01:40:44 UTC	8860	IN	Data Raw: 56 51 ed 94 6c 20 cd 34 8c 47 62 50 67 04 4a 83 44 4f 0d 40 14 45 c5 5e 61 12 92 77 73 3b cc eb 2e 14 31 be 59 33 16 21 5c 4a ab 83 74 c1 76 87 92 51 b5 10 71 64 52 ee 5c e6 36 63 4b 5c 1e c1 a4 80 fc d8 28 0b e0 9b a5 d1 b7 d1 51 f5 01 a3 b0 f7 5b 96 31 20 3b 92 9f 24 0e 14 cc 99 02 5b 86 05 cc 17 88 4f 80 94 94 ee 2f b9 d8 cb 79 88 38 7d 0e e8 af 61 e8 f6 25 85 37 b2 28 f8 79 c3 12 e9 3d 30 0e 0c ae 80 7c 4b 85 95 15 a5 c1 37 3e 78 4b 95 81 f1 7e f1 7d 8f ac 51 bf a8 83 b0 26 8a 03 dc d0 56 42 14 f8 f5 34 c8 9c 91 c8 24 e8 c4 5b 04 51 ba 89 58 82 5c c7 2b 06 3c 44 48 e2 78 09 6b 44 72 a2 a2 0d c2 0a 97 65 45 c0 9e 12 9e 91 0e 14 a3 0b 69 76 3a 98 86 89 c0 38 56 5d 5e 62 dc 56 70 6d 85 60 c2 10 83 28 3f 2c a1 71 fb 24 01 85 82 75 03 96 67 82 08 d4 18 c0 Data Ascii: VQl 4GbPgJDO@E^aws;.1Y3!\JtvQqdR\6cK\(Q[1 ;$[O/y8}a%7(y=0\|K7>xK~}Q&VB4$[QX\+<DHxkDreEiv:8V]^bVpm`(?,q$ug

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49826	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	665	OUT	GET /v/t15.5256-10/438043668_951275763118012_9085738709733793549_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Ag36yU8NZ2YAb6DVjhK&_nc_oc=AdhGlZK-sKtqhfza7ml_SykynPBUSx2UizoL0jq-Q1WsBlq6hBHetpwRDqkENWqjVAg&_nc_ht=scontent-atl3-2.xx&oh=00_AfA66vG8Ma9yADhKUsRHkt3rFZiZhApEGqODDzKsb816Dw&oe=6627B1A4 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 17 Apr 2024 22:24:10 GMT X-Needle-Checksum: 3379381119 thrift_fmhk: GBBBjC5SPrA1kovx1LtYpNFvFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3664347727 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 43734
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	15143	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 35 37 31 63 30 30 30 30 36 33 33 34 30 30 30 30 31 35 33 61 30 30 30 30 36 66 34 30 30 30 30 30 32 66 34 39 30 30 30 30 32 31 36 35 30 30 30 30 37 31 36 62 30 30 30 30 36 62 37 32 30 30 30 30 36 31 37 39 30 30 30 30 64 36 61 61 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a70010000571c000063340000153a00006f4000002f49000021650000716b00006b72000061790000d6aa0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 7b 70 3e ca bf 55 e5 e0 6b 91 8f 26 0d 1c 3f c9 93 26 6e c7 ec 53 f3 66 89 76 60 97 1d 95 7e ab c8 97 9b 62 da 48 61 6e ec 63 63 f6 29 23 23 25 6c 18 30 54 f3 76 55 f3 79 0d 72 60 68 8c 1b 65 3e 16 0a b5 14 21 93 d5 4f 39 29 eb f3 c4 8e a2 97 83 26 7d 88 ac 21 da 68 56 46 0a d2 4a 47 55 0e ba 3a e3 a8 99 d4 23 19 31 c7 6f 93 6a c9 b0 d8 28 08 d5 bf f1 de 9d 67 12 9d 45 35 c7 b1 05 97 7c 15 38 ba 44 be 58 b6 4e 4d b3 23 be 9e 9e e6 6d c1 52 24 f8 23 96 28 18 c5 ab c3 74 30 6c 25 1c 5a 9c dc 1f 05 3a ca 5d f0 8e 15 d1 58 ab aa 84 38 3d 74 bf 04 3e 23 24 f9 25 aa 85 5a 7c 12 ed a1 0c 45 23 05 46 2a 79 23 15 1b 3b 32 a4 30 4a 23 89 81 3c 14 ab fe 1f 66 47 2e 48 f8 be 0a dd 94 22 fc 93 1d e8 c7 74 d2 23 c0 d8 c4 c7 23 70 e4 66 d3 8e 49 53 1c 07 11 db 4f 53 77 Data Ascii: {p>Uk&?&nSfv`~bHancc)##%l0TvUyr`he>!O9)&}!hVFJGU:#1oj(gE5\|8DXNM#mR$#(t0l%Z:]X8=t>#$%Z\|E#F*y#;20J#<fG.H"t##pfISOSw
2024-04-19 01:40:44 UTC	12206	IN	Data Raw: 72 e5 cb 97 2e 5c b9 71 66 5c b8 52 56 7a e9 52 a6 28 8e 0d ca c1 72 25 ee d8 95 0f 12 e5 cb 87 be 81 52 a5 41 f9 1f 99 ff 00 7b bc a8 72 ff 00 cc 10 fd 88 c5 55 00 86 2a 42 b2 ff 00 88 22 52 cc b7 5e fa b2 d9 6c ce 97 3d 27 a4 f4 74 26 04 8d c0 f4 3a 69 84 ba 07 06 c8 3c 24 83 9d db f5 7f dc c4 97 2e 5e a5 a2 dc b9 72 e5 cb fd 02 e5 cb 97 2e 5c ae 9d d8 b9 81 41 08 fb 5d e2 0d 6a af de 5f bc 4f 79 49 4e 8f fb 7c b2 e2 1b 8d f9 84 a5 84 58 5b e8 8d 41 48 d1 8f 96 47 a8 80 cb 1b 1b f3 17 0a 79 ba f2 4a 95 2a 57 89 51 25 4a 95 2b a0 d5 49 8a 06 86 86 18 8b 10 ac e8 6a dd e6 d1 d4 07 75 aa 8e 80 ef 0e ad df a5 72 e0 f4 0a 4b 94 98 3e e3 0a 58 65 47 94 bd 57 ca 5a 79 22 fb cf 67 43 bf 08 9f 98 b6 ff 00 e9 d1 52 ed fe 11 fd c8 31 2a 2a c5 fc cb d1 58 1e 57 5a Data Ascii: r.\qf\RVzR(r%RA{rUB"R^l='t&:i<$.^r.\A]j_OyIN\|X[AHGyJWQ%J+IjurK>XeGWZy"gCR1**XWZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49825	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	591	OUT	GET /v/t15.5256-10/437105006_1102269597670542_4976784059220029358_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=Q8Y5BK9l_XIAb4Cr9pt&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-I28Z40HUGosKs6OU1VaGQD7MbfRLpHLFa4by2T23cA&oe=6627854D HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:43 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 15:18:53 GMT X-Needle-Checksum: 2844707571 thrift_fmhk: GBCRHotY3z55w+GbGB/Yv4FKFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2425666237 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:43 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 70232
2024-04-19 01:40:43 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:43 UTC	1500	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 31 66 31 39 30 30 30 30 34 62 34 33 30 30 30 30 66 62 34 33 30 30 30 30 36 65 34 34 30 30 30 30 33 35 35 64 30 30 30 30 38 63 39 66 30 30 30 30 63 33 61 35 30 30 30 30 64 38 61 37 30 30 30 30 66 32 61 39 30 30 30 30 35 38 31 32 30 31 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e0100001f1900004b430000fb4300006e440000355d00008c9f0000c3a50000d8a70000f2a9000058120100C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16332	IN	Data Raw: a2 a0 e8 9b 06 8e 02 55 63 e9 50 75 26 0f 8a 96 36 2a 2b 6d 36 36 2a e1 b6 9b 19 6b 83 22 e0 d8 a8 36 d3 06 da a0 c8 ba 19 79 39 b3 5d 0e 72 6f 3d d9 6b b9 a6 50 eb 67 37 44 ef 5c f4 44 8e f9 68 bc f1 34 cc c5 2b 32 69 03 94 ad f2 b9 93 7d 26 3b d7 66 4a d2 26 7b 6d 8a 23 85 e9 4b 46 af 4a 65 18 aa 1d 13 07 96 7b 1d 13 07 44 c1 c4 8b 1b 13 63 a2 aa 9d 15 07 44 d8 e8 9b 1b 15 63 62 a0 cb 54 1d 15 21 b3 3e 15 e9 e1 c3 33 d4 ed 65 37 26 8d 4c e4 3d 75 ae 62 75 19 08 52 ca 06 41 2f 11 b1 d1 15 2e 89 9a 8d 35 9e a9 e0 a8 68 5a 68 6d 2d c0 d7 4b 59 c1 bf 53 be 3c 4b fd d1 9e 16 73 d8 68 45 09 71 35 4f 2c f6 3e 22 c7 c4 58 e2 ce 43 a2 60 e8 98 3a d1 63 ef 39 c3 62 68 7c 44 34 52 a8 71 61 4c bd 0c 88 63 4b ad 0c 97 2b 9f 76 53 93 19 75 26 58 ea 4a 8d 54 9b b1 b1 Data Ascii: UcPu&6+m66k"6y9]ro=kPg7D\Dh4+2i}&;fJ&{m#KFJe{DcDcbT!>3e7&L=ubuRA/.5hZhm-KYS<KshEq5O,>"XC`:c9bh\|D4RqaLcK+vSu&XJT
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: c6 29 d2 9f 6b 08 99 29 a5 69 cd 52 bd 3a 51 54 fe a5 5e 14 36 65 7b ad e4 92 49 1d 10 84 19 08 20 83 9b 49 24 92 84 a0 9e 26 a5 3a 52 94 4c d4 bf 7f 35 1f f5 db ab 35 ae 29 43 1f 4f 4a 7d a6 33 5b 20 98 46 4b b2 2a 8f a4 d5 a8 64 c7 ea 24 92 4c f3 6e 08 42 0d a4 1c 92 49 29 67 19 2a 5f 63 4d 29 4f ab 9b bc 75 f7 5e 3f 40 c9 f2 6b 5c fa 1a 69 44 b6 79 5b 6b 5f 12 9a 63 f8 cf 0a 26 af ba c9 92 31 ea 6b 5c fa 1a 69 4e 84 4f b3 8a 51 cf da 42 1a 93 f8 3c 26 fe bc 27 46 9a 14 d5 84 35 66 a3 42 25 23 f5 2d 5c af f1 d8 4d c6 57 ec 68 a5 4f ea d5 ec 86 8a 13 ad aa 38 51 e9 b5 34 ad 3a 0c d3 65 c9 e1 e3 a5 6d 95 12 f8 55 71 c6 fd 54 e0 df 51 8a 6a ca 99 eb 64 c2 77 53 56 b5 31 c7 dc 75 c1 fd 45 a5 4d 3f 83 62 8c 67 a9 8c 08 97 64 11 2c e3 1e 62 e4 c6 44 c1 e2 30 Data Ascii: )k)iR:QT^6e{I I$&:RL55)COJ}3[ FKd$LnBI)g_cM)Ou^?@k\iDy[k_c&1k\iNOQB<&'F5fB%#-\MWhO8Q4:emUqTQjdwSV1uEM?bgd,bD0
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: a8 36 63 4b a5 0f 12 62 68 fe 45 d3 4e 89 13 e2 84 56 a6 5a 8d 89 da 23 72 99 8d 5c cd 55 e0 d8 c9 3b cc 70 4d 2c 34 7e 60 cb ac 0f ac 73 a6 d1 2b b6 98 dd 58 93 14 bb 6d 31 9b 4a 2f 81 0c 2f 72 38 4c cc 33 90 50 75 6f a2 7a 69 93 28 60 2a 6e 25 21 bc c4 c7 24 4e a4 84 dc 02 1d 06 86 18 73 72 86 5d b9 5d 10 be 41 93 e4 b4 08 34 e9 83 41 62 e3 98 6b a4 f6 86 7b 18 c9 ea 1f 04 86 b2 00 b7 c1 62 de ac 5a 86 49 d7 ee 41 73 fd 90 62 7b 1d 90 9e ad 95 bb 6c 91 6d a5 c8 a6 40 a9 47 02 5a 4e 21 4d a0 c7 04 c3 80 49 2c eb 71 bd b4 8d 0d ee d1 3e 43 e1 26 8b 21 6e 0d 72 37 a4 fe 45 70 71 d1 a8 0a 3d 93 14 f4 3e 58 a2 69 2f 81 03 c7 d8 8a 2e ef 92 98 c7 63 d4 20 aa 08 e7 72 69 48 1b 3d 88 a9 a9 36 83 d5 02 e6 93 e8 88 7f 81 02 2c 4d b1 9e c9 16 97 a1 4f 4a d8 5a 71 Data Ascii: 6cKbhENVZ#r\U;pM,4~`s+Xm1J//r8L3Puozi(`*n%!$Nsr]]A4Abk{bZIAsb{lm@GZN!MI,q>C&!nr7Epq=>Xi/.c riH=6,MOJZq
2024-04-19 01:40:44 UTC	14935	IN	Data Raw: e2 7f 72 d8 51 e8 df f7 2a 6f e3 ea 16 5c e9 54 0f 88 8a 31 8e 61 fc 47 6a ef 48 8d 72 bf 26 73 e9 e1 26 3f a0 0c 69 56 4f 77 28 73 42 85 a7 89 78 84 91 73 44 1d 4d e1 81 70 b7 c4 02 35 39 aa 20 4b 1e 40 94 c8 47 32 b5 6b e9 80 25 d1 cb 86 64 ea 1e 62 f9 74 f1 48 b5 d2 e3 22 57 54 3d 4b d0 42 9a a5 bc e6 54 00 07 b5 84 82 26 26 c7 c8 87 62 0f 55 2d 56 d0 0d d6 79 8c 0d e0 eb 38 03 14 89 57 eb 28 70 3e 18 34 28 f3 a2 55 1e f6 da 45 e9 ec 2c 4b 10 9e 88 87 61 fb 66 61 23 bb b0 92 8d 78 2e 5b 0a be 39 8e 70 0f 44 2d 43 ce e5 47 14 77 60 99 26 df 35 06 6c a8 8a d9 ea a3 a6 c9 e6 07 32 5a 1c 0f 34 9a f8 80 2b b9 6b 52 d4 a6 a6 81 cc 73 05 3c 25 cf a6 56 66 7f 75 71 2c b6 7d d7 7f 77 13 7c 4c 1e b6 79 65 91 68 22 f4 18 1d 97 01 a0 1d 6a 61 2c ae 46 e5 c0 97 1a Data Ascii: rQ*o\T1aGjHr&s&?iVOw(sBxsDMp59 K@G2k%dbtH"WT=KBT&&bU-Vy8W(p>4(UE,Kafa#x.[9pD-CGw`&5l2Z4+kRs<%Vfuq,}w\|Lyeh"ja,F
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 0c 01 ba 80 d7 46 d1 06 cb c7 27 fa 60 82 5a d3 6c c6 e1 c8 0f a4 a0 61 34 18 20 18 73 e6 62 15 f8 20 da 3f 34 a0 b4 3c ce 00 7d 43 1a b8 61 44 6f 66 9e 25 73 9b 97 ba 88 5a 37 55 2a 58 ab af 70 2b a2 f3 10 b6 38 1a 89 59 f6 dc 05 e9 2f 2c c5 74 47 7c b0 2e 43 da c6 b0 3a dd 0a 89 d8 1e 11 2a 94 2d 9e d8 20 35 da a1 44 36 ab 7e 20 9b 6b f2 4d 6d a7 98 56 46 a0 05 59 4b d6 18 1c 9a 89 37 5b 1c d3 ed 81 30 5f cb 2a da 1d 30 02 84 33 68 43 bc 70 7c 10 76 03 80 03 f7 29 09 1a 2a 6f 95 c5 c0 4c b7 2c c7 aa 63 13 e6 a1 e7 68 3a 9a be 61 4d 90 4c 05 27 71 21 cc cd b4 70 2a 7f 58 11 1b 23 51 77 35 95 98 b6 0b 97 44 3b 10 41 56 3c c6 5c 28 1e 9c 42 aa 9b 8b b8 1f 2c 20 c9 4f 98 47 28 35 ba 5b 6b 78 05 4f 89 50 fd d1 f1 13 b5 4d 52 8b 2a 09 be d4 db 1a e2 ea 1b 4b Data Ascii: F'`Zla4 sb ?4<}CaDof%sZ7UXp+8Y/,tG\|.C:- 5D6~ kMmVFYK7[0_03hCp\|v)oL,ch:aML'q!pX#Qw5D;AV<\(B, OG(5[kxOPMRK
2024-04-19 01:40:44 UTC	3196	IN	Data Raw: 8c 6a 54 ab 69 f2 d4 f5 a1 78 18 32 c0 e1 af ee 04 bd b1 b8 d6 7a 5c 34 2c 1e f9 80 55 b9 c6 f8 db 97 65 33 2f 76 28 0a bc ac 32 46 b5 00 8e ab 55 41 a3 fc b0 36 4b 39 0c 78 a8 97 e9 2e 15 a8 b9 01 43 ee 19 55 76 18 46 6d 15 79 b8 9e 85 c9 b9 a3 3c ec 5d 7a 76 93 60 9e 81 08 59 df 07 f5 15 d8 31 6d 67 cc 45 42 bc 00 c6 16 83 a4 8a 92 83 7c a4 75 7e 28 5b 06 ef b4 40 ae 5d b3 32 29 e2 1f 3d 16 1b dc 78 35 16 a6 57 da 72 53 d0 04 03 22 6a 7c 13 0f 6f 90 fa 8a 14 f6 0a 63 43 44 7b 08 03 49 f7 1b 92 67 40 ee 0a ac 4d 16 30 13 19 ce 10 08 31 c2 81 f5 01 8c 86 50 3e 18 3e 65 10 f1 d7 58 7a ca f7 15 bf 0f 10 ec 41 b6 4b 82 39 68 3e 66 09 8f 69 03 4b 1e d1 94 0b 01 b1 61 13 9f 5d 0a 51 6e d5 3a 11 82 94 c0 ac a8 9b 60 25 2e e1 c4 dc 41 da 4b bc e1 05 a6 15 d2 2f Data Ascii: jTix2z\4,Ue3/v(2FUA6K9x.CUvFmy<]zv`Y1mgEB\|u~([@]2)=x5WrS"j\|ocCD{Ig@M01P>>eXzAK9h>fiKa]Qn:`%.AK/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49830	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	611	OUT	GET /rsrc.php/v3/yb/r/7NqDjYL3eb9.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	1609	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: cu5Xe8waainQQiw+sSSIYQ== Expires: Sun, 06 Apr 2025 08:43:48 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: eRF5WIKDC82zON9PNWOucnszCKOC4aZMUS8U7ycM5o0ztu4bxa6nWOuMEQuSLvwbypikR4RH66Z/u6dxJ5ZY2Q== Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1633
2024-04-19 01:40:44 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:44 UTC	1632	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 31 00 00 00 4a 08 03 00 00 00 25 a7 4c 2c 00 00 02 10 50 4c 54 45 00 00 00 00 00 00 eb eb eb f7 f7 f7 ff ff ff ff ff ff 00 00 00 47 70 4c 00 00 00 00 00 00 eb eb eb f2 f2 f2 00 00 00 00 00 00 05 05 05 1c 1c 1c a9 a9 a9 46 46 46 00 00 00 ff ff ff 6f 6f 6f ff ff ff 42 42 42 ff ff ff fd fd fd af af af ff ff ff ff ff ff 11 11 11 ff ff ff 98 98 98 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 4e 4e 4e ff ff ff 75 75 75 93 93 93 ba ba ba ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 90 90 90 ff ff ff f2 f2 f2 0d 0d 0d 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 39 39 39 0c 0c 0c ff ff ff d6 d6 d6 c0 c0 c0 04 04 04 e1 e1 e1 2c 2c 2c ff ff ff a4 a4 a4 ff ff ff 41 41 Data Ascii: PNGIHDR1J%L,PLTEGpLFFFoooBBBNNNuuu999,,,AA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49831	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	610	OUT	GET /rsrc.php/v3ivlb4/yn/l/en_US/5ZMgj96iLR9.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	1704	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: Dfm2qCrU8csOIVQGMg7+2Q== Expires: Sat, 12 Apr 2025 20:00:09 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: 1//MN7+Ig5G3LMD0ZodVanIkEo8RwEr5iiRhHqykFco54gzrI7hr0au28tGD6rwuLm5GRBASDb80Kl4wqBMXmA== Date: Fri, 19 Apr 2024 01:40:44 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 477626
2024-04-19 01:40:44 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:44 UTC	16102	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 42 61 74 63 68 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 53 74 61 74 65 43 68 61 6e 67 65 53 75 62 73 63 72 69 70 74 69 6f 6e 5f 66 61 63 65 62 6f 6f 6b 52 65 6c 61 79 4f 70 65 72 61 74 69 6f 6e 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 65 2e 65 78 70 6f 72 74 73 3d 22 36 35 34 36 35 39 36 32 32 32 30 36 31 36 30 37 22 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 43 6f 6d 65 74 42 61 74 63 68 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 53 74 61 74 65 43 68 61 6e 67 65 53 75 62 73 63 72 69 70 74 69 6f 6e 2e 67 72 61 70 68 71 6c 22 2c 5b 22 43 6f 6d 65 74 42 61 74 63 68 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 53 74 61 74 65 43 68 61 6e 67 65 Data Ascii: /FB_PKG_DELIM/__d("CometBatchNotificationsStateChangeSubscription_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6546596222061607"}),null);__d("CometBatchNotificationsStateChangeSubscription.graphql",["CometBatchNotificationsStateChange
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 72 6c 3a 65 7d 3a 76 6f 69 64 20 30 7d 2c 5b 65 2c 70 5d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 73 78 28 63 28 22 42 61 73 65 54 6f 61 73 74 2e 72 65 61 63 74 22 29 2c 7b 61 63 74 69 6f 6e 3a 62 21 3d 6e 75 6c 6c 3f 7b 6c 61 62 65 6c 3a 62 2e 6c 61 62 65 6c 2c 6c 61 62 65 6c 52 65 6e 64 65 72 65 72 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6b 2e 6a 73 78 28 63 28 22 54 65 74 72 61 54 65 78 74 2e 72 65 61 63 74 22 29 2c 7b 63 6f 6c 6f 72 3a 22 62 6c 75 65 4c 69 6e 6b 22 2c 6e 75 6d 62 65 72 4f 66 4c 69 6e 65 73 3a 31 2c 74 79 70 65 3a 22 62 6f 64 79 33 22 2c 63 68 69 6c 64 72 65 6e 3a 61 7d 29 7d 2c 6f 6e 50 72 65 73 73 3a 62 2e 6f 6e 50 72 65 73 73 2c 74 65 73 74 69 64 3a 62 2e 74 65 73 74 69 64 7d 3a 76 6f 69 64 20 30 2c 61 64 64 4f 6e 53 Data Ascii: rl:e}:void 0},[e,p]);return k.jsx(c("BaseToast.react"),{action:b!=null?{label:b.label,labelRenderer:function(a){return k.jsx(c("TetraText.react"),{color:"blueLink",numberOfLines:1,type:"body3",children:a})},onPress:b.onPress,testid:b.testid}:void 0,addOnS
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 6e 74 73 4c 6f 67 67 65 72 43 6f 6e 66 69 67 22 29 7d 29 2c 6e 75 6c 6c 29 3b 0a 5f 5f 64 28 22 48 61 73 74 65 52 65 73 70 6f 6e 73 65 46 61 6c 63 6f 45 76 65 6e 74 22 2c 5b 22 46 61 6c 63 6f 4c 6f 67 67 65 72 49 6e 74 65 72 6e 61 6c 22 2c 22 67 65 74 46 61 6c 63 6f 4c 6f 67 50 6f 6c 69 63 79 5f 44 4f 5f 4e 4f 54 5f 55 53 45 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 63 28 22 67 65 74 46 61 6c 63 6f 4c 6f 67 50 6f 6c 69 63 79 5f 44 4f 5f 4e 4f 54 5f 55 53 45 22 29 28 22 31 38 32 33 39 32 36 22 29 3b 62 3d 64 28 22 46 61 6c 63 6f 4c 6f 67 67 65 72 49 6e 74 65 72 6e 61 6c 22 29 2e 63 72 65 61 74 65 28 22 68 61 73 74 65 5f 72 65 73 70 6f 6e 73 65 22 2c 61 29 3b 65 3d 62 3b Data Ascii: ntsLoggerConfig")}),null);__d("HasteResponseFalcoEvent",["FalcoLoggerInternal","getFalcoLogPolicy_DO_NOT_USE"],(function(a,b,c,d,e,f,g){"use strict";a=c("getFalcoLogPolicy_DO_NOT_USE")("1823926");b=d("FalcoLoggerInternal").create("haste_response",a);e=b;
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 61 69 6c 65 64 2e 20 25 73 22 2c 61 2e 65 72 72 6f 72 43 6f 64 65 2c 61 2e 65 72 72 6f 72 54 79 70 65 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 78 28 61 29 7b 76 61 72 20 65 3d 6e 65 77 20 44 61 74 65 28 29 2e 76 61 6c 75 65 4f 66 28 29 2c 66 3d 5b 5d 2c 67 3d 5b 5d 2c 6a 3d 6e 65 77 28 69 7c 7c 28 69 3d 62 28 22 50 72 6f 6d 69 73 65 22 29 29 29 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 68 7c 7c 28 68 3d 64 28 22 4a 53 53 63 68 65 64 75 6c 65 72 22 29 29 29 2e 73 63 68 65 64 75 6c 65 4c 6f 67 67 69 6e 67 50 72 69 43 61 6c 6c 62 61 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 66 3d 66 2e 63 6f 6e 63 61 74 28 73 28 29 29 7d 63 61 74 63 68 28 61 29 7b 63 28 22 46 42 4c 6f 67 67 65 72 22 29 28 22 64 6f 6d 73 63 61 6e 6e 65 72 22 29 2e 63 61 74 63 68 69 Data Ascii: ailed. %s",a.errorCode,a.errorType)})}function x(a){var e=new Date().valueOf(),f=[],g=[],j=new(i\|\|(i=b("Promise")))(function(a){(h\|\|(h=d("JSScheduler"))).scheduleLoggingPriCallback(function(){try{f=f.concat(s())}catch(a){c("FBLogger")("domscanner").catchi
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 71 75 61 6c 56 61 6c 75 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 65 74 53 69 67 6e 61 6c 56 61 6c 75 65 28 29 2e 69 73 45 71 75 61 6c 28 61 2e 67 65 74 53 69 67 6e 61 6c 56 61 6c 75 65 28 29 29 7d 3b 63 2e 61 64 64 56 61 6c 75 65 4f 72 45 72 72 6f 72 54 6f 4a 53 4f 4e 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 5b 64 28 22 53 69 67 6e 61 6c 56 61 6c 75 65 54 79 70 65 44 65 66 22 29 2e 42 44 5f 56 41 4c 55 45 5d 3d 74 68 69 73 2e 67 65 74 53 69 67 6e 61 6c 56 61 6c 75 65 28 29 2e 74 6f 4a 53 4f 4e 28 29 7d 3b 72 65 74 75 72 6e 20 62 7d 28 64 28 22 53 69 67 6e 61 6c 56 61 6c 75 65 54 79 70 65 44 65 66 22 29 2e 53 69 67 6e 61 6c 56 61 6c 75 65 54 79 70 65 44 65 66 29 3b 67 5b 22 64 65 66 61 75 6c 74 22 5d 3d 61 7d 29 2c Data Ascii: qualValue=function(a){return this.getSignalValue().isEqual(a.getSignalValue())};c.addValueOrErrorToJSON=function(a){a[d("SignalValueTypeDef").BD_VALUE]=this.getSignalValue().toJSON()};return b}(d("SignalValueTypeDef").SignalValueTypeDef);g["default"]=a}),
2024-04-19 01:40:44 UTC	14884	IN	Data Raw: 6c 43 6f 6c 6c 65 63 74 69 6f 6e 20 61 6e 64 20 65 78 65 63 75 74 65 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 69 6f 6e 20 73 68 6f 75 6c 64 20 6e 6f 74 20 62 65 20 63 61 6c 6c 65 64 20 6f 6e 20 62 69 6f 6d 65 74 72 69 63 20 73 69 67 6e 61 6c 73 22 29 7d 3b 72 65 74 75 72 6e 20 62 7d 28 63 28 22 42 44 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 6f 72 42 61 73 65 22 29 29 3b 67 2e 42 49 4f 4d 45 54 52 49 43 5f 53 49 47 4e 41 4c 5f 43 4f 4c 4c 45 43 54 45 44 5f 45 56 45 4e 54 5f 4e 41 4d 45 3d 61 3b 67 2e 42 44 42 69 6f 6d 65 74 72 69 63 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 6f 72 42 61 73 65 3d 62 7d 29 2c 39 38 29 3b 0a 5f 5f 64 28 22 4b 65 79 44 6f 77 6e 55 70 4f 62 6a 65 63 74 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b Data Ascii: lCollection and executeSignalCollection should not be called on biometric signals")};return b}(c("BDSignalCollectorBase"));g.BIOMETRIC_SIGNAL_COLLECTED_EVENT_NAME=a;g.BDBiometricSignalCollectorBase=b}),98);__d("KeyDownUpObject",[],(function(a,b,c,d,e,f){
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 74 68 69 73 2c 6a 2e 73 69 67 6e 61 6c 54 79 70 65 29 7c 7c 74 68 69 73 7d 76 61 72 20 64 3d 61 2e 70 72 6f 74 6f 74 79 70 65 3b 64 2e 65 78 65 63 75 74 65 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 6e 65 77 28 63 28 22 4e 75 6d 62 65 72 53 69 67 6e 61 6c 56 61 6c 75 65 54 79 70 65 22 29 29 28 44 61 74 65 2e 6e 6f 77 28 29 2c 74 68 69 73 2e 67 65 74 43 6f 6e 74 65 78 74 28 29 2c 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 3f 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 2e 6c 65 6e 67 74 68 3a 30 29 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 4f 72 45 72 72 6f 72 3a 61 7d 7d 3b 72 65 74 75 72 6e 20 61 7d 28 63 28 22 42 44 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 6f 72 42 Data Ascii: eturn b.call(this,j.signalType)\|\|this}var d=a.prototype;d.executeSignalCollection=function(){var a=new(c("NumberSignalValueType"))(Date.now(),this.getContext(),window.history?window.history.length:0);return{valueOrError:a}};return a}(c("BDSignalCollectorB
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 42 44 42 69 6f 6d 65 74 72 69 63 53 69 67 6e 61 6c 43 6f 6c 6c 65 63 74 6f 72 42 61 73 65 22 29 2e 42 49 4f 4d 45 54 52 49 43 5f 53 49 47 4e 41 4c 5f 43 4f 4c 4c 45 43 54 45 44 5f 45 56 45 4e 54 5f 4e 41 4d 45 2c 74 68 69 73 2e 24 36 29 3b 74 68 69 73 2e 24 31 3d 21 30 7d 3b 65 2e 24 34 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 2e 67 65 74 42 75 66 66 65 72 43 6f 6e 66 69 67 28 29 3d 3d 6e 75 6c 6c 26 26 64 28 22 42 44 53 69 67 6e 61 6c 42 75 66 66 65 72 22 29 2e 69 6e 69 74 69 61 6c 69 7a 65 28 62 2e 73 69 67 6e 61 6c 54 79 70 65 2c 74 68 69 73 2e 67 65 74 43 69 72 63 75 6c 61 72 42 75 66 66 65 72 53 69 7a 65 28 62 29 2c 62 2e 73 69 67 6e 61 6c 46 6c 61 67 73 29 2c 61 2e 76 61 6c 75 65 4f 72 45 72 72 6f 72 26 26 21 74 68 69 73 2e 69 73 45 71 75 61 Data Ascii: BDBiometricSignalCollectorBase").BIOMETRIC_SIGNAL_COLLECTED_EVENT_NAME,this.$6);this.$1=!0};e.$4=function(a,b){b.getBufferConfig()==null&&d("BDSignalBuffer").initialize(b.signalType,this.getCircularBufferSize(b),b.signalFlags),a.valueOrError&&!this.isEqua
2024-04-19 01:40:44 UTC	14884	IN	Data Raw: 69 65 72 22 3b 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 7d 76 61 72 20 64 3d 61 2e 70 72 6f 74 6f 74 79 70 65 3b 64 2e 70 61 74 63 68 52 65 71 75 65 73 74 48 65 61 64 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 64 3d 7b 7d 2c 65 3d 63 28 22 52 54 49 53 75 62 73 63 72 69 70 74 69 6f 6e 4d 61 6e 61 67 65 72 43 6f 6e 66 69 67 22 29 2e 62 6c 61 64 65 72 75 6e 6e 65 72 5f 77 77 77 5f 73 61 6e 64 62 6f 78 2c 66 3d 63 28 22 52 54 49 53 75 62 73 63 72 69 70 74 69 6f 6e 4d 61 6e 61 67 65 72 43 6f 6e 66 69 67 22 29 2e 69 73 5f 69 6e 74 65 72 6e 3b 69 66 28 21 28 68 7c 7c 28 68 3d 63 28 22 69 73 45 6d 70 74 79 22 29 29 29 28 63 28 22 57 65 62 44 72 69 76 65 72 43 6f 6e 66 69 67 22 29 2e 61 75 78 69 6c 69 61 72 79 Data Ascii: ier";a=function(){function a(){}var d=a.prototype;d.patchRequestHeaders=function(a){var d={},e=c("RTISubscriptionManagerConfig").bladerunner_www_sandbox,f=c("RTISubscriptionManagerConfig").is_intern;if(!(h\|\|(h=c("isEmpty")))(c("WebDriverConfig").auxiliary

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49774	64.233.176.147	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	1206	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA
2024-04-19 01:40:44 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 18 Apr 2024 09:07:01 GMT Expires: Fri, 26 Apr 2024 09:07:01 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 59623 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:40:44 UTC	549	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 01:40:44 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;I
2024-04-19 01:40:44 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4S
2024-04-19 01:40:44 UTC	1255	IN	Data Raw: ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 01:40:44 UTC	1116	IN	Data Raw: 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49832	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:43 UTC	610	OUT	GET /rsrc.php/v3ieKI4/yX/l/en_US/aia9_5MaGl8.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	1761	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: sW3kfW47dxb0BpLIn2tXfg== Expires: Thu, 17 Apr 2025 20:33:55 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: 8n+UYKQEMSHUdyGRvL8xQuwQ1HS7WzDqdyVp0UvzCO+lUEIWEpYPbt2bmQRmgXoexB33NhjYAcCswcXP1KPZ+A== Date: Fri, 19 Apr 2024 01:40:44 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 18268
2024-04-19 01:40:44 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:44 UTC	16044	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 46 6f 63 75 73 47 72 6f 75 70 46 69 72 73 74 4c 65 74 74 65 72 4e 61 76 69 67 61 74 69 6f 6e 22 2c 5b 22 69 73 53 74 72 69 6e 67 4e 75 6c 6c 4f 72 45 6d 70 74 79 22 2c 22 72 65 61 63 74 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 68 3b 62 3d 68 7c 7c 64 28 22 72 65 61 63 74 22 29 3b 76 61 72 20 69 3d 62 2e 75 73 65 45 66 66 65 63 74 2c 6a 3d 62 2e 75 73 65 53 74 61 74 65 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 73 6c 69 63 65 28 30 2c 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 76 61 72 20 62 3d 6a 28 Data Ascii: /FB_PKG_DELIM/__d("CometFocusGroupFirstLetterNavigation",["isStringNullOrEmpty","react"],(function(a,b,c,d,e,f,g){"use strict";var h;b=h\|\|d("react");var i=b.useEffect,j=b.useState,k=function(a){return a.slice(0,1).toLowerCase()};function a(a){var b=j(
2024-04-19 01:40:44 UTC	2223	IN	Data Raw: 79 3a 22 70 72 69 6d 61 72 79 22 2c 73 65 63 6f 6e 64 61 72 79 3a 22 73 65 63 6f 6e 64 61 72 79 22 2c 74 65 72 74 69 61 72 79 3a 22 74 65 72 74 69 61 72 79 22 2c 77 68 69 74 65 3a 22 77 68 69 74 65 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 73 77 69 74 63 68 28 61 29 7b 63 61 73 65 22 61 63 74 69 76 65 2d 74 61 62 22 3a 72 65 74 75 72 6e 22 70 72 69 6d 61 72 79 41 63 63 65 6e 74 22 3b 63 61 73 65 22 69 6e 61 63 74 69 76 65 2d 74 61 62 22 3a 72 65 74 75 72 6e 22 73 65 63 6f 6e 64 61 72 79 22 3b 63 61 73 65 22 6e 6f 6e 65 22 3a 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3b 63 61 73 65 22 6d 64 73 2d 61 63 63 65 6e 74 22 3a 63 61 73 65 22 6d 64 73 2d 64 65 73 74 72 75 63 74 69 76 65 22 3a 63 61 73 65 22 6d 64 73 2d 69 6e 61 63 74 69 76 65 22 3a 63 61 73 Data Ascii: y:"primary",secondary:"secondary",tertiary:"tertiary",white:"white"};function a(a){switch(a){case"active-tab":return"primaryAccent";case"inactive-tab":return"secondary";case"none":return void 0;case"mds-accent":case"mds-destructive":case"mds-inactive":cas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49835	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	986	OUT	POST /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 5116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ
2024-04-19 01:40:44 UTC	5116	OUT	Data Raw: 72 6f 75 74 65 5f 75 72 6c 73 5b 30 5d 3d 25 32 46 31 30 30 30 38 33 36 38 33 34 33 34 33 32 34 25 32 46 76 69 64 65 6f 73 25 32 46 31 31 34 35 34 34 31 31 38 33 34 37 31 39 31 35 25 32 46 25 33 46 5f 5f 73 6f 5f 5f 25 33 44 64 69 73 63 6f 76 65 72 25 32 36 5f 5f 72 76 5f 5f 25 33 44 76 69 64 65 6f 5f 68 6f 6d 65 5f 77 77 77 5f 6c 6f 65 5f 70 6f 70 75 6c 61 72 5f 76 69 64 65 6f 73 25 32 36 5f 5f 63 66 74 5f 5f 5b 30 5d 25 33 44 41 5a 57 78 32 57 49 71 43 48 5a 6b 7a 57 76 37 69 33 5a 76 66 42 35 42 47 77 73 49 5f 4f 6c 6e 33 61 79 59 36 65 32 72 78 41 45 32 6f 50 4e 32 53 63 44 42 64 55 5a 39 51 6f 6a 71 6d 4f 38 49 33 4b 68 33 7a 72 34 76 70 4e 58 34 33 4a 36 32 52 5a 30 5a 6e 30 55 74 49 53 56 6c 30 7a 58 63 6b 42 65 73 71 76 53 57 44 51 30 35 63 50 71 Data Ascii: route_urls[0]=%2F100083683434324%2Fvideos%2F1145441183471915%2F%3F__so__%3Ddiscover%26__rv__%3Dvideo_home_www_loe_popular_videos%26__cft__[0]%3DAZWx2WIqCHZkzWv7i3ZvfB5BGwsI_Oln3ayY6e2rxAE2oPN2ScDBdUZ9QojqmO8I3Kh3zr4vpNX43J62RZ0Zn0UtISVl0zXckBesqvSWDQ05cPq
2024-04-19 01:40:44 UTC	942	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:44 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:44 UTC	1807	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:44 UTC	7	IN	Data Raw: 31 36 36 39 33 0d 0a Data Ascii: 16693
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 66 6f 72 20 28 3b 3b 29 3b 7b 22 70 61 79 6c 6f 61 64 22 3a 7b 22 70 61 79 6c 6f 61 64 73 22 3a 7b 22 2f 31 30 30 30 38 33 36 38 33 34 33 34 33 32 34 2f 76 69 64 65 6f 73 2f 31 31 34 35 34 34 31 31 38 33 34 37 31 39 31 35 2f 3f 5f 5f 73 6f 5f 5f 3d 64 69 73 63 6f 76 65 72 26 5f 5f 72 76 5f 5f 3d 76 69 64 65 6f 5f 68 6f 6d 65 5f 77 77 77 5f 6c 6f 65 5f 70 6f 70 75 6c 61 72 5f 76 69 64 65 6f 73 26 5f 5f 63 66 74 5f 5f 5b 30 5d 3d 41 5a 57 78 32 57 49 71 43 48 5a 6b 7a 57 76 37 69 33 5a 76 66 42 35 42 47 77 73 49 5f 4f 6c 6e 33 61 79 59 36 65 32 72 78 41 45 32 6f 50 4e 32 53 63 44 42 64 55 5a 39 51 6f 6a 71 6d 4f 38 49 33 4b 68 33 7a 72 34 76 70 4e 58 34 33 4a 36 32 52 5a 30 5a 6e 30 55 74 49 53 56 6c 30 7a 58 63 6b 42 65 73 71 76 53 57 44 51 30 35 63 50 71 Data Ascii: for (;;);{"payload":{"payloads":{"/100083683434324/videos/1145441183471915/?__so__=discover&__rv__=video_home_www_loe_popular_videos&__cft__[0]=AZWx2WIqCHZkzWv7i3ZvfB5BGwsI_Oln3ayY6e2rxAE2oPN2ScDBdUZ9QojqmO8I3Kh3zr4vpNX43J62RZ0Zn0UtISVl0zXckBesqvSWDQ05cPq
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 22 3a 7b 22 73 6f 75 72 63 65 22 3a 22 70 61 72 61 6d 22 2c 22 76 61 6c 75 65 22 3a 22 76 22 7d 7d 2c 22 68 6f 73 74 61 62 6c 65 56 69 65 77 22 3a 7b 22 61 6c 6c 52 65 73 6f 75 72 63 65 73 22 3a 5b 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 4c 4f 45 56 69 64 65 6f 50 65 72 6d 61 6c 69 6e 6b 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 4c 4f 45 56 69 64 65 6f 50 65 72 6d 61 6c 69 6e 6b 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 46 65 65 64 52 6f 6f 74 2e 72 65 61 63 74 22 Data Ascii: ":{"source":"param","value":"v"}},"hostableView":{"allResources":[{"__jsr":"CometVideoHomeLOEVideoPermalinkRoot.react"},{"__jsr":"CometVideoHomeLOEVideoPermalinkRoot.entrypoint"},{"__jsr":"CometVideoHomeRoot.react"},{"__jsr":"CometVideoHomeFeedRoot.react"
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 73 68 61 72 65 5f 75 72 6c 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 70 61 67 65 5f 74 6f 6b 65 6e 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 22 76 61 6e 69 74 79 22 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 74 72 75 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 73 74 6f 72 79 5f 74 6f 6b 65 6e 22 3a 7b 22 6c 65 67 Data Ascii: cibleType":"STRING"},"share_url":{"legacyNames":[],"default":null,"path":false,"significant":false,"coercibleType":"STRING"},"page_token":{"legacyNames":["vanity"],"default":null,"path":true,"significant":true,"coercibleType":"STRING"},"story_token":{"leg
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 6c 69 73 74 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 6c 69 73 74 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 2c 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 52 6f 6f 74 2e 72 65 61 63 74 22 7d 5d 2c 22 72 65 73 6f 75 72 63 65 22 3a 7b 22 5f 5f 6a 73 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 6c 69 73 74 52 6f 6f 74 2e 72 65 61 63 74 22 7d 2c 22 70 72 6f 70 73 22 3a 7b 22 69 64 22 3a 22 31 30 30 30 38 33 36 38 33 34 33 34 33 32 34 22 7d 2c 22 65 6e 74 72 79 50 6f 69 6e 74 22 3a 7b 22 5f 5f 64 72 22 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 Data Ascii: ":"CometVideoHomePlaylistRoot.react"},{"__jsr":"CometVideoHomePlaylistRoot.entrypoint"},{"__jsr":"CometVideoHomeRoot.react"}],"resource":{"__jsr":"CometVideoHomePlaylistRoot.react"},"props":{"id":"100083683434324"},"entryPoint":{"__dr":"CometVideoHomePlay
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 45 4e 55 4d 22 7d 2c 22 74 61 62 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 45 4e 55 4d 22 7d 2c 22 69 64 6f 72 76 61 6e 69 74 79 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 22 73 65 63 74 69 6f 6e 5f 69 64 22 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 74 72 75 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 Data Ascii: l,"path":false,"significant":true,"coercibleType":"ENUM"},"tab":{"legacyNames":[],"default":null,"path":false,"significant":true,"coercibleType":"ENUM"},"idorvanity":{"legacyNames":["section_id"],"default":null,"path":true,"significant":true,"coercibleTyp
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 48 6f 6d 65 4c 4f 45 56 69 64 65 6f 50 65 72 6d 61 6c 69 6e 6b 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 7d 2c 22 74 72 61 63 65 50 6f 6c 69 63 79 22 3a 22 63 6f 6d 65 74 2e 77 61 74 63 68 2e 69 6e 6a 65 63 74 69 6f 6e 22 2c 22 6d 65 74 61 22 3a 7b 22 74 69 74 6c 65 22 3a 22 45 6c 20 61 6d 70 6c 69 6f 20 23 73 65 67 75 69 64 6f 72 65 73 64 65 6d 6f 72 74 61 64 65 6c 6f 20 23 76 69 72 61 6c 72 65 65 6c 73 20 23 68 75 6d 6f 72 6c 61 74 69 6e 6f 20 23 68 75 6d 6f 72 20 23 41 6d 61 7a 6f 6e 20 23 64 65 73 74 61 63 61 72 20 23 66 6c 6f 72 65 6e 63 69 61 20 23 53 74 61 72 73 45 76 65 72 79 77 68 65 72 65 20 23 6d 75 6e 64 69 61 6c 20 23 76 69 72 61 6c 20 7c 20 4d 6f 72 74 61 64 65 6c 6f 20 48 75 6d 6f 72 20 7c 20 4d 6f 72 74 61 64 65 6c 6f 20 48 75 6d Data Ascii: HomeLOEVideoPermalinkRoot.entrypoint"}},"tracePolicy":"comet.watch.injection","meta":{"title":"El amplio #seguidoresdemortadelo #viralreels #humorlatino #humor #Amazon #destacar #florencia #StarsEverywhere #mundial #viral \| Mortadelo Humor \| Mortadelo Hum

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49834	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	986	OUT	POST /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1455 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ
2024-04-19 01:40:44 UTC	1455	OUT	Data Raw: 72 6f 75 74 65 5f 75 72 6c 73 5b 30 5d 3d 25 32 46 77 61 74 63 68 25 32 46 31 37 39 30 34 38 35 33 34 36 25 32 46 25 33 46 5f 5f 63 66 74 5f 5f 5b 30 5d 25 33 44 41 5a 55 6a 4f 56 42 75 55 6e 46 61 36 30 6e 4e 78 66 62 4b 51 6b 4e 37 56 48 35 77 30 4f 6c 66 4b 4f 44 30 47 35 41 38 35 77 38 5a 45 6b 63 6c 4c 70 50 4b 6f 45 6e 57 75 34 6f 4f 71 62 67 4a 57 51 31 50 6d 65 4f 57 70 5a 38 56 69 37 56 4a 68 6b 5a 6c 5a 42 50 4d 4f 4f 7a 50 50 54 62 76 32 6b 2d 76 63 2d 78 4b 30 2d 45 42 36 39 4a 46 70 58 64 58 75 5f 32 4e 2d 44 6c 47 53 34 6e 62 6c 50 4b 6f 5f 36 53 32 6d 7a 35 36 43 7a 6b 75 30 45 37 45 6e 31 47 59 67 30 33 5f 79 6f 61 6f 2d 52 41 68 35 4f 6c 58 6d 32 73 46 55 35 4f 78 4b 41 44 58 4f 61 6a 72 4e 48 69 61 35 73 41 78 73 58 63 26 72 6f 75 74 65 Data Ascii: route_urls[0]=%2Fwatch%2F1790485346%2F%3F__cft__[0]%3DAZUjOVBuUnFa60nNxfbKQkN7VH5w0OlfKOD0G5A85w8ZEkclLpPKoEnWu4oOqbgJWQ1PmeOWpZ8Vi7VJhkZlZBPMOOzPPTbv2k-vc-xK0-EB69JFpXdXu_2N-DlGS4nblPKo_6S2mz56Czku0E7En1GYg03_yoao-RAh5OlXm2sFU5OxKADXOajrNHia5sAxsXc&route
2024-04-19 01:40:44 UTC	942	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:44 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:44 UTC	1806	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:44 UTC	6	IN	Data Raw: 65 33 33 63 0d 0a Data Ascii: e33c
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 66 6f 72 20 28 3b 3b 29 3b 7b 22 70 61 79 6c 6f 61 64 22 3a 7b 22 70 61 79 6c 6f 61 64 73 22 3a 7b 22 2f 77 61 74 63 68 2f 31 37 39 30 34 38 35 33 34 36 2f 3f 5f 5f 63 66 74 5f 5f 5b 30 5d 3d 41 5a 55 6a 4f 56 42 75 55 6e 46 61 36 30 6e 4e 78 66 62 4b 51 6b 4e 37 56 48 35 77 30 4f 6c 66 4b 4f 44 30 47 35 41 38 35 77 38 5a 45 6b 63 6c 4c 70 50 4b 6f 45 6e 57 75 34 6f 4f 71 62 67 4a 57 51 31 50 6d 65 4f 57 70 5a 38 56 69 37 56 4a 68 6b 5a 6c 5a 42 50 4d 4f 4f 7a 50 50 54 62 76 32 6b 2d 76 63 2d 78 4b 30 2d 45 42 36 39 4a 46 70 58 64 58 75 5f 32 4e 2d 44 6c 47 53 34 6e 62 6c 50 4b 6f 5f 36 53 32 6d 7a 35 36 43 7a 6b 75 30 45 37 45 6e 31 47 59 67 30 33 5f 79 6f 61 6f 2d 52 41 68 35 4f 6c 58 6d 32 73 46 55 35 4f 78 4b 41 44 58 4f 61 6a 72 4e 48 69 61 35 73 41 Data Ascii: for (;;);{"payload":{"payloads":{"/watch/1790485346/?__cft__[0]=AZUjOVBuUnFa60nNxfbKQkN7VH5w0OlfKOD0G5A85w8ZEkclLpPKoEnWu4oOqbgJWQ1PmeOWpZ8Vi7VJhkZlZBPMOOzPPTbv2k-vc-xK0-EB69JFpXdXu_2N-DlGS4nblPKo_6S2mz56Czku0E7En1GYg03_yoao-RAh5OlXm2sFU5OxKADXOajrNHia5sA
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 30 32 35 35 44 3d 41 5a 55 6a 4f 56 42 75 55 6e 46 61 36 30 6e 4e 78 66 62 4b 51 6b 4e 37 56 48 35 77 30 4f 6c 66 4b 4f 44 30 47 35 41 38 35 77 38 5a 45 6b 63 6c 4c 70 50 4b 6f 45 6e 57 75 34 6f 4f 71 62 67 4a 57 51 31 50 6d 65 4f 57 70 5a 38 56 69 37 56 4a 68 6b 5a 6c 5a 42 50 4d 4f 4f 7a 50 50 54 62 76 32 6b 2d 76 63 2d 78 4b 30 2d 45 42 36 39 4a 46 70 58 64 58 75 5f 32 4e 2d 44 6c 47 53 34 6e 62 6c 50 4b 6f 5f 36 53 32 6d 7a 35 36 43 7a 6b 75 30 45 37 45 6e 31 47 59 67 30 33 5f 79 6f 61 6f 2d 52 41 68 35 4f 6c 58 6d 32 73 46 55 35 4f 78 4b 41 44 58 4f 61 6a 72 4e 48 69 61 35 73 41 78 73 58 63 22 7d 2c 22 72 6f 75 74 65 5f 6d 61 74 63 68 5f 69 6e 66 6f 73 22 3a 5b 7b 22 69 6e 73 74 61 6e 63 65 50 61 72 61 6d 73 22 3a 7b 22 72 65 66 22 3a 6e 75 6c 6c 2c Data Ascii: 0255D=AZUjOVBuUnFa60nNxfbKQkN7VH5w0OlfKOD0G5A85w8ZEkclLpPKoEnWu4oOqbgJWQ1PmeOWpZ8Vi7VJhkZlZBPMOOzPPTbv2k-vc-xK0-EB69JFpXdXu_2N-DlGS4nblPKo_6S2mz56Czku0E7En1GYg03_yoao-RAh5OlXm2sFU5OxKADXOajrNHia5sAxsXc"},"route_match_infos":[{"instanceParams":{"ref":null,
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 6c 6f 73 65 42 75 74 74 6f 6e 22 3a 74 72 75 65 2c 22 72 6f 75 74 65 54 79 70 65 22 3a 22 6d 65 64 69 61 5f 76 69 65 77 65 72 22 2c 22 75 70 73 65 6c 6c 43 6f 6e 66 69 67 22 3a 7b 22 73 75 72 66 61 63 65 22 3a 22 72 65 65 6c 73 22 2c 22 74 79 70 65 22 3a 22 6c 6f 67 69 6e 5f 75 70 73 65 6c 6c 22 2c 22 69 73 44 69 73 6d 69 73 73 69 62 6c 65 22 3a 74 72 75 65 2c 22 64 65 62 75 67 53 65 72 76 65 72 55 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 7d 2c 22 63 61 6e 6f 6e 69 63 61 6c 55 72 6c 22 3a 6e 75 6c 6c 7d 2c 22 72 6f 75 74 65 5f 6d 61 74 63 68 5f 69 6e 66 6f 73 22 3a 5b 7b 22 69 6e 73 74 61 6e 63 65 50 61 72 61 6d 73 22 3a Data Ascii: loseButton":true,"routeType":"media_viewer","upsellConfig":{"surface":"reels","type":"login_upsell","isDismissible":true,"debugServerUri":"https://www.facebook.com/ajax/bulk-route-definitions/"},"canonicalUrl":null},"route_match_infos":[{"instanceParams":
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 2c 22 70 72 6f 70 73 22 3a 7b 7d 2c 22 65 6e 74 72 79 50 6f 69 6e 74 22 3a 7b 22 5f 5f 64 72 22 3a 22 46 42 52 65 65 6c 73 52 6f 6f 74 2e 65 6e 74 72 79 70 6f 69 6e 74 22 7d 7d 2c 22 74 72 61 63 65 50 6f 6c 69 63 79 22 3a 22 63 6f 6d 65 74 2e 72 65 65 6c 73 2e 68 6f 6d 65 22 2c 22 6d 65 74 61 22 3a 7b 22 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 61 63 63 65 73 73 6f 72 79 22 3a 6e 75 6c 6c 2c 22 66 61 76 69 63 6f 6e 22 3a 6e 75 6c 6c 7d 2c 22 70 72 65 66 65 74 63 68 61 62 6c 65 22 3a 74 72 75 65 2c 22 65 6e 74 69 74 79 4b 65 79 43 6f 6e 66 69 67 22 3a 7b 22 65 6e 74 69 74 79 5f 74 79 70 65 22 3a 7b 22 73 6f 75 72 63 65 22 3a 22 63 6f 6e 73 74 61 6e 74 22 2c 22 76 61 6c 75 65 22 3a 22 72 65 65 6c 22 7d 2c 22 65 6e 74 69 74 79 5f 69 64 22 3a 7b 22 73 6f 75 72 Data Ascii: ,"props":{},"entryPoint":{"__dr":"FBReelsRoot.entrypoint"}},"tracePolicy":"comet.reels.home","meta":{"title":null,"accessory":null,"favicon":null},"prefetchable":true,"entityKeyConfig":{"entity_type":{"source":"constant","value":"reel"},"entity_id":{"sour
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 49 4e 47 22 7d 2c 22 6d 69 62 65 78 74 69 64 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 73 68 61 72 65 5f 75 72 6c 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 7d 2c 22 72 6f 75 74 65 50 61 74 68 22 3a 22 2f 72 65 65 6c 2f 7b 3f 76 69 64 65 6f 5f 69 64 7d 2f 22 7d 5d 7d 7d 2c 22 2f 72 65 65 Data Ascii: ING"},"mibextid":{"legacyNames":[],"default":null,"path":false,"significant":true,"coercibleType":"STRING"},"share_url":{"legacyNames":[],"default":null,"path":false,"significant":false,"coercibleType":"STRING"}},"routePath":"/reel/{?video_id}/"}]}},"/ree
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 67 72 6f 75 70 5f 69 64 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 63 61 6e 74 22 3a 74 72 75 65 2c 22 63 6f 65 72 63 69 62 6c 65 54 79 70 65 22 3a 22 53 54 52 49 4e 47 22 7d 2c 22 73 74 61 63 6b 5f 69 64 78 22 3a 7b 22 6c 65 67 61 63 79 4e 61 6d 65 73 22 3a 5b 5d 2c 22 64 65 66 61 75 6c 74 22 3a 6e 75 6c 6c 2c 22 70 61 74 68 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 69 66 69 Data Ascii: gacyNames":[],"default":null,"path":false,"significant":true,"coercibleType":"STRING"},"group_id":{"legacyNames":[],"default":null,"path":false,"significant":true,"coercibleType":"STRING"},"stack_idx":{"legacyNames":[],"default":null,"path":false,"signifi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49838	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	1273	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 681 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA
2024-04-19 01:40:44 UTC	681	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 31 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 34 30 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,1,0,0,0]]],558,[["1713490840000",null,null,nu
2024-04-19 01:40:44 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=RLSrVSuzpSQu_kB4Jm6PEd-ODYkxT8nw4bej9iQsFB-NyyIGYMaKFdqLrUR6bIePNZZPLMz08FVKbL1epUcC0ptQcNbqGmUbG1xmA_NuvrJ6VHv8Mm9BFtMC6JkYEx1-hbl5mwilZY7M4NBVyd7nsIacZAu4h-mzPulrrfEi1jg; expires=Sat, 19-Oct-2024 01:40:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:40:44 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 19 Apr 2024 01:40:44 GMT Connection: close Transfer-Encoding: chunked
2024-04-19 01:40:44 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:40:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49839	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	1273	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 931 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA
2024-04-19 01:40:44 UTC	931	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 31 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 34 30 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,1,0,0,0]]],558,[["1713490840000",null,null,null,
2024-04-19 01:40:44 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI; expires=Sat, 19-Oct-2024 01:40:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:40:44 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 19 Apr 2024 01:40:44 GMT Connection: close Transfer-Encoding: chunked
2024-04-19 01:40:44 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:40:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49840	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	590	OUT	GET /v/t15.5256-10/436859318_962909741584758_3870588264605380752_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=s7KXFq-dOKwAb6FUqMa&_nc_ht=scontent-atl3-2.xx&oh=00_AfB-GpW_tvCHQBURGYoJaXuwYk2uRI3TGoOELVJq2jzi8A&oe=6627A99F HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Fri, 12 Apr 2024 13:13:46 GMT X-Needle-Checksum: 2594005369 thrift_fmhk: GBCZReYEnjz0ukfDYH9tYMuaFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2753918392 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 31621
2024-04-19 01:40:44 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:44 UTC	15113	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 33 66 31 38 30 30 30 30 66 61 32 39 30 30 30 30 64 38 32 63 30 30 30 30 34 37 33 30 30 30 30 30 61 61 33 34 30 30 30 30 62 37 34 38 30 30 30 30 35 61 34 66 30 30 30 30 39 36 35 33 30 30 30 30 38 33 35 38 30 30 30 30 38 35 37 62 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f0100003f180000fa290000d82c000047300000aa340000b74800005a4f00009653000083580000857b0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 83 d0 a9 5c f3 e6 98 84 94 fd 0a 1b 6d 95 26 ce 7a 1f fc 0b 30 2d 0d 6b e5 0f 91 36 3d c7 c0 ef 3a 34 cf 06 4c 64 35 b3 c1 6f 47 a4 6c bf 6f bc dc 66 88 2c 9a 06 ae ac 2b 63 44 27 07 d8 84 f3 0d 5a 5b 10 1e b8 72 52 30 8e 21 9e 41 f4 55 c4 ba 38 48 ec 6e da 21 85 78 38 23 f8 66 9d e2 ea 3e 75 54 f4 7f eb 3c 2b 69 f6 12 48 b1 fa a8 6a 36 98 b0 44 3b bf 9e 08 42 ae 36 39 28 1a 57 0a 36 cb b3 88 95 cb c2 35 61 3f 03 f0 15 dc 4f 99 89 cb a4 cd 94 6a cb 2c 0b 5d 45 95 70 3a 37 39 90 c4 e3 1e 13 63 d5 42 77 e4 4b e8 87 d2 6a 90 f9 c4 09 1e 40 ca 98 a6 21 70 58 3b a3 9e b8 42 65 48 bb fa 61 ed 13 3f d8 84 4c 42 94 9e 3b a9 46 e1 8f 97 08 af 39 0d 11 b1 f7 6a 95 7a 1b be 45 6e 08 06 17 a8 61 c9 36 36 e8 90 9e 8a b3 7a ba 02 72 7d 05 f0 e0 7a e9 51 c4 6b c2 12 92 Data Ascii: \m&z0-k6=:4Ld5oGlof,+cD'Z[rR0!AU8Hn!x8#f>uT<+iHj6D;B69(W65a?Oj,]Ep:79cBwKj@!pX;BeHa?LB;F9jzEna66zr}zQk
2024-04-19 01:40:44 UTC	123	IN	Data Raw: 48 79 01 73 e0 10 83 85 70 6f e1 34 7c ea 95 2a 57 15 2b e6 0f 05 27 e6 57 93 f1 2b 2b 0c a1 f4 87 00 cf 91 38 42 08 1e 3d fc 26 8f e1 2a 54 a9 5c 2a 57 8f d8 f8 a6 16 96 96 96 84 92 49 e3 44 1c 04 1a 86 58 6a 77 cf 52 9f 52 9f 52 a5 78 1a 25 43 e1 af 92 a5 4a 95 28 95 2a 54 a9 52 a5 72 54 a9 52 a5 4a 80 b8 04 10 20 82 1d 40 83 30 21 0e 1d 4e f9 eb e0 34 70 73 ff d9 Data Ascii: Hyspo4\|W+'W++8B=&T\WIDXjwRRRx%CJ(TRrTRJ @0!N4ps

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49842	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	591	OUT	GET /v/t15.5256-10/435585243_1336893433647196_6208832241633396260_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=elYzPYAIG9kAb6SZKEF&_nc_ht=scontent-atl3-2.xx&oh=00_AfCvf0SUTHuy36cSdF56yN534pHFsf_uSWdDHk8TaBveJA&oe=6627852B HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 17 Apr 2024 19:23:37 GMT X-Needle-Checksum: 653023462 thrift_fmhk: GBDemtRQ+JPFe8igL1mkJabVFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=287571640 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 49949
2024-04-19 01:40:44 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:44 UTC	15146	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 61 35 31 39 30 30 30 30 36 36 33 35 30 30 30 30 32 65 33 37 30 30 30 30 33 31 33 39 30 30 30 30 34 61 34 32 30 30 30 30 36 35 36 61 30 30 30 30 39 65 37 30 30 30 30 30 66 62 37 33 30 30 30 30 66 62 37 37 30 30 30 30 31 64 63 33 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000a5190000663500002e370000313900004a420000656a00009e700000fb730000fb7700001dc30000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 17 52 eb a1 48 bc 6a a3 f9 c5 14 be 3b 14 69 eb 54 bf 38 54 59 45 d8 95 05 4d 72 8a 20 b3 44 2e 5c b9 72 e5 e5 42 e5 6a 50 a1 55 2e 3e 87 69 f3 a9 dc 4b 17 29 15 a7 14 93 04 38 17 02 2c 94 41 44 93 61 a6 45 27 b9 b3 e6 37 a2 be a5 e3 48 50 e3 da aa 95 df 4f c9 cf 51 95 45 44 51 a2 11 30 26 35 13 02 89 a1 6e 65 1f 4a c3 cd c7 85 15 4a 43 0a 42 98 98 85 17 2e 93 59 25 0e 5d 04 5e b5 4c 3c ee 38 c9 34 9d 52 56 2c 5b 05 66 b5 10 4e 23 9b 41 1d 7c eb 37 a3 b1 62 da 5e 65 39 97 40 9b 54 fb ea f7 e2 e5 c8 49 ae 27 1b 4e b0 c5 63 a9 d4 ba 97 88 e6 53 9d 4e 75 39 ce 73 9c e7 43 9e 13 9a 13 a1 d0 e8 74 3a 16 42 c8 74 3f 4f e4 fd 3f 93 a1 64 fc 89 bc 89 41 21 85 19 0b 1c a7 22 9c 8a 36 ce 21 f6 51 7e 0e 48 84 a6 ce 2f c1 f4 e2 fc 0f 0a 8b fd 87 55 85 08 95 12 e7 0a Data Ascii: RHj;iT8TYEMr D.\rBjPU.>iK)8,ADaE'7HPOQEDQ0&5neJJCB.Y%]^L<84RV,[fN#A\|7b^e9@TI'NcSNu9sCt:Bt?O?dA!"6!Q~H/U
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 13 0c ff 00 c1 15 22 74 79 d7 8b f0 a0 c3 29 89 35 78 28 9c 84 18 7d cb af 85 53 2a 65 ce 6a b3 fe cf 17 15 49 fe 67 f7 e1 71 73 14 40 b5 9d 24 bd a7 e6 3b 92 15 ec 83 7b 81 81 db fe c2 81 e9 05 7c 04 dc 08 91 3c d4 4c ca f5 e4 18 9a 54 c4 67 c7 66 09 ca 98 89 f1 07 1e 47 83 c8 7f 11 ba 58 2f d4 0a bb 49 fb 99 19 bc c0 8f 3f c0 83 14 78 cd 7f 82 5c b5 ad c7 98 a0 2d 0f 91 87 fb 84 49 60 b1 97 14 bf f1 3b 97 2e 2c 58 c6 35 53 9d 2a 01 64 cc 05 04 e5 49 b9 0a 83 23 dc b0 20 e0 f4 4e 21 e1 8e 88 97 d6 27 f0 a9 a4 48 87 ba a8 0e 7d 11 c1 98 86 72 a3 47 f7 a3 fa a1 12 d0 20 e8 5b 9f f9 10 77 81 a5 a1 88 8d 25 43 c8 7f 12 58 8f 31 d3 2a cf ee 6a 47 98 8a 8a a2 bf 0b 08 78 6b 63 c1 1c 20 9a 21 b5 07 3e 2b 59 7b 5f 24 58 a4 ad 7b 7f dc b9 71 62 cc 1c c4 81 50 c2 Data Ascii: "ty)5x(}SejIgqs@$;{\|<LTgfGX/I?x\-I`;.,X5SdI# N!'H}rG [w%CX1*jGxkc !>+Y{_$X{qbP
2024-04-19 01:40:44 UTC	2034	IN	Data Raw: 7c 58 6e 6c 94 4b 04 c4 dc 1f 0c 17 32 d6 58 22 2a d7 b0 a8 a2 e8 44 f1 45 61 2d 3a 93 20 e0 81 51 cf a8 ea c4 82 ac 45 b6 2e 7c 60 54 53 65 85 c6 66 66 a5 23 2f a9 ae 28 f7 05 3e d2 65 0c 0f 51 0e 5c c6 cc b8 86 7d ca 33 a2 21 cc e7 8c 4d bf ca 05 14 3c 98 35 58 11 cb 98 c3 eb 0e d1 b9 51 97 2c 4b 2c ab 25 1a 83 a9 66 3e 92 db 8a 8e 18 8b 3a 88 a4 a1 8b ca 69 00 17 2f 60 67 b3 2c d5 c4 e1 fb 4e 03 f9 4d 3a 80 b2 59 37 57 d4 1b c8 4e a2 cd 20 fc c1 b2 40 e9 87 74 a7 70 7c 30 d4 2a 02 cc 62 ab 63 9c 28 53 93 dc be f4 09 84 46 5c 1a 96 89 ac b3 6c 15 08 ac 48 a4 68 41 6b 51 03 58 91 39 2b 50 bb f0 6d 38 8e 63 b0 54 36 d5 b1 a1 58 c4 5b 6e 5d 66 07 99 77 e3 ea 19 e2 05 73 17 d4 bc 47 7e 09 8a aa 38 94 11 6e 03 c2 fc b3 dd 05 79 65 03 31 02 84 ac 5e a5 93 50 Data Ascii: \|XnlK2X"DEa-: QE.\|`TSeff#/(>eQ\}3!M<5XQ,K,%f>:i/`g,NM:Y7WN @tp\|0bc(SF\lHhAkQX9+Pm8cT6X[n]fwsG~8nye1^P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49843	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	590	OUT	GET /v/t15.5256-10/435297039_1622642408563885_856096703543016407_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=GWAVaQ02VJ8Ab6-Thma&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGNYDZ7rzrA5aOKLdOlSZvN9nxTDaGyE2PI0T-WhTcwA&oe=6627AC74 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 15:39:54 GMT X-Needle-Checksum: 1116073295 thrift_fmhk: GBB6+OknO22ht9eU8TqxLs7EFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1061052477 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 78051
2024-04-19 01:40:44 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 34 30 31 64 30 30 30 30 61 61 34 39 30 30 30 30 36 31 34 63 30 30 30 30 35 62 35 30 30 30 30 30 32 37 37 64 30 30 30 30 62 34 62 62 30 30 30 30 66 33 63 31 30 30 30 30 37 35 63 36 30 30 30 30 36 34 63 63 30 30 30 30 65 33 33 30 30 31 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000401d0000aa490000614c00005b500000277d0000b4bb0000f3c1000075c6000064cc0000e3300100C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16332	IN	Data Raw: 2e 6f 7f 3d 73 9a d8 de 6f ab 56 5f 31 af 6e a4 d8 00 2a 29 d8 6d e1 f4 92 c7 57 66 2c 5e 3c 47 58 a0 69 d0 6e e0 ef e6 a4 72 63 62 ec af 17 6a ba a6 61 6a 49 1d 2d 77 4b cb c3 d7 d5 8e 5e 2d aa 91 8d 36 8d 4c c7 47 2b 39 da b6 59 0e 73 a8 57 77 09 33 9a de 69 df 02 cb 69 21 75 b2 90 bc 57 c6 fa 51 ae 47 21 1d 3d f5 0b 27 af 2a d5 45 91 d6 43 6a 38 ed bd 63 15 ba 6e f3 fa 99 1d d3 d2 6f 2f ef c7 4b 97 9b ab d2 3f 63 3d f6 63 d3 d3 cc e1 d4 14 05 45 3a 9e 9f 91 eb 17 41 8e 6e 2f 18 a8 a8 a0 ea de de e7 7a 29 4c dd 2e 7a 20 8b 1d dd 31 72 08 20 d6 74 ef e2 4c 6d 4f cd bf 3a e9 9d ce d9 cd db 86 95 bc 6b 36 97 47 14 98 0f db ad ca 67 c5 6b 3f 9c 96 5a 77 b1 1f 24 4f e6 78 c3 36 77 c0 d2 cb e0 59 65 74 0e 2c 35 95 cb 49 cf e6 76 cf 54 ce 59 37 3a 89 f8 db 91 Data Ascii: .o=soV_1n)mWf,^<GXinrcbjajI-wK^-6LG+9YsWw3ii!uWQG!='ECj8cno/K?c=cE:An/z)L.z 1r tLmO:k6Ggk?Zw$Ox6wYet,5IvTY7:
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 83 dd 2c 34 1d a5 a1 6a 7c 6e 63 ac 9a df 76 2b 15 88 45 a2 d1 86 f1 d9 8b d8 ae d5 21 6d b2 0b 20 b2 59 2b fd db 95 72 ab 0f 6f d9 b9 5e e5 ee 56 71 11 e5 8f 75 62 ac 54 81 62 b1 58 ac 42 00 72 7b 57 b5 7b 55 da a3 73 78 f2 0b 20 b2 4f 2b 25 75 dd 77 50 f7 a8 6d 4c 31 aa d3 23 da fa 86 f1 cd 8e 50 48 21 6e 6a 69 8b 1b 52 5b 22 a3 2d 89 b1 54 c7 22 a6 7c ad 92 aa 48 65 58 a6 b7 df 80 58 b5 59 a8 e3 66 3a 3e 3e 48 d7 2c 4b 9e 24 f9 e3 5e a6 25 ea e3 5e ae 35 eb 23 5e ad b9 fa d6 af 5a 14 d3 f2 ac 97 b9 59 ea e6 d9 21 93 95 ca 8d af 91 d1 c5 24 8d f7 2e eb dc bd ca 3b ab 2b 2c 54 8d f6 06 8b 62 16 2d 56 62 bb 04 99 c6 b9 22 5c d1 2f 51 12 65 4c 60 7a a8 97 ab 89 7a b8 93 ea e3 23 d6 b1 7a d6 af 58 bd 62 a5 a8 ca a6 56 89 63 0f c9 54 ca dc aa 25 77 aa 96 21 Data Ascii: ,4j\|ncv+E!m Y+ro^VqubTbXBr{W{Usx O+%uwPmL1#PH!njiR["-T"\|HeXXYf:>>H,K$^%^5#^ZY!$.;+,Tb-Vb"\/QeL`zz#zXbVcT%w!
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 0f 59 bb 0f 1a 72 5b e1 ee 8d 1e 71 6c ba b9 7c 56 3e 86 ac fb ca 60 52 e3 ca 35 45 93 70 fe 83 e2 5b f6 04 c6 54 8d e0 58 40 d6 2d 82 58 a6 ea 7a 84 3c 0b ec 85 df 6a 05 d1 47 76 19 55 b1 f7 21 9c 31 35 ca 5f 02 69 c2 1b 70 44 bb 94 a1 c8 d3 31 81 fa 9e c2 8b 9f b9 14 be c3 17 84 83 a4 37 78 11 b3 61 db 60 62 6b f5 0c 98 cd 5a 1f 60 4c 09 47 50 93 d9 41 55 8d 51 71 60 48 e5 3f 67 22 ab c0 d5 26 ca 32 df bc 09 aa bc 0f ec dd 2b 1b 5e d3 a2 0c 93 e9 84 fe 0b a3 8b c8 aa 76 db 17 dc 53 f1 fd ae aa 4d 0d 56 7a cf 5d 21 3f 68 75 7d 81 a2 ce c9 fd 7c 08 ef dd b3 82 73 1b 56 1b 3d 88 96 d3 af 0f 42 1d a4 e8 f9 c3 19 49 27 f2 37 7e ae 66 8a 6d 9e ce 42 21 13 90 49 22 bc 84 7f 20 4a 54 3f 62 c6 f6 26 5a 62 6e 46 af ee 21 77 0e 11 12 96 b6 37 19 67 6c a7 74 64 46 Data Ascii: Yr[ql\|V>`R5Ep[TX@-Xz<jGvU!15_ipD17xa`bkZ`LGPAUQq`H?g"&2+^vSMVz]!?hu}\|sV=BI'7~fmB!I" JT?b&ZbnF!w7gltdF
2024-04-19 01:40:44 UTC	14935	IN	Data Raw: 48 9f d9 2e ee 7b ff 00 83 a1 15 ed 0e 8b 97 7a 6b f1 9d a7 a8 97 fe 1d 86 7f b0 c1 f8 89 3e 90 90 65 ec 55 86 45 89 44 8e eb 44 82 29 48 c8 42 10 84 12 e1 04 75 63 2a 91 d2 b4 28 eb ec f7 68 30 ad 46 75 a0 ee b5 2b 3b 3b 23 21 0e c8 c8 f1 08 4f 0a 44 26 c2 64 21 08 4c 84 21 08 42 10 84 21 08 51 5c c0 98 9c 04 c4 27 00 91 08 42 10 9f d4 a9 4a 52 94 a5 e5 4a 52 ff 00 47 5e 28 42 10 84 21 08 42 10 84 21 08 42 10 84 21 3f c6 df 3b d6 5f 2c 1a e6 dc d2 94 a5 29 4a 52 94 b9 d9 d9 de 52 94 a5 29 4f ff c4 00 24 11 00 03 00 02 03 01 00 02 01 05 00 00 00 00 00 00 00 01 11 10 21 20 31 41 51 30 61 40 50 71 81 91 b1 ff da 00 08 01 02 01 01 3f 10 fe 1c b8 42 10 84 21 08 42 10 45 21 04 88 41 22 10 48 84 21 08 42 10 86 8d 0e 15 0e 79 c5 08 34 52 2b 97 09 8a 88 0a c5 b1 Data Ascii: H.{zk>eUEDD)HBuc*(h0Fu+;;#!OD&d!L!B!Q\'BJRJRG^(B!B!B!?;_,)JRR)O$! 1AQ0a@Pq?B!BE!A"H!By4R+
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: 80 dd ce fc da bf da 5d 5a ad d2 7f 89 9a 8f 8b bf f5 45 2d 47 37 6a 87 ac 08 5f 26 22 a8 ce 1b 2d e0 ea 24 28 b1 b5 ab fa 97 68 76 94 ee 51 6b 41 4b ba f1 e6 25 92 c0 e4 10 fe 53 35 78 31 a0 b7 bc 46 55 5f 23 d7 7e a1 f0 57 90 07 d4 cc a8 57 82 9f de 3a 10 33 c9 30 44 dc a2 50 e7 24 b0 b7 3f 55 31 77 f5 00 a3 4b 5b 8c 69 95 3b dc 32 a0 a5 2d 88 c6 66 9f b7 6d f8 7e f1 69 28 8e 55 8e 5a 48 9c ac b2 16 98 80 ea b4 4b be 8f b8 45 98 74 4a 86 e5 cb 8f c1 73 11 59 8d 4a f8 b8 df d3 82 00 cc e4 fb 97 ab 2d 28 d1 cc 0a fa 3b 5e 5e df c4 23 7f d9 0d 0a 8c 0e aa 05 b8 78 7a 81 41 63 83 c7 fb 4b a4 b5 df 57 b7 e8 84 c2 81 29 8d fd a1 fa 88 aa ba 17 97 96 5c ad 56 8e a6 ed ab 65 ee 03 01 3b 71 00 80 d3 58 96 1b e8 19 42 9f 92 43 47 04 6f 5b 87 40 ef 89 42 82 f8 6f Data Ascii: ]ZE-G7j_&"-$(hvQkAK%S5x1FU_#~WW:30DP$?U1wK[i;2-fm~i(UZHKEtJsYJ-(;^^#xzAcKW)\Ve;qXBCGo[@Bo
2024-04-19 01:40:44 UTC	11015	IN	Data Raw: b6 45 20 0b 8f da 2a 80 48 96 d2 ce 05 9b 1b 09 74 b2 68 0e 1f 2c 54 42 d4 51 b5 39 8d cd 2e 11 dc 9b 09 b1 d9 be e5 c0 8b db 80 83 52 ce 5a 15 ee 61 15 8d 63 f3 5b 54 40 0c a3 65 23 ee 5d 01 47 0b 3f 0c 29 2e f7 9a 01 a0 7b 10 66 80 f2 b5 03 e7 16 8c 1f 56 c4 7f 2c 8f e8 a9 58 c5 4a 6b f7 61 06 8a af 0b 97 f8 83 15 ab 22 1a f3 16 c6 8e ad fc cc e8 79 a3 ff 00 48 b4 d4 01 25 df 86 62 35 c4 b5 f0 2d f1 c4 7d 11 87 35 ab e2 5f c3 98 fb 62 10 5a 0b 4e 3d 4a a3 6d f9 bc 45 a5 54 da fb 94 6e dd a7 f1 2e 38 a9 da 8e 49 cd cd ab 72 b2 5b d9 18 d5 31 b8 73 18 bb 15 8e 5e e2 44 77 cb 10 e4 2a aa c4 6a b1 94 76 40 96 85 e9 3b 60 82 a2 78 40 83 08 0a 73 a9 57 72 1e 31 73 62 06 04 5a f0 db 33 7a 0b 37 ed 35 8e b9 ee 07 c1 af b5 a4 20 b7 99 ca 62 02 82 e9 8d c4 28 07 Data Ascii: E Hth,TBQ9.RZac[T@e#]G?).{fV,XJka"yH%b5-}5_bZN=JmETn.8Ir[1s^Dwjv@;`x@sWr1sbZ3z75 b(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49846	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	599	OUT	GET /rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	1677	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: ogpXKXKWIQrlXCYwZDb85Q== Expires: Sun, 06 Apr 2025 08:14:47 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: RCr6nWAcUfdoCEq4yK7UOfGakpYaGUQOg+Y8nKRNxsJIbf94jKCETCzbLyDLh5BgPH39FtPYfwQ9GH1g8vs4BA== Date: Fri, 19 Apr 2024 01:40:44 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 43237
2024-04-19 01:40:44 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:44 UTC	16139	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 2f 2a 2a 0a 20 2a 20 4c 69 63 65 6e 73 65 3a 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 6c 65 67 61 6c 2f 6c 69 63 65 6e 73 65 2f 74 33 68 4f 4c 73 38 77 6c 58 79 2f 0a 20 2a 2f 0a 5f 5f 64 28 22 62 69 67 6e 75 6d 62 65 72 2d 6a 73 2d 39 2e 30 2e 31 22 2c 5b 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 62 3d 7b 7d 3b 76 61 72 20 67 3d 7b 65 78 70 6f 72 74 73 3a 62 7d 2c 68 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 3d 2f 5e 2d 3f 28 3f 3a 5c 64 2b 28 3f 3a 5c 2e 5c 64 2a 29 3f 7c 5c 2e 5c 64 2b 29 28 3f 3a 65 5b 2b 2d 5d 3f 5c 64 2b 29 3f 24 Data Ascii: /FB_PKG_DELIM//** * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/ /__d("bignumber-js-9.0.1",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b},h;function i(){(function(a){var b,c=/^-?(?:\d+(?:\.\d)?\|\.\d+)(?:e[+-]?\d+)?$
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 3a 6a 2c 6c 3d 6b 2e 6c 65 6e 67 74 68 3b 68 26 26 28 65 3d 67 2c 67 3d 68 2c 68 3d 65 2c 6c 2d 3d 65 29 3b 69 66 28 67 3e 30 26 26 6c 3e 30 29 7b 65 3d 6c 25 67 7c 7c 67 3b 6a 3d 6b 2e 73 75 62 73 74 72 28 30 2c 65 29 3b 66 6f 72 28 3b 65 3c 6c 3b 65 2b 3d 67 29 6a 2b 3d 69 2b 6b 2e 73 75 62 73 74 72 28 65 2c 67 29 3b 68 3e 30 26 26 28 6a 2b 3d 69 2b 6b 2e 73 6c 69 63 65 28 65 29 29 3b 64 26 26 28 6a 3d 22 2d 22 2b 6a 29 7d 62 3d 63 3f 6a 2b 28 61 2e 64 65 63 69 6d 61 6c 53 65 70 61 72 61 74 6f 72 7c 7c 22 22 29 2b 28 28 68 3d 2b 61 2e 66 72 61 63 74 69 6f 6e 47 72 6f 75 70 53 69 7a 65 29 3f 63 2e 72 65 70 6c 61 63 65 28 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 64 7b 22 2b 68 2b 22 7d 5c 5c 42 22 2c 22 67 22 29 2c 22 24 26 22 2b 28 61 2e 66 72 61 63 74 Data Ascii: :j,l=k.length;h&&(e=g,g=h,h=e,l-=e);if(g>0&&l>0){e=l%g\|\|g;j=k.substr(0,e);for(;e<l;e+=g)j+=i+k.substr(e,g);h>0&&(j+=i+k.slice(e));d&&(j="-"+j)}b=c?j+(a.decimalSeparator\|\|"")+((h=+a.fractionGroupSize)?c.replace(new RegExp("\\d{"+h+"}\\B","g"),"$&"+(a.fract
2024-04-19 01:40:44 UTC	10713	IN	Data Raw: 31 31 31 2c 32 32 37 33 31 33 34 38 34 32 2c 33 32 38 31 39 31 31 30 37 39 2c 34 30 38 30 39 36 32 38 34 36 2c 31 37 32 34 35 30 36 32 35 2c 32 35 36 39 39 39 34 31 30 30 2c 39 38 30 33 38 31 33 35 35 2c 34 31 30 39 39 35 38 34 35 35 2c 32 38 31 39 38 30 38 33 35 32 2c 32 37 31 36 35 38 39 35 36 30 2c 32 35 36 38 37 34 31 31 39 36 2c 33 36 38 31 34 34 36 36 36 39 2c 33 33 32 39 39 37 31 34 37 32 2c 31 38 33 35 34 37 38 30 37 31 2c 36 36 30 39 38 34 38 39 31 2c 33 37 30 34 36 37 38 34 30 34 2c 34 30 34 35 39 39 39 35 35 39 2c 33 34 32 32 36 31 37 35 30 37 2c 33 30 34 30 34 31 35 36 33 34 2c 31 37 36 32 36 35 31 34 30 33 2c 31 37 31 39 33 37 37 39 31 35 2c 33 34 37 30 34 39 31 30 33 36 2c 32 36 39 33 39 31 30 32 38 33 2c 33 36 34 32 30 35 36 33 35 35 2c 33 Data Ascii: 111,2273134842,3281911079,4080962846,172450625,2569994100,980381355,4109958455,2819808352,2716589560,2568741196,3681446669,3329971472,1835478071,660984891,3704678404,4045999559,3422617507,3040415634,1762651403,1719377915,3470491036,2693910283,3642056355,3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49847	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	591	OUT	GET /v/t51.29350-10/438882269_729999509341792_5681810228876178213_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rx4uzBlOIl8Ab6ytXk7&_nc_ht=scontent-atl3-2.xx&oh=00_AfAvO6SJOH5Y80LRz1OMs2wXXZ5sp1gyOizIOTgXp7L6GA&oe=66279CD1 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 15:04:03 GMT X-Needle-Checksum: 3628258601 thrift_fmhk: GBBkMFD5Cns/eBElW45VxP/mFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=4087443857 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 65489
2024-04-19 01:40:44 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:44 UTC	1500	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 31 30 31 30 30 30 30 61 33 31 64 30 30 30 30 38 61 33 65 30 30 30 30 65 65 34 32 30 30 30 30 34 31 34 36 30 30 30 30 37 32 36 31 30 30 30 30 34 62 39 33 30 30 30 30 37 37 39 39 30 30 30 30 64 62 61 30 30 30 30 30 36 66 61 37 30 30 30 30 64 31 66 66 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a71010000a31d00008a3e0000ee42000041460000726100004b93000077990000dba000006fa70000d1ff0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:44 UTC	16332	IN	Data Raw: d0 aa af 36 9d 45 e4 6d 11 19 30 77 15 3e 2f 33 bb c4 0c e9 57 6d c7 1c eb ac cf 9b d8 e5 74 ea 35 df 45 a1 6d 37 d4 15 6a cf 78 5d 65 5a 25 e9 a7 42 26 da 53 52 a8 cc 06 b4 5d 9a 6b 99 e4 fd 76 6b 9f 9f d1 f4 3f 24 b4 e7 68 b0 e5 d3 33 6d b4 38 55 77 b8 da e1 5e 9a bb 4a ab b5 2c cb a6 cf 3d ea b9 97 9f 09 5c 6f c5 de 1d 50 a3 cf 6f 98 5a f4 97 79 de c1 5a 73 ed 64 57 6b 19 74 55 7d 74 a8 b5 2e 96 d1 8a 76 5d 48 75 a6 cc dc a5 ae bd 9c d1 35 e9 2e e0 74 c5 31 59 60 f8 ab d1 b1 55 7a f3 09 ae 70 d9 96 b1 e7 74 30 6d df 8f a1 6a 58 06 b7 50 aa fc ba 03 56 9c 77 a7 be b8 25 ec d3 9a f5 56 22 54 37 c6 d9 c2 98 ad 4a bf 39 e9 6b 4f e7 db 0e 1c bb 37 d9 87 6c 5d fc de b5 c9 f3 f7 5f 19 96 bb 2f 29 2d bb 72 3c 76 3f 74 97 82 57 a6 bd b8 f9 b8 7b 39 6e 3c f6 9d Data Ascii: 6Em0w>/3Wmt5Em7jx]eZ%B&SR]kvk?$h3m8Uw^J,=\oPoZyZsdWktU}t.v]Hu5.t1Y`Uzpt0mjXPVw%V"T7J9kO7l]_/)-r<v?tW{9n<
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 0e 27 b2 c2 dd e2 8a 1e b1 e2 7b 2c 2d 98 f8 57 13 e7 7c 49 e1 8b 67 c0 b7 7c 51 e1 7c ef 16 2c 3d 63 b5 e5 f0 2d de 56 95 98 f0 be 05 95 a3 c5 0b 6a 16 eb 0f 9d f1 ad 97 dc 5c 17 c2 b4 5c ab 7a 2b 81 6c b9 16 cb 17 ba 16 cb e9 2e 05 84 3f b0 b8 57 d3 5c 1f ff c4 00 40 10 00 01 03 02 03 04 07 05 07 03 04 02 03 01 00 00 01 00 02 11 03 21 12 31 41 10 22 51 61 13 20 30 32 40 50 71 04 42 52 81 a1 14 23 62 72 91 b1 c1 33 82 92 34 43 73 d1 a2 c2 63 90 e1 f0 ff da 00 08 01 01 00 06 3f 02 ff 00 e8 32 cb 9e cb 1f 3f bf 5a 1d 70 a4 65 e7 76 57 3d 84 66 10 23 ce 38 9d b7 eb 66 af b2 c5 4f 9a dd 5b b6 1c 3c d6 ee f9 78 0e 63 cc f9 e8 15 fc 03 c7 99 db 3f 02 e1 cb cc 9c 4e 40 22 7c 0c 79 94 0f 04 df 32 60 f0 43 cc a9 bb 4f 05 3e 12 c1 68 a1 d6 2b 31 b2 26 ea de 23 d1 Data Ascii: '{,-W\|Ig\|Q\|,=c-Vj\\z+l.?W\@!1A"Qa 02@PqBR#br34Csc?2?ZpevW=f#8fO[<xc?N@"\|y2`CO>h+1&#
2024-04-19 01:40:44 UTC	16384	IN	Data Raw: 8c 43 69 cf 9d a6 4d 14 b0 75 ea 54 86 e8 48 26 87 9d 5f 91 3a a8 fe d8 3b 62 e6 bc c1 7e 06 4e 7a ee 2a 1e 77 a3 bf da 2e 2c 02 f8 ef f8 9e 05 0d 77 db fd fe 23 ee 5d 4b 4c 3a 97 a6 3a 55 cd 57 f1 72 ab af 2b dd f5 36 ea 97 b1 ba a8 1f a1 56 4c db 2c 35 e2 18 4a c8 b9 7e 23 da 36 f3 3f b4 c1 a8 45 85 4b 41 a9 48 37 55 94 7e bc c6 77 69 19 4b 35 2c 68 b6 03 4d c8 39 42 66 22 00 e5 34 59 f6 89 dc 5f b3 fc 13 f3 51 68 ff 00 5c 7f 1a 6a 0d 7e a7 7c 3f 07 5c 5d f3 7c 3c 32 f8 ea 66 ad 85 bf f1 2d 7c e4 ea 31 33 17 d8 7a 46 b9 12 5f 40 ee 66 b2 52 d6 fe d1 53 59 01 d3 b1 97 21 76 7d a3 d8 8b a6 e0 4d 0a c0 f5 0a 69 75 2c 73 6c 56 ea 35 50 a8 1b ed 89 39 14 1d 0b 07 07 09 bd 9d 7f 13 bd b8 be 56 9f da 61 0a 4a 55 b2 7b 48 e7 96 e6 90 da 94 74 08 a3 5c 76 73 6c Data Ascii: CiMuTH&_:;b~Nz*w.,w#]KL::UWr+6VL,5J~#6?EKAH7U~wiK5,hM9Bf"4Y_Qh\j~\|?\]\|<2f-\|13zF_@fRSY!v}Miu,slV5P9VaJU{Ht\vsl
2024-04-19 01:40:44 UTC	14888	IN	Data Raw: 64 aa 34 1d 4b ac 77 3e 44 50 4a 49 cc b0 8e 7b 9f 59 91 99 d1 20 62 41 96 b5 71 9a 1a 2e 93 5f 49 aa b3 1f e6 22 af 3e 04 a6 38 cb ee 2b cb 77 2c 37 55 18 28 b0 a5 52 d9 fb 88 9d 46 e6 d6 a5 47 a6 98 62 2b 53 0c c0 e7 1d 4b 35 63 8d 34 c5 0f 1b 20 d6 b8 45 82 d0 d2 c7 d4 42 38 22 f5 4e c7 b9 a0 fb 99 be 22 39 67 03 e1 a8 0c c2 89 d0 30 ff 00 11 29 25 05 a9 6a 98 f1 b1 02 ac 29 2e 70 d5 ea 6c 9e ff 00 09 9c c0 ca 1d f8 97 1b 53 f9 41 a2 51 61 32 25 37 1d 5a 44 0d 1d 3f 07 4a fc 7e e5 99 91 be 25 ad 95 f7 0f 72 a3 2e 33 71 dc 34 a2 5e 7d 47 1b 90 ec 95 b9 98 3d 46 0b 72 ec 58 a8 d4 1a 95 f1 ca 0f 87 5e aa df 44 b0 51 4d 86 f1 a6 2a 61 b5 74 30 fc 33 61 88 3c e1 72 f3 aa 60 c0 6b 70 73 f5 50 8e 0c 4d cd b3 dc 65 ec ad cc c0 cc 6f 42 07 a3 39 98 99 e7 f1 00 Data Ascii: d4Kw>DPJI{Y bAq._I">8+w,7U(RFGb+SK5c4 EB8"N"9g0)%j).plSAQa2%7ZD?J~%r.3q4^}G=FrX^DQM*at03a<r`kpsPMeoB9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49850	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	375	OUT	GET /rsrc.php/v3/yb/r/7NqDjYL3eb9.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	1609	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: cu5Xe8waainQQiw+sSSIYQ== Expires: Sun, 06 Apr 2025 08:43:48 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: eRF5WIKDC82zON9PNWOucnszCKOC4aZMUS8U7ycM5o0ztu4bxa6nWOuMEQuSLvwbypikR4RH66Z/u6dxJ5ZY2Q== Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1633
2024-04-19 01:40:44 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:44 UTC	1632	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 31 00 00 00 4a 08 03 00 00 00 25 a7 4c 2c 00 00 02 10 50 4c 54 45 00 00 00 00 00 00 eb eb eb f7 f7 f7 ff ff ff ff ff ff 00 00 00 47 70 4c 00 00 00 00 00 00 eb eb eb f2 f2 f2 00 00 00 00 00 00 05 05 05 1c 1c 1c a9 a9 a9 46 46 46 00 00 00 ff ff ff 6f 6f 6f ff ff ff 42 42 42 ff ff ff fd fd fd af af af ff ff ff ff ff ff 11 11 11 ff ff ff 98 98 98 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 4e 4e 4e ff ff ff 75 75 75 93 93 93 ba ba ba ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 90 90 90 ff ff ff f2 f2 f2 0d 0d 0d 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 39 39 39 0c 0c 0c ff ff ff d6 d6 d6 c0 c0 c0 04 04 04 e1 e1 e1 2c 2c 2c ff ff ff a4 a4 a4 ff ff ff 41 41 Data Ascii: PNGIHDR1J%L,PLTEGpLFFFoooBBBNNNuuu999,,,AA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49851	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	826	OUT	GET /v/t15.5256-10/430843272_438547758855568_3782525580529738461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ki7LIH_ntfYAb7lEcz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfCIj5_yMIP5Es9E9YFuWRv8iLuRq49yvysp8vObeIcFQA&oe=66278DC5 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:44 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 10 Apr 2024 13:21:23 GMT X-Needle-Checksum: 2917034374 thrift_fmhk: GBCEIw+tg4Ycd7Gc24H2xNnOFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1499874574 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:44 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 10842
2024-04-19 01:40:44 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:44 UTC	10841	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 35 34 30 36 30 30 30 30 35 66 30 63 30 30 30 30 33 36 30 64 30 30 30 30 66 39 30 64 30 30 30 30 64 61 31 31 30 30 30 30 61 32 31 39 30 30 30 30 62 32 31 61 30 30 30 30 65 33 31 62 30 30 30 30 30 34 31 64 30 30 30 30 35 61 32 61 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000540600005f0c0000360d0000f90d0000da110000a2190000b21a0000e31b0000041d00005a2a0000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49852	142.251.15.105	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	635	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=MDfl99a8HcsWbttk4FFiiR8NDrBhCww36YdNj1uKpiso07eGcvsh2owHJl6xowzvUoQVtqEycGjE0idljTUJyPRZLMNalpMOXk5lH6nOUPYlliWBUGFfmgHcWUHYGp6eaRiCvQ79dDnqLT59unDyLvvBGoyMOOdIL4T1ogyTHxA
2024-04-19 01:40:44 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 17 Apr 2024 16:47:52 GMT Expires: Thu, 25 Apr 2024 16:47:52 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 118372 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:40:44 UTC	548	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-04-19 01:40:44 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C;
2024-04-19 01:40:44 UTC	1255	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4S4
2024-04-19 01:40:44 UTC	1255	IN	Data Raw: ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-04-19 01:40:44 UTC	1117	IN	Data Raw: ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49856	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	434	OUT	GET /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ
2024-04-19 01:40:45 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuc.AWVYKvhM6i8; expires=Thu, 18-Jul-2024 01:40:44 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:45 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:45 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:45 UTC	2550	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 4c 31 6d 77 53 33 77 47 69 66 5f 65 38 78 50 61 36 55 30 47 51 4b 55 31 69 73 47 39 44 61 45 37 39 49 76 30 35 4a 6a 37 6b 43 41 4c 53 5a 53 73 4d 79 6c 42 6f 50 37 33 48 73 46 67 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4c 42 6c 30 4d 4d 73 69 45 56 7a 48 5a 46 72 4b 75 5f 79 76 4a 6a 34 48 78 64 65 38 4d 47 67 50 6d 55 39 4c 31 31 61 72 2d 55 47 61 4d 32 75 64 58 67 49 6c 6a 45 75 56 31 2d 68 66 78 5f 67 45 4c 33 75 44 51 43 72 45 74 41 50 6f 62 6a 49 77 35 2d 68 34 6c 78 7a 53 36 58 46 61 59 6c 6f 7a 44 74 5f 74 4a 78 31 78 66 70 45 32 32 45 45 67 22 3b 20 65 5f 66 62 5f Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcL1mwS3wGif_e8xPa6U0GQKU1isG9DaE79Iv05Jj7kCALSZSsMylBoP73HsFg"; e_clientaddr="AcLBl0MMsiEVzHZFrKu_yvJj4Hxde8MGgPmU9L11ar-UGaM2udXgIljEuV1-hfx_gEL3uDQCrEtAPobjIw5-h4lxzS6XFaYlozDt_tJx1xfpE22EEg"; e_fb_
2024-04-19 01:40:45 UTC	166	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 35 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 35 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 31 31 35 2c 20 75 6c 6c 61 74 3d 31 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=115, ullat=1Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:40:45 UTC	1334	IN	Data Raw: 39 64 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 78 77 4f 72 78 52 75 73 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: 9d9f<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="xwOrxRus">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 6e 6f 79 64 69 72 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 Data Ascii: reen and (max-width: 640px)" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><meta name="robots" content="noodp,noydir" /><meta property="
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 32 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d Data Ascii: 20935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"20936":{"result":false,"hash":null}
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 2c 5b 5d 2c 7b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 3a 22 6d 6e 39 7a 45 65 51 7a 39 4b 67 Data Ascii: ,{"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce",[],{"ServerNonce":"mn9zEeQz9Kg
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 6e 67 46 72 6f 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e Data Ascii: ngFromTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translationRetries":[200,500],"translation
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 5f 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 71 52 48 5a 54 30 4c 42 63 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 72 22 3a 31 2c 22 6d 61 6e 69 66 65 73 74 5f 62 61 73 65 5f 75 72 69 22 3a 22 68 74 74 70 73 Data Ascii: _DOMAIN":false},270],["LSD",[],{"token":"AVqRHZT0LBc"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0..0.0","pr":1,"manifest_base_uri":"https

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49858	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	827	OUT	GET /v/t15.5256-10/438091798_1180371333322580_3869440255780885829_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xEMShP_qLFMAb55VT3m&_nc_ht=scontent-atl3-2.xx&oh=00_AfDWfJxHj0HZNwe-NDko3zvnYAmSYlIZukKiC1ty_egxkw&oe=6627908C HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 18:54:43 GMT X-Needle-Checksum: 1724717867 thrift_fmhk: GBA/ymPseBJYD5JdQmZkDeAAFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3993230806 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 13353
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	13352	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 36 62 30 36 30 30 30 30 63 61 30 63 30 30 30 30 36 37 30 65 30 30 30 30 63 65 30 66 30 30 30 30 65 35 31 34 30 30 30 30 35 64 31 65 30 30 30 30 36 63 31 66 30 30 30 30 33 33 32 31 30 30 30 30 66 36 32 32 30 30 30 30 32 39 33 34 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a700100006b060000ca0c0000670e0000ce0f0000e51400005d1e00006c1f000033210000f622000029340000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49859	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	1243	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=7&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1082 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryn7lHWgoo4LOlgMK6 sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ; wd=1280x907
2024-04-19 01:40:44 UTC	1082	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6e 37 6c 48 57 67 6f 6f 34 4c 4f 6c 67 4d 4b 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 33 35 35 32 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6e 37 6c 48 57 67 6f 6f 34 4c 4f 6c 67 4d 4b 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 32 32 30 33 39 31 37 38 38 32 30 30 38 39 32 22 2c 22 70 6f 73 74 73 22 3a 5b 5b 22 66 61 6c 63 6f 3a 6c 6f 78 5f 75 70 73 65 6c 6c 5f 65 76 65 6e 74 22 2c 7b 22 Data Ascii: ------WebKitFormBoundaryn7lHWgoo4LOlgMK6Content-Disposition: form-data; name="ts"1713490843552------WebKitFormBoundaryn7lHWgoo4LOlgMK6Content-Disposition: form-data; name="q"[{"app_id":"2220391788200892","posts":[["falco:lox_upsell_event",{"
2024-04-19 01:40:45 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:45 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:45 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49860	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:44 UTC	827	OUT	GET /v/t15.5256-10/427423164_1136863804107170_2890424799444787669_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=B9Pc79yiemQAb6zBz4r&_nc_ht=scontent-atl3-2.xx&oh=00_AfCiWqDXjAXfVtRjlfSGhw15nEOc_vXUOs2xVTfr50viLg&oe=6627A6F7 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 14:46:36 GMT X-Needle-Checksum: 1250053321 thrift_fmhk: GBBkYzkU7YOZSccATI0a23x2FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=887068551 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 14752
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	14751	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 35 38 30 36 30 30 30 30 32 34 30 65 30 30 30 30 37 66 30 66 30 30 30 30 64 37 31 30 30 30 30 30 61 66 31 37 30 30 30 30 37 63 32 32 30 30 30 30 39 36 32 33 30 30 30 30 34 66 32 35 30 30 30 30 31 30 32 37 30 30 30 30 61 30 33 39 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f01000058060000240e00007f0f0000d7100000af1700007c220000962300004f25000010270000a0390000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49861	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	590	OUT	GET /v/t15.5256-10/430843272_438547758855568_3782525580529738461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=ki7LIH_ntfYAb7lEcz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfCIj5_yMIP5Es9E9YFuWRv8iLuRq49yvysp8vObeIcFQA&oe=66278DC5 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 10 Apr 2024 13:21:23 GMT X-Needle-Checksum: 2917034374 thrift_fmhk: GBCEIw+tg4Ycd7Gc24H2xNnOFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1499874574 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 10842
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	10841	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 35 34 30 36 30 30 30 30 35 66 30 63 30 30 30 30 33 36 30 64 30 30 30 30 66 39 30 64 30 30 30 30 64 61 31 31 30 30 30 30 61 32 31 39 30 30 30 30 62 32 31 61 30 30 30 30 65 33 31 62 30 30 30 30 30 34 31 64 30 30 30 30 35 61 32 61 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000540600005f0c0000360d0000f90d0000da110000a2190000b21a0000e31b0000041d00005a2a0000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49862	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	826	OUT	GET /v/t15.5256-10/438193634_720475476662614_5584509116371930153_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-ExROFrTdmwAb5t0lBc&_nc_ht=scontent-atl3-2.xx&oh=00_AfDC4ORowz8xLhxbrweQGY8ubgpNS608cJQiE9HwjWJqyw&oe=66279C6D HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 22:48:14 GMT X-Needle-Checksum: 1271853996 thrift_fmhk: GBBA/Aw6dSuqpYmBBlrWp7woFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3532318398 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=8, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 16053
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	15145	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 39 39 30 36 30 30 30 30 35 61 30 66 30 30 30 30 62 35 31 30 30 30 30 30 63 33 31 32 30 30 30 30 32 63 31 62 30 30 30 30 39 33 32 36 30 30 30 30 61 35 32 37 30 30 30 30 36 33 32 39 30 30 30 30 38 30 32 62 30 30 30 30 62 35 33 65 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a70010000990600005a0f0000b5100000c31200002c1b000093260000a527000063290000802b0000b53e0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:45 UTC	907	IN	Data Raw: b0 a8 54 22 79 1f f9 30 9a 63 3b b7 f7 70 1a e4 e5 e4 e1 f2 8c 05 14 9f cf a8 aa 8b cb 08 d9 6b c5 6a dd 39 94 a6 5d a1 4d 77 62 43 b8 1c 0a 07 63 fc 5d cc c0 72 14 48 1c 3d fc b2 31 cf 6f c4 ce be 21 c2 2e 39 d4 38 b9 a7 88 06 a1 cf 73 06 f5 03 c4 c5 e2 38 ed 03 0f cc c5 6e a7 77 74 42 52 f3 c4 00 21 e9 08 a6 09 ec b1 8c 1a 0a 66 9a 3f 7a c3 53 31 c5 f3 0e 54 46 dd 19 f6 ec 1c ea 08 c6 30 98 46 ec 96 7c 29 11 a3 9f b3 7e 49 61 91 68 f4 c8 c5 61 a1 ed da 88 ab 8c 75 e4 26 2d b4 d4 58 0a a7 af f7 b8 b7 aa dc a8 74 c1 2e ef 12 ef 5a 8b 88 2b 5d 21 5c 6b 51 ee 38 8a 8f 98 ac c4 d2 8d 5e e6 3b c8 73 36 0e f1 01 63 bf c9 0d 02 9b 19 2d fe 93 ea 55 c6 66 bb 2b fd 05 23 53 35 98 0a 89 5d dd c2 a8 e3 39 18 ae dc 45 09 94 3c 46 ad b3 e8 f0 c4 16 35 55 61 3e 06 55 Data Ascii: T"y0c;pkj9]MwbCc]rH=1o!.98s8nwtBR!f?zS1TF0F\|)~Iahau&-Xt.Z+]!\kQ8^;s6c-Uf+#S5]9E<F5Ua>U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49863	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	1277	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=8&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 921 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38wUNLrJAwhxKTwI sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ; wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:45 UTC	921	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 33 38 77 55 4e 4c 72 4a 41 77 68 78 4b 54 77 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 33 38 31 31 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 33 38 77 55 4e 4c 72 4a 41 77 68 78 4b 54 77 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 32 32 30 33 39 31 37 38 38 32 30 30 38 39 32 22 2c 22 70 6f 73 74 73 22 3a 5b 5b 22 66 61 6c 63 6f 3a 62 64 5f 70 64 63 5f 73 69 67 6e 61 6c 73 22 2c 7b 22 65 22 Data Ascii: ------WebKitFormBoundary38wUNLrJAwhxKTwIContent-Disposition: form-data; name="ts"1713490843811------WebKitFormBoundary38wUNLrJAwhxKTwIContent-Disposition: form-data; name="q"[{"app_id":"2220391788200892","posts":[["falco:bd_pdc_signals",{"e"
2024-04-19 01:40:45 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:45 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:45 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49865	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	447	OUT	GET /ajax/bulk-route-definitions/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcua.AWVHWfgcJYQ; wd=1280x907
2024-04-19 01:40:45 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; expires=Thu, 18-Jul-2024 01:40:45 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:45 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:45 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:45 UTC	2548	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 4a 4c 4a 78 31 69 49 70 37 7a 6c 38 66 4a 72 50 41 36 57 4b 78 4e 65 70 5a 45 44 6d 77 74 4d 69 4c 47 66 6f 72 56 6c 52 64 47 6b 52 42 56 53 62 48 37 45 72 49 56 64 39 53 62 6f 67 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 49 5a 4f 72 31 64 6a 30 48 48 66 49 59 37 4a 79 75 77 5f 4a 6b 69 54 38 76 6c 4f 6a 33 75 78 59 68 75 65 6a 36 6e 73 51 38 33 68 6c 37 32 45 31 4d 78 61 58 5f 49 30 64 38 56 51 72 58 7a 37 31 6b 63 32 71 47 4c 62 57 64 57 74 66 31 65 39 41 66 4f 56 31 55 53 62 73 63 41 50 6b 2d 62 75 6b 55 49 71 31 2d 51 75 74 72 5a 73 56 41 22 3b 20 65 5f 66 62 5f 76 69 70 Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcJLJx1iIp7zl8fJrPA6WKxNepZEDmwtMiLGforVlRdGkRBVSbH7ErIVd9Sbog"; e_clientaddr="AcIZOr1dj0HHfIY7Jyuw_JkiT8vlOj3uxYhuej6nsQ83hl72E1MxaX_I0d8VQrXz71kc2qGLbWdWtf1e9AfOV1USbscAPk-bukUIq1-QutrZsVA"; e_fb_vip
2024-04-19 01:40:45 UTC	165	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 34 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 35 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 39 36 2c 20 75 6c 6c 61 74 3d 31 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=10, mss=1277, tbw=3405, tp=-1, tpl=-1, uplat=96, ullat=1Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:40:45 UTC	1335	IN	Data Raw: 64 38 65 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 59 6a 58 35 4a 6b 53 65 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: d8ef<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="YjX5JkSe">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 62 75 6c 6b 2d 72 6f 75 74 65 2d 64 65 66 69 6e 69 74 69 6f 6e 73 2f 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 6e 6f 79 64 69 72 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f Data Ascii: een and (max-width: 640px)" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/bulk-route-definitions/" /><meta name="robots" content="noodp,noydir" /><meta property="o
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c Data Ascii: 0935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"20936":{"result":false,"hash":null},
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 2c 5b 5d 2c 7b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 3a 22 32 35 45 42 4c 62 4b 58 63 2d 59 30 Data Ascii: {"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce",[],{"ServerNonce":"25EBLbKXc-Y0
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 69 65 73 22 3a 5b 32 30 30 2c 35 30 30 5d 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e 52 65 74 72 79 Data Ascii: mTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translationRetries":[200,500],"translationRetry
2024-04-19 01:40:45 UTC	1500	IN	Data Raw: 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 6f 6f 63 64 35 39 42 59 73 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 72 22 3a 31 2c 22 6d 61 6e 69 66 65 73 74 5f 62 61 73 65 5f 75 72 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f Data Ascii: IN":false},270],["LSD",[],{"token":"AVoocd59BYs"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0..0.0","pr":1,"manifest_base_uri":"https:\/\/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49867	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	591	OUT	GET /v/t15.5256-10/438091798_1180371333322580_3869440255780885829_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xEMShP_qLFMAb55VT3m&_nc_ht=scontent-atl3-2.xx&oh=00_AfDWfJxHj0HZNwe-NDko3zvnYAmSYlIZukKiC1ty_egxkw&oe=6627908C HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 18:54:43 GMT X-Needle-Checksum: 1724717867 thrift_fmhk: GBA/ymPseBJYD5JdQmZkDeAAFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3993230806 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 13353
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	13352	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 36 62 30 36 30 30 30 30 63 61 30 63 30 30 30 30 36 37 30 65 30 30 30 30 63 65 30 66 30 30 30 30 65 35 31 34 30 30 30 30 35 64 31 65 30 30 30 30 36 63 31 66 30 30 30 30 33 33 32 31 30 30 30 30 66 36 32 32 30 30 30 30 32 39 33 34 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a700100006b060000ca0c0000670e0000ce0f0000e51400005d1e00006c1f000033210000f622000029340000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49866	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	827	OUT	GET /v/t51.29350-10/434466436_742991631307311_2684269917892696380_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=lEVRaVUhRrUAb6Mesom&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGHE-qbLV-U2v08MXPZy2tIrgHciSRcQNZx7LxILUMmA&oe=6627AD2E HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 27 Mar 2024 04:34:59 GMT X-Needle-Checksum: 2023812789 thrift_fmhk: GBDyiD7+d0JgVdxjkU2OASh2FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2827600584 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=4, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 14054
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	14053	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 31 61 30 36 30 30 30 30 32 33 30 64 30 30 30 30 64 34 30 64 30 30 30 30 61 66 30 65 30 30 30 30 32 66 31 36 30 30 30 30 32 64 32 31 30 30 30 30 33 65 32 32 30 30 30 30 33 66 32 33 30 30 30 30 36 31 32 34 30 30 30 30 65 36 33 36 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f0100001a060000230d0000d40d0000af0e00002f1600002d2100003e2200003f23000061240000e6360000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49868	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	733	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=7&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuc.AWVYKvhM6i8
2024-04-19 01:40:45 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:45 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:45 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49869	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	827	OUT	GET /v/t15.5256-10/427755631_1521380321923283_7278901302032905672_n.jpg?stp=dst-jpg_p296x100&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xJQH45NEw5sAb6WK0Xa&_nc_ht=scontent-atl3-2.xx&oh=00_AfDz4tA7Z9g7MaNQs3vhOnXqFfZweGTXP76ZT7aDiBvboA&oe=6627A761 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sat, 06 Apr 2024 19:47:01 GMT X-Needle-Checksum: 3646397509 thrift_fmhk: GBAMrYNseGzeO0N2pCjzPIzeFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3674860515 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 18541
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	15109	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 31 30 31 30 30 30 30 30 33 30 38 30 30 30 30 65 65 31 32 30 30 30 30 35 66 31 34 30 30 30 30 35 63 31 35 30 30 30 30 36 34 32 32 30 30 30 30 62 38 32 66 30 30 30 30 33 65 33 31 30 30 30 30 61 34 33 32 30 30 30 30 64 62 33 33 30 30 30 30 36 64 34 38 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a7101000003080000ee1200005f1400005c15000064220000b82f00003e310000a4320000db3300006d480000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:45 UTC	3431	IN	Data Raw: 27 4a 25 c7 cf 98 fb d0 b0 4c 26 9b c3 75 6b 5a 98 86 38 75 7a ca aa 5d 10 d9 4b d5 f5 09 b4 f6 81 8e aa ac 09 44 03 4a 67 0b 84 61 0d 74 32 82 e8 7d d9 9f 1c 12 bd c0 e6 37 2a 56 54 76 8b a6 fc c4 58 b4 d8 ba 57 61 ed 34 e3 00 5f 77 ee fd 3a 5e 19 4f 4c a7 a6 53 d3 2d d3 2d d3 2d d3 2d d3 2d d3 2d d3 2d d3 29 e9 94 f4 ca 7a 65 3d 32 dd 32 9e 99 4f 4c b7 4c b7 4c a7 a6 53 d3 29 e9 96 e9 96 e9 96 e9 94 f4 cb 74 cb 74 cb 74 ca 7a 65 3d 32 dd 32 9e 99 4f 4c a7 a6 53 d3 0c 35 8a 65 94 9f da 03 75 f3 3c 04 f6 67 82 68 8f bc 56 87 cc 14 ba 7c c1 34 7e 62 11 ea 52 40 ab 22 ab a8 7b 48 31 ac 11 41 ba 38 97 8b 31 a6 37 b2 9c 03 24 a8 d8 f4 65 5c be 48 31 d0 b0 46 a5 98 1b fb 26 38 06 85 88 6d 8d bc 8f ee 04 78 d3 64 ff 00 b4 4f fb 04 1b fb 21 67 f2 46 bc 3f 92 39 Data Ascii: 'J%L&ukZ8uz]KDJgat2}7*VTvXWa4_w:^OLS-------)ze=22OLLLS)tttze=22OLS5eu<ghV\|4~bR@"{H1A817$e\H1F&8mxdO!gF?9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49870	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	591	OUT	GET /v/t15.5256-10/427423164_1136863804107170_2890424799444787669_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=B9Pc79yiemQAb6zBz4r&_nc_ht=scontent-atl3-2.xx&oh=00_AfCiWqDXjAXfVtRjlfSGhw15nEOc_vXUOs2xVTfr50viLg&oe=6627A6F7 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 14:46:36 GMT X-Needle-Checksum: 1250053321 thrift_fmhk: GBBkYzkU7YOZSccATI0a23x2FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=887068551 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 14752
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	14751	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 35 38 30 36 30 30 30 30 32 34 30 65 30 30 30 30 37 66 30 66 30 30 30 30 64 37 31 30 30 30 30 30 61 66 31 37 30 30 30 30 37 63 32 32 30 30 30 30 39 36 32 33 30 30 30 30 34 66 32 35 30 30 30 30 31 30 32 37 30 30 30 30 61 30 33 39 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f01000058060000240e00007f0f0000d7100000af1700007c220000962300004f25000010270000a0390000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49871	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	733	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=8&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuc.AWVYKvhM6i8
2024-04-19 01:40:45 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:45 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:45 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49872	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	599	OUT	GET /rsrc.php/v3/yl/r/SDtEN57PJgl.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.facebook.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	1702	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: Uey63AmUHnTfz8qwkuRK9A== Expires: Wed, 16 Apr 2025 04:33:47 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: iCVSj0ImaebzElx93FaiAJRptBtisYW0zMwAArj6AxOMPbiyug1yIJ1WaaXQutlNBeSoZn55zunk78BeyA3jXQ== Date: Fri, 19 Apr 2024 01:40:45 GMT Access-Control-Allow-Origin: https://www.facebook.com Vary: Origin X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1221
2024-04-19 01:40:45 UTC	1	IN	Data Raw: 3b Data Ascii: ;
2024-04-19 01:40:45 UTC	1220	IN	Data Raw: 2f 2a 46 42 5f 50 4b 47 5f 44 45 4c 49 4d 2a 2f 0a 0a 5f 5f 64 28 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 6c 69 73 74 52 6f 6f 74 51 75 65 72 79 24 50 61 72 61 6d 65 74 65 72 73 22 2c 5b 22 53 74 6f 72 69 65 73 52 69 6e 67 2e 72 65 6c 61 79 70 72 6f 76 69 64 65 72 22 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 3d 7b 6b 69 6e 64 3a 22 50 72 65 6c 6f 61 64 61 62 6c 65 43 6f 6e 63 72 65 74 65 52 65 71 75 65 73 74 22 2c 70 61 72 61 6d 73 3a 7b 69 64 3a 22 38 32 34 35 33 39 34 39 39 32 31 34 32 39 35 33 22 2c 6d 65 74 61 64 61 74 61 3a 7b 7d 2c 6e 61 6d 65 3a 22 43 6f 6d 65 74 56 69 64 65 6f 48 6f 6d 65 50 6c 61 79 6c 69 73 74 52 6f 6f 74 51 75 65 72 79 22 2c 6f 70 65 72 Data Ascii: /FB_PKG_DELIM/__d("CometVideoHomePlaylistRootQuery$Parameters",["StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:"8245394992142953",metadata:{},name:"CometVideoHomePlaylistRootQuery",oper

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49873	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	590	OUT	GET /v/t15.5256-10/438193634_720475476662614_5584509116371930153_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-ExROFrTdmwAb5t0lBc&_nc_ht=scontent-atl3-2.xx&oh=00_AfDC4ORowz8xLhxbrweQGY8ubgpNS608cJQiE9HwjWJqyw&oe=66279C6D HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:45 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 22:48:14 GMT X-Needle-Checksum: 1271853996 thrift_fmhk: GBBA/Aw6dSuqpYmBBlrWp7woFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3532318398 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:45 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 16053
2024-04-19 01:40:45 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:45 UTC	15145	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 39 39 30 36 30 30 30 30 35 61 30 66 30 30 30 30 62 35 31 30 30 30 30 30 63 33 31 32 30 30 30 30 32 63 31 62 30 30 30 30 39 33 32 36 30 30 30 30 61 35 32 37 30 30 30 30 36 33 32 39 30 30 30 30 38 30 32 62 30 30 30 30 62 35 33 65 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a70010000990600005a0f0000b5100000c31200002c1b000093260000a527000063290000802b0000b53e0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:46 UTC	907	IN	Data Raw: b0 a8 54 22 79 1f f9 30 9a 63 3b b7 f7 70 1a e4 e5 e4 e1 f2 8c 05 14 9f cf a8 aa 8b cb 08 d9 6b c5 6a dd 39 94 a6 5d a1 4d 77 62 43 b8 1c 0a 07 63 fc 5d cc c0 72 14 48 1c 3d fc b2 31 cf 6f c4 ce be 21 c2 2e 39 d4 38 b9 a7 88 06 a1 cf 73 06 f5 03 c4 c5 e2 38 ed 03 0f cc c5 6e a7 77 74 42 52 f3 c4 00 21 e9 08 a6 09 ec b1 8c 1a 0a 66 9a 3f 7a c3 53 31 c5 f3 0e 54 46 dd 19 f6 ec 1c ea 08 c6 30 98 46 ec 96 7c 29 11 a3 9f b3 7e 49 61 91 68 f4 c8 c5 61 a1 ed da 88 ab 8c 75 e4 26 2d b4 d4 58 0a a7 af f7 b8 b7 aa dc a8 74 c1 2e ef 12 ef 5a 8b 88 2b 5d 21 5c 6b 51 ee 38 8a 8f 98 ac c4 d2 8d 5e e6 3b c8 73 36 0e f1 01 63 bf c9 0d 02 9b 19 2d fe 93 ea 55 c6 66 bb 2b fd 05 23 53 35 98 0a 89 5d dd c2 a8 e3 39 18 ae dc 45 09 94 3c 46 ad b3 e8 f0 c4 16 35 55 61 3e 06 55 Data Ascii: T"y0c;pkj9]MwbCc]rH=1o!.98s8nwtBR!f?zS1TF0F\|)~Iahau&-Xt.Z+]!\kQ8^;s6c-Uf+#S5]9E<F5Ua>U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49874	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	827	OUT	GET /v/t39.30808-1/294724701_110489671750480_988274315942354852_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=CsDREyxMCqwAb6Zm1uF&_nc_ht=scontent-atl3-2.xx&oh=00_AfDUhmgSNym9P3hgORApjgvt5uZCr5vKPXDneN84pBy-xQ&oe=662798CE HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Fri, 29 Jul 2022 16:53:02 GMT X-Needle-Checksum: 237387349 thrift_fmhk: GBDLjfzimJFsvSLDzRLgaTxdFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1454473292 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2080
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	2079	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e2 01 d8 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 01 c8 6c 63 6d 73 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 e2 00 03 00 14 00 09 00 0e 00 1d 61 63 73 70 4d 53 46 54 00 00 00 00 73 61 77 73 63 74 72 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 68 61 6e 64 b4 aa dd 1f 13 c8 03 3c f5 51 14 45 28 7a 98 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 5e 63 70 72 74 00 00 01 0c 00 00 00 0c 77 74 70 74 00 00 01 18 00 00 00 14 72 58 59 5a 00 00 01 2c 00 00 00 14 67 58 59 5a 00 00 01 40 00 00 00 14 62 58 59 5a 00 00 01 54 00 00 00 14 72 54 52 43 00 00 01 68 00 00 00 60 67 54 Data Ascii: JFIFICC_PROFILElcmsmntrRGB XYZ acspMSFTsawsctrl-hand<QE(zdesc^cprtwtptrXYZ,gXYZ@bXYZTrTRCh`gT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49875	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	591	OUT	GET /v/t51.29350-10/434466436_742991631307311_2684269917892696380_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=lEVRaVUhRrUAb6Mesom&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGHE-qbLV-U2v08MXPZy2tIrgHciSRcQNZx7LxILUMmA&oe=6627AD2E HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Wed, 27 Mar 2024 04:34:59 GMT X-Needle-Checksum: 2023812789 thrift_fmhk: GBDyiD7+d0JgVdxjkU2OASh2FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2827600584 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 14054
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	14053	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 31 61 30 36 30 30 30 30 32 33 30 64 30 30 30 30 64 34 30 64 30 30 30 30 61 66 30 65 30 30 30 30 32 66 31 36 30 30 30 30 32 64 32 31 30 30 30 30 33 65 32 32 30 30 30 30 33 66 32 33 30 30 30 30 36 31 32 34 30 30 30 30 65 36 33 36 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f0100001a060000230d0000d40d0000af0e00002f1600002d2100003e2200003f23000061240000e6360000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49876	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	1278	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=9&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 3887 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIkl7lGspmSVmKkld sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
2024-04-19 01:40:45 UTC	3887	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 6b 6c 37 6c 47 73 70 6d 53 56 6d 4b 6b 6c 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 34 35 35 33 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 49 6b 6c 37 6c 47 73 70 6d 53 56 6d 4b 6b 6c 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 78 9c ed 59 69 Data Ascii: ------WebKitFormBoundaryIkl7lGspmSVmKkldContent-Disposition: form-data; name="ts"1713490844553------WebKitFormBoundaryIkl7lGspmSVmKkldContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamxYi
2024-04-19 01:40:46 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:46 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:46 UTC	1817	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49877	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:45 UTC	828	OUT	GET /v/t39.30808-1/429682066_368649729457593_2210717644653039134_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=PCsmMolcaEYAb5liA2T&_nc_ht=scontent-atl3-2.xx&oh=00_AfAr3LnIIBAW4Oll3CfuMViVa6IZ_P_aBcdVZ1tFLfUJ0Q&oe=66278F81 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 26 Feb 2024 01:29:50 GMT X-Needle-Checksum: 2870525417 thrift_fmhk: GBDO6kQ6+VMzHoql7QkvlS5XFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2264022454 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1667
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1666	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 64 30 31 30 30 30 30 65 30 30 31 30 30 30 30 38 37 30 32 30 30 30 30 63 63 30 32 30 30 30 30 31 33 30 33 30 30 30 30 63 30 30 33 30 30 30 30 37 66 30 34 30 30 30 30 62 35 30 34 30 30 30 30 66 38 30 34 30 30 30 30 33 66 30 35 30 30 30 30 38 33 30 36 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6d010000e001000087020000cc02000013030000c00300007f040000b5040000f80400003f05000083060000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49878	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	591	OUT	GET /v/t15.5256-10/427755631_1521380321923283_7278901302032905672_n.jpg?stp=dst-jpg_p296x100&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=xJQH45NEw5sAb6WK0Xa&_nc_ht=scontent-atl3-2.xx&oh=00_AfDz4tA7Z9g7MaNQs3vhOnXqFfZweGTXP76ZT7aDiBvboA&oe=6627A761 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	661	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sat, 06 Apr 2024 19:47:01 GMT X-Needle-Checksum: 3646397509 thrift_fmhk: GBAMrYNseGzeO0N2pCjzPIzeFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3674860515 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 18541
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	15109	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 31 30 31 30 30 30 30 30 33 30 38 30 30 30 30 65 65 31 32 30 30 30 30 35 66 31 34 30 30 30 30 35 63 31 35 30 30 30 30 36 34 32 32 30 30 30 30 62 38 32 66 30 30 30 30 33 65 33 31 30 30 30 30 61 34 33 32 30 30 30 30 64 62 33 33 30 30 30 30 36 64 34 38 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a7101000003080000ee1200005f1400005c15000064220000b82f00003e310000a4320000db3300006d480000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:46 UTC	3431	IN	Data Raw: 27 4a 25 c7 cf 98 fb d0 b0 4c 26 9b c3 75 6b 5a 98 86 38 75 7a ca aa 5d 10 d9 4b d5 f5 09 b4 f6 81 8e aa ac 09 44 03 4a 67 0b 84 61 0d 74 32 82 e8 7d d9 9f 1c 12 bd c0 e6 37 2a 56 54 76 8b a6 fc c4 58 b4 d8 ba 57 61 ed 34 e3 00 5f 77 ee fd 3a 5e 19 4f 4c a7 a6 53 d3 2d d3 2d d3 2d d3 2d d3 2d d3 2d d3 2d d3 29 e9 94 f4 ca 7a 65 3d 32 dd 32 9e 99 4f 4c b7 4c b7 4c a7 a6 53 d3 29 e9 96 e9 96 e9 96 e9 94 f4 cb 74 cb 74 cb 74 ca 7a 65 3d 32 dd 32 9e 99 4f 4c a7 a6 53 d3 0c 35 8a 65 94 9f da 03 75 f3 3c 04 f6 67 82 68 8f bc 56 87 cc 14 ba 7c c1 34 7e 62 11 ea 52 40 ab 22 ab a8 7b 48 31 ac 11 41 ba 38 97 8b 31 a6 37 b2 9c 03 24 a8 d8 f4 65 5c be 48 31 d0 b0 46 a5 98 1b fb 26 38 06 85 88 6d 8d bc 8f ee 04 78 d3 64 ff 00 b4 4f fb 04 1b fb 21 67 f2 46 bc 3f 92 39 Data Ascii: 'J%L&ukZ8uz]KDJgat2}7*VTvXWa4_w:^OLS-------)ze=22OLLLS)tttze=22OLS5eu<ghV\|4~bR@"{H1A817$e\H1F&8mxdO!gF?9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49880	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	829	OUT	GET /v/t39.30808-1/438331716_2765174076970236_1145479496426679813_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=obA5gIRYYUYAb7KFZz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfDhyPAWHnsY26BikqP407np3qhXfYGR6avsj0inolkFDg&oe=6627A836 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 03:37:13 GMT X-Needle-Checksum: 3242346525 thrift_fmhk: GBA1uX0jH7XsXdrP6F7A+e2xFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=4158901559 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1444
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1443	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 65 32 30 31 30 30 30 30 36 62 30 32 30 30 30 30 62 62 30 32 30 30 30 30 30 36 30 33 30 30 30 30 37 32 30 33 30 30 30 30 66 62 30 33 30 30 30 30 33 33 30 34 30 30 30 30 37 37 30 34 30 30 30 30 62 66 30 34 30 30 30 30 61 34 30 35 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000e20100006b020000bb0200000603000072030000fb0300003304000077040000bf040000a4050000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49881	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	826	OUT	GET /v/t1.6435-1/166562961_289775365843871_1089544784969631943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=gsiZqHemNI0Ab7xotOc&_nc_ht=scontent-atl3-2.xx&oh=00_AfCJ2y8PnGo5iYFIOIqkgTsp2QT4Magjkq-glreMKFQsPQ&oe=664932DC HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sun, 28 Mar 2021 16:21:52 GMT X-Needle-Checksum: 3944168440 thrift_fmhk: GBBjlJjG/0UEomG65ORFlITHFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=657512465 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1983
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1982	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 9c 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 80 1c 02 67 00 14 55 4a 73 2d 76 4e 72 44 44 47 77 73 47 78 5f 67 71 51 6b 32 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 38 35 30 31 30 30 30 30 66 62 30 31 30 30 30 30 62 61 30 32 30 30 30 30 30 32 30 33 30 30 30 30 35 65 30 33 30 30 30 30 36 32 30 34 30 30 30 30 35 33 30 35 30 30 30 30 38 64 30 35 30 30 30 30 64 36 30 35 30 30 30 30 32 66 30 36 30 30 30 30 62 66 30 37 30 30 30 30 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a Data Ascii: JFIFPhotoshop 3.08BIMgUJs-vNrDDGwsGx_gqQk2(bFBMD0a000a85010000fb010000ba020000020300005e03000062040000530500008d050000d60500002f060000bf070000C%# , #&')*)-0-(0%()(C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49882	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	591	OUT	GET /v/t39.30808-1/294724701_110489671750480_988274315942354852_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=CsDREyxMCqwAb6Zm1uF&_nc_ht=scontent-atl3-2.xx&oh=00_AfDUhmgSNym9P3hgORApjgvt5uZCr5vKPXDneN84pBy-xQ&oe=662798CE HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Fri, 29 Jul 2022 16:53:02 GMT X-Needle-Checksum: 237387349 thrift_fmhk: GBDLjfzimJFsvSLDzRLgaTxdFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1454473292 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2080
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	2079	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e2 01 d8 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 01 c8 6c 63 6d 73 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 e2 00 03 00 14 00 09 00 0e 00 1d 61 63 73 70 4d 53 46 54 00 00 00 00 73 61 77 73 63 74 72 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 68 61 6e 64 b4 aa dd 1f 13 c8 03 3c f5 51 14 45 28 7a 98 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 5e 63 70 72 74 00 00 01 0c 00 00 00 0c 77 74 70 74 00 00 01 18 00 00 00 14 72 58 59 5a 00 00 01 2c 00 00 00 14 67 58 59 5a 00 00 01 40 00 00 00 14 62 58 59 5a 00 00 01 54 00 00 00 14 72 54 52 43 00 00 01 68 00 00 00 60 67 54 Data Ascii: JFIFICC_PROFILElcmsmntrRGB XYZ acspMSFTsawsctrl-hand<QE(zdesc^cprtwtptrXYZ,gXYZ@bXYZTrTRCh`gT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49883	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	733	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=9&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
2024-04-19 01:40:46 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:46 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:46 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49884	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	829	OUT	GET /v/t39.30808-1/414867464_7046595375378763_4861839573446109840_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=QVssM7vGW2oAb4BrMfp&_nc_ht=scontent-atl3-2.xx&oh=00_AfDu-H0r-6CfzXEJPa3gbJwso6VAEOgSMr--wRf3P1KcMw&oe=66279958 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Fri, 29 Dec 2023 16:52:16 GMT X-Needle-Checksum: 1319188037 thrift_fmhk: GBDlUfkgekJE5TTsB6BaAVk2FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2144270772 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1554
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1553	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 65 38 30 31 30 30 30 30 37 39 30 32 30 30 30 30 62 63 30 32 30 30 30 30 30 38 30 33 30 30 30 30 61 33 30 33 30 30 30 30 34 37 30 34 30 30 30 30 38 30 30 34 30 30 30 30 62 64 30 34 30 30 30 30 30 33 30 35 30 30 30 30 31 32 30 36 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000e801000079020000bc02000008030000a30300004704000080040000bd0400000305000012060000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49885	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	592	OUT	GET /v/t39.30808-1/429682066_368649729457593_2210717644653039134_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=PCsmMolcaEYAb5liA2T&_nc_ht=scontent-atl3-2.xx&oh=00_AfAr3LnIIBAW4Oll3CfuMViVa6IZ_P_aBcdVZ1tFLfUJ0Q&oe=66278F81 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 26 Feb 2024 01:29:50 GMT X-Needle-Checksum: 2870525417 thrift_fmhk: GBDO6kQ6+VMzHoql7QkvlS5XFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2264022454 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1667
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1666	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 64 30 31 30 30 30 30 65 30 30 31 30 30 30 30 38 37 30 32 30 30 30 30 63 63 30 32 30 30 30 30 31 33 30 33 30 30 30 30 63 30 30 33 30 30 30 30 37 66 30 34 30 30 30 30 62 35 30 34 30 30 30 30 66 38 30 34 30 30 30 30 33 66 30 35 30 30 30 30 38 33 30 36 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6d010000e001000087020000cc02000013030000c00300007f040000b5040000f80400003f05000083060000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49886	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	826	OUT	GET /v/t1.6435-1/182862089_329809465171561_9124100968924750007_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rbjHzLvzucEAb5bZn4H&_nc_ht=scontent-atl3-2.xx&oh=00_AfDvEfsbAQgrTPLx-opY6lSgCA3J3Ac-nhnwCNbY_jzosg&oe=664928B3 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sun, 09 May 2021 21:41:50 GMT X-Needle-Checksum: 3112362267 thrift_fmhk: GBDHcszWJwSB3wniy7VltMCbFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1392041609 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1471
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1470	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 61 30 31 30 30 30 30 64 37 30 31 30 30 30 30 36 36 30 32 30 30 30 30 38 37 30 32 30 30 30 30 62 64 30 32 30 30 30 30 37 64 30 33 30 30 30 30 32 65 30 34 30 30 30 30 35 65 30 34 30 30 30 30 37 66 30 34 30 30 30 30 61 65 30 34 30 30 30 30 62 66 30 35 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6a010000d70100006602000087020000bd0200007d0300002e0400005e0400007f040000ae040000bf050000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49887	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	593	OUT	GET /v/t39.30808-1/438331716_2765174076970236_1145479496426679813_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=obA5gIRYYUYAb7KFZz4&_nc_ht=scontent-atl3-2.xx&oh=00_AfDhyPAWHnsY26BikqP407np3qhXfYGR6avsj0inolkFDg&oe=6627A836 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Tue, 16 Apr 2024 03:37:13 GMT X-Needle-Checksum: 3242346525 thrift_fmhk: GBA1uX0jH7XsXdrP6F7A+e2xFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=4158901559 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1444
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1443	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 65 32 30 31 30 30 30 30 36 62 30 32 30 30 30 30 62 62 30 32 30 30 30 30 30 36 30 33 30 30 30 30 37 32 30 33 30 30 30 30 66 62 30 33 30 30 30 30 33 33 30 34 30 30 30 30 37 37 30 34 30 30 30 30 62 66 30 34 30 30 30 30 61 34 30 35 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000e20100006b020000bb0200000603000072030000fb0300003304000077040000bf040000a4050000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49890	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	590	OUT	GET /v/t1.6435-1/166562961_289775365843871_1089544784969631943_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=gsiZqHemNI0Ab7xotOc&_nc_ht=scontent-atl3-2.xx&oh=00_AfCJ2y8PnGo5iYFIOIqkgTsp2QT4Magjkq-glreMKFQsPQ&oe=664932DC HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sun, 28 Mar 2021 16:21:52 GMT X-Needle-Checksum: 3944168440 thrift_fmhk: GBBjlJjG/0UEomG65ORFlITHFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=657512465 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1983
2024-04-19 01:40:46 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:46 UTC	1982	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 9c 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 80 1c 02 67 00 14 55 4a 73 2d 76 4e 72 44 44 47 77 73 47 78 5f 67 71 51 6b 32 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 38 35 30 31 30 30 30 30 66 62 30 31 30 30 30 30 62 61 30 32 30 30 30 30 30 32 30 33 30 30 30 30 35 65 30 33 30 30 30 30 36 32 30 34 30 30 30 30 35 33 30 35 30 30 30 30 38 64 30 35 30 30 30 30 64 36 30 35 30 30 30 30 32 66 30 36 30 30 30 30 62 66 30 37 30 30 30 30 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a Data Ascii: JFIFPhotoshop 3.08BIMgUJs-vNrDDGwsGx_gqQk2(bFBMD0a000a85010000fb010000ba020000020300005e03000062040000530500008d050000d60500002f060000bf070000C%# , #&')*)-0-(0%()(C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49889	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	829	OUT	GET /v/t51.29350-10/438844348_833636295261460_8820580507418716899_n.jpg?stp=dst-jpg_p206x206&_nc_cat=111&ccb=1-7&_nc_sid=5f2048&_nc_ohc=J7XdDp8SzdsAb7ozIpk&_nc_ht=scontent-atl3-2.xx&oh=00_AfCB8Q844RX1O_1OVOJ0GECUmomF3JgeZ_RWXRdhba-onA&oe=66278584 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:46 UTC	786	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 01:46:42 GMT X-Needle-Checksum: 4278261544 thrift_fmhk: GBAEVzC0JsOZAxaiesL/+5ZgFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=768445106 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:46 GMT X-FB-Edge-Debug: QKzpiwVrZYsKvUzZfxBOjTm0s6F6a43wDv3YKTv_M6wC7kSOwAL79oSOZ6pr2KxJ9BZl2nsJjLKzpmG7qLyZw_tNMNrMxFQTYeL3-KNSZBY X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=35, ullat=0 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 19202
2024-04-19 01:40:46 UTC	714	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 34 66 30 36 30 30 30 30 38 39 30 66 30 30 30 30 37 31 31 30 30 30 30 30 37 63 31 31 30 30 30 30 63 39 31 63 30 30 30 30 63 62 32 63 30 30 30 30 65 30 32 64 30 30 30 30 32 38 32 66 30 30 30 30 61 35 33 30 30 30 30 30 30 32 34 62 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a700100004f060000890f0000711000007c110000c91c0000cb2c0000e02d0000282f0000a5300000024b0000C%# , #&')*)-0-(0%()(C((((((((((((((
2024-04-19 01:40:47 UTC	15622	IN	Data Raw: fc ef ec 3f 34 4a 06 02 e3 91 4a d4 cc ac 1f 8f 3e b6 7b 8a e0 c4 5b 7c 69 5e 56 f9 55 c3 d1 7a ab 95 bf 4e aa d6 d0 31 48 d3 5c ad e4 ea 91 74 08 75 c5 3c 74 74 4f 47 f0 1b 70 6b 1f 2a b4 6e fb b7 15 49 a4 3e cf 99 d8 d0 bd c7 af d2 a9 0f 68 58 cd 64 92 4a 18 6a 5d 8c 33 da 89 56 3f ba 78 4e 66 fc fe 25 90 b4 1f ce ef 6e 88 94 e7 bd 0e 36 fe 7e 9d 83 b6 94 be 9f 36 16 fa 9f 4d e8 f3 db 30 c9 8b e0 5a 96 6c b9 f5 1b 03 2e 35 5d 9c da 63 77 83 4e ba 70 d8 96 f6 67 15 ec 0a 3e 3b 51 5f e6 c7 41 eb 03 58 eb 29 b4 3b 13 95 97 b7 53 6f 6b 6f d3 bd 80 2b 11 38 b7 c7 a2 dc b4 aa 3a 59 61 b7 99 67 9a 48 5f 29 62 ab b6 45 15 ae 29 74 15 5f 61 06 5b 2c 1d b5 7d 56 12 f5 c6 8d 8f 98 d5 52 d8 98 d4 6b 21 9b 59 97 87 ea c1 dc 86 d7 87 6a 01 df 54 e7 4d a1 60 0d 61 60 Data Ascii: ?4JJ>{[\|i^VUzN1H\tu<ttOGpk*nI>hXdJj]3V?xNf%n6~6M0Zl.5]cwNpg>;Q_AX);Soko+8:YagH_)bE)t_a[,}VRk!YjTM`a`
2024-04-19 01:40:47 UTC	1500	IN	Data Raw: 87 c8 bf d8 7e 23 da 01 97 fd c7 85 2d 02 9f 12 d1 8f b2 e6 1e fe 7b 4f 21 77 ee 2e 81 e9 dc c0 5d 2d e2 3d 7a a1 41 78 bb 3f 17 2b 05 d0 73 c0 04 51 58 3d 3f 1a 8c d6 07 8a 06 10 58 af 0e 6b f0 97 07 00 b5 89 7c 31 92 e5 b5 54 58 1d b8 2b 10 af e9 45 99 18 7d f3 64 74 1a 38 2b 01 d0 b4 6f 6d 1a 48 c3 6a 4b 53 08 5e 81 02 d0 2e ad bc 5e 35 f8 99 30 1b b2 42 85 96 5d e5 fa 98 2f 83 05 70 d7 c3 5b cb 88 a4 83 66 00 51 58 b8 66 2c a0 4a 07 ab 6b d1 28 0c d5 10 b7 9d b0 79 38 87 07 5b b1 d4 c6 ef b8 69 52 5e 72 bc 42 bb 00 6a 7e 06 1e 2b 2c 2b 3c 16 e0 f1 16 98 01 e0 8e d9 dc bf 55 67 b8 66 d3 2c 02 c3 2e 70 b9 aa ac e2 ec b6 98 35 50 1c 2e d7 00 3c 01 75 f3 b9 8e e3 05 67 dc 79 78 ed 2b 99 f7 b8 7a 5f c3 09 ae 6a 24 a6 78 84 64 cc 2d 0c 68 be 73 1e 48 95 42 Data Ascii: ~#-{O!w.]-=zAx?+sQX=?Xk\|1TX+E}dt8+omHjKS^.^50B]/p[fQXf,Jk(y8[iR^rBj~+,+<Ugf,.p5P.<ugyx+z_j$xd-hsHB
2024-04-19 01:40:47 UTC	1366	IN	Data Raw: 46 e9 e5 b4 d9 a7 56 ff 00 8c c4 7a 9f f0 81 a5 5b aa df 50 4c 14 3a 80 00 12 23 c8 c5 9a 30 95 e5 b0 3c 9a f8 96 5a 9c 96 1d 92 ff 00 1f 99 7c 02 b0 1a ae b3 52 b5 48 68 30 d3 f7 02 a9 1f 0d ca 77 0b 0a 2a 29 e6 0d 65 ff 00 f2 ad 50 4f 88 40 34 be 25 1c d4 ed 5e d1 87 55 32 68 79 51 11 6b 00 9b 57 fa 96 05 9c e1 66 80 af c4 b0 43 bc 23 5a 81 b0 ce 73 4d b7 dc 45 06 03 10 91 5a 32 c2 ab 8d 04 67 38 c6 49 b8 b2 3f e1 7f 12 e8 c6 a5 34 3f aa 84 16 62 3b 16 79 bd 90 6c d3 c7 23 e8 22 34 05 e5 94 1a e6 5d 5a 9e 41 15 02 96 94 4f a8 6e 16 e8 73 2a 36 20 73 c4 3a 00 bd 29 fe 45 71 8f 50 06 74 11 ad bb f1 09 44 51 77 17 00 e1 77 1d 20 02 ab 94 ab 5b 77 ca 01 07 ff 00 b9 60 c2 e5 6b 12 ed da c9 15 80 3d 25 f1 cb 21 dd 3f 90 c8 83 57 96 5d 03 9d f3 ea 22 40 59 29 Data Ascii: FVz[PL:#0<Z\|RHh0w)ePO@4%^U2hyQkWfC#ZsMEZ2g8I?4?b;yl#"4]ZAOns6 s:)EqPtDQww [w`k=%!?W]"@Y)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49891	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	829	OUT	GET /v/t39.30808-1/417843986_7077021149032703_7323956251606094932_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=LP1IcS8WNgkAb5jFRoV&_nc_ht=scontent-atl3-2.xx&oh=00_AfA70jyAe-1RiEXheUHVhxrne1KBbSQ7H9DEFsRhZDQbsQ&oe=6627932F HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	786	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 08 Jan 2024 03:50:44 GMT X-Needle-Checksum: 2552508717 thrift_fmhk: GBDDIiS8AFV+BPpJwva55rNwFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3763837103 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Edge-Debug: uhCPXoKY_RFwn5OEgJdEIUPXEV3jrx0Eh2bK6oCxsYfo7is3t08vryAR5O5PWzN5n2PNE-4O40mqaHtAGEtLag3sYVBlpV4RaR2mOxwraR0 X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=23, ullat=0 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1851
2024-04-19 01:40:47 UTC	714	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 65 37 30 31 30 30 30 30 39 32 30 32 30 30 30 30 64 35 30 32 30 30 30 30 32 61 30 33 30 30 30 30 31 32 30 34 30 30 30 30 66 63 30 34 30 30 30 30 33 33 30 35 30 30 30 30 37 32 30 35 30 30 30 30 62 62 30 35 30 30 30 30 33 62 30 37 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000e701000092020000d50200002a03000012040000fc0400003305000072050000bb0500003b070000C%# , #&')*)-0-(0%()(C((((((((((((((
2024-04-19 01:40:47 UTC	1137	IN	Data Raw: 00 00 01 02 03 10 11 12 21 31 51 ff da 00 08 01 02 01 01 3f 01 9a e8 a4 a1 c3 55 2f 0d 06 f6 f0 94 33 d2 94 1a 46 0a 1f 0a 72 e5 b0 47 db 2b 7f ff c4 00 2e 10 00 01 03 02 04 02 08 07 00 00 00 00 00 00 00 00 01 00 02 21 03 11 12 22 31 41 10 61 04 13 23 32 42 51 71 81 62 72 92 a2 b1 c1 e3 ff da 00 08 01 01 00 06 3f 02 e0 3a c2 6e 7c 21 5e 9b 9c 39 22 d8 c6 de 35 2d ad 8a 2d ad 57 6c a0 ee 9f 5d cd ec 9c 72 d8 de 17 67 0a 8b fc f2 bb 85 4e d1 dd e3 ba aa 7e 12 9b 55 b0 34 bf 9a a2 f2 c6 e3 75 30 4a 71 6d 2a 98 7d 13 2f ea 8a 77 aa 2e 6b 81 88 4c 35 05 cf 57 a5 4d dd 74 4e 3b 61 20 5b 95 93 df 9b ca 4a 18 6f f3 14 e6 55 9c b0 e2 8c bb e8 52 23 70 8f 56 03 79 b6 0a a7 86 f7 71 b4 9b a9 1e eb 16 aa 7d 82 ee 7d 8b 11 f1 9d 13 88 6c de d7 5d 1a 9e c2 4a 75 5a 91 Data Ascii: !1Q?U/3FrG+.!"1Aa#2BQqbr?:n\|!^9"5--Wl]rgN~U4u0Jqm*}/w.kL5WMtN;a [JoUR#pVyq}}l]JuZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49892	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	593	OUT	GET /v/t39.30808-1/414867464_7046595375378763_4861839573446109840_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=QVssM7vGW2oAb4BrMfp&_nc_ht=scontent-atl3-2.xx&oh=00_AfDu-H0r-6CfzXEJPa3gbJwso6VAEOgSMr--wRf3P1KcMw&oe=66279958 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Fri, 29 Dec 2023 16:52:16 GMT X-Needle-Checksum: 1319188037 thrift_fmhk: GBDlUfkgekJE5TTsB6BaAVk2FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=2144270772 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1554
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	1553	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 65 38 30 31 30 30 30 30 37 39 30 32 30 30 30 30 62 63 30 32 30 30 30 30 30 38 30 33 30 30 30 30 61 33 30 33 30 30 30 30 34 37 30 34 30 30 30 30 38 30 30 34 30 30 30 30 62 64 30 34 30 30 30 30 30 33 30 35 30 30 30 30 31 32 30 36 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000e801000079020000bc02000008030000a30300004704000080040000bd0400000305000012060000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49893	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:46 UTC	1278	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=a&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1383 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryipDmhC29F1BcaWcu sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
2024-04-19 01:40:46 UTC	1383	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 69 70 44 6d 68 43 32 39 46 31 42 63 61 57 63 75 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 35 35 35 33 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 69 70 44 6d 68 43 32 39 46 31 42 63 61 57 63 75 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 78 9c d5 56 61 Data Ascii: ------WebKitFormBoundaryipDmhC29F1BcaWcuContent-Disposition: form-data; name="ts"1713490845553------WebKitFormBoundaryipDmhC29F1BcaWcuContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamxVa
2024-04-19 01:40:47 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:47 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:47 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49894	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	827	OUT	GET /v/t15.5256-10/429173328_1660370348130360_2791089032841410318_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=oTY5-d1wVVAAb4mnIdt&_nc_ht=scontent-atl3-2.xx&oh=00_AfDbm_PgkHfw_O7s22gOSLB_gTtS0owWxPY3tvmWzgR_aQ&oe=66278BDF HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sat, 13 Apr 2024 20:01:45 GMT X-Needle-Checksum: 202713080 thrift_fmhk: GBDcD5oxaWtIElSCHXHV9cUyFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3403809335 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 10418
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	10417	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 38 62 30 35 30 30 30 30 35 39 30 61 30 30 30 30 31 64 30 62 30 30 30 30 32 34 30 63 30 30 30 30 35 32 31 32 30 30 30 30 33 39 31 39 30 30 30 30 35 31 31 61 30 30 30 30 36 66 31 62 30 30 30 30 62 39 31 63 30 30 30 30 62 32 32 38 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a700100008b050000590a00001d0b0000240c00005212000039190000511a00006f1b0000b91c0000b2280000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49895	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	590	OUT	GET /v/t1.6435-1/182862089_329809465171561_9124100968924750007_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=rbjHzLvzucEAb5bZn4H&_nc_ht=scontent-atl3-2.xx&oh=00_AfDvEfsbAQgrTPLx-opY6lSgCA3J3Ac-nhnwCNbY_jzosg&oe=664928B3 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sun, 09 May 2021 21:41:50 GMT X-Needle-Checksum: 3112362267 thrift_fmhk: GBDHcszWJwSB3wniy7VltMCbFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=1392041609 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1471
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	1470	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 61 30 31 30 30 30 30 64 37 30 31 30 30 30 30 36 36 30 32 30 30 30 30 38 37 30 32 30 30 30 30 62 64 30 32 30 30 30 30 37 64 30 33 30 30 30 30 32 65 30 34 30 30 30 30 35 65 30 34 30 30 30 30 37 66 30 34 30 30 30 30 61 65 30 34 30 30 30 30 62 66 30 35 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6a010000d70100006602000087020000bd0200007d0300002e0400005e0400007f040000ae040000bf050000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49896	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	830	OUT	GET /v/t39.30808-1/297577919_10217274176765031_2994694822502324520_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-3rUZ9jyX0wAb5bIv02&_nc_ht=scontent-atl3-2.xx&oh=00_AfCINx_mKEMbP48d8aI4g-TLfOU0Eri64MtOnKfkm9oufA&oe=6627AB82 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Thu, 04 Aug 2022 12:15:22 GMT X-Needle-Checksum: 2587559349 thrift_fmhk: GBCXxC0Wpn5UbJNeJXjJD4O5FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=573673310 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1838
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	1837	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 65 66 30 31 30 30 30 30 39 64 30 32 30 30 30 30 30 39 30 33 30 30 30 30 38 31 30 33 30 30 30 30 33 31 30 34 30 30 30 30 65 62 30 34 30 30 30 30 32 61 30 35 30 30 30 30 39 35 30 35 30 30 30 30 30 38 30 36 30 30 30 30 32 65 30 37 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000ef0100009d020000090300008103000031040000eb0400002a05000095050000080600002e070000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49898	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	593	OUT	GET /v/t51.29350-10/438844348_833636295261460_8820580507418716899_n.jpg?stp=dst-jpg_p206x206&_nc_cat=111&ccb=1-7&_nc_sid=5f2048&_nc_ohc=J7XdDp8SzdsAb7ozIpk&_nc_ht=scontent-atl3-2.xx&oh=00_AfCB8Q844RX1O_1OVOJ0GECUmomF3JgeZ_RWXRdhba-onA&oe=66278584 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 15 Apr 2024 01:46:42 GMT X-Needle-Checksum: 4278261544 thrift_fmhk: GBAEVzC0JsOZAxaiesL/+5ZgFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=768445106 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=6, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 19202
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	15143	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 34 66 30 36 30 30 30 30 38 39 30 66 30 30 30 30 37 31 31 30 30 30 30 30 37 63 31 31 30 30 30 30 63 39 31 63 30 30 30 30 63 62 32 63 30 30 30 30 65 30 32 64 30 30 30 30 32 38 32 66 30 30 30 30 61 35 33 30 30 30 30 30 30 32 34 62 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a700100004f060000890f0000711000007c110000c91c0000cb2c0000e02d0000282f0000a5300000024b0000C%# , #&')*)-0-(0%()(C(((((((((((((((
2024-04-19 01:40:47 UTC	4058	IN	Data Raw: be d4 c1 e4 ae 16 5b 7c be 92 d3 f1 01 01 19 50 ab 77 cf 12 b4 07 65 d8 38 1f 35 3b b2 0e 07 67 88 b5 6c 08 65 38 7d 6b 50 65 ed 81 44 2d a3 37 ab 8e a0 3b c1 5b e9 44 a6 b7 b9 fc 7b bc 91 a6 22 b1 87 c3 93 e6 e2 3e 5b 87 13 06 f1 6e 68 6d f9 97 6e 66 6a c5 47 83 a8 c2 76 0a d4 0d f5 af 98 1c d1 b0 7f ee 32 15 d5 c2 ae bb 97 a1 41 c8 31 5b cb 12 06 aa db 9e f3 89 5e 5e 77 ff 00 49 5c ce 16 0b d2 b0 52 7e 2c 0f ec bd 2e 72 bd f5 83 31 d9 33 48 e9 f1 50 a3 25 ef fc 27 0c 91 b2 0c 97 79 ea 01 34 34 80 f5 71 ce 15 c6 07 dc 33 6d 7d 40 96 71 03 fd e2 b5 fe 03 9f 75 af 11 bf d8 30 b4 3f 58 9c a4 86 e6 28 6b 93 70 d4 61 55 05 77 59 2b b8 df 00 2d 74 3a bb b2 fd cd c0 b8 64 3e 86 a0 da b2 86 d3 77 93 12 91 ad 0f 7f 43 f9 ea 00 ba 3a 74 ae d0 ef de ba b8 be 10 66 Data Ascii: [\|Pwe85;gle8}kPeD-7;[D{">[nhmnfjGv2A1[^^wI\R~,.r13HP%'y44q3m}@qu0?X(kpaUwY+-t:d>wC:tf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49899	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	593	OUT	GET /v/t39.30808-1/417843986_7077021149032703_7323956251606094932_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=LP1IcS8WNgkAb5jFRoV&_nc_ht=scontent-atl3-2.xx&oh=00_AfA70jyAe-1RiEXheUHVhxrne1KBbSQ7H9DEFsRhZDQbsQ&oe=6627932F HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Mon, 08 Jan 2024 03:50:44 GMT X-Needle-Checksum: 2552508717 thrift_fmhk: GBDDIiS8AFV+BPpJwva55rNwFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3763837103 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=105, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1851
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	1850	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 65 30 31 30 30 30 30 65 37 30 31 30 30 30 30 39 32 30 32 30 30 30 30 64 35 30 32 30 30 30 30 32 61 30 33 30 30 30 30 31 32 30 34 30 30 30 30 66 63 30 34 30 30 30 30 33 33 30 35 30 30 30 30 37 32 30 35 30 30 30 30 62 62 30 35 30 30 30 30 33 62 30 37 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6e010000e701000092020000d50200002a03000012040000fc0400003305000072050000bb0500003b070000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49897	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	611	OUT	GET /rsrc.php/v3/yO/r/q8Uic1K195T.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	1608	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: wVbBB65zXF84EyICNeDRHg== Expires: Sat, 05 Apr 2025 08:27:18 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: 9t3G7GtZLiwUGkPgjJgYc6t1o7oTVgqIERoqhyM1xBHofYZneDFUXfYfzkWgGTw7cFrY1qTqYoYSH0g+16AG3Q== Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 804
2024-04-19 01:40:47 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:47 UTC	803	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 19 00 00 00 40 08 03 00 00 00 d8 b6 2c 6e 00 00 00 f6 50 4c 54 45 47 70 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDR@,nPLTEGpL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49900	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	733	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=a&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
2024-04-19 01:40:47 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:47 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:47 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49901	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	591	OUT	GET /v/t15.5256-10/429173328_1660370348130360_2791089032841410318_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=oTY5-d1wVVAAb4mnIdt&_nc_ht=scontent-atl3-2.xx&oh=00_AfDbm_PgkHfw_O7s22gOSLB_gTtS0owWxPY3tvmWzgR_aQ&oe=66278BDF HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	660	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Sat, 13 Apr 2024 20:01:45 GMT X-Needle-Checksum: 202713080 thrift_fmhk: GBDcD5oxaWtIElSCHXHV9cUyFfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=3403809335 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=2, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 10418
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	10417	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 37 30 30 31 30 30 30 30 38 62 30 35 30 30 30 30 35 39 30 61 30 30 30 30 31 64 30 62 30 30 30 30 32 34 30 63 30 30 30 30 35 32 31 32 30 30 30 30 33 39 31 39 30 30 30 30 35 31 31 61 30 30 30 30 36 66 31 62 30 30 30 30 62 39 31 63 30 30 30 30 62 32 32 38 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a700100008b050000590a00001d0b0000240c00005212000039190000511a00006f1b0000b91c0000b2280000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49902	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	632	OUT	GET /hads-ak-prn2/1487645_6012475414660_1439393861_n.png HTTP/1.1 Host: scontent.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	417	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Fri, 21 Dec 2012 00:00:01 GMT Expires: Fri, 19 Apr 2024 01:40:47 GMT cross-origin-resource-policy: cross-origin Server: proxygen-bolt Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 79
2024-04-19 01:40:47 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:47 UTC	78	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 0a 08 02 00 00 00 02 50 58 ea 00 00 00 16 49 44 41 54 18 57 63 fc cf 80 0f 30 61 0a 21 83 91 29 cd c0 00 00 41 2c 01 13 80 ff 5a 6c 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRPXIDATWc0a!)A,ZlIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49903	31.13.88.13	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	594	OUT	GET /v/t39.30808-1/297577919_10217274176765031_2994694822502324520_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=5f2048&_nc_ohc=-3rUZ9jyX0wAb5bIv02&_nc_ht=scontent-atl3-2.xx&oh=00_AfCINx_mKEMbP48d8aI4g-TLfOU0Eri64MtOnKfkm9oufA&oe=6627AB82 HTTP/1.1 Host: scontent-atl3-2.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	659	IN	HTTP/1.1 200 OK x-storage-error-category: dfs:none;sc_p:200:WSE_NOT_SET Last-Modified: Thu, 04 Aug 2022 12:15:22 GMT X-Needle-Checksum: 2587559349 thrift_fmhk: GBCXxC0Wpn5UbJNeJXjJD4O5FfDr4Z0EvFUAAAA= Content-Type: image/jpeg content-digest: adler32=573673310 cross-origin-resource-policy: cross-origin timing-allow-origin: * Access-Control-Allow-Origin: * Cache-Control: max-age=1209600, no-transform Accept-Ranges: bytes Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 1838
2024-04-19 01:40:47 UTC	1	IN	Data Raw: ff Data Ascii:
2024-04-19 01:40:47 UTC	1837	IN	Data Raw: d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff ed 00 84 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 68 1c 02 28 00 62 46 42 4d 44 30 61 30 30 30 61 36 66 30 31 30 30 30 30 65 66 30 31 30 30 30 30 39 64 30 32 30 30 30 30 30 39 30 33 30 30 30 30 38 31 30 33 30 30 30 30 33 31 30 34 30 30 30 30 65 62 30 34 30 30 30 30 32 61 30 35 30 30 30 30 39 35 30 35 30 30 30 30 30 38 30 36 30 30 30 30 32 65 30 37 30 30 30 30 00 ff db 00 43 00 06 04 05 06 05 04 06 06 05 06 07 07 06 08 0a 10 0a 0a 09 09 0a 14 0e 0f 0c 10 17 14 18 18 17 14 16 16 1a 1d 25 1f 1a 1b 23 1c 16 16 20 2c 20 23 26 27 29 2a 29 19 1f 2d 30 2d 28 30 25 28 29 28 ff db 00 43 01 07 07 07 0a 08 0a 13 0a 0a 13 28 1a 16 1a 28 28 28 28 28 28 28 28 28 28 28 28 28 28 Data Ascii: JFIFPhotoshop 3.08BIMh(bFBMD0a000a6f010000ef0100009d020000090300008103000031040000eb0400002a05000095050000080600002e070000C%# , #&')*)-0-(0%()(C(((((((((((((((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49904	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:47 UTC	375	OUT	GET /rsrc.php/v3/yO/r/q8Uic1K195T.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:47 UTC	1608	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: wVbBB65zXF84EyICNeDRHg== Expires: Sat, 05 Apr 2025 08:27:18 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: 9t3G7GtZLiwUGkPgjJgYc6t1o7oTVgqIERoqhyM1xBHofYZneDFUXfYfzkWgGTw7cFrY1qTqYoYSH0g+16AG3Q== Date: Fri, 19 Apr 2024 01:40:47 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 804
2024-04-19 01:40:47 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:47 UTC	803	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 19 00 00 00 40 08 03 00 00 00 d8 b6 2c 6e 00 00 00 f6 50 4c 54 45 47 70 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDR@,nPLTEGpL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49905	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:48 UTC	875	OUT	GET /data/manifest/ HTTP/1.1 Host: www.facebook.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; _js_datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ
2024-04-19 01:40:48 UTC	1248	IN	HTTP/1.1 200 OK Vary: Accept-Encoding Set-Cookie: datr=lMshZix5qPWRCJbLXT1BC9lU; expires=Sat, 24-May-2025 01:40:48 GMT; Max-Age=34560000; path=/; domain=.facebook.com; secure; httponly; SameSite=None Set-Cookie: _js_datr=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=-1713490847; path=/; domain=.facebook.com; httponly Content-Type: application/json reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:48 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:48 UTC	1565	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:40:48 UTC	5	IN	Data Raw: 34 61 66 0d 0a Data Ascii: 4af
2024-04-19 01:40:48 UTC	1206	IN	Data Raw: 7b 22 67 63 6d 5f 73 65 6e 64 65 72 5f 69 64 22 3a 22 31 35 30 35 37 38 31 34 33 35 34 22 2c 22 67 63 6d 5f 75 73 65 72 5f 76 69 73 69 62 6c 65 5f 6f 6e 6c 79 22 3a 74 72 75 65 2c 22 65 64 67 65 5f 73 69 64 65 5f 70 61 6e 65 6c 22 3a 7b 22 70 72 65 66 65 72 72 65 64 5f 77 69 64 74 68 22 3a 33 37 36 7d 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 6e 61 6d 65 22 3a 22 46 61 63 65 62 6f 6f 6b 22 2c 22 73 74 61 72 74 5f 75 72 6c 22 3a 22 5c 2f 3f 72 65 66 3d 68 6f 6d 65 73 63 72 65 65 6e 70 77 61 22 2c 22 64 69 73 70 6c 61 79 22 3a 22 6d 69 6e 69 6d 61 6c 2d 75 69 22 2c 22 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 22 3a 22 23 46 46 46 46 46 46 22 2c 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 22 23 31 38 37 37 46 32 22 2c Data Ascii: {"gcm_sender_id":"15057814354","gcm_user_visible_only":true,"edge_side_panel":{"preferred_width":376},"short_name":"Facebook","name":"Facebook","start_url":"\/?ref=homescreenpwa","display":"minimal-ui","background_color":"#FFFFFF","theme_color":"#1877F2",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49906	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:48 UTC	608	OUT	GET /rsrc.php/yT/r/aGT3gskzWBf.ico HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:48 UTC	1612	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: PnZPD3N3Z7MKaS+rHePOSQ== Expires: Sat, 05 Apr 2025 10:27:07 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: idOz6nr18lyrEJk/9l+5ffcevUc35H30n7WM2WWr1k0svYBPmqAmrlBWRP7RbAOt6U/XTHHD4viUdbtR8vA68Q== Date: Fri, 19 Apr 2024 01:40:48 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=103, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 5430
2024-04-19 01:40:48 UTC	1	IN	Data Raw: 00 Data Ascii:
2024-04-19 01:40:48 UTC	5429	IN	Data Raw: 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 68 08 20 ff 66 08 a0 ff f3 ec cf ff ff ff ff ff ff ff ff ff 66 08 df ff 67 09 90 ff 64 08 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 60 00 10 ff 65 07 90 ff 66 08 ff ff 66 08 ff ff eb e0 ff ff ff ff ff ff ff ff ff ff 66 08 ff ff 66 08 ff ff 66 08 ff ff 65 09 90 ff 70 10 10 00 00 00 00 00 00 00 00 00 00 00 00 ff 60 00 10 ff 66 07 cf ff 66 08 ff ff 66 08 ff ff 66 08 ff ff eb e0 ff ff ff ff ff ff ff ff ff ff 66 08 ff ff 66 08 ff ff 66 08 ff ff 66 Data Ascii: h& ( h ffgd@`efffffep`ffffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49907	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:48 UTC	396	OUT	GET /hads-ak-prn2/1487645_6012475414660_1439393861_n.png HTTP/1.1 Host: scontent.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:48 UTC	417	IN	HTTP/1.1 200 OK Content-Type: image/png Last-Modified: Fri, 21 Dec 2012 00:00:01 GMT Expires: Fri, 19 Apr 2024 01:40:48 GMT cross-origin-resource-policy: cross-origin Server: proxygen-bolt Date: Fri, 19 Apr 2024 01:40:48 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3412, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 79
2024-04-19 01:40:48 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:48 UTC	78	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 0a 08 02 00 00 00 02 50 58 ea 00 00 00 16 49 44 41 54 18 57 63 fc cf 80 0f 30 61 0a 21 83 91 29 cd c0 00 00 41 2c 01 13 80 ff 5a 6c 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRPXIDATWc0a!)A,ZlIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49908	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:48 UTC	372	OUT	GET /rsrc.php/yT/r/aGT3gskzWBf.ico HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:48 UTC	1612	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: PnZPD3N3Z7MKaS+rHePOSQ== Expires: Sat, 05 Apr 2025 10:27:07 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} X-FB-Debug: idOz6nr18lyrEJk/9l+5ffcevUc35H30n7WM2WWr1k0svYBPmqAmrlBWRP7RbAOt6U/XTHHD4viUdbtR8vA68Q== Date: Fri, 19 Apr 2024 01:40:48 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 5430
2024-04-19 01:40:48 UTC	1	IN	Data Raw: 00 Data Ascii:
2024-04-19 01:40:48 UTC	5429	IN	Data Raw: 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 68 08 20 ff 66 08 a0 ff f3 ec cf ff ff ff ff ff ff ff ff ff 66 08 df ff 67 09 90 ff 64 08 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 60 00 10 ff 65 07 90 ff 66 08 ff ff 66 08 ff ff eb e0 ff ff ff ff ff ff ff ff ff ff 66 08 ff ff 66 08 ff ff 66 08 ff ff 65 09 90 ff 70 10 10 00 00 00 00 00 00 00 00 00 00 00 00 ff 60 00 10 ff 66 07 cf ff 66 08 ff ff 66 08 ff ff 66 08 ff ff eb e0 ff ff ff ff ff ff ff ff ff ff 66 08 ff ff 66 08 ff ff 66 08 ff ff 66 Data Ascii: h& ( h ffgd@`efffffep`ffffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49909	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:48 UTC	611	OUT	GET /rsrc.php/v3/y0/r/eFZD1KABzRA.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.facebook.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:48 UTC	1635	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: ZFLtdcU+Go6QpmTfGJWakA== Expires: Sun, 06 Apr 2025 08:21:01 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: RB0VkMUo8makejYcCmyurOYV1Cxk785TxpfaFn/6wKP8Uha2YWr89x0vMDBRPIAwDGCnAw7BsuNdsz1gfV7RfA== Date: Fri, 19 Apr 2024 01:40:48 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3413, tp=-1, tpl=-1, uplat=0, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2106
2024-04-19 01:40:48 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:48 UTC	2105	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 01 59 50 4c 54 45 47 70 4c 05 65 ff 08 65 ff 07 65 ff 10 70 ff 07 65 ff 08 66 ff 08 66 ff 08 68 ff 08 66 ff 07 66 ff 00 60 ff 10 60 ff ff ff ff 08 67 ff 07 66 ff 08 66 ff 08 67 ff 08 67 ff 08 66 ff 08 66 ff 08 66 ff 08 67 ff 07 66 ff 08 68 ff 09 65 ff 08 66 ff 08 64 ff 09 67 ff 07 65 ff 07 65 ff 06 63 ff 0a 66 ff 07 66 ff 08 65 ff 07 66 ff 09 67 ff 06 67 ff 08 65 ff 08 66 ff 08 66 ff ff ff ff ff ff ff 08 69 ff 08 68 ff 07 65 ff 09 66 ff 07 66 ff ff ff ff 0b 65 ff ff ff ff ff ff ff 07 65 ff 07 67 ff 07 66 ff 07 66 ff 0a 66 ff 09 66 ff 07 66 ff 09 66 ff 07 67 ff ff ff ff ff ff ff 06 66 ff 08 65 ff 07 65 ff ff ff ff 87 b7 ff 46 8c ff ff ff ff ff ff ff ff ff Data Ascii: PNGIHDRe5YPLTEGpLeeepeffhff``gffggfffgfhefdgeecffefggeffiheffeegffffffgfeeF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49910	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:49 UTC	1273	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=b&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 990 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygBwI4T0SW1FPVu1E sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:49 UTC	990	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 67 42 77 49 34 54 30 53 57 31 46 50 56 75 31 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 37 39 32 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 67 42 77 49 34 54 30 53 57 31 46 50 56 75 31 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 78 9c e5 91 cb Data Ascii: ------WebKitFormBoundarygBwI4T0SW1FPVu1EContent-Disposition: form-data; name="ts"1713490847926------WebKitFormBoundarygBwI4T0SW1FPVu1EContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamx
2024-04-19 01:40:49 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:49 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:49 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49911	31.13.65.7	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:49 UTC	375	OUT	GET /rsrc.php/v3/y0/r/eFZD1KABzRA.png HTTP/1.1 Host: static.xx.fbcdn.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:40:50 UTC	1635	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT content-md5: ZFLtdcU+Go6QpmTfGJWakA== Expires: Sun, 06 Apr 2025 08:21:01 GMT Cache-Control: public,max-age=31536000,immutable reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/" timing-allow-origin: * document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" cross-origin-resource-policy: cross-origin X-Content-Type-Options: nosniff report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} origin-agent-cluster: ?0 X-FB-Debug: RB0VkMUo8makejYcCmyurOYV1Cxk785TxpfaFn/6wKP8Uha2YWr89x0vMDBRPIAwDGCnAw7BsuNdsz1gfV7RfA== Date: Fri, 19 Apr 2024 01:40:50 GMT X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=14, mss=1277, tbw=3414, tp=-1, tpl=-1, uplat=1, ullat=-1 Alt-Svc: h3=":443"; ma=86400 Connection: close Content-Length: 2106
2024-04-19 01:40:50 UTC	1	IN	Data Raw: 89 Data Ascii:
2024-04-19 01:40:50 UTC	2105	IN	Data Raw: 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c0 00 00 00 c0 08 03 00 00 00 65 02 9c 35 00 00 01 59 50 4c 54 45 47 70 4c 05 65 ff 08 65 ff 07 65 ff 10 70 ff 07 65 ff 08 66 ff 08 66 ff 08 68 ff 08 66 ff 07 66 ff 00 60 ff 10 60 ff ff ff ff 08 67 ff 07 66 ff 08 66 ff 08 67 ff 08 67 ff 08 66 ff 08 66 ff 08 66 ff 08 67 ff 07 66 ff 08 68 ff 09 65 ff 08 66 ff 08 64 ff 09 67 ff 07 65 ff 07 65 ff 06 63 ff 0a 66 ff 07 66 ff 08 65 ff 07 66 ff 09 67 ff 06 67 ff 08 65 ff 08 66 ff 08 66 ff ff ff ff ff ff ff 08 69 ff 08 68 ff 07 65 ff 09 66 ff 07 66 ff ff ff ff 0b 65 ff ff ff ff ff ff ff 07 65 ff 07 67 ff 07 66 ff 07 66 ff 0a 66 ff 09 66 ff 07 66 ff 09 66 ff 07 67 ff ff ff ff ff ff ff 06 66 ff 08 65 ff 07 65 ff ff ff ff 87 b7 ff 46 8c ff ff ff ff ff ff ff ff ff Data Ascii: PNGIHDRe5YPLTEGpLeeepeffhff``gffggfffgfhefdgeecffefggeffiheffeegffffffgfeeF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49912	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:52 UTC	1277	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=c&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 5280 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryapxAi9PO5NRPnZWP sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:52 UTC	5280	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 70 78 41 69 39 50 4f 35 4e 52 50 6e 5a 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 34 38 38 37 33 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 70 78 41 69 39 50 4f 35 4e 52 50 6e 5a 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a a5 6a d0 5b 5b Data Ascii: ------WebKitFormBoundaryapxAi9PO5NRPnZWPContent-Disposition: form-data; name="ts"1713490848873------WebKitFormBoundaryapxAi9PO5NRPnZWPContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamj[[
2024-04-19 01:40:52 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:52 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:52 UTC	1817	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49913	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:52 UTC	1278	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=d&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 54365 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryvTeXXT9wDuTLV2nB sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:52 UTC	16384	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 76 54 65 58 58 54 39 77 44 75 54 4c 56 32 6e 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 35 30 38 39 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 76 54 65 58 58 54 39 77 44 75 54 4c 56 32 6e 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a aa ca 03 40 5b Data Ascii: ------WebKitFormBoundaryvTeXXT9wDuTLV2nBContent-Disposition: form-data; name="ts"1713490850896------WebKitFormBoundaryvTeXXT9wDuTLV2nBContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-stream@[
2024-04-19 01:40:52 UTC	16384	OUT	Data Raw: 64 67 34 42 48 44 62 57 43 56 59 57 41 41 42 54 42 53 77 57 6a 52 45 41 63 2f 34 56 48 56 49 56 48 56 5a 34 41 46 59 57 41 48 4b 4f 41 43 6b 6f 42 44 49 33 2f 76 4d 4a 46 76 4d 4a 44 59 45 4d 61 48 52 74 62 42 36 4b 45 45 6f 54 41 48 4b 52 41 50 35 42 41 6b 6c 42 4a 59 48 79 69 41 41 70 47 66 34 63 44 42 34 63 44 41 32 52 46 48 52 70 5a 58 4a 50 62 75 48 6a 51 68 45 41 2f 68 55 42 6f 68 55 42 33 6f 51 41 4b 52 45 41 4d 66 34 74 44 52 6f 74 44 54 30 41 43 46 52 33 62 34 46 6e 4b 62 4d 42 6e 67 6b 52 2f 68 45 42 73 68 45 42 43 58 4f 32 68 41 41 35 45 51 51 73 49 75 35 65 49 68 4a 65 49 67 31 37 6b 47 46 6b 63 46 39 31 63 32 56 44 62 32 31 6c 64 45 78 76 5a 30 6c 75 52 6d 39 79 62 56 46 31 5a 58 4a 35 55 6d 56 73 59 58 6c 51 63 6d 56 73 62 32 45 4f 69 53 41 Data Ascii: dg4BHDbWCVYWAABTBSwWjREAc/4VHVIVHVZ4AFYWAHKOACkoBDI3/vMJFvMJDYEMaHRtbB6KEEoTAHKRAP5BAklBJYHyiAApGf4cDB4cDA2RFHRpZXJPbuHjQhEA/hUBohUB3oQAKREAMf4tDRotDT0ACFR3b4FnKbMBngkR/hEBshEBCXO2hAA5EQQsIu5eIhJeIg17kGFkcF91c2VDb21ldExvZ0luRm9ybVF1ZXJ5UmVsYXlQcmVsb2EOiSA
2024-04-19 01:40:52 UTC	16384	OUT	Data Raw: 4d 7a 59 78 44 69 52 55 51 6a 63 73 45 44 4d 30 4d 44 51 31 2f 73 59 4d 2f 73 59 4d 2f 73 59 4d 4d 73 59 4d 46 44 63 34 4f 44 45 34 4e 78 4a 63 4d 43 36 30 4c 42 71 33 4d 6a 4b 7a 4c 42 51 33 4f 44 6b 77 4f 44 63 53 45 44 41 45 4e 54 6b 4f 63 33 78 53 71 52 44 2b 61 52 4d 4f 61 52 4e 36 6c 77 4d 41 58 77 34 56 57 38 34 44 41 67 55 35 64 67 55 43 47 6c 45 54 2f 6b 59 6e 46 6b 59 6e 34 71 51 41 34 6a 6b 41 55 74 73 47 2f 6d 49 77 47 6d 49 77 34 70 55 41 34 6a 6b 41 53 74 38 47 41 44 42 65 4c 35 33 2b 33 77 61 4b 33 77 5a 46 50 2b 4c 4e 41 50 37 6a 42 76 37 6a 42 6c 62 6a 42 76 62 55 41 50 37 61 44 4a 72 61 44 49 62 57 43 66 37 48 41 4a 72 63 44 41 51 32 4d 41 36 34 63 6b 59 58 42 67 41 79 45 70 4e 66 2f 75 41 4d 2f 75 41 4d 2f 75 41 4d 32 75 41 4d 2f 67 30 Data Ascii: MzYxDiRUQjcsEDM0MDQ1/sYM/sYM/sYMMsYMFDc4ODE4NxJcMC60LBq3MjKzLBQ3ODkwODcSEDAENTkOc3xSqRD+aRMOaRN6lwMAXw4VW84DAgU5dgUCGlET/kYnFkYn4qQA4jkAUtsG/mIwGmIw4pUA4jkASt8GADBeL53+3waK3wZFP+LNAP7jBv7jBlbjBvbUAP7aDJraDIbWCf7HAJrcDAQ2MA64ckYXBgAyEpNf/uAM/uAM/uAM2uAM/g0
2024-04-19 01:40:52 UTC	5213	OUT	Data Raw: 33 0e 2c 08 b8 71 47 67 63 42 32 47 61 45 46 77 41 31 42 62 78 69 6e 41 41 70 63 51 41 30 59 6a 6f 48 41 44 49 46 58 31 70 55 41 52 72 61 47 47 6f 39 41 47 0e cb 24 58 41 79 52 58 78 6d 48 52 68 79 36 77 45 57 69 68 5a 79 6c 77 42 71 6c 0e 5c 1f 04 6d 49 41 70 e0 43 41 79 6b 74 43 44 45 34 4f 57 4c 4d 41 53 6b 76 59 6d 63 49 4b 54 46 69 65 77 43 43 4c 67 46 69 46 41 64 79 4c 51 45 57 47 52 64 71 74 41 41 42 65 47 49 69 41 67 6d 30 81 dc f0 4e 33 6b 34 42 61 56 5a 61 44 51 45 70 61 32 4a 74 43 68 59 4c 47 47 49 38 41 43 48 45 59 6f 55 42 69 53 64 6d 33 42 6b 4a 58 47 4c 78 41 49 6b 73 59 6e 73 41 49 51 34 45 4d 54 5a 6d 31 77 4a 4a 49 6d 71 64 41 71 46 59 59 71 77 42 4b 65 68 01 d0 f0 fc 4a 58 57 6f 66 41 43 45 5a 64 72 73 41 58 6e 6f 46 65 68 59 42 45 5a Data Ascii: 3,qGgcB2GaEFwA1BbxinAApcQA0YjoHADIFX1pUARraGGo9AG$XAyRXxmHRhy6wEWihZylwBql\mIApCAyktCDE4OWLMASkvYmcIKTFiewCCLgFiFAdyLQEWGRdqtAABeGIiAgm0N3k4BaVZaDQEpa2JtChYLGGI8ACHEYoUBiSdm3BkJXGLxAIksYnsAIQ4EMTZm1wJJImqdAqFYYqwBKehJXWofACEZdrsAXnoFehYBEZ
2024-04-19 01:40:52 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:52 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:52 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49915	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:52 UTC	729	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=b&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:52 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:52 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:52 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49916	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:53 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d+yvfuDOyXFdawd&MD=Th7e1MAM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 01:40:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b002fe9d-3487-4af4-adde-03788aa732be MS-RequestId: 7bb79d11-69b8-46d7-941f-6699e48e3757 MS-CV: HVj059gPaUONqzOs.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 01:40:53 GMT Connection: close Content-Length: 24490
2024-04-19 01:40:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-19 01:40:53 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49914	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:55 UTC	1274	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=e&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1044 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBMBA7Ut5KUCZfGlY sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:55 UTC	1044	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 4d 42 41 37 55 74 35 4b 55 43 5a 66 47 6c 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 35 34 35 36 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 42 4d 42 41 37 55 74 35 4b 55 43 5a 66 47 6c 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 78 9c e5 53 cb Data Ascii: ------WebKitFormBoundaryBMBA7Ut5KUCZfGlYContent-Disposition: form-data; name="ts"1713490854566------WebKitFormBoundaryBMBA7Ut5KUCZfGlYContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamxS
2024-04-19 01:40:55 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:55 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:55 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49921	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:40:56 UTC	729	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=e&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:40:56 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:40:56 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:40:56 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49922	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:06 UTC	1038	OUT	POST /ajax/webstorage/process_keys/?state=1 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 823 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:41:06 UTC	823	OUT	Data Raw: 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 53 65 73 73 69 6f 6e 5d 3d 32 30 26 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 68 62 5f 74 69 6d 65 73 74 61 6d 70 5d 3d 31 33 26 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 62 61 6e 7a 61 69 25 33 41 6c 61 73 74 5f 73 74 6f 72 61 67 65 5f 66 6c 75 73 68 5d 3d 31 33 26 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 73 69 67 6e 61 6c 5f 66 6c 75 73 68 5f 74 69 6d 65 73 74 61 6d 70 5d 3d 31 33 26 73 65 73 73 69 6f 6e 5f 73 74 6f 72 61 67 65 5b 54 61 62 49 64 5d 3d 36 26 6c 6f 67 74 69 6d 65 3d 30 26 5f 5f 61 61 69 64 3d 30 26 5f 5f 75 73 65 72 3d 30 26 5f 5f 61 3d 31 26 5f 5f 72 65 71 3d 66 26 5f 5f 68 73 3d 31 39 38 33 32 2e 48 59 50 25 33 41 63 6f 6d 65 74 5f 6c 6f 67 67 65 64 6f 75 74 5f 70 6b 67 2e 32 2e 31 2e 2e 30 2e Data Ascii: local_storage[Session]=20&local_storage[hb_timestamp]=13&local_storage[banzai%3Alast_storage_flush]=13&local_storage[signal_flush_timestamp]=13&session_storage[TabId]=6&logtime=0&__aaid=0&__user=0&__a=1&__req=f&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.
2024-04-19 01:41:07 UTC	1546	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" cross-origin-resource-policy: cross-origin cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report" Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff
2024-04-19 01:41:07 UTC	1227	IN	Data Raw: 72 65 70 6f 72 74 2d 74 6f 3a 20 7b 22 6d 61 78 5f 61 67 65 22 3a 32 35 39 32 30 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 62 72 6f 77 73 65 72 5f 72 65 70 6f 72 74 69 6e 67 5c 2f 63 6f 6f 70 5c 2f 3f 6d 69 6e 69 6d 69 7a 65 3d 30 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 6f 6f 70 5f 72 65 70 6f 72 74 22 2c 22 69 6e 63 6c 75 64 65 5f 73 75 62 64 6f 6d 61 69 6e 73 22 3a 74 72 75 65 7d 2c 20 7b 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 62 72 6f 77 73 65 72 5f 72 65 70 6f 72 74 69 6e 67 5c 2f 63 Data Ascii: report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/c
2024-04-19 01:41:07 UTC	80	IN	Data Raw: 34 35 0d 0a 66 6f 72 20 28 3b 3b 29 3b 7b 22 5f 5f 61 72 22 3a 31 2c 22 70 61 79 6c 6f 61 64 22 3a 7b 22 6b 65 79 73 22 3a 5b 5d 7d 2c 22 6c 69 64 22 3a 22 37 33 35 39 33 38 37 32 33 35 39 35 37 35 31 35 34 34 36 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 45for (;;);{"__ar":1,"payload":{"keys":[]},"lid":"7359387235957515446"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49923	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:07 UTC	487	OUT	GET /ajax/webstorage/process_keys/?state=1 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcud.AWW5f6UkgfQ; datr=lMshZix5qPWRCJbLXT1BC9lU
2024-04-19 01:41:07 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is; expires=Thu, 18-Jul-2024 01:41:07 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:41:07 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:41:07 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:41:07 UTC	2551	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 49 69 45 48 36 48 45 6b 75 50 33 4c 62 62 42 35 72 62 53 54 55 36 4a 50 5a 4e 43 4d 75 78 70 59 75 58 71 48 65 4a 6e 75 59 43 7a 47 4e 5f 37 51 6f 4b 64 45 49 43 47 4e 73 38 74 67 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4a 5a 6e 48 46 64 51 36 61 57 58 37 4a 36 53 66 51 68 59 65 67 7a 33 5f 70 44 46 56 7a 78 35 65 41 65 42 75 4d 4f 67 47 7a 2d 75 39 64 44 76 4f 6e 37 62 58 4a 52 4c 59 64 33 6b 53 6b 49 66 53 30 4e 2d 43 37 58 49 57 38 51 75 49 77 36 6e 30 50 6c 7a 41 46 52 52 30 41 35 2d 34 66 36 37 66 31 33 66 44 68 61 7a 57 4a 6f 4c 2d 68 6d 22 3b 20 65 5f 66 62 5f 76 69 Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcIiEH6HEkuP3LbbB5rbSTU6JPZNCMuxpYuXqHeJnuYCzGN_7QoKdEICGNs8tg"; e_clientaddr="AcJZnHFdQ6aWX7J6SfQhYegz3_pDFVzx5eAeBuMOgGz-u9dDvOn7bXJRLYd3kSkIfS0N-C7XIW8QuIw6n0PlzAFRR0A5-4f67f13fDhazWJoL-hm"; e_fb_vi
2024-04-19 01:41:07 UTC	166	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 34 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 34 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 31 36 34 2c 20 75 6c 6c 61 74 3d 30 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=164, ullat=0Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:41:07 UTC	1334	IN	Data Raw: 31 37 33 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 38 73 57 55 45 61 45 4d 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: 1738<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="8sWUEaEM">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:41:07 UTC	1500	IN	Data Raw: 65 64 69 61 3d 22 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 77 65 62 73 74 6f 72 61 67 65 2f 70 72 6f 63 65 73 73 5f 6b 65 79 73 2f 3f 73 74 61 74 65 3d 31 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 77 65 62 73 74 6f 72 61 67 65 2f 70 72 6f 63 65 73 73 5f 6b 65 79 73 2f 3f 73 74 61 74 65 3d 31 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e Data Ascii: edia="only screen and (max-width: 640px)" href="https://www.facebook.com/ajax/webstorage/process_keys/?state=1" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/webstorage/process_keys/?state=1" /><meta name="robots" content="n
2024-04-19 01:41:07 UTC	1500	IN	Data Raw: 7b 22 72 22 3a 31 30 30 30 30 2c 22 73 22 3a 31 7d 7d 2c 22 67 6b 78 44 61 74 61 22 3a 7b 22 32 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 Data Ascii: {"r":10000,"s":1}},"gkxData":{"20935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"2093
2024-04-19 01:41:07 UTC	1500	IN	Data Raw: 59 4e 43 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 39 36 37 30 33 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 Data Ascii: YNC",null]},-1],["cr:696703",[],{"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce"
2024-04-19 01:41:07 UTC	1500	IN	Data Raw: 73 65 2c 22 74 69 6d 65 6f 75 74 22 3a 36 30 30 30 30 2c 22 74 69 65 72 65 64 4c 6f 61 64 69 6e 67 46 72 6f 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 0d 0a 63 32 62 34 0d 0a 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 Data Ascii: se,"timeout":60000,"tieredLoadingFromTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreac2b4dyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"tra
2024-04-19 01:41:07 UTC	1500	IN	Data Raw: 73 65 2c 22 41 50 50 5f 49 44 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 49 53 5f 42 55 53 49 4e 45 53 53 5f 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 71 32 4c 68 32 6c 70 30 73 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e Data Ascii: se,"APP_ID":"256281040558","IS_BUSINESS_DOMAIN":false},270],["LSD",[],{"token":"AVq2Lh2lp0s"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49924	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:12 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:41:12 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:12 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49925	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:12 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 01:41:12 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:12 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49926	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:12 UTC	1313	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 524 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:12 UTC	524	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 37 30 38 36 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1713490870861",null,null,n
2024-04-19 01:41:12 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:41:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:41:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49927	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:12 UTC	1313	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 524 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:12 UTC	524	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 37 30 38 37 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1713490870875",null,null,n
2024-04-19 01:41:12 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:41:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:41:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49928	142.251.15.138	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:13 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:13 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 01:41:13 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:41:13 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-19 01:41:13 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49929	142.251.15.138	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:13 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:13 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 01:41:13 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:41:13 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-19 01:41:13 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49930	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:13 UTC	1291	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1086 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:13 UTC	1086	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 2d 55 53 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 34 31 34 2e 30 38 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en-US",null,"boq_identityfrontendauthuiserver_20240414.08_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,
2024-04-19 01:41:13 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:13 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:41:13 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:41:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49931	142.251.15.138	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:14 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:14 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 01:41:14 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:41:14 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-19 01:41:14 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49933	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:14 UTC	1313	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 521 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:14 UTC	521	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 37 33 35 36 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1713490873565",null,null,null
2024-04-19 01:41:15 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:15 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:41:15 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:41:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49932	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:14 UTC	1313	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 521 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:14 UTC	521	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 31 33 34 39 30 38 37 33 35 36 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1713490873569",null,null,null
2024-04-19 01:41:15 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:15 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:41:15 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:41:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49934	142.251.15.138	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:15 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:15 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 01:41:15 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:41:15 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-19 01:41:15 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49935	142.251.15.138	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:15 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:16 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 01:41:16 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:41:16 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-19 01:41:16 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49936	31.13.65.36	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:15 UTC	1273	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=g&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 921 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarysXeWGdy5dPlk226C sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
2024-04-19 01:41:15 UTC	921	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 73 58 65 57 47 64 79 35 64 50 6c 6b 32 32 36 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 38 37 34 35 35 37 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 73 58 65 57 47 64 79 35 64 50 6c 6b 32 32 36 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 71 22 0d 0a 0d 0a 5b 7b 22 61 70 70 5f 69 64 22 3a 22 32 32 32 30 33 39 31 37 38 38 32 30 30 38 39 32 22 2c 22 70 6f 73 74 73 22 3a 5b 5b 22 66 61 6c 63 6f 3a 62 64 5f 70 64 63 5f 73 69 67 6e 61 6c 73 22 2c 7b 22 65 22 Data Ascii: ------WebKitFormBoundarysXeWGdy5dPlk226CContent-Disposition: form-data; name="ts"1713490874557------WebKitFormBoundarysXeWGdy5dPlk226CContent-Disposition: form-data; name="q"[{"app_id":"2220391788200892","posts":[["falco:bd_pdc_signals",{"e"
2024-04-19 01:41:16 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:41:16 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:41:16 UTC	1817	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49937	64.233.177.101	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:15 UTC	1290	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 940 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:15 UTC	940	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 34 31 34 2e 30 38 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240414.08_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0
2024-04-19 01:41:16 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 19 Apr 2024 01:41:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-19 01:41:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-04-19 01:41:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49938	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:16 UTC	729	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=g&__rev=1012888762&__s=q3fhw7%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
2024-04-19 01:41:16 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:41:16 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:41:16 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49939	142.251.15.138	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:16 UTC	664	OUT	GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=513=XFUFNTJjIRNiaBvITfRsB5ZN0yRAm1u7DWYT0bKBC9KLUtL-GaKo5kKnfLsAeKQRMqSBWkLdCKblXKkn7qvM-clWYtx-K1jiyX1DdV7oCHABjdkkDPMA0nZ4TO7Dxr8ud6YQYfqAbXisJF689hmjuGfPmXn2XrV0OZwhQGXRPYI
2024-04-19 01:41:16 UTC	270	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 01:41:16 GMT Content-Type: text/html; charset=UTF-8 Server: Playlog Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-19 01:41:16 UTC	985	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px arial,sans-
2024-04-19 01:41:16 UTC	570	IN	Data Raw: 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 Data Ascii: -image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-rep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49940	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:31 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d+yvfuDOyXFdawd&MD=Th7e1MAM HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 01:41:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 146ab281-2cae-4c49-8f00-581122c72819 MS-RequestId: 7e63fafe-f4ec-4f7e-9514-588336fa65c9 MS-CV: yHpDyO1OnEaKp1fu.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 01:41:30 GMT Connection: close Content-Length: 25457
2024-04-19 01:41:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-19 01:41:31 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49945	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:56 UTC	1268	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=h&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 1660 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarya9FD8vbfC0Pc8lgo sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
2024-04-19 01:41:56 UTC	1660	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 39 46 44 38 76 62 66 43 30 50 63 38 6c 67 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 39 31 34 35 36 36 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 61 39 46 44 38 76 62 66 43 30 50 63 38 6c 67 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 78 9c 55 90 4b Data Ascii: ------WebKitFormBoundarya9FD8vbfC0Pc8lgoContent-Disposition: form-data; name="ts"1713490914566------WebKitFormBoundarya9FD8vbfC0Pc8lgoContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamxUK
2024-04-19 01:41:56 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:41:56 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:41:56 UTC	1818	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49946	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:56 UTC	723	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=h&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
2024-04-19 01:41:57 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:41:57 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:41:57 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49947	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:57 UTC	1038	OUT	POST /ajax/webstorage/process_keys/?state=1 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 817 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded X-FB-LSD: AVq2Lh2l0hc sec-ch-ua-platform-version: "10.0.0" X-ASBD-ID: 129477 dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
2024-04-19 01:41:57 UTC	817	OUT	Data Raw: 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 53 65 73 73 69 6f 6e 5d 3d 32 30 26 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 68 62 5f 74 69 6d 65 73 74 61 6d 70 5d 3d 31 33 26 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 62 61 6e 7a 61 69 25 33 41 6c 61 73 74 5f 73 74 6f 72 61 67 65 5f 66 6c 75 73 68 5d 3d 31 33 26 6c 6f 63 61 6c 5f 73 74 6f 72 61 67 65 5b 73 69 67 6e 61 6c 5f 66 6c 75 73 68 5f 74 69 6d 65 73 74 61 6d 70 5d 3d 31 33 26 73 65 73 73 69 6f 6e 5f 73 74 6f 72 61 67 65 5b 54 61 62 49 64 5d 3d 36 26 6c 6f 67 74 69 6d 65 3d 31 26 5f 5f 61 61 69 64 3d 30 26 5f 5f 75 73 65 72 3d 30 26 5f 5f 61 3d 31 26 5f 5f 72 65 71 3d 69 26 5f 5f 68 73 3d 31 39 38 33 32 2e 48 59 50 25 33 41 63 6f 6d 65 74 5f 6c 6f 67 67 65 64 6f 75 74 5f 70 6b 67 2e 32 2e 31 2e 2e 30 2e Data Ascii: local_storage[Session]=20&local_storage[hb_timestamp]=13&local_storage[banzai%3Alast_storage_flush]=13&local_storage[signal_flush_timestamp]=13&session_storage[TabId]=6&logtime=1&__aaid=0&__user=0&__a=1&__req=i&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.
2024-04-19 01:41:58 UTC	1546	IN	HTTP/1.1 200 OK Content-Type: application/x-javascript; charset=utf-8 reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" document-policy: force-load-at-top permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" cross-origin-resource-policy: cross-origin cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report" cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report" Pragma: no-cache Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT X-Content-Type-Options: nosniff
2024-04-19 01:41:58 UTC	1227	IN	Data Raw: 72 65 70 6f 72 74 2d 74 6f 3a 20 7b 22 6d 61 78 5f 61 67 65 22 3a 32 35 39 32 30 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 62 72 6f 77 73 65 72 5f 72 65 70 6f 72 74 69 6e 67 5c 2f 63 6f 6f 70 5c 2f 3f 6d 69 6e 69 6d 69 7a 65 3d 30 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 6f 6f 70 5f 72 65 70 6f 72 74 22 2c 22 69 6e 63 6c 75 64 65 5f 73 75 62 64 6f 6d 61 69 6e 73 22 3a 74 72 75 65 7d 2c 20 7b 22 6d 61 78 5f 61 67 65 22 3a 38 36 34 30 30 2c 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 5c 2f 62 72 6f 77 73 65 72 5f 72 65 70 6f 72 74 69 6e 67 5c 2f 63 Data Ascii: report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/c
2024-04-19 01:41:58 UTC	80	IN	Data Raw: 34 35 0d 0a 66 6f 72 20 28 3b 3b 29 3b 7b 22 5f 5f 61 72 22 3a 31 2c 22 70 61 79 6c 6f 61 64 22 3a 7b 22 6b 65 79 73 22 3a 5b 5d 7d 2c 22 6c 69 64 22 3a 22 37 33 35 39 33 38 37 34 35 36 37 35 32 37 37 36 37 39 34 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 45for (;;);{"__ar":1,"payload":{"keys":[]},"lid":"7359387456752776794"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49948	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:41:58 UTC	487	OUT	GET /ajax/webstorage/process_keys/?state=1 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcuz.AWWlN6Ji0Is
2024-04-19 01:41:58 UTC	1119	IN	HTTP/1.1 404 Not Found Vary: Accept-Encoding Set-Cookie: fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcvm.AWUVYGdJSe8; expires=Thu, 18-Jul-2024 01:41:58 GMT; Max-Age=7776000; path=/; domain=.facebook.com; secure; httponly; SameSite=None reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:41:58 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:41:58 UTC	1441	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w
2024-04-19 01:41:58 UTC	2552	IN	Data Raw: 50 72 6f 78 79 2d 53 74 61 74 75 73 3a 20 68 74 74 70 5f 72 65 71 75 65 73 74 5f 65 72 72 6f 72 3b 20 65 5f 66 62 5f 63 6f 6e 66 69 67 76 65 72 73 69 6f 6e 3d 22 41 63 49 68 39 75 64 6d 4a 64 75 4d 62 45 52 7a 48 70 74 69 55 59 35 65 78 4b 32 66 34 41 70 49 5f 72 57 39 74 35 53 48 36 75 66 68 4c 55 30 4c 62 73 63 6e 62 57 77 35 74 6f 48 35 34 67 22 3b 20 65 5f 63 6c 69 65 6e 74 61 64 64 72 3d 22 41 63 4b 46 4f 56 34 51 49 55 34 72 31 31 35 53 46 35 74 78 45 41 68 64 30 44 6a 45 35 45 61 63 43 57 71 76 42 54 69 54 57 59 33 65 4c 70 34 44 56 45 67 35 4d 6c 5f 64 6e 4b 34 33 61 71 59 68 5a 67 74 4b 65 5a 76 37 4d 46 63 4a 56 4f 73 4f 5f 6a 79 74 47 70 36 53 69 43 4e 4a 57 61 5f 56 67 52 6c 6d 69 4a 47 38 5a 4b 55 4b 73 63 41 36 51 67 22 3b 20 65 5f 66 62 5f Data Ascii: Proxy-Status: http_request_error; e_fb_configversion="AcIh9udmJduMbERzHptiUY5exK2f4ApI_rW9t5SH6ufhLU0LbscnbWw5toH54g"; e_clientaddr="AcKFOV4QIU4r115SF5txEAhd0DjE5EacCWqvBTiTWY3eLp4DVEg5Ml_dnK43aqYhZgtKeZv7MFcJVOsO_jytGp6SiCNJWa_VgRlmiJG8ZKUKscA6Qg"; e_fb_
2024-04-19 01:41:58 UTC	166	IN	Data Raw: 58 2d 46 42 2d 43 6f 6e 6e 65 63 74 69 6f 6e 2d 51 75 61 6c 69 74 79 3a 20 47 4f 4f 44 3b 20 71 3d 30 2e 37 2c 20 72 74 74 3d 31 30 34 2c 20 72 74 78 3d 30 2c 20 63 3d 31 30 2c 20 6d 73 73 3d 31 32 37 37 2c 20 74 62 77 3d 33 34 30 34 2c 20 74 70 3d 2d 31 2c 20 74 70 6c 3d 2d 31 2c 20 75 70 6c 61 74 3d 31 32 37 2c 20 75 6c 6c 61 74 3d 32 0d 0a 41 6c 74 2d 53 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a Data Ascii: X-FB-Connection-Quality: GOOD; q=0.7, rtt=104, rtx=0, c=10, mss=1277, tbw=3404, tp=-1, tpl=-1, uplat=127, ullat=2Alt-Svc: h3=":443"; ma=86400Connection: close
2024-04-19 01:41:58 UTC	1334	IN	Data Raw: 64 39 65 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 20 63 6c 61 73 73 3d 22 6e 6f 5f 6a 73 22 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 2d 77 68 65 6e 2d 63 72 6f 73 73 6f 72 69 67 69 6e 22 20 69 64 3d 22 6d 65 74 61 5f 72 65 66 65 72 72 65 72 22 20 2f 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 55 7a 78 4e 34 4c 78 46 22 3e 66 75 6e 63 74 69 6f 6e 20 65 6e 76 46 6c 75 73 68 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 29 7b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 61 29 62 5b 63 5d 3d 61 Data Ascii: d9e9<!DOCTYPE html><html lang="en" id="facebook" class="no_js"><head><meta charset="utf-8" /><meta name="referrer" content="origin-when-crossorigin" id="meta_referrer" /><script nonce="UzxN4LxF">function envFlush(a){function b(b){for(var c in a)b[c]=a
2024-04-19 01:41:58 UTC	1500	IN	Data Raw: 65 64 69 61 3d 22 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 34 30 70 78 29 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 77 65 62 73 74 6f 72 61 67 65 2f 70 72 6f 63 65 73 73 5f 6b 65 79 73 2f 3f 73 74 61 74 65 3d 31 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 6d 65 64 69 61 3d 22 68 61 6e 64 68 65 6c 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 61 6a 61 78 2f 77 65 62 73 74 6f 72 61 67 65 2f 70 72 6f 63 65 73 73 5f 6b 65 79 73 2f 3f 73 74 61 74 65 3d 31 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e Data Ascii: edia="only screen and (max-width: 640px)" href="https://www.facebook.com/ajax/webstorage/process_keys/?state=1" /><link rel="alternate" media="handheld" href="https://www.facebook.com/ajax/webstorage/process_keys/?state=1" /><meta name="robots" content="n
2024-04-19 01:41:58 UTC	1500	IN	Data Raw: 7b 22 72 22 3a 31 30 30 30 30 2c 22 73 22 3a 31 7d 7d 2c 22 67 6b 78 44 61 74 61 22 3a 7b 22 32 30 39 33 35 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 39 22 3a 7b 22 72 65 73 75 6c 74 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 34 30 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 31 30 34 33 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 37 37 34 32 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 38 33 36 22 3a 7b 22 72 65 73 75 6c 74 22 3a 66 61 6c 73 65 2c 22 68 61 73 68 22 3a 6e 75 6c 6c 7d 2c 22 32 30 39 33 Data Ascii: {"r":10000,"s":1}},"gkxData":{"20935":{"result":false,"hash":null},"20939":{"result":true,"hash":null},"20940":{"result":false,"hash":null},"21043":{"result":false,"hash":null},"7742":{"result":false,"hash":null},"20836":{"result":false,"hash":null},"2093
2024-04-19 01:41:58 UTC	1500	IN	Data Raw: 59 4e 43 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 39 36 37 30 33 22 2c 5b 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 6e 75 6c 6c 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 37 30 38 38 38 36 22 2c 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 45 76 65 6e 74 50 72 6f 66 69 6c 65 72 49 6d 70 6c 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 31 33 35 22 2c 5b 22 52 75 6e 42 6c 75 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 52 75 6e 42 6c 75 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 63 72 3a 36 36 36 39 22 2c 5b 22 44 61 74 61 53 74 6f 72 65 22 5d 2c 7b 22 5f 5f 72 63 22 3a 5b 22 44 61 74 61 53 74 6f 72 65 22 2c 6e 75 6c 6c 5d 7d 2c 2d 31 5d 2c 5b 22 53 65 72 76 65 72 4e 6f 6e 63 65 22 Data Ascii: YNC",null]},-1],["cr:696703",[],{"__rc":[null,null]},-1],["cr:708886",["EventProfilerImpl"],{"__rc":["EventProfilerImpl",null]},-1],["cr:135",["RunBlue"],{"__rc":["RunBlue",null]},-1],["cr:6669",["DataStore"],{"__rc":["DataStore",null]},-1],["ServerNonce"
2024-04-19 01:41:58 UTC	1500	IN	Data Raw: 73 65 2c 22 74 69 6d 65 6f 75 74 22 3a 36 30 30 30 30 2c 22 74 69 65 72 65 64 4c 6f 61 64 69 6e 67 46 72 6f 6d 54 69 65 72 22 3a 31 30 30 2c 22 68 79 70 53 74 65 70 34 22 3a 66 61 6c 73 65 2c 22 70 68 64 4f 6e 22 3a 66 61 6c 73 65 2c 22 62 74 43 75 74 6f 66 66 49 6e 64 65 78 22 3a 32 33 33 30 2c 22 66 61 73 74 50 61 74 68 46 6f 72 41 6c 72 65 61 64 79 52 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 65 61 72 6c 79 52 65 71 75 69 72 65 4c 61 7a 79 22 3a 66 61 6c 73 65 2c 22 65 6e 61 62 6c 65 54 69 6d 65 6f 75 74 4c 6f 67 67 69 6e 67 46 6f 72 4e 6f 6e 43 6f 6d 65 74 22 3a 66 61 6c 73 65 2c 22 64 65 66 65 72 4c 6f 6e 67 54 61 69 6c 4d 61 6e 69 66 65 73 74 22 3a 74 72 75 65 2c 22 6c 61 7a 79 53 6f 54 22 3a 66 61 6c 73 65 2c 22 74 72 61 6e 73 6c 61 74 69 6f 6e Data Ascii: se,"timeout":60000,"tieredLoadingFromTier":100,"hypStep4":false,"phdOn":false,"btCutoffIndex":2330,"fastPathForAlreadyRequired":true,"earlyRequireLazy":false,"enableTimeoutLoggingForNonComet":false,"deferLongTailManifest":true,"lazySoT":false,"translation
2024-04-19 01:41:58 UTC	1500	IN	Data Raw: 49 44 22 3a 22 32 35 36 32 38 31 30 34 30 35 35 38 22 2c 22 49 53 5f 42 55 53 49 4e 45 53 53 5f 44 4f 4d 41 49 4e 22 3a 66 61 6c 73 65 7d 2c 32 37 30 5d 2c 5b 22 4c 53 44 22 2c 5b 5d 2c 7b 22 74 6f 6b 65 6e 22 3a 22 41 56 71 32 4c 68 32 6c 7a 30 63 22 7d 2c 33 32 33 5d 2c 5b 22 53 69 74 65 44 61 74 61 22 2c 5b 5d 2c 7b 22 73 65 72 76 65 72 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 63 6c 69 65 6e 74 5f 72 65 76 69 73 69 6f 6e 22 3a 31 30 31 32 38 38 38 37 36 32 2c 22 70 75 73 68 5f 70 68 61 73 65 22 3a 22 43 33 22 2c 22 70 6b 67 5f 63 6f 68 6f 72 74 22 3a 22 42 50 3a 44 45 46 41 55 4c 54 22 2c 22 68 61 73 74 65 5f 73 65 73 73 69 6f 6e 22 3a 22 31 39 38 33 32 2e 42 50 3a 44 45 46 41 55 4c 54 2e 32 2e 30 2e 2e 30 2e 30 22 2c 22 70 Data Ascii: ID":"256281040558","IS_BUSINESS_DOMAIN":false},270],["LSD",[],{"token":"AVq2Lh2lz0c"},323],["SiteData",[],{"server_revision":1012888762,"client_revision":1012888762,"push_phase":"C3","pkg_cohort":"BP:DEFAULT","haste_session":"19832.BP:DEFAULT.2.0..0.0","p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49950	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:42:23 UTC	1267	OUT	POST /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=j&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive Content-Length: 973 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6zxG60LesdMkR5Vz sec-ch-ua-platform-version: "10.0.0" dpr: 1 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-model: "" sec-ch-prefers-color-scheme: light sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.facebook.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.facebook.com/video Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcvm.AWUVYGdJSe8
2024-04-19 01:42:23 UTC	973	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 36 7a 78 47 36 30 4c 65 73 64 4d 6b 52 35 56 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 73 22 0d 0a 0d 0a 31 37 31 33 34 39 30 39 34 32 35 37 35 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 36 7a 78 47 36 30 4c 65 73 64 4d 6b 52 35 56 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 6f 73 74 5f 30 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 62 6c 6f 62 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 78 9c 75 50 5b Data Ascii: ------WebKitFormBoundary6zxG60LesdMkR5VzContent-Disposition: form-data; name="ts"1713490942575------WebKitFormBoundary6zxG60LesdMkR5VzContent-Disposition: form-data; name="post_0"; filename="blob"Content-Type: application/octet-streamxuP[
2024-04-19 01:42:24 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:42:24 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:42:24 UTC	1817	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49951	31.13.88.35	443	7544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 01:42:24 UTC	723	OUT	GET /ajax/bz?__a=1&__aaid=0&__ccg=GOOD&__comet_req=15&__hs=19832.HYP%3Acomet_loggedout_pkg.2.1..0.0&__hsi=7359387103923729254&__req=j&__rev=1012888762&__s=%3A2cd228%3Aqgd3o4&__spin_b=trunk&__spin_r=1012888762&__spin_t=1713490836&__user=0&dpr=1&jazoest=2903&lsd=AVq2Lh2l0hc&ph=C3 HTTP/1.1 Host: www.facebook.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: wd=1280x907; datr=lMshZix5qPWRCJbLXT1BC9lU; fr=0vajiWcpM3izk77P7..BmIcuZ..AAA.0.0.BmIcvm.AWUVYGdJSe8
2024-04-19 01:42:24 UTC	896	IN	HTTP/1.1 200 OK reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/comet_error_reports/?device_level=unknown", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/comet_error_reports\/?device_level=unknown"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
2024-04-19 01:42:24 UTC	1903	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 2e 66 62 73 62 78 2e 63 6f 6d 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 3b 73 63 72 69 70 74 2d 73 72 63 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 20 2a 2e 66 62 63 64 6e 2e 6e 65 74 20 2a 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 31 32 37 2e 30 2e 30 2e 31 3a 2a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 62 6c 6f 62 3a 20 64 61 74 61 3a 20 27 73 65 6c 66 27 20 63 6f 6e 6e 65 63 74 2e 66 61 63 65 62 6f 6f 6b 2e 6e 65 74 20 27 Data Ascii: content-security-policy: default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net '
2024-04-19 01:42:24 UTC	1598	IN	Data Raw: 70 65 72 6d 69 73 73 69 6f 6e 73 2d 70 6f 6c 69 63 79 3a 20 61 63 63 65 6c 65 72 6f 6d 65 74 65 72 3d 28 29 2c 20 61 74 74 72 69 62 75 74 69 6f 6e 2d 72 65 70 6f 72 74 69 6e 67 3d 28 73 65 6c 66 29 2c 20 61 75 74 6f 70 6c 61 79 3d 28 29 2c 20 62 6c 75 65 74 6f 6f 74 68 3d 28 29 2c 20 63 61 6d 65 72 61 3d 28 73 65 6c 66 29 2c 20 63 68 2d 64 65 76 69 63 65 2d 6d 65 6d 6f 72 79 3d 28 29 2c 20 63 68 2d 64 6f 77 6e 6c 69 6e 6b 3d 28 29 2c 20 63 68 2d 65 63 74 3d 28 29 2c 20 63 68 2d 72 74 74 3d 28 29 2c 20 63 68 2d 73 61 76 65 2d 64 61 74 61 3d 28 29 2c 20 63 68 2d 75 61 2d 61 72 63 68 3d 28 29 2c 20 63 68 2d 75 61 2d 62 69 74 6e 65 73 73 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 68 65 69 67 68 74 3d 28 29 2c 20 63 68 2d 76 69 65 77 70 6f 72 74 2d 77 Data Ascii: permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-w

Target ID:	0
Start time:	03:40:33
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\HxesZl7bIx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HxesZl7bIx.exe"
Imagebase:	0x340000
File size:	918'528 bytes
MD5 hash:	054664DA74DEB75DF32022E644C197D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:40:33
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/account
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:40:33
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:40:33
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:40:34
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1948,i,11509186462824718599,1135908042397387967,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:40:34
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:40:34
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1852,i,4759629210035678805,3371975258739190933,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:40:41
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:40:41
Start date:	19/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=2384,i,589836651291773641,6998480296126428136,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	1167
Total number of Limit Nodes:	25

Executed Functions

Function 003442DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0034430D

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

GetCurrentProcess.KERNEL32(?,003DCB64,00000000,?,?), ref: 00344422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00344429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00344454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00344466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00344474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0034447B
GetSystemInfo.KERNEL32(?,?,?), ref: 003444A0

Strings

GetNativeSystemInfo, xrefs: 00344460
kernel32.dll, xrefs: 0034444F
|O, xrefs: 003836F8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 04cc271c7b3b259ef869691d696775b60cc855a3407d1fa814436b88c27c686a
Instruction ID: 48336769f939185ac22b76ed7e4e3b5cfa1941603e319ab0f5e533a899416724
Opcode Fuzzy Hash: 04cc271c7b3b259ef869691d696775b60cc855a3407d1fa814436b88c27c686a
Instruction Fuzzy Hash: DFA1E66191A3C8CFEB13D77A7C443D57FE86B26700B08D4BAEAA197B39D2204504CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 003442A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,003450AA,?,?,00000000,00000000), ref: 003442B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,003450AA,?,?,00000000,00000000), ref: 003442C9
LoadResource.KERNEL32(?,00000000,?,?,003450AA,?,?,00000000,00000000,?,?,?,?,?,?,00344F20), ref: 003835BE
SizeofResource.KERNEL32(?,00000000,?,?,003450AA,?,?,00000000,00000000,?,?,?,?,?,?,00344F20), ref: 003835D3
LockResource.KERNEL32(003450AA,?,?,003450AA,?,?,00000000,00000000,?,?,?,?,?,?,00344F20,?), ref: 003835E6

Strings

SCRIPT, xrefs: 003442BF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: c74552ec2cbec3f901fbf9f3a02ec1ab269697918d39a562022f54e9311a79b0
Instruction ID: f5b4576c6b685d6125318cb2d4fd6b136e87f7282cf8ac1c0984f6a4acf4db22
Opcode Fuzzy Hash: c74552ec2cbec3f901fbf9f3a02ec1ab269697918d39a562022f54e9311a79b0
Instruction Fuzzy Hash: 36117CB1211701BFDB228BA5EC48F677BBDEBC5B51F10496EF4029A290DBB1E800C720

Uniqueness

Uniqueness Score: -1.00%

Function 00382BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00342B6B

Part of subcall function 00343A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00411418,?,00342E7F,?,?,?,00000000), ref: 00343A78

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00402224), ref: 00382C10
ShellExecuteW.SHELL32(00000000,?,?,00402224), ref: 00382C17

Strings

runas, xrefs: 00382C0B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 6afe9d11537d67206cb37cf277338571881b136cf9aa6581131470d2cf643935
Instruction ID: e9ea26ce0522489e75f876eda9e4f391aa1fc7b7eb49927a1f7bba4a24431b8e
Opcode Fuzzy Hash: 6afe9d11537d67206cb37cf277338571881b136cf9aa6581131470d2cf643935
Instruction Fuzzy Hash: 1911AF312083416AC707FF60D856AAFBBE89B91750F44542EB1822F0A2CF75AA49C752

Uniqueness

Uniqueness Score: -1.00%

Function 00364CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(003728E9,?,00364CBE,003728E9,004088B8,0000000C,00364E15,003728E9,00000002,00000000,?,003728E9), ref: 00364D09
TerminateProcess.KERNEL32(00000000,?,00364CBE,003728E9,004088B8,0000000C,00364E15,003728E9,00000002,00000000,?,003728E9), ref: 00364D10
ExitProcess.KERNEL32 ref: 00364D22

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0ab5e8da386c239c22e1aab04d9b3c97c9b88485b34d556cb4e9bc6e91be779f
Instruction ID: 7e925ec7f0e9c4052fa7d1c55934929872d13aa656f5f0dd903482da2f6ae23d
Opcode Fuzzy Hash: 0ab5e8da386c239c22e1aab04d9b3c97c9b88485b34d556cb4e9bc6e91be779f
Instruction Fuzzy Hash: DEE0B631821149ABCF23AF54ED09A583F6DEB41781F119015FC098B127CB39DD52DA80

Uniqueness

Uniqueness Score: -1.00%

Function 0034D730 Relevance: 21.6, APIs: 14, Instructions: 631windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0034D807
timeGetTime.WINMM ref: 0034DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0034DB28
TranslateMessage.USER32(?), ref: 0034DB7B
DispatchMessageW.USER32(?), ref: 0034DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0034DB9F
Sleep.KERNEL32(0000000A), ref: 0034DBB1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 203935d39ff536438a5f5b26a15b12d8d5bf2a891340711da9cb0e1fc4f2e1c6
Instruction ID: 2b0480ce52e9ae24f300c6afec049e83bc4a6bde9e28ea98b6b91614646b11aa
Opcode Fuzzy Hash: 203935d39ff536438a5f5b26a15b12d8d5bf2a891340711da9cb0e1fc4f2e1c6
Instruction Fuzzy Hash: 2B42C130604642EFDB27DF24C885BAAB7E5FF46304F158569E8558F2A1D770F844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00342CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00342D07
RegisterClassExW.USER32(00000030), ref: 00342D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00342D42
InitCommonControlsEx.COMCTL32(?), ref: 00342D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00342D6F
LoadIconW.USER32(000000A9), ref: 00342D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00342D94

Strings

0, xrefs: 00342CE9
+, xrefs: 00342CF0
TaskbarCreated, xrefs: 00342D37
AutoIt v3 GUI, xrefs: 00342D23

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 72ca2f779e99efa455b43f247a4a2ce03ffdbd539dc639ee59d81c9b877e01d0
Instruction ID: c667096aa7e7e1451e689b6f65026ebf5233308abd760de02e5835c3af1bd0b9
Opcode Fuzzy Hash: 72ca2f779e99efa455b43f247a4a2ce03ffdbd539dc639ee59d81c9b877e01d0
Instruction Fuzzy Hash: B821C8B5D22219AFDB01DF94EC49BDDBBB8FB08701F00911AF621A62A0D7B14544CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0038065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0038039A: CreateFileW.KERNEL32(00000000,00000000,?,00380704,?,?,00000000,?,00380704,00000000,0000000C), ref: 003803B7

GetLastError.KERNEL32 ref: 0038076F
__dosmaperr.LIBCMT ref: 00380776
GetFileType.KERNEL32(00000000), ref: 00380782
GetLastError.KERNEL32 ref: 0038078C
__dosmaperr.LIBCMT ref: 00380795
CloseHandle.KERNEL32(00000000), ref: 003807B5
CloseHandle.KERNEL32(?), ref: 003808FF
GetLastError.KERNEL32 ref: 00380931
__dosmaperr.LIBCMT ref: 00380938

Strings

H, xrefs: 003808BD

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d9a359fa6145bbcb74084ea300cc4f9b637fecb7d67048ca509f7893abe7b835
Instruction ID: e6d881d96ace1ea65e2caefaba85534c4caf88d7771aeff321d9630b7b33f1e7
Opcode Fuzzy Hash: d9a359fa6145bbcb74084ea300cc4f9b637fecb7d67048ca509f7893abe7b835
Instruction Fuzzy Hash: B2A15736A102048FDF1EEF68D852BAE7BA0EB06320F15419DF8159F2A1DB759C17CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0034344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00343A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00411418,?,00342E7F,?,?,?,00000000), ref: 00343A78

Part of subcall function 00343357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00343379

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0034356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0038318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 003831CE
RegCloseKey.ADVAPI32(?), ref: 00383210
_wcslen.LIBCMT ref: 00383277
_wcslen.LIBCMT ref: 00383286

Strings

Include, xrefs: 00383184, 003831C5
\Include\, xrefs: 00343527
\, xrefs: 0038328C
Software\AutoIt v3\AutoIt, xrefs: 00343560

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: d426642755197361581d53d4ab96be08c711eac8d86ed8fdbba9b601c9adfe41
Instruction ID: c2c627b43c436ccfcec5d45be21c4904a16132961a5555a2df0c144d2916c7a0
Opcode Fuzzy Hash: d426642755197361581d53d4ab96be08c711eac8d86ed8fdbba9b601c9adfe41
Instruction Fuzzy Hash: 43719E714143059EC706EF25ED8199BBBE8FF85740F40883EF855CB261DB709A58CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00342B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00342B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00342B9D
LoadIconW.USER32(00000063), ref: 00342BB3
LoadIconW.USER32(000000A4), ref: 00342BC5
LoadIconW.USER32(000000A2), ref: 00342BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00342BEF
RegisterClassExW.USER32(?), ref: 00342C40

Part of subcall function 00342CD4: GetSysColorBrush.USER32(0000000F), ref: 00342D07
Part of subcall function 00342CD4: RegisterClassExW.USER32(00000030), ref: 00342D31
Part of subcall function 00342CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00342D42
Part of subcall function 00342CD4: InitCommonControlsEx.COMCTL32(?), ref: 00342D5F
Part of subcall function 00342CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00342D6F
Part of subcall function 00342CD4: LoadIconW.USER32(000000A9), ref: 00342D85
Part of subcall function 00342CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00342D94

Strings

0, xrefs: 00342C0F
#, xrefs: 00342C16
AutoIt v3, xrefs: 00342C2F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: ea5a7fc55c2d863e407fda01a321cac934850f0f2e509b259030c6c001151740
Instruction ID: 824628e003e66e9d5b80be556dfd8255d2ab3ddf887463b5a6d35fdd371de7f1
Opcode Fuzzy Hash: ea5a7fc55c2d863e407fda01a321cac934850f0f2e509b259030c6c001151740
Instruction Fuzzy Hash: 8B214F74E21318AFEB119F95EC95AD97FB4FB08B50F00802AFA11A66B4D3B11540CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00343170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0034316A,?,?), ref: 003431D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0034316A,?,?), ref: 00343204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00343227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0034316A,?,?), ref: 00343232
CreatePopupMenu.USER32 ref: 00343246
PostQuitMessage.USER32(00000000), ref: 00343267

Strings

TaskbarCreated, xrefs: 0034322D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ecb7abb9d81cc6c8b1cc5d9353859658c0304d9cc3055601f1dc494417880ca0
Instruction ID: 97ae8981462011ca36428691b6af293fac728e11c72580e58c26fbd10b42b0a7
Opcode Fuzzy Hash: ecb7abb9d81cc6c8b1cc5d9353859658c0304d9cc3055601f1dc494417880ca0
Instruction Fuzzy Hash: 50411731260209ABDF172B78ED49BB93B9DE705300F044126FA228F5B5C7A5FB40D769

Uniqueness

Uniqueness Score: -1.00%

Function 00341410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00341459
OleUninitialize.OLE32(?,00000000), ref: 003414F8
UnregisterHotKey.USER32(?), ref: 003416DD
DestroyWindow.USER32(?), ref: 003824B9
FreeLibrary.KERNEL32(?), ref: 0038251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0038254B

Strings

close all, xrefs: 00341454

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 92a83059d51ab4dda73e7f7648f53e026040772ea6b28cb7b5720925be1b2059
Instruction ID: ff94d643fb91a520376a1a1a8aa6a948eab0b918278a4d26e04eac05d2d89637
Opcode Fuzzy Hash: 92a83059d51ab4dda73e7f7648f53e026040772ea6b28cb7b5720925be1b2059
Instruction Fuzzy Hash: 40D16A317126128FCB1BEF15D899A6AF7A4BF05700F1542ADE84A6F262DB30ED52CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00342C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00342C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00342CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00341CAD,?), ref: 00342CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00341CAD,?), ref: 00342CCF

Strings

edit, xrefs: 00342CAC
AutoIt v3, xrefs: 00342C89, 00342C8E, 00342C8F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: eaecb2873f92ce9999257a7874b13fa760cc7e3218085d8f28c4cb947608b7c7
Instruction ID: a254a00e9934a04a7f542b3ead52ee34942d2496a7d43c2323a01928d08b398d
Opcode Fuzzy Hash: eaecb2873f92ce9999257a7874b13fa760cc7e3218085d8f28c4cb947608b7c7
Instruction Fuzzy Hash: ABF0DA755A02987AFB311717BC08EB76EBDD7C6F50F00916AFE10A26B4C6711850DAB8

Uniqueness

Uniqueness Score: -1.00%

Function 003CAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 003CAEA3

Part of subcall function 00347620: _wcslen.LIBCMT ref: 00347625

GetProcessId.KERNEL32(00000000), ref: 003CAF38
FindCloseChangeNotification.KERNEL32(00000000), ref: 003CAF67

Strings

<, xrefs: 003CAE6B
@, xrefs: 003CAE72

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ChangeCloseExecuteFindNotificationProcessShell_wcslen
String ID: <$@
API String ID: 520158406-1426351568
Opcode ID: c9effcbd212facbf8fde52a167ed1e2bcac7719e2d90f53250015f379b02029b
Instruction ID: 5f2f7ff7ef8f30ece0df98174c88b4344f42da95dcd652fc80bf23c7abf20f64
Opcode Fuzzy Hash: c9effcbd212facbf8fde52a167ed1e2bcac7719e2d90f53250015f379b02029b
Instruction Fuzzy Hash: 28713574A00A19DFCB16EF64C485A9EBBF0EF08314F05849DE816AF262CB75ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00343B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00343B0F,SwapMouseButtons,00000004,?), ref: 00343B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00343B0F,SwapMouseButtons,00000004,?), ref: 00343B61
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00343B0F,SwapMouseButtons,00000004,?), ref: 00343B83

Strings

Control Panel\Mouse, xrefs: 00343B3E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 4d3b9a35aa5a40ee71e55d076225e1879c553d81784288be14eaa3c9967709b3
Instruction ID: bec718540cdeab843f0cea7f1837cfdcabb05e01e86a9fcf456ba3f38d6262d5
Opcode Fuzzy Hash: 4d3b9a35aa5a40ee71e55d076225e1879c553d81784288be14eaa3c9967709b3
Instruction Fuzzy Hash: 8B112AB5521208FFDB228FA5DC44AAEB7FCEF04744B11855AA805DB110D231EF449B60

Uniqueness

Uniqueness Score: -1.00%

Function 00343923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 003833A2

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00343A04

Strings

Line: , xrefs: 003833EB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: f7a9cfc9674dc93e6b22b6b49a1c4f980b1669031b7fa68ebb7b3a7ef5e2c033
Instruction ID: 9808f084bcbf06e850192816dafadce379aece6d81f6a4760c352ffe9b53a4f0
Opcode Fuzzy Hash: f7a9cfc9674dc93e6b22b6b49a1c4f980b1669031b7fa68ebb7b3a7ef5e2c033
Instruction Fuzzy Hash: 7331B471548304AAD723EF20DC46BEBB7ECAF41710F10492AF5999B1A1DB70A648CBC7

Uniqueness

Uniqueness Score: -1.00%

Function 00342DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00382C8C

Part of subcall function 00343AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00343A97,?,?,00342E7F,?,?,?,00000000), ref: 00343AC2

Part of subcall function 00342DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00342DC4

Strings

`e@, xrefs: 00382C85
X, xrefs: 00382C5A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e@
API String ID: 779396738-3348127276
Opcode ID: 19eaf77c69b24702cc3a4626ea6bc05dd43cc07debbc27eaf589f91be3e88757
Instruction ID: 55b68ad2882494db44ff10322aebdd114a2392e8140c1982d451c6c7b012f109
Opcode Fuzzy Hash: 19eaf77c69b24702cc3a4626ea6bc05dd43cc07debbc27eaf589f91be3e88757
Instruction Fuzzy Hash: 40219671A102589BDB02EF94C845BEE7BFC9F49314F00805AE505BF281DBB85689CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0035FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00360668

Part of subcall function 003632A4: RaiseException.KERNEL32(?,?,?,0036068A,?,00411444,?,?,?,?,?,?,0036068A,00341129,00408738,00341129), ref: 00363304

__CxxThrowException@8.LIBVCRUNTIME ref: 00360685

Strings

Unknown exception, xrefs: 00360692

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 9604134a13f2ba75a6eb974f4607bf282991e3ba345af5c75cb56f682cfcbe22
Instruction ID: a4e0fec2f3a865e180b12f6adc5576aa18f4fc8d3f18afc05db809922243dbb7
Opcode Fuzzy Hash: 9604134a13f2ba75a6eb974f4607bf282991e3ba345af5c75cb56f682cfcbe22
Instruction Fuzzy Hash: 47F0C23490020DBBCB06BAA4DC57D9E77BC9E00314B60C535B9149A5EDEF71DA69C681

Uniqueness

Uniqueness Score: -1.00%

Function 003410F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00341BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00341BF4
Part of subcall function 00341BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00341BFC
Part of subcall function 00341BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00341C07
Part of subcall function 00341BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00341C12
Part of subcall function 00341BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00341C1A
Part of subcall function 00341BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00341C22

Part of subcall function 00341B4A: RegisterWindowMessageW.USER32(00000004,?,003412C4), ref: 00341BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0034136A
OleInitialize.OLE32 ref: 00341388
CloseHandle.KERNEL32(00000000,00000000), ref: 003824AB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 8779bcbf9d9dbf07bb6b2078910c8dcaa96f168abb8ae0971f92e0faf6977712
Instruction ID: 397434a6fa65d2985d407694795951d3fe38a216a74b5343d779ab59265f1e1d
Opcode Fuzzy Hash: 8779bcbf9d9dbf07bb6b2078910c8dcaa96f168abb8ae0971f92e0faf6977712
Instruction Fuzzy Hash: 3A71C9B9922201AFC785EF7AA9456D53BE6FB88744744C23AD60ACB371EB304481CF4C

Uniqueness

Uniqueness Score: -1.00%

Function 003786AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,?,?,003785CC,?,00408CC8,0000000C), ref: 00378704
GetLastError.KERNEL32(?,003785CC,?,00408CC8,0000000C), ref: 0037870E
__dosmaperr.LIBCMT ref: 00378739

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 15a058d8c51f6b6e7de18b77013bfddb710119fac3884d6f81a196ae04dfefdc
Instruction ID: 1d3597988ef66923b0535fb09957aef3e7dacc9a3cbe02f3bccdc08bb1a45fc3
Opcode Fuzzy Hash: 15a058d8c51f6b6e7de18b77013bfddb710119fac3884d6f81a196ae04dfefdc
Instruction Fuzzy Hash: 7F016B36B4526036E63B6334684E77E278A4B81774F3AC119F90C9F0E2DEEC8C81C150

Uniqueness

Uniqueness Score: -1.00%

Function 00351310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003517F6

Strings

CALL, xrefs: 003517C6

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: bf0681ad91bf244a511c9f18d02f621cc4224277ed012370389e5c4a117139e7
Instruction ID: 56095f8d414cf6c33bd744b5e97ebb516cdde196dd3584e4cd96abe46480d289
Opcode Fuzzy Hash: bf0681ad91bf244a511c9f18d02f621cc4224277ed012370389e5c4a117139e7
Instruction Fuzzy Hash: 8022AB706082419FCB16DF14C481F2ABBF5BF89315F15892DF8968B362D771E949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00343837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00343908

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 72f284c9c05de9a495c11dde02297a6aec3dd1a5fe82429d446f6868973ba14c
Instruction ID: 68fc09e3eb0644d6fe2c3ece7d467d602aa32a89ffad93b37849683ed46f218a
Opcode Fuzzy Hash: 72f284c9c05de9a495c11dde02297a6aec3dd1a5fe82429d446f6868973ba14c
Instruction Fuzzy Hash: C93175706057059FE722DF24D8857D7B7E8FB49704F00092EFA998B250D771AA44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00344ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00344E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00344EDD,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344E9C
Part of subcall function 00344E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00344EAE
Part of subcall function 00344E90: FreeLibrary.KERNEL32(00000000,?,?,00344EDD,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344EFD

Part of subcall function 00344E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00383CDE,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344E62
Part of subcall function 00344E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00344E74
Part of subcall function 00344E59: FreeLibrary.KERNEL32(00000000,?,?,00383CDE,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344E87

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 930bdb51eb5efb69bf0946bc7358aa27ed28abf0c1cde559524a95b588ef3e68
Instruction ID: 50cdafa79de0adf25a961e74aeb0352b2f3aaf8ffbc7cfe688b3c501a3c801f6
Opcode Fuzzy Hash: 930bdb51eb5efb69bf0946bc7358aa27ed28abf0c1cde559524a95b588ef3e68
Instruction Fuzzy Hash: 02119132610305AADF16BB64D802BAD77E5AF40B11F10843AF542AE1D1EE75EA499B50

Uniqueness

Uniqueness Score: -1.00%

Function 00378402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00378440

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d20b4ac976af7f361bd954fc0d066af7dff4ebcf4aeb2e5013edd8764f318514
Instruction ID: e4fded9325064aefe72e88a617cb51150da3eaaccf9cde7d45400f4c08b5bc15
Opcode Fuzzy Hash: d20b4ac976af7f361bd954fc0d066af7dff4ebcf4aeb2e5013edd8764f318514
Instruction Fuzzy Hash: 09114C7190410AAFCB16DF59E94499A7BF4EF48310F118059F808AB311DB70DA11CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00375000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00374C7D: RtlAllocateHeap.NTDLL(00000008,00341129,00000000,?,00372E29,00000001,00000364,?,?,?,0036F2DE,00373863,00411444,?,0035FDF5,?), ref: 00374CBE

_free.LIBCMT ref: 0037506C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 3dea38cc65aa6ef5c078eba41a1db8c8737075a7c9fef3739ffe6d0c6fa1ba3b
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 94012B722047096BE3368E659841A5AFBECFB89370F25451DE19887280E7746805C674

Uniqueness

Uniqueness Score: -1.00%

Function 0036E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: a8682b4106e7f62ddd0ec7bf3f8cd85a754ab587df9702e927fb6cf73183cbfe
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 3DF0283A910A14AAC7333A79DC09B5B339C9F52330F11C715F5289B1D6CB78E80A86A6

Uniqueness

Uniqueness Score: -1.00%

Function 00374C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00341129,00000000,?,00372E29,00000001,00000364,?,?,?,0036F2DE,00373863,00411444,?,0035FDF5,?), ref: 00374CBE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6202775199f74aa4dcaa14d169880ae924bd030ce1568b3d383a3ac396c422cd
Instruction ID: c3a4bd237313c255839d0b1dbf688eece8f630b4badedb2dd48e348f172b43b7
Opcode Fuzzy Hash: 6202775199f74aa4dcaa14d169880ae924bd030ce1568b3d383a3ac396c422cd
Instruction Fuzzy Hash: 5CF0B431602226B6DB335F629C05B5A3788AF41BA0B1AC521BD1DAA594CB78FC008AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00373820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00411444,?,0035FDF5,?,?,0034A976,00000010,00411440,003413FC,?,003413C6,?,00341129), ref: 00373852

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 05e92461731c5474370d60d167e7877d29236c040ff730d7e3f027b18331c1cc
Instruction ID: bdb1dce1dbc524f4f95b2475af650d5ebbf0a8281eb65c1631ec94dff773af75
Opcode Fuzzy Hash: 05e92461731c5474370d60d167e7877d29236c040ff730d7e3f027b18331c1cc
Instruction Fuzzy Hash: 34E0E531501225B6E7332A669C00F9A374CAF427B0F06C122BC1C9A995CB79DD05A2E3

Uniqueness

Uniqueness Score: -1.00%

Function 00344F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344F6D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3932d11aa9b7d26bb7cd646beb30ac5c2f984afc42aaeb461c738c8404738513
Instruction ID: 6d943b7c86c713cc9a71943fb53816a72e0dc661cbd64493462d68f5f669813b
Opcode Fuzzy Hash: 3932d11aa9b7d26bb7cd646beb30ac5c2f984afc42aaeb461c738c8404738513
Instruction Fuzzy Hash: 8EF03071105752CFDB369F64E494912B7E4AF14319311897EE1EA8A921C731A848DF10

Uniqueness

Uniqueness Score: -1.00%

Function 003430F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 0034314E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 6fced13f63395cc994ef62e02f58b2f3f5a2aad638da9cda64722ecf98b74f68
Instruction ID: 4459e4be0ce3f0423c6593c0bb36b9f77a08c8375ee804f550c096fc8f3228a5
Opcode Fuzzy Hash: 6fced13f63395cc994ef62e02f58b2f3f5a2aad638da9cda64722ecf98b74f68
Instruction Fuzzy Hash: 48F0A0B09103189FEB539B24DC4A7DA7BFCAB01708F0040E9A68897296DB705B88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00342DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00342DC4

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 803e15121884b86ccfac76575b9a1a739d9c3f6fe68a5a470da479f32eb048fb
Instruction ID: d68f3e02e931dbd5e9db80adc0de45f3a9ef3e0657fe6457fb75d058dc0a5507
Opcode Fuzzy Hash: 803e15121884b86ccfac76575b9a1a739d9c3f6fe68a5a470da479f32eb048fb
Instruction Fuzzy Hash: 2EE0CD726002245BCB11A6589C06FDA77DDDFC8790F0401B1FD09DB248D960AD80C651

Uniqueness

Uniqueness Score: -1.00%

Function 00342B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00343837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00343908

Part of subcall function 0034D730: GetInputState.USER32 ref: 0034D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00342B6B

Part of subcall function 003430F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0034314E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 4449619723d358cfdac52fc4d355ec7ee884550d52efb9fa50afabe4bd86c4a6
Instruction ID: ad548e45e40e13eb804957b95b83f9d80166576dc8f3e13d2c8b9b60d5447351
Opcode Fuzzy Hash: 4449619723d358cfdac52fc4d355ec7ee884550d52efb9fa50afabe4bd86c4a6
Instruction Fuzzy Hash: 42E0262130020407CA06BB34A8125AEB7C98BD1311F40153FF1424F173CF6465898212

Uniqueness

Uniqueness Score: -1.00%

Function 0038039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00380704,?,?,00000000,?,00380704,00000000,0000000C), ref: 003803B7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: caf4c0e6f6489b3f3a78ecaf74af98aad35d462a4fb5ce084f23f341902e9aee
Instruction ID: 1c6ac7f71a1a23327a682f0ccaf483013b63f3c43576f8b3cc136436bf844b02
Opcode Fuzzy Hash: caf4c0e6f6489b3f3a78ecaf74af98aad35d462a4fb5ce084f23f341902e9aee
Instruction Fuzzy Hash: 9FD06C3205010DBBDF028F84ED06EDA3BAAFB48714F014000BE1856020C732E821EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00341CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00341CBC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 7039ef247447f54af5f71650ff176f59751a6dad56f6841097150c08caed6b8c
Instruction ID: de25b605c379c076237611fc7e0bcfa43030915d63bf0f3efcf3659fc6bf86dc
Opcode Fuzzy Hash: 7039ef247447f54af5f71650ff176f59751a6dad56f6841097150c08caed6b8c
Instruction Fuzzy Hash: 46C09B35290305AFF6154780BD4AF507755E348B00F04C111F709955F3C3E11420D654

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003D9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 003D961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003D965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 003D969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003D96C9
SendMessageW.USER32 ref: 003D96F2
GetKeyState.USER32(00000011), ref: 003D978B
GetKeyState.USER32(00000009), ref: 003D9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003D97AE
GetKeyState.USER32(00000010), ref: 003D97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003D97E9
SendMessageW.USER32 ref: 003D9810
SendMessageW.USER32(?,00001030,?,003D7E95), ref: 003D9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 003D992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 003D9941
SetCapture.USER32(?), ref: 003D994A
ClientToScreen.USER32(?,?), ref: 003D99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 003D99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003D99D6
ReleaseCapture.USER32 ref: 003D99E1
GetCursorPos.USER32(?), ref: 003D9A19
ScreenToClient.USER32(?,?), ref: 003D9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 003D9A80
SendMessageW.USER32 ref: 003D9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 003D9AEB
SendMessageW.USER32 ref: 003D9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 003D9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 003D9B4A
GetCursorPos.USER32(?), ref: 003D9B68
ScreenToClient.USER32(?,?), ref: 003D9B75
GetParent.USER32(?), ref: 003D9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 003D9BFA
SendMessageW.USER32 ref: 003D9C2B
ClientToScreen.USER32(?,?), ref: 003D9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 003D9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 003D9CDE
SendMessageW.USER32 ref: 003D9D01
ClientToScreen.USER32(?,?), ref: 003D9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 003D9D82

Part of subcall function 00359944: GetWindowLongW.USER32(?,000000EB), ref: 00359952

GetWindowLongW.USER32(?,000000F0), ref: 003D9E05

Strings

p#A, xrefs: 003D9990
@GUI_DRAGID, xrefs: 003D997D
F, xrefs: 003D9D07

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#A
API String ID: 3429851547-3939693707
Opcode ID: 08d914f749f6f095558d420b59c29743e49c8155c590d8ef106d06dd76642272
Instruction ID: c24316bbef173b3b81ac0f789e58a279aedec18b9cf8d75a6e4d6e2e381f5f5c
Opcode Fuzzy Hash: 08d914f749f6f095558d420b59c29743e49c8155c590d8ef106d06dd76642272
Instruction Fuzzy Hash: 8F429D72215201AFD722CF24EC44BAABBE9FF49320F15461BF6999B3A1D731E854CB41

Uniqueness

Uniqueness Score: -1.00%

Function 003D4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 003D48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 003D4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 003D4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 003D494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 003D495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 003D497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 003D49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 003D49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 003D4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 003D4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 003D4A7E
IsMenu.USER32(?), ref: 003D4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003D4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003D4B20
GetWindowLongW.USER32(?,000000F0), ref: 003D4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 003D4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 003D4C82
wsprintfW.USER32 ref: 003D4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003D4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 003D4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 003D4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003D4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 003D4D5A

Strings

%d/%02d/%02d, xrefs: 003D4CA8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: f8e7277e4f000fd31c739760a589e94e99431cde10be8d9cdb1883f828c7deb8
Instruction ID: ae99f5de10dc7c303793d60a5972843124f32d43ffa6c128c0099458b6c74c29
Opcode Fuzzy Hash: f8e7277e4f000fd31c739760a589e94e99431cde10be8d9cdb1883f828c7deb8
Instruction Fuzzy Hash: 9512F072610215ABEB268F24EC49FAEBBFCEF45310F14412AF915EB2E1DB749940CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0035F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0035F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0039F474
IsIconic.USER32(00000000), ref: 0039F47D
ShowWindow.USER32(00000000,00000009), ref: 0039F48A
SetForegroundWindow.USER32(00000000), ref: 0039F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0039F4AA
GetCurrentThreadId.KERNEL32 ref: 0039F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0039F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0039F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0039F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0039F4DE
SetForegroundWindow.USER32(00000000), ref: 0039F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039F4F6
keybd_event.USER32(00000012,00000000), ref: 0039F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039F50B
keybd_event.USER32(00000012,00000000), ref: 0039F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039F519
keybd_event.USER32(00000012,00000000), ref: 0039F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039F528
keybd_event.USER32(00000012,00000000), ref: 0039F52D
SetForegroundWindow.USER32(00000000), ref: 0039F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0039F557

Strings

Shell_TrayWnd, xrefs: 0039F46F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4768f86f701423eef530c0b40cf3715bc3615f59aa41dc7a6d0fa71075deb85d
Instruction ID: 75c63f85e9d597863b723b8437fcf8f35d113976a5813b17441aa1fa4e5fa75a
Opcode Fuzzy Hash: 4768f86f701423eef530c0b40cf3715bc3615f59aa41dc7a6d0fa71075deb85d
Instruction Fuzzy Hash: CF319671A602197FEF226BB66C49FBF7F6DEB45B50F111066FA00E61D1C6B05D00EA60

Uniqueness

Uniqueness Score: -1.00%

Function 003A1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 003A16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003A170D
Part of subcall function 003A16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003A173A
Part of subcall function 003A16C3: GetLastError.KERNEL32 ref: 003A174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 003A1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 003A12A8
CloseHandle.KERNEL32(?), ref: 003A12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 003A12D1
GetProcessWindowStation.USER32 ref: 003A12EA
SetProcessWindowStation.USER32(00000000), ref: 003A12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 003A1310

Part of subcall function 003A10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003A11FC), ref: 003A10D4
Part of subcall function 003A10BF: CloseHandle.KERNEL32(?,?,003A11FC), ref: 003A10E9

Strings

winsta0, xrefs: 003A12CC
default, xrefs: 003A130B
, xrefs: 003A125A
Z@, xrefs: 003A1392

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z@
API String ID: 22674027-2232833548
Opcode ID: 8c7dcfd11859db7be3bb38910d9dc177c94b009e0f256417d1243a190a70abf7
Instruction ID: 93c159dfcb4cdbad855b28b95f464c7966029940cb3569873d1878eb2c1bc1b7
Opcode Fuzzy Hash: 8c7dcfd11859db7be3bb38910d9dc177c94b009e0f256417d1243a190a70abf7
Instruction Fuzzy Hash: B7818D71910209AFDF229FA9DC49FEE7BBDEF09704F18412AF911EA1A0D7758944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 003A1114
Part of subcall function 003A10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A1120
Part of subcall function 003A10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A112F
Part of subcall function 003A10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A1136
Part of subcall function 003A10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 003A114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003A0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003A0C00
GetLengthSid.ADVAPI32(?), ref: 003A0C17
GetAce.ADVAPI32(?,00000000,?), ref: 003A0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003A0C6D
GetLengthSid.ADVAPI32(?), ref: 003A0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 003A0C8C
HeapAlloc.KERNEL32(00000000), ref: 003A0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 003A0CB4
CopySid.ADVAPI32(00000000), ref: 003A0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003A0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003A0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 003A0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A0D45
HeapFree.KERNEL32(00000000), ref: 003A0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A0D55
HeapFree.KERNEL32(00000000), ref: 003A0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A0D65
HeapFree.KERNEL32(00000000), ref: 003A0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 003A0D78
HeapFree.KERNEL32(00000000), ref: 003A0D7F

Part of subcall function 003A1193: GetProcessHeap.KERNEL32(00000008,003A0BB1,?,00000000,?,003A0BB1,?), ref: 003A11A1
Part of subcall function 003A1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,003A0BB1,?), ref: 003A11A8
Part of subcall function 003A1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,003A0BB1,?), ref: 003A11B7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1d34c71ca5fc865993d3c42c208b4a13c2f9df8fd6bdbede7fe59b87c362ddef
Instruction ID: deb75a672100eaaacfa4b5aacb12e75cdb6f536cfa7ddaf25ef7abc36278fd19
Opcode Fuzzy Hash: 1d34c71ca5fc865993d3c42c208b4a13c2f9df8fd6bdbede7fe59b87c362ddef
Instruction Fuzzy Hash: FB718B7291121AABDF16DFA4EC44BAEBBBCFF05310F054215E914A7291D771E905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003BEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(003DCC08), ref: 003BEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 003BEB37
GetClipboardData.USER32(0000000D), ref: 003BEB43
CloseClipboard.USER32 ref: 003BEB4F
GlobalLock.KERNEL32(00000000), ref: 003BEB87
CloseClipboard.USER32 ref: 003BEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 003BEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 003BEBC9
GetClipboardData.USER32(00000001), ref: 003BEBD1
GlobalLock.KERNEL32(00000000), ref: 003BEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 003BEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 003BEC38
GetClipboardData.USER32(0000000F), ref: 003BEC44
GlobalLock.KERNEL32(00000000), ref: 003BEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 003BEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 003BEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 003BECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 003BECF3
CountClipboardFormats.USER32 ref: 003BED14
CloseClipboard.USER32 ref: 003BED59

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: a0d32a248556bca67bb413e7fdfa18161433ff5c45ee37a0ef71524399124952
Instruction ID: 0f9bed9e9e4aedf30ec3e80a8529237f837ae8fee2f1c1061d915ca0039e90f4
Opcode Fuzzy Hash: a0d32a248556bca67bb413e7fdfa18161433ff5c45ee37a0ef71524399124952
Instruction Fuzzy Hash: C461F4352143029FD302EF28D895FAA77E8EF84708F08551EF5569B6A2CB71ED05CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003B698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003B69BE
FindClose.KERNEL32(00000000), ref: 003B6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003B6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003B6A75

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 003B6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 003B6ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 003B6B32
%4d%02d%02d%02d%02d%02d, xrefs: 003B6B6A
%4d, xrefs: 003B6BB1
%02d, xrefs: 003B6C00, 003B6C0A, 003B6C5A, 003B6CAA, 003B6CFA, 003B6D4A
%03d, xrefs: 003B6DA2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 577668ce614aa5b9ab892dd472e80135011b0b6e9b1340e229d25f5482c9b25c
Instruction ID: c8a314a7edafd2916bb20a325d2b2b49f38525f7bbd29116669ca538876f3b0b
Opcode Fuzzy Hash: 577668ce614aa5b9ab892dd472e80135011b0b6e9b1340e229d25f5482c9b25c
Instruction Fuzzy Hash: 47D154715083009FC711EBA4D986EAFB7ECAF88704F44491EF585DB191EB74EA48CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003B9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003B9663
GetFileAttributesW.KERNEL32(?), ref: 003B96A1
SetFileAttributesW.KERNEL32(?,?), ref: 003B96BB
FindNextFileW.KERNEL32(00000000,?), ref: 003B96D3
FindClose.KERNEL32(00000000), ref: 003B96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 003B96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 003B974A
SetCurrentDirectoryW.KERNEL32(00406B7C), ref: 003B9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 003B9772
FindClose.KERNEL32(00000000), ref: 003B977F
FindClose.KERNEL32(00000000), ref: 003B978F

Strings

*.*, xrefs: 003B96F5

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 26e4afb8191699392ca1b3472e0750a67fd2404c0a89486f7eadd1bff7c8a40b
Instruction ID: 1a3552c255ed5404ad74e3cab82f0e6e024074afcfa0c5d1afd57140bd2111b0
Opcode Fuzzy Hash: 26e4afb8191699392ca1b3472e0750a67fd2404c0a89486f7eadd1bff7c8a40b
Instruction Fuzzy Hash: D631E27252121A6ACF12AFB4EC49BDE37EC9F09324F114567FA05E21A0EB34DD40CA54

Uniqueness

Uniqueness Score: -1.00%

Function 003B979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003B97BE
FindNextFileW.KERNEL32(00000000,?), ref: 003B9819
FindClose.KERNEL32(00000000), ref: 003B9824
FindFirstFileW.KERNEL32(*.*,?), ref: 003B9840
SetCurrentDirectoryW.KERNEL32(?), ref: 003B9890
SetCurrentDirectoryW.KERNEL32(00406B7C), ref: 003B98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 003B98B8
FindClose.KERNEL32(00000000), ref: 003B98C5
FindClose.KERNEL32(00000000), ref: 003B98D5

Part of subcall function 003ADAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003ADB00

Strings

*.*, xrefs: 003B983B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 9033969a80e604566d65ec2b13d15ec6b792bcf3914e6766b3f4d9e941ef3e6e
Instruction ID: c1fd4ce79c97f9be2a454657ab4f49e9083d252e225f2f6350e845e3d7736d76
Opcode Fuzzy Hash: 9033969a80e604566d65ec2b13d15ec6b792bcf3914e6766b3f4d9e941ef3e6e
Instruction Fuzzy Hash: 0B31F23251121A6ADF12EFB4EC48BDE77BC9F06324F118567EB14E25E0DB31DA84CA64

Uniqueness

Uniqueness Score: -1.00%

Function 003CBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CB6AE,?,?), ref: 003CC9B5
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CC9F1
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA68
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 003CBFA9
RegCloseKey.ADVAPI32(00000000), ref: 003CBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 003CC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003CC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003CC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003CC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 003CC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003CC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003CC382
RegCloseKey.ADVAPI32(00000000), ref: 003CC38F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 7764577e2008cc5b1d8c5ee3ec7a54580d3c5cae54f0841a0b8d5f8211ae3f96
Instruction ID: 5c2079983cdb6936633dead4d11f9949aa27d0fb534a0588778e1f691fe1ccdb
Opcode Fuzzy Hash: 7764577e2008cc5b1d8c5ee3ec7a54580d3c5cae54f0841a0b8d5f8211ae3f96
Instruction Fuzzy Hash: 9F0239716142409FC716DF28C895F2ABBE5AF89308F19889DE84ACF2A2D731ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003B8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 003B8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 003B8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003B8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003B8310
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8324
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 003B838C
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8395

Strings

*.*, xrefs: 003B839B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: e3db7c34b910a0a65fc9379c0794e25aa91eb29ee7e95809dd156571179392e9
Instruction ID: c9c7423ca2edbe8070a7d9b68f4dadec6f33c3a4c001b2482691d4df6cbfd4b5
Opcode Fuzzy Hash: e3db7c34b910a0a65fc9379c0794e25aa91eb29ee7e95809dd156571179392e9
Instruction Fuzzy Hash: 33617A765143459FCB12EF64C840AAEB3ECFF89314F04891EFA898B651DB35E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003AD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00343AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00343A97,?,?,00342E7F,?,?,?,00000000), ref: 00343AC2

Part of subcall function 003AE199: GetFileAttributesW.KERNEL32(?,003ACF95), ref: 003AE19A

FindFirstFileW.KERNEL32(?,?), ref: 003AD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 003AD1DD
MoveFileW.KERNEL32(?,?), ref: 003AD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 003AD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 003AD237

Part of subcall function 003AD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,003AD21C,?,?), ref: 003AD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 003AD253
FindClose.KERNEL32(00000000), ref: 003AD264

Strings

\*.*, xrefs: 003AD0CD, 003AD0D6, 003AD0EB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 7724b3a99bc4075bdd7b0d5a6c2f0920ca43ba9e839f24d3bf484f0ce37d8688
Instruction ID: 8ad8800ac643835e3fe0fe393b1cd2ee153ff3ce9ba10cae71ff1196a53727e6
Opcode Fuzzy Hash: 7724b3a99bc4075bdd7b0d5a6c2f0920ca43ba9e839f24d3bf484f0ce37d8688
Instruction Fuzzy Hash: DD616E3184114D9BCF06EBE0D992AEDB7B9EF56300F204566E4027B192EB30AF09CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003BED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 003BED91
EmptyClipboard.USER32 ref: 003BED97
GlobalAlloc.KERNEL32(00000002,?), ref: 003BEDAC
CloseClipboard.USER32 ref: 003BEEA3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 27dcedb17306bfdfc65abf92454eca270a813d7c6e98516a6be4c2000c5753d4
Instruction ID: db5356ffefd939eeb5a319a7fcd8eafbd8da853b715dd59f1346079bb55a556d
Opcode Fuzzy Hash: 27dcedb17306bfdfc65abf92454eca270a813d7c6e98516a6be4c2000c5753d4
Instruction Fuzzy Hash: 3741EF30215212AFE712CF19E888B99BBE8EF44318F05D09DE9158FA62C775EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 003AE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 003A16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003A170D
Part of subcall function 003A16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003A173A
Part of subcall function 003A16C3: GetLastError.KERNEL32 ref: 003A174A

ExitWindowsEx.USER32(?,00000000), ref: 003AE932

Strings

SeShutdownPrivilege, xrefs: 003AE902
@, xrefs: 003AE925
, xrefs: 003AE920
, xrefs: 003AE95C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 62cb944c317300a0fcc7b54607f499ea809c40d79c0f94203531493b4cb2b704
Instruction ID: 17b542632cfb25ea5768e0c3ed5d6ecd28ff8b667a1f269e4a0d666b626e47ed
Opcode Fuzzy Hash: 62cb944c317300a0fcc7b54607f499ea809c40d79c0f94203531493b4cb2b704
Instruction Fuzzy Hash: A1014972620311ABEB5626B4AC8AFFF735CEB06740F16082AFC13F60D1D7AC5C4081A4

Uniqueness

Uniqueness Score: -1.00%

Function 003C1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 003C1276
WSAGetLastError.WSOCK32 ref: 003C1283
bind.WSOCK32(00000000,?,00000010), ref: 003C12BA
WSAGetLastError.WSOCK32 ref: 003C12C5
closesocket.WSOCK32(00000000), ref: 003C12F4
listen.WSOCK32(00000000,00000005), ref: 003C1303
WSAGetLastError.WSOCK32 ref: 003C130D
closesocket.WSOCK32(00000000), ref: 003C133C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: ba3881dd1fae1d07442f27beeb1f8c2cb7855ffbe95053bd0aa2a68e97e9bd74
Instruction ID: 9d794d8ce1d29e3888d20a070d6de69e68d17e92f2bb4da7261c896bac06ffea
Opcode Fuzzy Hash: ba3881dd1fae1d07442f27beeb1f8c2cb7855ffbe95053bd0aa2a68e97e9bd74
Instruction Fuzzy Hash: 2441AD35A001419FD712DF24D488F2AFBE5AF46318F19858DE8568F2A7C731ED81DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003AD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00343AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00343A97,?,?,00342E7F,?,?,?,00000000), ref: 00343AC2

Part of subcall function 003AE199: GetFileAttributesW.KERNEL32(?,003ACF95), ref: 003AE19A

FindFirstFileW.KERNEL32(?,?), ref: 003AD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 003AD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 003AD481
FindClose.KERNEL32(00000000), ref: 003AD498
FindClose.KERNEL32(00000000), ref: 003AD4A1

Strings

\*.*, xrefs: 003AD3F2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: e308b34c6ca5fff8e1973acd8f13140ae4c5c5945bff51172e8978550ab28d76
Instruction ID: 0256816a9e138704853236ebed3e713266a7473de928400668152d6354e06fce
Opcode Fuzzy Hash: e308b34c6ca5fff8e1973acd8f13140ae4c5c5945bff51172e8978550ab28d76
Instruction Fuzzy Hash: BA3170710193459FC702EF64D8569AF77E8EE96304F444E1EF4D25B1A1EB30AA09C763

Uniqueness

Uniqueness Score: -1.00%

Function 0037E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0037E645

Strings

1#QNAN, xrefs: 0037F84B
1#SNAN, xrefs: 0037F844
1#IND, xrefs: 0037F83D
1#INF, xrefs: 0037F852

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: fb4a72e0681c92d4beb463cad84a3fe148b23a65bdee15bfcea0fc7a659153cd
Instruction ID: 38e4480948d197e80aec07c5f67638f9d629278b11056bc1ab4c54df8004e0d5
Opcode Fuzzy Hash: fb4a72e0681c92d4beb463cad84a3fe148b23a65bdee15bfcea0fc7a659153cd
Instruction Fuzzy Hash: 70C21B71E086298FDB36CE289D407E9B7B9FB49315F1581EAD44DE7240E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 003B648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003B64DC
CoInitialize.OLE32(00000000), ref: 003B6639
CoCreateInstance.OLE32(003DFCF8,00000000,00000001,003DFB68,?), ref: 003B6650
CoUninitialize.OLE32 ref: 003B68D4

Strings

.lnk, xrefs: 003B64BA, 003B6524, 003B65E0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 74eb78adc6eed6f19a93634e00f191dbbf8f8533bb69cc3424a990d1041033c1
Instruction ID: db5be4ce87371888006cdb1f60a851edd7dbec206dd8d0eeb0b8705659ce26c2
Opcode Fuzzy Hash: 74eb78adc6eed6f19a93634e00f191dbbf8f8533bb69cc3424a990d1041033c1
Instruction Fuzzy Hash: 5AD139715082019FC315EF24C881EABB7E9FF95708F10496DF5958B2A2DB71ED09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003C22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 003C22E8

Part of subcall function 003BE4EC: GetWindowRect.USER32(?,?), ref: 003BE504

GetDesktopWindow.USER32 ref: 003C2312
GetWindowRect.USER32(00000000), ref: 003C2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 003C2355
GetCursorPos.USER32(?), ref: 003C2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 003C23DF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 59ad38491d1614b8e9cdc10955df483f1693b390befd2818d44d6bfb9ea21b7f
Instruction ID: efecd17249da82190f8179bb175d64d285124832a5bffb22c10563b7ce5807e0
Opcode Fuzzy Hash: 59ad38491d1614b8e9cdc10955df483f1693b390befd2818d44d6bfb9ea21b7f
Instruction Fuzzy Hash: D631DC72105346ABC722DF14D808F9BBBAAFB85710F000A1EF984D7181DB34EE08CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003B9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 003B9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 003B9C8B

Part of subcall function 003B3874: GetInputState.USER32 ref: 003B38CB
Part of subcall function 003B3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003B3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 003B9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 003B9C75

Strings

*.*, xrefs: 003B9B5D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: c0cc2d8064153b77db5ef7bb366d2f224de62af150e4e52997091a29ac8791c7
Instruction ID: 12de3fc00d85610ac0617c03fb5c71ec732411c3fe3b8566d3c64bba871b0126
Opcode Fuzzy Hash: c0cc2d8064153b77db5ef7bb366d2f224de62af150e4e52997091a29ac8791c7
Instruction Fuzzy Hash: 1C414E7194420A9BDF16DFA4D889BEE7BF8EF05314F244156E605A7191EB30AE44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00348060 Relevance: 8.7, Strings: 6, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 003483E8
_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{, xrefs: 00385DAA
VUUU, xrefs: 0034843C
VUUU, xrefs: 00385DF0
ERCP, xrefs: 0034813C
VUUU, xrefs: 003483FA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU$_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{
API String ID: 0-2009957334
Opcode ID: 68835d3d637170baee02205a080158226f970612b560f21b1431b430d3ad8d45
Instruction ID: e18e46aa053b8cfa5b656ffe923dae26720ff2f05bc773dfbb4c8d558c13f8d8
Opcode Fuzzy Hash: 68835d3d637170baee02205a080158226f970612b560f21b1431b430d3ad8d45
Instruction Fuzzy Hash: 9BA2AE70E0021ACBDF26DF58C8417AEB7B1BF54314F2585EAE815AB681DB74AD81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0035997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00359A4E
GetSysColor.USER32(0000000F), ref: 00359B23
SetBkColor.GDI32(?,00000000), ref: 00359B36

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 4ae7cdbb753ec45eb70051ba7871ba5cc3fae90c762e6d1050c7502bf63e866e
Instruction ID: 645cdad24a686f6f07c11307feed941543de4d9574ddd0b8bf5d76e52357acb8
Opcode Fuzzy Hash: 4ae7cdbb753ec45eb70051ba7871ba5cc3fae90c762e6d1050c7502bf63e866e
Instruction Fuzzy Hash: 92A12DB1228544EEEB27AB3C9C48FBB365DDB42341F17411BF902CAAF1CA259D05C275

Uniqueness

Uniqueness Score: -1.00%

Function 003C1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003C307A
Part of subcall function 003C304E: _wcslen.LIBCMT ref: 003C309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 003C185D
WSAGetLastError.WSOCK32 ref: 003C1884
bind.WSOCK32(00000000,?,00000010), ref: 003C18DB
WSAGetLastError.WSOCK32 ref: 003C18E6
closesocket.WSOCK32(00000000), ref: 003C1915

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 56cea04349c7aed289e2952775de3bcdb028de396513ffb065b7326161fc733a
Instruction ID: 87748379f6619c5c8e12d2a61eafa1e89c3100e86ae19d40100399dc0d13cfaa
Opcode Fuzzy Hash: 56cea04349c7aed289e2952775de3bcdb028de396513ffb065b7326161fc733a
Instruction Fuzzy Hash: B9519071A00210AFDB12AF24C886F2AB7E5AB45718F18849CF9069F393C771AD41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003D1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 003D1CC0
IsWindowEnabled.USER32 ref: 003D1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 003D1CDB
IsIconic.USER32 ref: 003D1CE9
IsZoomed.USER32 ref: 003D1CF7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 3906121ca71fde13617936a0e3b5fb431e3a71c16b72bf721a5a10d6b611cc0d
Instruction ID: ea5effb3378c798d08d4e60837cc28b3c730b48072f2215ddcd5320627a38092
Opcode Fuzzy Hash: 3906121ca71fde13617936a0e3b5fb431e3a71c16b72bf721a5a10d6b611cc0d
Instruction Fuzzy Hash: 632129327612016FD7228F1AE844F267BE9EF85310F19805AE845CB351CB71EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003A8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 003A82AA

Strings

|, xrefs: 003A82DA
tb@, xrefs: 003A84F4
(, xrefs: 003A82F0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: lstrlen
String ID: ($tb@$|
API String ID: 1659193697-3099576147
Opcode ID: 9dc01f16710acf0bdeb14ab6846d032535d18b7a1322705f8475a83d2ae89091
Instruction ID: 58fb556454e45cc18d657d9b1afd261a86ef3ebf331155861d324ea4bff8fb87
Opcode Fuzzy Hash: 9dc01f16710acf0bdeb14ab6846d032535d18b7a1322705f8475a83d2ae89091
Instruction Fuzzy Hash: 43323578A007059FCB29CF59C481A6AB7F0FF48710B15C56EE59ADB7A1EB70E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 003CA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 003CA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 003CA6BA

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Process32NextW.KERNEL32(00000000,?), ref: 003CA79C
CloseHandle.KERNEL32(00000000), ref: 003CA7AB

Part of subcall function 0035CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00383303,?), ref: 0035CE8A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 1f9e4c79856c579e12fb89afee3f0e483f2862d5a1b0fa9d1b7bec57b94b12af
Instruction ID: ce4c1bebc4ca41d28f62bf7ab6259200c7013803265659df3da50806088d4677
Opcode Fuzzy Hash: 1f9e4c79856c579e12fb89afee3f0e483f2862d5a1b0fa9d1b7bec57b94b12af
Instruction Fuzzy Hash: 5E514A71508311AFD311EF24D886E6BBBE8FF89754F00491DF9859B262EB30E904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003AAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 003AAAAC
SetKeyboardState.USER32(00000080), ref: 003AAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 003AAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 003AAB88

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0d1658fd442e148631e93b6fc08dd82f83f975c2afeafa311e108bf8513fcff9
Instruction ID: bea9c980697d07e5c3cbc4a17e0f24b94bcef8424453dfa32af7740c17462c61
Opcode Fuzzy Hash: 0d1658fd442e148631e93b6fc08dd82f83f975c2afeafa311e108bf8513fcff9
Instruction Fuzzy Hash: 9B313932A50A08AEFF37CB64CC05BFA7BAAEB46310F04421BF181965D1D3758981D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0037BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0037BB7F

Part of subcall function 003729C8: HeapFree.KERNEL32(00000000,00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000), ref: 003729DE
Part of subcall function 003729C8: GetLastError.KERNEL32(00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000,00000000), ref: 003729F0

GetTimeZoneInformation.KERNEL32 ref: 0037BB91
WideCharToMultiByte.KERNEL32(00000000,?,0041121C,000000FF,?,0000003F,?,?), ref: 0037BC09
WideCharToMultiByte.KERNEL32(00000000,?,00411270,000000FF,?,0000003F,?,?,?,0041121C,000000FF,?,0000003F,?,?), ref: 0037BC36

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 5c1dd9ef4785fcb7603088b279f22938a718f1c37dff195c041a03706de95938
Instruction ID: ddcf3f47a3579af5fce90d34dd0c2a0485c88560e9510ee2257a40ee094e29bf
Opcode Fuzzy Hash: 5c1dd9ef4785fcb7603088b279f22938a718f1c37dff195c041a03706de95938
Instruction Fuzzy Hash: 2931A170904206DFCB22DF69DC80AA9FBB8FF46310B15C2AAE559EB2B1D7349D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 003BCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 003BCE89
GetLastError.KERNEL32(?,00000000), ref: 003BCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 003BCEFE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: fab2b74c0b42b79afa07b2ad8d7bee359141fe1e10d0ae9f19244414e9a8fce2
Instruction ID: bf76421fd296aa0e641d97e6d2bc64f248c8b655cb7ac5430d3338f5d9a23666
Opcode Fuzzy Hash: fab2b74c0b42b79afa07b2ad8d7bee359141fe1e10d0ae9f19244414e9a8fce2
Instruction Fuzzy Hash: 2321BD71A20306DBDB32DFA5D948BA777FCEB00319F10941EE64692951E774EE04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003ADBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00385222), ref: 003ADBCE
GetFileAttributesW.KERNEL32(?), ref: 003ADBDD
FindFirstFileW.KERNEL32(?,?), ref: 003ADBEE
FindClose.KERNEL32(00000000), ref: 003ADBFA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 292744bae61e096e9aa2b5bab2719b24560bc7320d707fc959fbe458292ba04b
Instruction ID: 1ccc9942dac273ea36d59c081b6d509334e00bc18b3f40d140d689814e26bde4
Opcode Fuzzy Hash: 292744bae61e096e9aa2b5bab2719b24560bc7320d707fc959fbe458292ba04b
Instruction Fuzzy Hash: 9DF0A03083192157C2226B78BC0D8AA376CDE02334F904B13F876C24E0EBB45D64C695

Uniqueness

Uniqueness Score: -1.00%

Function 003B5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003B5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 003B5D17
FindClose.KERNEL32(?), ref: 003B5D5F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: cb6d0b4ca602d6d935dfcdc713fe7b0d7716a0e750fd723327a2c7f2fc9f6249
Instruction ID: e4fb545702cb45eaeb1c740bdb3693410a91e089a9d2c9552de7ad078dd0680b
Opcode Fuzzy Hash: cb6d0b4ca602d6d935dfcdc713fe7b0d7716a0e750fd723327a2c7f2fc9f6249
Instruction Fuzzy Hash: 14518974604A019FC716DF28C494A96B7E4FF49318F15865EEA5A8B3A1CB30F905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00372622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0037271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00372724
UnhandledExceptionFilter.KERNEL32(?), ref: 00372731

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ec0b70bd36a48a1312b1507e1a94c3a53e615b00762413f2cfbb71c252040993
Instruction ID: fd5cf2847817beae492b3ef07d89f83b324c6ead8d1a1b6bce894abd26de8531
Opcode Fuzzy Hash: ec0b70bd36a48a1312b1507e1a94c3a53e615b00762413f2cfbb71c252040993
Instruction Fuzzy Hash: C631D5749112189BCB26DF68DD8979DB7B8AF08310F5082EAE80CA7261E7349F81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 003B51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003B51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 003B5238
SetErrorMode.KERNEL32(00000000), ref: 003B52A1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1c04b49383734df8de67d290d66ca8438e906197b49b616d4010dcffa3fc6363
Instruction ID: 0cedc7f26e47b42fe4295c666b3c46b634a1bcbd4e6cbe3a62cfd837b86c9538
Opcode Fuzzy Hash: 1c04b49383734df8de67d290d66ca8438e906197b49b616d4010dcffa3fc6363
Instruction Fuzzy Hash: DB315A35A105189FDB01DF54D884AADBBB4FF09318F048499E905AF362CB32E846CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003A16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0035FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00360668
Part of subcall function 0035FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00360685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003A170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003A173A
GetLastError.KERNEL32 ref: 003A174A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 3b9e06fbdd86be38bd79e9fb65bd766655f0b0af209a6c749b0c4a19dbabfcb4
Instruction ID: eb6103c36e3b091ebccd1407977b9b1ed2a57e17d361eb9c29294435fdf53c6a
Opcode Fuzzy Hash: 3b9e06fbdd86be38bd79e9fb65bd766655f0b0af209a6c749b0c4a19dbabfcb4
Instruction Fuzzy Hash: 6411BCB2820205AFD719AF54EC86D6AB7FDEB04714F20852EE45696251EB70FC41CA20

Uniqueness

Uniqueness Score: -1.00%

Function 003AD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003AD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 003AD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003AD650

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 4fac0577b8c215eb35bdfe9fdd5995897331268600045d870c4cb9605fcdf667
Instruction ID: 8db0d5c76981a02a5992972f3cdfe261eda9f6b9a55ed26cc98a30089923e92a
Opcode Fuzzy Hash: 4fac0577b8c215eb35bdfe9fdd5995897331268600045d870c4cb9605fcdf667
Instruction Fuzzy Hash: 48118E75E05228BFDB118FA4EC44FAFBBBCEB45B50F108112F904E7290C2704A018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 003A1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 003A168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 003A16A1
FreeSid.ADVAPI32(?), ref: 003A16B1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 45e2ca1d7048fce5c070a600c211159948a05c7a8c7aa3c9584a1892c24b91d7
Instruction ID: 5e696d488e05dd69cad0e696c9d0be493e58410aebc1ce3e4b80a3de45f24ba3
Opcode Fuzzy Hash: 45e2ca1d7048fce5c070a600c211159948a05c7a8c7aa3c9584a1892c24b91d7
Instruction Fuzzy Hash: ACF0F471961309FBDF01DFE49C89AAEBBBCEB08704F504565E901E2191E774EA448A50

Uniqueness

Uniqueness Score: -1.00%

Function 0039D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0039D28C

Strings

X64, xrefs: 0039D2A8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 8b5714a800a7c89362327e6c60ede8b02caa8bceb7900d54e4c601e562388474
Instruction ID: 35f693fba817b64cde4bff36099300647713f7594e67cc2be5f5b4ab0c0eb255
Opcode Fuzzy Hash: 8b5714a800a7c89362327e6c60ede8b02caa8bceb7900d54e4c601e562388474
Instruction Fuzzy Hash: FBD0C9B481111DEACF91CB90EC88DD9B37CBB04305F100552F506A2480D73095488F10

Uniqueness

Uniqueness Score: -1.00%

Function 0036CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 8f9e4578271c914b13bfa5ffded5b37efad2d62b28c540e61e36210f186396af
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 15024B71E102199BDF15CFA9C8806ADFBF1EF88314F25816AD859EB384D731AE018B90

Uniqueness

Uniqueness Score: -1.00%

Function 0034CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00390C40
p#A, xrefs: 0034CF7F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#A
API String ID: 0-1342752299
Opcode ID: f8acec65df36cd0a018a1f4ca39647c6042716a3be4d249b572a7192188bfe49
Instruction ID: 64f4e63983a11620727d113bed11b796e3f21aad422e9953668b9d5d98ac4a45
Opcode Fuzzy Hash: f8acec65df36cd0a018a1f4ca39647c6042716a3be4d249b572a7192188bfe49
Instruction Fuzzy Hash: 4E327970911218DFCF5ADF90C980AEDB7F9BF05304F159069E806AF292DB75AE4ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 003B68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003B6918
FindClose.KERNEL32(00000000), ref: 003B6961

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4b53b5ab1f7ec5015380ee4a105f32cd9b2dedb718607522a44a29fbfadc0f6b
Instruction ID: e52eb0425eeef6afa79a61d720cf750b78de90eb72118095f846b77417691062
Opcode Fuzzy Hash: 4b53b5ab1f7ec5015380ee4a105f32cd9b2dedb718607522a44a29fbfadc0f6b
Instruction Fuzzy Hash: FA11E2316142019FC711CF29D485A16BBE4FF85328F05C699F9698F7A2C734EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003B37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,003C4891,?,?,00000035,?), ref: 003B37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,003C4891,?,?,00000035,?), ref: 003B37F4

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3eccd08afc1215c372d837596cd3e80f332ae6e17dd59585159b1d52867e24d2
Instruction ID: 0ccb1214e14a63d2f3c0d81824b22b57de1d1393e73dcb06013635d2c079a810
Opcode Fuzzy Hash: 3eccd08afc1215c372d837596cd3e80f332ae6e17dd59585159b1d52867e24d2
Instruction Fuzzy Hash: 74F0EC706153396AD71117655C4DFDB379DEFC4765F000265F609D2581D9605D04C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 003AB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 003AB25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 003AB270

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 6f6e78efa638b91882982cd5c0ef1bdcdaedacbbdd7364c531733eaf8a76230f
Instruction ID: e96bc791ecee612fee9ade29ed81a0a2e6f2bf296604c3780ffb64e1562b40c2
Opcode Fuzzy Hash: 6f6e78efa638b91882982cd5c0ef1bdcdaedacbbdd7364c531733eaf8a76230f
Instruction Fuzzy Hash: D6F01D7181424EABDB069FA1D805BAEBBB4FF05305F00944AF955A5192C3798611DF94

Uniqueness

Uniqueness Score: -1.00%

Function 003A10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003A11FC), ref: 003A10D4
CloseHandle.KERNEL32(?,?,003A11FC), ref: 003A10E9

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 911c27b34e9181ce4f50a8d965abd1677add90ccfeb7050663233da4a361a557
Instruction ID: 10e22356888c9e57b7114efac85af010f19f8191df09abecd4bd7e35bd782ef9
Opcode Fuzzy Hash: 911c27b34e9181ce4f50a8d965abd1677add90ccfeb7050663233da4a361a557
Instruction Fuzzy Hash: D6E04F32024601AEE7262B11FC06E7377EDEB04311F10882EF8A5844B5DB62AC90DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0034BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#A, xrefs: 003907CE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#A
API String ID: 3964851224-348305189
Opcode ID: d264d2f01df0f748e7c0619519109c0456e184b6fe2b75a000b016cc1b986489
Instruction ID: 01908081115a67b86ecb050cd3b6d236f64ba01114e3e6b5db2e42721c188fb0
Opcode Fuzzy Hash: d264d2f01df0f748e7c0619519109c0456e184b6fe2b75a000b016cc1b986489
Instruction Fuzzy Hash: E9A27B706183019FCB56CF18C480B2ABBE5BF89304F15996DE99A8F362D771EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0037676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00376766,?,?,00000008,?,?,0037FEFE,00000000), ref: 00376998

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 629b795e05bd034681a36a65b99cc6ef3e63a37db5534994a4bdfb6d3070d5bc
Instruction ID: c01c6b0a1850bea2574d68415eb99b0976ff01de10009c98fd4cb7eaff4a96fc
Opcode Fuzzy Hash: 629b795e05bd034681a36a65b99cc6ef3e63a37db5534994a4bdfb6d3070d5bc
Instruction Fuzzy Hash: D6B15B71510A099FD72ACF28C496B657BE0FF45364F26C658E89DCF2A2C339D985CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0035B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0039851F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4def34c697595243baa9cb300a717080041f3a2d34f6a6f7b4f32104ceb534cb
Instruction ID: fc45648b7f1af524953ef8e0a22d793d5b0146f4472db2f6d6d5ab58c5a46483
Opcode Fuzzy Hash: 4def34c697595243baa9cb300a717080041f3a2d34f6a6f7b4f32104ceb534cb
Instruction Fuzzy Hash: D3125F759002299FCF26CF59C880AEEB7F5FF49710F15819AE849EB251DB309E85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003BEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 003BEABD

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 5df69fd4a2229e95f13384ecbf447c2cfe30b532f314cc9a7cb8573b89a5ed89
Instruction ID: 559db8134e0ff83849dde570768ff1757160d708ebe2dcd95dd05b9dab4f7cf4
Opcode Fuzzy Hash: 5df69fd4a2229e95f13384ecbf447c2cfe30b532f314cc9a7cb8573b89a5ed89
Instruction Fuzzy Hash: 06E01A312202049FC711EF69D804E9AF7EDAF98764F008416FD49CB6A1DA70E8408B90

Uniqueness

Uniqueness Score: -1.00%

Function 003609D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,003603EE), ref: 003609DA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 902e78d64cf5cc52391b80553ec8b0c89ba44902a16fc63981aaf9e5b52f7065
Instruction ID: d60db3601907482510a5cc5181d7dd28c4a22c8858dc996fde7a19a25a440593
Opcode Fuzzy Hash: 902e78d64cf5cc52391b80553ec8b0c89ba44902a16fc63981aaf9e5b52f7065
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0036781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0036798B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 70fec9ec28b8ae148615f96dc34f5fb978b6ca2cba771dbb0dbe9769b6d2cee4
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 8451567160C6055ADB3B8678885F7BE23D99B0234CFD9CA09D882CB78EC715EE41D366

Uniqueness

Uniqueness Score: -1.00%

Function 003B2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&A, xrefs: 003B2053

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: 0&A
API String ID: 0-422563488
Opcode ID: 352583740ef1d0962f3c875a4b2a0046414656e0ae1304d177eaf0065fb8d52a
Instruction ID: 3b8ee4b02279b2f3641b2ddb7e37430cfccfdc463fa221ebb9b3764e6b6ed632
Opcode Fuzzy Hash: 352583740ef1d0962f3c875a4b2a0046414656e0ae1304d177eaf0065fb8d52a
Instruction Fuzzy Hash: 3121D5322206118BD728CE79C9226BE73E5A754314F158A2EE4A7C77D0DE79A904CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00376DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29bc83a1d2ad4cbf995768b84e143a8ae67cb849d432976814d3cff7d5c1136a
Instruction ID: 76ed6820870d605d252ce36cdeeb4bed1e3d3ecf57e3b466c7903c7aca2eb4a6
Opcode Fuzzy Hash: 29bc83a1d2ad4cbf995768b84e143a8ae67cb849d432976814d3cff7d5c1136a
Instruction Fuzzy Hash: C6323522D29F414DD7339634CC62336A68DAFB73D5F15D737E82AB99A6EB29C4834100

Uniqueness

Uniqueness Score: -1.00%

Function 0035CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a940087837cf2fa142b218c41d955873191a4830aec725dda68374f982f71698
Instruction ID: ed687ed7786508c2bc66dd309b7976db3554f6a93085f9269e270b8cca4d57e3
Opcode Fuzzy Hash: a940087837cf2fa142b218c41d955873191a4830aec725dda68374f982f71698
Instruction Fuzzy Hash: 03327D31A202058FDF27CF28C490A7D7BA5EF45305F2AA526D85ADB6A2D330DD86DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00347920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b8b1730e22eccc8dc4c892b03ffc6f862049060d16813ddce9c610767fab74
Instruction ID: 570c58f821fda8042394a612e2ebe5396e8fba8286a9103a7d6089505bac8912
Opcode Fuzzy Hash: c6b8b1730e22eccc8dc4c892b03ffc6f862049060d16813ddce9c610767fab74
Instruction Fuzzy Hash: 4F22D3B0A04609DFDF16DFA4C981AAEB7F5FF44300F204569E812EB291EB36AD15CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003491C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84cfb5375364c9c74e7a0dc75fe36d3c10841d4a0e83e1cca5e7e30b79fc4c5
Instruction ID: 545e17fa04c173105c73826dc88a2f241dc3c7497069646f4f1a22a8a9343eb4
Opcode Fuzzy Hash: f84cfb5375364c9c74e7a0dc75fe36d3c10841d4a0e83e1cca5e7e30b79fc4c5
Instruction Fuzzy Hash: 1E02A6B1E00209EFDB06EF54D981AAEB7F5FF44300F1185A9E8169F291E731EA14CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00379EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddae849eb777657e5bf9408f3a5d747c3e6e3e8bca34bbc466cd94aebf18fb46
Instruction ID: 0d6a2e0382cffd30909e46f928e27c890a9b1905376cb32f3283d222c8cbb86b
Opcode Fuzzy Hash: ddae849eb777657e5bf9408f3a5d747c3e6e3e8bca34bbc466cd94aebf18fb46
Instruction Fuzzy Hash: F8B12524D2AF804DD33396398875336B65CAFBB2C5F91D71BFC2679DA2EB2285834140

Uniqueness

Uniqueness Score: -1.00%

Function 00361C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 57eb32463a1699e3acf35fc67bb34364529e56e33c46156fc5eee5d6f3c567a5
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: B89177725090E34ADB6F463E857403EFFE15A923A131F479ED4F2CA1C9EE20C964E620

Uniqueness

Uniqueness Score: -1.00%

Function 00361F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 0b0888e58994096db51e4fb9711c1a9a0874b302ff307b877325d133decf6f50
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: D291467220D4A349DB6F473A857403FFFE15A923A131F879DD4F2CA5C9EE248564E620

Uniqueness

Uniqueness Score: -1.00%

Function 003619B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: b752282e17b37d35159b91e93ddd069eff6e538cc509079d94eaa8bdcb7ed636
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: F19152722090E34ADB6F427A857403EFFE55A923A231F879DD4F2CB5C9FE14C564A620

Uniqueness

Uniqueness Score: -1.00%

Function 00367A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72eccf640bf66d8c414cff6bff9dd131304de2819213a6d68f7ab60dd22a499
Instruction ID: 37eb70aeed5921c5fe9d9884a6aab872a7647dc087f0849ec8da1e6c80ac39f6
Opcode Fuzzy Hash: b72eccf640bf66d8c414cff6bff9dd131304de2819213a6d68f7ab60dd22a499
Instruction Fuzzy Hash: BB61793120834956DA379AA8C8A5BBE2398DF4170CFE1CA19E843DF38DDA519E42C355

Uniqueness

Uniqueness Score: -1.00%

Function 00367CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148f4e5b2bd3de8c6c2ba9c1445c652e16bae60d6760ef95262187ea97741bb2
Instruction ID: 31b8a0247ef97801a6584958675d999552e862de9670f8c9efa9053beb789a26
Opcode Fuzzy Hash: 148f4e5b2bd3de8c6c2ba9c1445c652e16bae60d6760ef95262187ea97741bb2
Instruction Fuzzy Hash: 0561AC3120870953DF3B9A288895BBF2388DF4274CFD1CD59E943DF68DEA129D468355

Uniqueness

Uniqueness Score: -1.00%

Function 00361706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: e1d5a5bf63833172e72a2b6494997c2858de8700825246b48bd97f16b5bca11d
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: A88163726090E30EDB6F863A853443EFFE15A923A131F879DD4F2CB5C9EE248554E660

Uniqueness

Uniqueness Score: -1.00%

Function 003C2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003C2B30
DeleteObject.GDI32(00000000), ref: 003C2B43
DestroyWindow.USER32 ref: 003C2B52
GetDesktopWindow.USER32 ref: 003C2B6D
GetWindowRect.USER32(00000000), ref: 003C2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 003C2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 003C2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2CF8
GetClientRect.USER32(00000000,?), ref: 003C2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003C2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2DA8
GlobalFree.KERNEL32(00000000), ref: 003C2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,003DFC38,00000000), ref: 003C2DDB
GlobalFree.KERNEL32(00000000), ref: 003C2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 003C2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 003C2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C303F

Strings

DISPLAY, xrefs: 003C2EA2
, xrefs: 003C2FC5
static, xrefs: 003C2D3A, 003C2E91
AutoIt v3, xrefs: 003C2CF2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 5a28a6685308a2548b905f5a8ec128f0124a7c7567db7aeede2a7e40cdcdf5f9
Instruction ID: b02d658e9c6119808f281f6fc7bd353906321378038614a1d7fde4d69023c372
Opcode Fuzzy Hash: 5a28a6685308a2548b905f5a8ec128f0124a7c7567db7aeede2a7e40cdcdf5f9
Instruction Fuzzy Hash: 11028E71910219AFDB16DF64DC89EAEBBB9FF49310F048559F915AB2A1CB70ED00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003D70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 003D712F
GetSysColorBrush.USER32(0000000F), ref: 003D7160
GetSysColor.USER32(0000000F), ref: 003D716C
SetBkColor.GDI32(?,000000FF), ref: 003D7186
SelectObject.GDI32(?,?), ref: 003D7195
InflateRect.USER32(?,000000FF,000000FF), ref: 003D71C0
GetSysColor.USER32(00000010), ref: 003D71C8
CreateSolidBrush.GDI32(00000000), ref: 003D71CF
FrameRect.USER32(?,?,00000000), ref: 003D71DE
DeleteObject.GDI32(00000000), ref: 003D71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 003D7230
FillRect.USER32(?,?,?), ref: 003D7262
GetWindowLongW.USER32(?,000000F0), ref: 003D7284

Part of subcall function 003D73E8: GetSysColor.USER32(00000012), ref: 003D7421
Part of subcall function 003D73E8: SetTextColor.GDI32(?,?), ref: 003D7425
Part of subcall function 003D73E8: GetSysColorBrush.USER32(0000000F), ref: 003D743B
Part of subcall function 003D73E8: GetSysColor.USER32(0000000F), ref: 003D7446
Part of subcall function 003D73E8: GetSysColor.USER32(00000011), ref: 003D7463
Part of subcall function 003D73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 003D7471
Part of subcall function 003D73E8: SelectObject.GDI32(?,00000000), ref: 003D7482
Part of subcall function 003D73E8: SetBkColor.GDI32(?,00000000), ref: 003D748B
Part of subcall function 003D73E8: SelectObject.GDI32(?,?), ref: 003D7498
Part of subcall function 003D73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 003D74B7
Part of subcall function 003D73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003D74CE
Part of subcall function 003D73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 003D74DB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: df9f92c245a8ac5a26dd619de81220b4a0848ab5e83632c5d52754cf6b58b350
Instruction ID: ff8f5c0904b89925f71c85d4e1413b3ab1264f709e1d2607e48bbc15463beb26
Opcode Fuzzy Hash: df9f92c245a8ac5a26dd619de81220b4a0848ab5e83632c5d52754cf6b58b350
Instruction Fuzzy Hash: C4A1A272029312AFDB029F60EC48E5BBBADFF49321F101B1AF962961E1D771E944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00358D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00358E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00396AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00396AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00396F43

Part of subcall function 00358F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00358BE8,?,00000000,?,?,?,?,00358BBA,00000000,?), ref: 00358FC5

SendMessageW.USER32(?,00001053), ref: 00396F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00396F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00396FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00396FB7

Strings

0, xrefs: 00396DCF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: f7c7fe61e66da0c295e3af4449408ff108db01371fe907ab3ee045a2d6561844
Instruction ID: e8de4877051ffd8936b2ce0d943629137bdda03a5ae9940b5572d1135c85c5ee
Opcode Fuzzy Hash: f7c7fe61e66da0c295e3af4449408ff108db01371fe907ab3ee045a2d6561844
Instruction Fuzzy Hash: 8512DA30612202DFCB22CF24D996BAAB7F9FB44301F158029F9959B661CB31EC55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003C2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 003C273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 003C286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 003C28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 003C28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 003C2900
GetClientRect.USER32(00000000,?), ref: 003C290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 003C2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 003C2964
GetStockObject.GDI32(00000011), ref: 003C2974
SelectObject.GDI32(00000000,00000000), ref: 003C2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 003C2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003C2991
DeleteDC.GDI32(00000000), ref: 003C299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 003C29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 003C29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 003C2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 003C2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 003C2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 003C2A77
GetStockObject.GDI32(00000011), ref: 003C2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 003C2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 003C2A97

Strings

DISPLAY, xrefs: 003C295A
msctls_progress32, xrefs: 003C2A13
static, xrefs: 003C294F, 003C2A71
AutoIt v3, xrefs: 003C28F8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 62396a6f399bb3ad7875c3d300bf2d80bdf033748a8b536b2f95d13e3f1914c8
Instruction ID: 979b1c1d7d9febed58f88f07f807a9b3d5bd76c276a7024f72d68837a0cccf46
Opcode Fuzzy Hash: 62396a6f399bb3ad7875c3d300bf2d80bdf033748a8b536b2f95d13e3f1914c8
Instruction Fuzzy Hash: 9EB16071A50219AFEB15DF68DC85FAFBBA9EB04710F008159FA15EB2A0D770ED40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 003B4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003B4AED
GetDriveTypeW.KERNEL32(?,003DCB68,?,\\.\,003DCC08), ref: 003B4BCA
SetErrorMode.KERNEL32(00000000,003DCB68,?,\\.\,003DCC08), ref: 003B4D36

Strings

RAID, xrefs: 003B4CBB
MMC, xrefs: 003B4CDE
SAS, xrefs: 003B4CC9
FileBackedVirtual, xrefs: 003B4CEC
iSCSI, xrefs: 003B4CC2
SSA, xrefs: 003B4CA6
PhysicalDrive, xrefs: 003B4B76
ATAPI, xrefs: 003B4C91
ATA, xrefs: 003B4C98
SSD, xrefs: 003B4C4A
1394, xrefs: 003B4C9F
Unknown, xrefs: 003B4BED, 003B4C83
Fixed, xrefs: 003B4C09
SCSI, xrefs: 003B4C8A
RAMDisk, xrefs: 003B4BF4
Virtual, xrefs: 003B4CE5
\\.\, xrefs: 003B4B3F
Fibre, xrefs: 003B4CAD
CDROM, xrefs: 003B4BFB
USB, xrefs: 003B4CB4
Removable, xrefs: 003B4C10, 003B4C15
SATA, xrefs: 003B4CD0
Network, xrefs: 003B4C02

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f90744d01255fc505c815ec4e418bdb4fa6c14ba57560835b44a5f7a38e74509
Instruction ID: 8a3c7731e5cc22e185bfb63248319824d3d879209aaa4c8cf0e650709028ba01
Opcode Fuzzy Hash: f90744d01255fc505c815ec4e418bdb4fa6c14ba57560835b44a5f7a38e74509
Instruction Fuzzy Hash: 4561C630705205ABCB06DF14C981AF97BA4EF04B08B218426FA07AFE97DB35ED55DB49

Uniqueness

Uniqueness Score: -1.00%

Function 003D73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 003D7421
SetTextColor.GDI32(?,?), ref: 003D7425
GetSysColorBrush.USER32(0000000F), ref: 003D743B
GetSysColor.USER32(0000000F), ref: 003D7446
CreateSolidBrush.GDI32(?), ref: 003D744B
GetSysColor.USER32(00000011), ref: 003D7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 003D7471
SelectObject.GDI32(?,00000000), ref: 003D7482
SetBkColor.GDI32(?,00000000), ref: 003D748B
SelectObject.GDI32(?,?), ref: 003D7498
InflateRect.USER32(?,000000FF,000000FF), ref: 003D74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003D74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 003D74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003D752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 003D7554
InflateRect.USER32(?,000000FD,000000FD), ref: 003D7572
DrawFocusRect.USER32(?,?), ref: 003D757D
GetSysColor.USER32(00000011), ref: 003D758E
SetTextColor.GDI32(?,00000000), ref: 003D7596
DrawTextW.USER32(?,003D70F5,000000FF,?,00000000), ref: 003D75A8
SelectObject.GDI32(?,?), ref: 003D75BF
DeleteObject.GDI32(?), ref: 003D75CA
SelectObject.GDI32(?,?), ref: 003D75D0
DeleteObject.GDI32(?), ref: 003D75D5
SetTextColor.GDI32(?,?), ref: 003D75DB
SetBkColor.GDI32(?,?), ref: 003D75E5

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 574531029a958f9a647c23ecd6e28bd09d13a20d9f3dd43c1fd557950dca3352
Instruction ID: 1046d0499a4fe3e6f4aea1fdb2c07088a97cf08f8aa69609a35046b56311977a
Opcode Fuzzy Hash: 574531029a958f9a647c23ecd6e28bd09d13a20d9f3dd43c1fd557950dca3352
Instruction Fuzzy Hash: 9B617272911219AFDF029FA4EC49EEEBF79EF09320F115116F915AB2A1D7709940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003D0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003D1128
GetDesktopWindow.USER32 ref: 003D113D
GetWindowRect.USER32(00000000), ref: 003D1144
GetWindowLongW.USER32(?,000000F0), ref: 003D1199
DestroyWindow.USER32(?), ref: 003D11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003D11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003D120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 003D121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 003D1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 003D1245
IsWindowVisible.USER32(00000000), ref: 003D12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 003D12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 003D12D0
GetWindowRect.USER32(00000000,?), ref: 003D12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 003D130E
GetMonitorInfoW.USER32(00000000,?), ref: 003D1328
CopyRect.USER32(?,?), ref: 003D133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 003D13AA

Strings

0, xrefs: 003D10D3
(, xrefs: 003D131B
tooltips_class32, xrefs: 003D11E6

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: fddd25593c2cae368185bcf7bab593a3c5318315c412d6d426919f716095e04b
Instruction ID: 8af2c8a4b0502ff260bfd1f899f1baeea20fb5a472d1485fbc6506c6945f52a1
Opcode Fuzzy Hash: fddd25593c2cae368185bcf7bab593a3c5318315c412d6d426919f716095e04b
Instruction Fuzzy Hash: 36B18D72618341AFD715DF64E884B6BFBE8FF84350F00891AF9999B2A1C771E844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00358891 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00358968
GetSystemMetrics.USER32(00000007), ref: 00358970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0035899B
GetSystemMetrics.USER32(00000008), ref: 003589A3
GetSystemMetrics.USER32(00000004), ref: 003589C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 003589E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 003589F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00358A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00358A3C
GetClientRect.USER32(00000000,000000FF), ref: 00358A5A
GetStockObject.GDI32(00000011), ref: 00358A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00358A81

Part of subcall function 0035912D: GetCursorPos.USER32(?), ref: 00359141
Part of subcall function 0035912D: ScreenToClient.USER32(00000000,?), ref: 0035915E
Part of subcall function 0035912D: GetAsyncKeyState.USER32(00000001), ref: 00359183
Part of subcall function 0035912D: GetAsyncKeyState.USER32(00000002), ref: 0035919D

SetTimer.USER32(00000000,00000000,00000028,003590FC), ref: 00358AA8

Strings

_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{, xrefs: 003589BE
AutoIt v3 GUI, xrefs: 00358A20

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$_______________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{
API String ID: 1458621304-3716850183
Opcode ID: 238c33eca951a6bc1d3c8f98e2b20f3dc796ee2ecb732f9d3dc662385ee509ac
Instruction ID: 8c937c781f69846155e064126d6fc877b5aab812d562448dec0b12f52c99e186
Opcode Fuzzy Hash: 238c33eca951a6bc1d3c8f98e2b20f3dc796ee2ecb732f9d3dc662385ee509ac
Instruction Fuzzy Hash: 5AB17D71A1120A9FDF16DFA8D845FEE3BB5FB48315F11412AFA15AB2A0DB34E840CB54

Uniqueness

Uniqueness Score: -1.00%

Function 003A0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 003A1114
Part of subcall function 003A10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A1120
Part of subcall function 003A10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A112F
Part of subcall function 003A10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A1136
Part of subcall function 003A10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 003A114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003A0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003A0E29
GetLengthSid.ADVAPI32(?), ref: 003A0E40
GetAce.ADVAPI32(?,00000000,?), ref: 003A0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003A0E96
GetLengthSid.ADVAPI32(?), ref: 003A0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 003A0EB5
HeapAlloc.KERNEL32(00000000), ref: 003A0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 003A0EDD
CopySid.ADVAPI32(00000000), ref: 003A0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003A0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003A0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 003A0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A0F6E
HeapFree.KERNEL32(00000000), ref: 003A0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A0F7E
HeapFree.KERNEL32(00000000), ref: 003A0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A0F8E
HeapFree.KERNEL32(00000000), ref: 003A0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 003A0FA1
HeapFree.KERNEL32(00000000), ref: 003A0FA8

Part of subcall function 003A1193: GetProcessHeap.KERNEL32(00000008,003A0BB1,?,00000000,?,003A0BB1,?), ref: 003A11A1
Part of subcall function 003A1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,003A0BB1,?), ref: 003A11A8
Part of subcall function 003A1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,003A0BB1,?), ref: 003A11B7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 071b314d8bfba31d9ab6e5be66e1055e640f6e92fa099595aca01cb880bfb368
Instruction ID: 43f9607d3052a0b68894f857e91b7ed50ec05d5f2869f8f7790e24928d830d76
Opcode Fuzzy Hash: 071b314d8bfba31d9ab6e5be66e1055e640f6e92fa099595aca01cb880bfb368
Instruction Fuzzy Hash: 11715A7291121AEFDF269FA4EC44FAEBBBCFF06301F058116E919B6191D731A905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003CC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,003DCC08,00000000,?,00000000,?,?), ref: 003CC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 003CC5A4
_wcslen.LIBCMT ref: 003CC5F4
_wcslen.LIBCMT ref: 003CC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 003CC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 003CC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 003CC84D
RegCloseKey.ADVAPI32(?), ref: 003CC881
RegCloseKey.ADVAPI32(00000000), ref: 003CC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 003CC960

Strings

REG_BINARY, xrefs: 003CC913
REG_EXPAND_SZ, xrefs: 003CC5CD
REG_MULTI_SZ, xrefs: 003CC6F5
REG_SZ, xrefs: 003CC644
REG_DWORD, xrefs: 003CC804
REG_QWORD, xrefs: 003CC8C3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: ba3b4091008edbcd537e8e1b230bbf76c2c5cc366b8b844dd0d3bd2bee7f8b64
Instruction ID: b4e04a646fff60e98a5f97dbbb2d7f6ae5d0e210873c5a945fa6e396944d272e
Opcode Fuzzy Hash: ba3b4091008edbcd537e8e1b230bbf76c2c5cc366b8b844dd0d3bd2bee7f8b64
Instruction Fuzzy Hash: B81231356142119FCB16DF24C881E2AB7E5EF89714F05889DF88A9F2A2DB31FC41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 003D091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003D09C6
_wcslen.LIBCMT ref: 003D0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003D0A54
_wcslen.LIBCMT ref: 003D0A8A
_wcslen.LIBCMT ref: 003D0B06
_wcslen.LIBCMT ref: 003D0B81

Part of subcall function 0035F9F2: _wcslen.LIBCMT ref: 0035F9FD

Part of subcall function 003A2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003A2BFA

Strings

EXPAND, xrefs: 003D0BF8
GETTOTALCOUNT, xrefs: 003D09F2, 003D0A17
COLLAPSE, xrefs: 003D0B01, 003D0B1C
GETSELECTED, xrefs: 003D0C4E
EXISTS, xrefs: 003D0B7C, 003D0B97
UNCHECK, xrefs: 003D0D3E
SELECT, xrefs: 003D0D11
CHECK, xrefs: 003D0A85, 003D0AA0
GETTEXT, xrefs: 003D0C97
GETITEMCOUNT, xrefs: 003D0C1E
ISCHECKED, xrefs: 003D0CE1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 3225e74da3958fa16d4ea5aaf40e4163f7d2aa8bc7bea984644137a9fa4d0451
Instruction ID: 029c476de8606bbdb3bff5913f8b49f219eb1f2912a21d9bee08cdb380b68070
Opcode Fuzzy Hash: 3225e74da3958fa16d4ea5aaf40e4163f7d2aa8bc7bea984644137a9fa4d0451
Instruction Fuzzy Hash: C9E1AE326087018FC71ADF24C450A2AB7E2FF99714F11895EF8966B3A2D730ED45CB81

Uniqueness

Uniqueness Score: -1.00%

Function 003CC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CB6AE,?,?), ref: 003CC9B5
_wcslen.LIBCMT ref: 003CC9F1
_wcslen.LIBCMT ref: 003CCA68
_wcslen.LIBCMT ref: 003CCA9E
_wcslen.LIBCMT ref: 003CCAF9
_wcslen.LIBCMT ref: 003CCB2F
_wcslen.LIBCMT ref: 003CCB7F

Strings

HKCC, xrefs: 003CCBAC
HKEY_CLASSES_ROOT, xrefs: 003CCAF3, 003CCAF8
HKU, xrefs: 003CCBF0
HKEY_CURRENT_USER, xrefs: 003CCBBD
HKEY_LOCAL_MACHINE, xrefs: 003CCA62, 003CCA67
HKCU, xrefs: 003CCBCE
HKCR, xrefs: 003CCB29, 003CCB2E
HKEY_USERS, xrefs: 003CCBDF
HKEY_CURRENT_CONFIG, xrefs: 003CCB79, 003CCB7E
HKLM, xrefs: 003CCA98, 003CCA9D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 123b4d11ad5d886af76045ae007ccead283ce73bde8a117a06651d0bd5a25007
Instruction ID: 94afc21fe0325ebd28bf76c19fca5aec6937909683a6f71d515446b6e3f153ab
Opcode Fuzzy Hash: 123b4d11ad5d886af76045ae007ccead283ce73bde8a117a06651d0bd5a25007
Instruction Fuzzy Hash: 20710632A2052A8BCB12DE7CC841FBA3395AB60750B12552DFC5EEB284E735ED45C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 003D833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003D835A
_wcslen.LIBCMT ref: 003D836E
_wcslen.LIBCMT ref: 003D8391
_wcslen.LIBCMT ref: 003D83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 003D83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,003D361A,?), ref: 003D844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003D8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 003D84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003D8501
FreeLibrary.KERNEL32(?), ref: 003D850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 003D851D
DestroyIcon.USER32(?), ref: 003D852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 003D8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 003D8555

Strings

.icl, xrefs: 003D8368
.exe, xrefs: 003D8388
.dll, xrefs: 003D83AB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 05d7750764bde5147dc4789b44044ff854b100339ec10dd0410cbd408b3c13de
Instruction ID: e51b430375d8cb8336610ed13f003911f1d57db600c5648605416e4f892b12e1
Opcode Fuzzy Hash: 05d7750764bde5147dc4789b44044ff854b100339ec10dd0410cbd408b3c13de
Instruction Fuzzy Hash: 3061F072910216BAEB16CF65EC41BBF77ACFB05B10F10460AF815DA2D1DB74AA90C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00347778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Unterminated group of comments, xrefs: 0038528C
#requireadmin, xrefs: 003477FF
#pragma compile, xrefs: 003477D3
#include-once, xrefs: 0034782F
#cs, xrefs: 00347873, 003478C5
#comments-start, xrefs: 0034785F, 003478B1
#comments-end, xrefs: 003478D9
", xrefs: 00385153
#include, xrefs: 00347847
Bad directive syntax error, xrefs: 0038519A
', xrefs: 00385169
Cannot parse #include, xrefs: 00385279
#OnAutoItStartRegister, xrefs: 00347817
#notrayicon, xrefs: 003477E7
#ce, xrefs: 003478ED

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: d70fcb19d702daa9dc88470cd86991e71cb7848c5c99003baee7f3198c72ef21
Instruction ID: 665323f235545165bf8f74c3617836527b7bc3409e5f19dfe0823d13a89b461e
Opcode Fuzzy Hash: d70fcb19d702daa9dc88470cd86991e71cb7848c5c99003baee7f3198c72ef21
Instruction Fuzzy Hash: 5F81F371A44205ABDB23AF60DC42FBE7BE8EF15300F018465F805AF296EB71EA15C791

Uniqueness

Uniqueness Score: -1.00%

Function 003B3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 003B3EF8
_wcslen.LIBCMT ref: 003B3F03
_wcslen.LIBCMT ref: 003B3F5A
_wcslen.LIBCMT ref: 003B3F98
GetDriveTypeW.KERNEL32(?), ref: 003B3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003B401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003B4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003B4087

Strings

wait, xrefs: 003B4044
type cdaudio alias cd wait, xrefs: 003B4001
close cd wait, xrefs: 003B4072
open , xrefs: 003B3FE5
set cd door , xrefs: 003B4028
open, xrefs: 003B3F54, 003B3F59
close, xrefs: 003B3EFE, 003B3F18
closed, xrefs: 003B3F08, 003B3F2D, 003B3F46, 003B3F7E, 003B3F97

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 4306c1ef4dae0a4b29ef203fcf57cccf8875359b4f024cb98054127ea7f99c9a
Instruction ID: dc4145588efb2aafac7b0031b64fca78b1b93f9667ca4d753ee97af449969ef2
Opcode Fuzzy Hash: 4306c1ef4dae0a4b29ef203fcf57cccf8875359b4f024cb98054127ea7f99c9a
Instruction Fuzzy Hash: 07710432A042119FC311EF24C8819BBB7F4EF94758F11492DFA969B691EB30ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003A5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 003A5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003A5A40
SetWindowTextW.USER32(?,?), ref: 003A5A57
GetDlgItem.USER32(?,000003EA), ref: 003A5A6C
SetWindowTextW.USER32(00000000,?), ref: 003A5A72
GetDlgItem.USER32(?,000003E9), ref: 003A5A82
SetWindowTextW.USER32(00000000,?), ref: 003A5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 003A5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 003A5AC3
GetWindowRect.USER32(?,?), ref: 003A5ACC
_wcslen.LIBCMT ref: 003A5B33
SetWindowTextW.USER32(?,?), ref: 003A5B6F
GetDesktopWindow.USER32 ref: 003A5B75
GetWindowRect.USER32(00000000), ref: 003A5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 003A5BD3
GetClientRect.USER32(?,?), ref: 003A5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 003A5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 003A5C2F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 670ce6d48b91943bbd9e30d1af8d342281826c5965698f163958a280b94d5e2c
Instruction ID: 5cb301e31d7d1fdf03e318a4c26afd119780b5173c3bd8d74567d0c6eded9837
Opcode Fuzzy Hash: 670ce6d48b91943bbd9e30d1af8d342281826c5965698f163958a280b94d5e2c
Instruction Fuzzy Hash: B8718031A00B05EFDB22DFA8CD85AAEBBF9FF48705F104519E142A75A0D774E944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003BFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 003BFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 003BFE32
LoadCursorW.USER32(00000000,00007F00), ref: 003BFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 003BFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 003BFE53
LoadCursorW.USER32(00000000,00007F01), ref: 003BFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 003BFE69
LoadCursorW.USER32(00000000,00007F88), ref: 003BFE74
LoadCursorW.USER32(00000000,00007F80), ref: 003BFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 003BFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 003BFE95
LoadCursorW.USER32(00000000,00007F85), ref: 003BFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 003BFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 003BFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 003BFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 003BFECC
GetCursorInfo.USER32(?), ref: 003BFEDC
GetLastError.KERNEL32 ref: 003BFF1E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 0db20f61088db81fcb2637d11c58e27d903ddf768aa6f689251e812b754f026b
Instruction ID: 8a15fef640c1ad1b7033b1bea6c32717bf22522a9d7e1096daaa4cebe4a65a68
Opcode Fuzzy Hash: 0db20f61088db81fcb2637d11c58e27d903ddf768aa6f689251e812b754f026b
Instruction Fuzzy Hash: 0B4184B0D093196EDB119FBA8C8586EBFE8FF04754B50412AE11CEB681DB78E901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003A30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003A318D
_wcslen.LIBCMT ref: 003A31F8

Strings

REGEXPCLASS, xrefs: 003A3255, 003A3266
INSTANCE, xrefs: 003A3453
[@, xrefs: 003A339A
CLASS, xrefs: 003A3188, 003A31A5
NAME, xrefs: 003A3335, 003A3346
TEXT, xrefs: 003A347C
CLASSNN, xrefs: 003A31F3, 003A3204

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[@
API String ID: 176396367-2531399406
Opcode ID: f521ee5c5bfb53de8dadc55579310cfddaee4fbd55ae50693186d5abaec52a69
Instruction ID: 44a71d67961c124156649acf3ceaedde6f87d349534312def787c9b3ed88d6ba
Opcode Fuzzy Hash: f521ee5c5bfb53de8dadc55579310cfddaee4fbd55ae50693186d5abaec52a69
Instruction Fuzzy Hash: BEE1D531A005169BCB16DFB8C4517EEFBB4FF56710F55812AF456BB280DB30AE858B90

Uniqueness

Uniqueness Score: -1.00%

Function 003600C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 003600C6

Part of subcall function 003600ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0041070C,00000FA0,949233B7,?,?,?,?,003823B3,000000FF), ref: 0036011C
Part of subcall function 003600ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,003823B3,000000FF), ref: 00360127
Part of subcall function 003600ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,003823B3,000000FF), ref: 00360138
Part of subcall function 003600ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0036014E
Part of subcall function 003600ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0036015C
Part of subcall function 003600ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0036016A
Part of subcall function 003600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00360195
Part of subcall function 003600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 003601A0

___scrt_fastfail.LIBCMT ref: 003600E7

Part of subcall function 003600A3: __onexit.LIBCMT ref: 003600A9

Strings

SleepConditionVariableCS, xrefs: 00360154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00360122
WakeAllConditionVariable, xrefs: 00360162
InitializeConditionVariable, xrefs: 00360148
kernel32.dll, xrefs: 00360133

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 57fac0651484bf413b3968fe92646b444f7e05a32089d2184b298efb4b5ed529
Instruction ID: 3146723afaa7fbea55cda96adc8235de427eba3d6a6c121222a788bf5505efa1
Opcode Fuzzy Hash: 57fac0651484bf413b3968fe92646b444f7e05a32089d2184b298efb4b5ed529
Instruction Fuzzy Hash: 002129366513116FD7176BA4BC47FAB7398EB06B51F118137F802E62D5DBB49800CA94

Uniqueness

Uniqueness Score: -1.00%

Function 003B44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,003DCC08), ref: 003B4527
_wcslen.LIBCMT ref: 003B453B
_wcslen.LIBCMT ref: 003B4599
_wcslen.LIBCMT ref: 003B45F4
_wcslen.LIBCMT ref: 003B463F
_wcslen.LIBCMT ref: 003B46A7

Part of subcall function 0035F9F2: _wcslen.LIBCMT ref: 0035F9FD

GetDriveTypeW.KERNEL32(?,00406BF0,00000061), ref: 003B4743

Strings

fixed, xrefs: 003B4635, 003B463A
unknown, xrefs: 003B4708
ramdisk, xrefs: 003B46F1
network, xrefs: 003B469D, 003B46A2
removable, xrefs: 003B45EA, 003B45EF
cdrom, xrefs: 003B458F, 003B4594
all, xrefs: 003B4531, 003B4536

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: e097a28f5d44e771c1fa4fc9d473103e1531a269f22028e886db9e58f42986af
Instruction ID: bf8b9be86273d2e9185234daf7976814845d07adbbedc8f4c8012f22f254b998
Opcode Fuzzy Hash: e097a28f5d44e771c1fa4fc9d473103e1531a269f22028e886db9e58f42986af
Instruction Fuzzy Hash: C1B137316083029FC712DF28C891ABEB7E4BF96718F11491EF696CB692D730E844CB56

Uniqueness

Uniqueness Score: -1.00%

Function 003D911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

DragQueryPoint.SHELL32(?,?), ref: 003D9147

Part of subcall function 003D7674: ClientToScreen.USER32(?,?), ref: 003D769A
Part of subcall function 003D7674: GetWindowRect.USER32(?,?), ref: 003D7710
Part of subcall function 003D7674: PtInRect.USER32(?,?,003D8B89), ref: 003D7720

SendMessageW.USER32(?,000000B0,?,?), ref: 003D91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 003D91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 003D91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 003D9225
SendMessageW.USER32(?,000000B0,?,?), ref: 003D923E
SendMessageW.USER32(?,000000B1,?,?), ref: 003D9255
SendMessageW.USER32(?,000000B1,?,?), ref: 003D9277
DragFinish.SHELL32(?), ref: 003D927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 003D9371

Strings

@GUI_DROPID, xrefs: 003D929E
@GUI_DRAGID, xrefs: 003D92E9
@GUI_DRAGFILE, xrefs: 003D9320
p#A, xrefs: 003D92BB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#A
API String ID: 221274066-1905417563
Opcode ID: ce0b3db6cb4250a3e9cb13bb69ec04ca3d2734a6e15236ef8044fd3cadddf34e
Instruction ID: 345640eb7b74cc67e7379866579827881ae966cacdaa3be344b0d30ffac50136
Opcode Fuzzy Hash: ce0b3db6cb4250a3e9cb13bb69ec04ca3d2734a6e15236ef8044fd3cadddf34e
Instruction Fuzzy Hash: D4615E71118305AFC702DF54EC85EAFBBE8EF85750F00092EF5959B2A1DB70AA49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003CAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003CB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003CB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003CB1D4
_wcslen.LIBCMT ref: 003CB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003CB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003CB236
_wcslen.LIBCMT ref: 003CB332

Part of subcall function 003B05A7: GetStdHandle.KERNEL32(000000F6), ref: 003B05C6

_wcslen.LIBCMT ref: 003CB34B
_wcslen.LIBCMT ref: 003CB366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003CB3B6
GetLastError.KERNEL32(00000000), ref: 003CB407
CloseHandle.KERNEL32(?), ref: 003CB439
CloseHandle.KERNEL32(00000000), ref: 003CB44A
CloseHandle.KERNEL32(00000000), ref: 003CB45C
CloseHandle.KERNEL32(00000000), ref: 003CB46E
CloseHandle.KERNEL32(?), ref: 003CB4E3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: aef9a8598c22b600cce7724a0c8e278270deb00050fbe566e442a738cced172c
Instruction ID: 962f36fc44d0f7b85b52fdfbecc7d0bee2373f7f07d98e883d92b572e3cb3fe4
Opcode Fuzzy Hash: aef9a8598c22b600cce7724a0c8e278270deb00050fbe566e442a738cced172c
Instruction Fuzzy Hash: FCF179316082409FC716EF24C892F6ABBE5AF85314F15895DF8999F2A2CB31EC44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003C3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003DCC08), ref: 003C40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003C40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,003DCC08), ref: 003C40F2
FreeLibrary.KERNEL32(00000000,?,003DCC08), ref: 003C413E
StringFromGUID2.OLE32(?,?,00000028,?,003DCC08), ref: 003C41A8
SysFreeString.OLEAUT32(00000009), ref: 003C4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003C42C8
SysFreeString.OLEAUT32(?), ref: 003C42F2

Strings

kernel32.dll, xrefs: 003C40B6
GetModuleHandleExW, xrefs: 003C40C7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: aa4d5c93f243fc044ddb6942730a365abaf6420b8e4856f5a709359fe924d7e2
Instruction ID: 3ff7631507f55baf601fbee54a2aca4b3a2aa4f19786722e810b17b175b8649d
Opcode Fuzzy Hash: aa4d5c93f243fc044ddb6942730a365abaf6420b8e4856f5a709359fe924d7e2
Instruction Fuzzy Hash: DE124875A00219EFDB16CF94C894FAEBBB9BF45314F258099E905DB261C731ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0034326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00411990), ref: 00382F8D
GetMenuItemCount.USER32(00411990), ref: 0038303D
GetCursorPos.USER32(?), ref: 00383081
SetForegroundWindow.USER32(00000000), ref: 0038308A
TrackPopupMenuEx.USER32(00411990,00000000,?,00000000,00000000,00000000), ref: 0038309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 003830A9

Strings

0, xrefs: 0034327D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 0a0575288a83326f3fbcec7e63572fa5cddb59026e95824967b45a1e92ace925
Instruction ID: 4beed7a9c179e412ee6410d0e3b8b86dcbf62490f08579a4f934976424bf28e1
Opcode Fuzzy Hash: 0a0575288a83326f3fbcec7e63572fa5cddb59026e95824967b45a1e92ace925
Instruction Fuzzy Hash: 69710770644306BEEB239F25DC49FAABFA9FF05324F204256F6256A1E1C7B1A910DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003D6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 003D6DEB

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 003D6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 003D6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003D6E94
DestroyWindow.USER32(?), ref: 003D6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00340000,00000000), ref: 003D6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003D6EFD
GetDesktopWindow.USER32 ref: 003D6F16
GetWindowRect.USER32(00000000), ref: 003D6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 003D6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 003D6F4D

Part of subcall function 00359944: GetWindowLongW.USER32(?,000000EB), ref: 00359952

Strings

0, xrefs: 003D6D98
tooltips_class32, xrefs: 003D6E58, 003D6EDD

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 5eb20eeb9f6685fce12c727bcf588f11f86f295feecdaff61309e340200d1889
Instruction ID: b0cffecc0db6c7041de8b352fa80975a60bd86b0e92357acd20baeca63ed8259
Opcode Fuzzy Hash: 5eb20eeb9f6685fce12c727bcf588f11f86f295feecdaff61309e340200d1889
Instruction Fuzzy Hash: B17167B1114241AFDB22CF18EC55BAABBE9FB89304F04452EF9A987361C770E905CB16

Uniqueness

Uniqueness Score: -1.00%

Function 003BC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003BC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 003BC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 003BC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 003BC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 003BC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 003BC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003BC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003BC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 003BC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 003BC5F0
InternetCloseHandle.WININET(00000000), ref: 003BC5FB

Strings

, xrefs: 003BC575

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: a936f39df43c5ad1cfe186f5a17d2ad6aa70312852857c11be3506dd31ed545f
Instruction ID: fe601bbcc3a8baf1fb95c9508a9449afea16031bcb38892916b46532d56e4ec1
Opcode Fuzzy Hash: a936f39df43c5ad1cfe186f5a17d2ad6aa70312852857c11be3506dd31ed545f
Instruction Fuzzy Hash: BF516FB0521209BFDB328F61D988AEB7BBCFF05748F00541AFA45D6910DB34EA44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003D856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 003D8592
GetFileSize.KERNEL32(00000000,00000000), ref: 003D85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 003D85AD
CloseHandle.KERNEL32(00000000), ref: 003D85BA
GlobalLock.KERNEL32(00000000), ref: 003D85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 003D85D7
GlobalUnlock.KERNEL32(00000000), ref: 003D85E0
CloseHandle.KERNEL32(00000000), ref: 003D85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 003D85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,003DFC38,?), ref: 003D8611
GlobalFree.KERNEL32(00000000), ref: 003D8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 003D8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 003D8671
DeleteObject.GDI32(00000000), ref: 003D8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 003D86AF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 42d095f1fbd2281ee8d585d7e6db3f00c1971ab0ef804c6279a6a3b83a18fd95
Instruction ID: 78548f67b407d003a8ffda6c81f6bf5a3fe965401d961fe17831dd694190ca2e
Opcode Fuzzy Hash: 42d095f1fbd2281ee8d585d7e6db3f00c1971ab0ef804c6279a6a3b83a18fd95
Instruction Fuzzy Hash: F7413A75611209AFDB129FA5EC88EAE7BBDFF89711F10455AF905E7260DB30AD01CB20

Uniqueness

Uniqueness Score: -1.00%

Function 003B14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 003B1502
VariantCopy.OLEAUT32(?,?), ref: 003B150B
VariantClear.OLEAUT32(?), ref: 003B1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 003B15FB
VarR8FromDec.OLEAUT32(?,?), ref: 003B1657
VariantInit.OLEAUT32(?), ref: 003B1708
SysFreeString.OLEAUT32(?), ref: 003B178C
VariantClear.OLEAUT32(?), ref: 003B17D8
VariantClear.OLEAUT32(?), ref: 003B17E7
VariantInit.OLEAUT32(00000000), ref: 003B1823

Strings

Default, xrefs: 003B16AF
%4d%02d%02d%02d%02d%02d, xrefs: 003B1625

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 1cf180db2a0ef64b422cdd8e7613a783d2dc7ca61fe8405f0d3943a00703ffeb
Instruction ID: 5593c7a218f2f4e86c9301311fb7efb9ca45043edbcf9efd883f26bae3cb3bdc
Opcode Fuzzy Hash: 1cf180db2a0ef64b422cdd8e7613a783d2dc7ca61fe8405f0d3943a00703ffeb
Instruction Fuzzy Hash: 31D10232600105DBCB229F65E8A5BB9B7B9BF46704F908057FA06AF990DB30ED44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 003CB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CB6AE,?,?), ref: 003CC9B5
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CC9F1
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA68
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003CB772
RegDeleteValueW.ADVAPI32(?,?), ref: 003CB80A
RegCloseKey.ADVAPI32(?), ref: 003CB87E
RegCloseKey.ADVAPI32(?), ref: 003CB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 003CB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 003CB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 003CB922
FreeLibrary.KERNEL32(00000000), ref: 003CB983
RegCloseKey.ADVAPI32(00000000), ref: 003CB994

Strings

advapi32.dll, xrefs: 003CB8ED
RegDeleteKeyExW, xrefs: 003CB8FE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 6453f66876d6f5ece80862768461abb59743fe2b29675605786b798bf33e2d05
Instruction ID: 33a4f5b433143e370abf320e104c6f983f62633cbfce3fb36ac9492c99e01aea
Opcode Fuzzy Hash: 6453f66876d6f5ece80862768461abb59743fe2b29675605786b798bf33e2d05
Instruction Fuzzy Hash: F9C17A35215241AFD712DF24C496F2AFBE5BF84308F15859CE49A8F2A2CB35EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003C255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003C25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 003C25E8
CreateCompatibleDC.GDI32(?), ref: 003C25F4
SelectObject.GDI32(00000000,?), ref: 003C2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 003C266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 003C26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 003C26D0
SelectObject.GDI32(?,?), ref: 003C26D8
DeleteObject.GDI32(?), ref: 003C26E1
DeleteDC.GDI32(?), ref: 003C26E8
ReleaseDC.USER32(00000000,?), ref: 003C26F3

Strings

(, xrefs: 003C268D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: d29ff8b26e298e7865bd16bee55f508309ac4dfa1a1259136328bf081263c093
Instruction ID: e2e3fa97adab3e7c96acc51edfcaaffa61d57bd56186bb6f34161f872aa4b38a
Opcode Fuzzy Hash: d29ff8b26e298e7865bd16bee55f508309ac4dfa1a1259136328bf081263c093
Instruction Fuzzy Hash: C861E175D1021AEFCB05CFA8D884EAEBBB9FF48310F24852AE955A7250D770AD51CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0037DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0037DAA1

Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D659
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D66B
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D67D
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D68F
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D6A1
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D6B3
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D6C5
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D6D7
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D6E9
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D6FB
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D70D
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D71F
Part of subcall function 0037D63C: _free.LIBCMT ref: 0037D731

_free.LIBCMT ref: 0037DA96

Part of subcall function 003729C8: HeapFree.KERNEL32(00000000,00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000), ref: 003729DE
Part of subcall function 003729C8: GetLastError.KERNEL32(00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000,00000000), ref: 003729F0

_free.LIBCMT ref: 0037DAB8
_free.LIBCMT ref: 0037DACD
_free.LIBCMT ref: 0037DAD8
_free.LIBCMT ref: 0037DAFA
_free.LIBCMT ref: 0037DB0D
_free.LIBCMT ref: 0037DB1B
_free.LIBCMT ref: 0037DB26
_free.LIBCMT ref: 0037DB5E
_free.LIBCMT ref: 0037DB65
_free.LIBCMT ref: 0037DB82
_free.LIBCMT ref: 0037DB9A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: ab89f8259e8f2d389a1d62899778a093b5529bcddbb4675a81c7c49a2ba1612c
Instruction ID: 382551ffdb663e32fbbc7cc168c7e637101ff979fd8391dc0af136dbfd39f3f3
Opcode Fuzzy Hash: ab89f8259e8f2d389a1d62899778a093b5529bcddbb4675a81c7c49a2ba1612c
Instruction Fuzzy Hash: 0B314A316042059FEB33AA39E845B5BB7F9FF02310F16C429E54DDB195DB39AC908B64

Uniqueness

Uniqueness Score: -1.00%

Function 003A365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 003A369C
_wcslen.LIBCMT ref: 003A36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 003A3797
GetClassNameW.USER32(?,?,00000400), ref: 003A380C
GetDlgCtrlID.USER32(?), ref: 003A385D
GetWindowRect.USER32(?,?), ref: 003A3882
GetParent.USER32(?), ref: 003A38A0
ScreenToClient.USER32(00000000), ref: 003A38A7
GetClassNameW.USER32(?,?,00000100), ref: 003A3921
GetWindowTextW.USER32(?,?,00000400), ref: 003A395D

Strings

%s%u, xrefs: 003A3734

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b9fe040965e92ac47a76800380df2088e9a751fbe5634ac1cba5b91e188d069e
Instruction ID: 8c53c8bd4b19e760e4727ef4040c717ec12a3409bbc39982e43d982e26bbdcc2
Opcode Fuzzy Hash: b9fe040965e92ac47a76800380df2088e9a751fbe5634ac1cba5b91e188d069e
Instruction Fuzzy Hash: F091C171204606AFD71ADF24C885FEAF7A8FF45350F00862DF999D6190DB34EA49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003A4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 003A4994
GetWindowTextW.USER32(?,?,00000400), ref: 003A49DA
_wcslen.LIBCMT ref: 003A49EB
CharUpperBuffW.USER32(?,00000000), ref: 003A49F7
_wcsstr.LIBVCRUNTIME ref: 003A4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 003A4A64
GetWindowTextW.USER32(?,?,00000400), ref: 003A4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 003A4AE6
GetClassNameW.USER32(?,?,00000400), ref: 003A4B20
GetWindowRect.USER32(?,?), ref: 003A4B8B

Strings

ThumbnailClass, xrefs: 003A4A6F, 003A4AF1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 23235efd9470e58d34cd107a9220c8fb63526df1c553ae1186133db849914add
Instruction ID: 4ea0d9d08ef1ec1dffce65bbbc2313ee9ebb49e2e887759b11737d925d5b8434
Opcode Fuzzy Hash: 23235efd9470e58d34cd107a9220c8fb63526df1c553ae1186133db849914add
Instruction Fuzzy Hash: 1291E1710082069FDB06CF14D981FAA77E8FFC6314F04846AFD859A196EB70ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003ABF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00411990,000000FF,00000000,00000030), ref: 003ABFAC
SetMenuItemInfoW.USER32(00411990,00000004,00000000,00000030), ref: 003ABFE1
Sleep.KERNEL32(000001F4), ref: 003ABFF3
GetMenuItemCount.USER32(?), ref: 003AC039
GetMenuItemID.USER32(?,00000000), ref: 003AC056
GetMenuItemID.USER32(?,-00000001), ref: 003AC082
GetMenuItemID.USER32(?,?), ref: 003AC0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003AC10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003AC124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003AC145

Strings

0, xrefs: 003ABF3D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 17f79602cea6b798d89e8ee382004ef35005ff09ad8e5d8aa9f0922bc04cee9f
Instruction ID: 03a33deebd88998fe459de1a9f2121f4a0d1d10a1e907b99d66782216a9fd4bf
Opcode Fuzzy Hash: 17f79602cea6b798d89e8ee382004ef35005ff09ad8e5d8aa9f0922bc04cee9f
Instruction Fuzzy Hash: D3619EB0A2024AAFDF12CF64DD88AEEBBB9EB07344F045155F911A7292D735ED04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003CCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 003CCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 003CCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 003CCD48

Part of subcall function 003CCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 003CCCAA
Part of subcall function 003CCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 003CCCBD
Part of subcall function 003CCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 003CCCCF
Part of subcall function 003CCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 003CCD05
Part of subcall function 003CCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 003CCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 003CCCF3

Strings

advapi32.dll, xrefs: 003CCCB8
RegDeleteKeyExW, xrefs: 003CCCC9

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 8d911ba9478a7af813cea99cbac0d4c35b9040d7acdbcd8f3e0dbd08c1d8c0e2
Instruction ID: 193942282d0389ad8e563f9319946f67592e61f6a4406b7cc4aa64867f9c1cb4
Opcode Fuzzy Hash: 8d911ba9478a7af813cea99cbac0d4c35b9040d7acdbcd8f3e0dbd08c1d8c0e2
Instruction Fuzzy Hash: A4318471921129BBDB229B50DC88EFFBB7CEF15740F015169E90AE2140DB349E45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003B3D40
_wcslen.LIBCMT ref: 003B3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 003B3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 003B3DBE
RemoveDirectoryW.KERNEL32(?), ref: 003B3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 003B3E55
CloseHandle.KERNEL32(00000000), ref: 003B3E60
CloseHandle.KERNEL32(00000000), ref: 003B3E6B

Strings

\, xrefs: 003B3D77
\??\%s, xrefs: 003B3D5B
:, xrefs: 003B3D82

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 42253dc73f6dac6cab827bdf3b0f9e87260be1ab15009fdd7e4be87273913cc3
Instruction ID: 2b04d3cd469676cd90561690691b06f25b611cdcc5e3cd08b96ae3eb5d0d7925
Opcode Fuzzy Hash: 42253dc73f6dac6cab827bdf3b0f9e87260be1ab15009fdd7e4be87273913cc3
Instruction Fuzzy Hash: B331D47595021AABDB229BA0DC48FEF37BCEF88704F1141BAF605D6060EB749744CB24

Uniqueness

Uniqueness Score: -1.00%

Function 003AE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 003AE6B4

Part of subcall function 0035E551: timeGetTime.WINMM(?,?,003AE6D4), ref: 0035E555

Sleep.KERNEL32(0000000A), ref: 003AE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 003AE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 003AE727
SetActiveWindow.USER32 ref: 003AE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003AE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 003AE773
Sleep.KERNEL32(000000FA), ref: 003AE77E
IsWindow.USER32 ref: 003AE78A
EndDialog.USER32(00000000), ref: 003AE79B

Strings

BUTTON, xrefs: 003AE719

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: bd65b34a60b67dc5b5068f51cb5bfbbef2285cfa47db8dd3b9d25930f91be503
Instruction ID: 486300457970e6aab22e58818e87f8849d98a7f30de8cbecb9d7d3aed7bd6c0a
Opcode Fuzzy Hash: bd65b34a60b67dc5b5068f51cb5bfbbef2285cfa47db8dd3b9d25930f91be503
Instruction Fuzzy Hash: 11216FB0220206AFEB035F60FD89B657B6DF796349F145436F911D25B1DBB2AC10CA28

Uniqueness

Uniqueness Score: -1.00%

Function 003AE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 003AEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 003AEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003AEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 003AEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 003AEAA7

Strings

play PlayMe wait, xrefs: 003AEA91
close PlayMe, xrefs: 003AEA6E, 003AEA9B
status PlayMe mode, xrefs: 003AEA58
play PlayMe, xrefs: 003AEAA2
open , xrefs: 003AEA0C
alias PlayMe, xrefs: 003AEA36

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: c4715b1d287a2182088b441aa64b1abe4eba0834848e9f83c0e83cabf39f010c
Instruction ID: 0934c1b866571409cdd61a1a63e94584b5382730ed1662e1dd3f78be79fd1f03
Opcode Fuzzy Hash: c4715b1d287a2182088b441aa64b1abe4eba0834848e9f83c0e83cabf39f010c
Instruction Fuzzy Hash: 6A117371A902597DE721A7A5DC4AFFF6ABCEBD2B00F11043A7802AB0D1EE701D15C5B0

Uniqueness

Uniqueness Score: -1.00%

Function 003A9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003AA012
SetKeyboardState.USER32(?), ref: 003AA07D
GetAsyncKeyState.USER32(000000A0), ref: 003AA09D
GetKeyState.USER32(000000A0), ref: 003AA0B4
GetAsyncKeyState.USER32(000000A1), ref: 003AA0E3
GetKeyState.USER32(000000A1), ref: 003AA0F4
GetAsyncKeyState.USER32(00000011), ref: 003AA120
GetKeyState.USER32(00000011), ref: 003AA12E
GetAsyncKeyState.USER32(00000012), ref: 003AA157
GetKeyState.USER32(00000012), ref: 003AA165
GetAsyncKeyState.USER32(0000005B), ref: 003AA18E
GetKeyState.USER32(0000005B), ref: 003AA19C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: de602bfded62f82f58ac2aa64a6f5029386ec7ba70a41e6f86b7220006371205
Instruction ID: 9c6903297d3399bf00a4737fc47896a82dc09354289a8d1f7cf657e39e08573d
Opcode Fuzzy Hash: de602bfded62f82f58ac2aa64a6f5029386ec7ba70a41e6f86b7220006371205
Instruction Fuzzy Hash: 53518831904B882DFB37DB6088157EABFB5DF13380F09859AD5C25B5C2DB54AA4CC762

Uniqueness

Uniqueness Score: -1.00%

Function 003A5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 003A5CE2
GetWindowRect.USER32(00000000,?), ref: 003A5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 003A5D59
GetDlgItem.USER32(?,00000002), ref: 003A5D69
GetWindowRect.USER32(00000000,?), ref: 003A5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 003A5DCF
GetDlgItem.USER32(?,000003E9), ref: 003A5DDD
GetWindowRect.USER32(00000000,?), ref: 003A5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 003A5E31
GetDlgItem.USER32(?,000003EA), ref: 003A5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 003A5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 003A5E67

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 08926c8266a664389bcda962fe78c8a35ba8d569aa8353d6694dd3f426887881
Instruction ID: 86e8f78e4a7384e3106bbbbe331dda87efe91a6415aee3e8ec12abc3dd0d62aa
Opcode Fuzzy Hash: 08926c8266a664389bcda962fe78c8a35ba8d569aa8353d6694dd3f426887881
Instruction Fuzzy Hash: 06512DB1B11606AFDF19CF68DD89AAEBBB9FB49300F148129F515E6290D770DE00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00358BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00358F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00358BE8,?,00000000,?,?,?,?,00358BBA,00000000,?), ref: 00358FC5

DestroyWindow.USER32(?), ref: 00358C81
KillTimer.USER32(00000000,?,?,?,?,00358BBA,00000000,?), ref: 00358D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00396973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00358BBA,00000000,?), ref: 003969A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00358BBA,00000000,?), ref: 003969B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00358BBA,00000000), ref: 003969D4
DeleteObject.GDI32(00000000), ref: 003969E6

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4bb1710c39d9b5b466c1cc0889a78387d56f4f00bda0a8f8bb1003a7805f0cab
Instruction ID: 58cf913d78654e7e264679e7154ec9bcfa084e923c2051fe6f75d6d1fe56cec7
Opcode Fuzzy Hash: 4bb1710c39d9b5b466c1cc0889a78387d56f4f00bda0a8f8bb1003a7805f0cab
Instruction Fuzzy Hash: BC619D71523601DFCF239F24D949B69B7F5FB40312F159529E942AA970CB31AC84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00359838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00359944: GetWindowLongW.USER32(?,000000EB), ref: 00359952

GetSysColor.USER32(0000000F), ref: 00359862

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 2834a52222d63e187d544651d2c8126bf4ac58e330dd7540460b70cc22fdf004
Instruction ID: b97112706f0aff32f6cf331fb9a3ce78e96bcb482449d095d9a6387026614a0a
Opcode Fuzzy Hash: 2834a52222d63e187d544651d2c8126bf4ac58e330dd7540460b70cc22fdf004
Instruction Fuzzy Hash: 0541A031115611DFDF225F38AC88FB93BA9AB06332F165616F9A28B2F1D7319C46DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00378D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.6, xrefs: 0037903A, 00378FD0, 00378FF2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: .6
API String ID: 0-1713163095
Opcode ID: e8bd6839488a77d70fcbd00b1c350f4330fe01751d400bbeda377ed0e3a666e9
Instruction ID: 4c92c4a1e631a2c6951fc74c2e0eea320d4466705a225cc45a9651aaf332f97a
Opcode Fuzzy Hash: e8bd6839488a77d70fcbd00b1c350f4330fe01751d400bbeda377ed0e3a666e9
Instruction Fuzzy Hash: 78C1D774E042499FDB23DFA8D885BEDBBB4AF0A310F05C156E518AB392C7789941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 003A96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0038F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 003A9717
LoadStringW.USER32(00000000,?,0038F7F8,00000001), ref: 003A9720

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0038F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 003A9742
LoadStringW.USER32(00000000,?,0038F7F8,00000001), ref: 003A9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 003A9866

Strings

Line %d (File "%s"):, xrefs: 003A978F
Error: , xrefs: 003A981D
Line %d:, xrefs: 003A97A0
^ ERROR, xrefs: 003A97FB
%s (%d) : ==> %s: %s %s, xrefs: 003A984A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 2b605bfea90f33e8a0e0aa2c2be1e41e48f69d419af1a80240f4e272dac37192
Instruction ID: 91aad9551fb64cad29ee63f2371974863f87d5bf7fcef57c1477e3fca9931706
Opcode Fuzzy Hash: 2b605bfea90f33e8a0e0aa2c2be1e41e48f69d419af1a80240f4e272dac37192
Instruction Fuzzy Hash: 97412F72900219AADB06EFE0DD86EEE77BCEF15340F500166B5057B092EB356F48CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003A06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003A07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003A07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003A07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 003A0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 003A082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003A0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003A083C

Strings

SOFTWARE\Classes\, xrefs: 003A070E
\IPC$, xrefs: 003A0784
\CLSID, xrefs: 003A0724

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 0a727d97f90dce2c2c6589bb24a8b24990b6db04648db1ff8238809c2b5fddc1
Instruction ID: 82e04da1204d27c4c45b83e73ec64684834a70a37f10a0c8fc36259fd8865237
Opcode Fuzzy Hash: 0a727d97f90dce2c2c6589bb24a8b24990b6db04648db1ff8238809c2b5fddc1
Instruction Fuzzy Hash: EA41F972C10229ABDF16EFA4DC95DEEB7B8FF04350F154166E905AB161EB34AE04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 003D403B
CreateCompatibleDC.GDI32(00000000), ref: 003D4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 003D4055
SelectObject.GDI32(00000000,00000000), ref: 003D405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 003D4068
DeleteDC.GDI32(00000000), ref: 003D4072
GetWindowLongW.USER32(?,000000EC), ref: 003D407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 003D4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 003D409E

Strings

static, xrefs: 003D3FD3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 5fc6dc670ee89e6c77cc7cd8077269deed558e55aa898d1c44e85c94191dbf33
Instruction ID: b16790d922818c9b8b913991c0c3f828bb8f3d99d5df7d88fa782dc960c87c03
Opcode Fuzzy Hash: 5fc6dc670ee89e6c77cc7cd8077269deed558e55aa898d1c44e85c94191dbf33
Instruction Fuzzy Hash: 7F315C3252121AABDF229FA4EC09FDA7B6DFF0D320F111212FA14A61A0C775D820DB54

Uniqueness

Uniqueness Score: -1.00%

Function 003C3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C3C5C
CoInitialize.OLE32(00000000), ref: 003C3C8A
CoUninitialize.OLE32 ref: 003C3C94
_wcslen.LIBCMT ref: 003C3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 003C3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 003C3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 003C3F0E
CoGetObject.OLE32(?,00000000,003DFB98,?), ref: 003C3F2D
SetErrorMode.KERNEL32(00000000), ref: 003C3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003C3FC4
VariantClear.OLEAUT32(?), ref: 003C3FD8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 547b775151929afabc5d2d2bea9209110085fe5c94b68aaef9cdd1a44a50063c
Instruction ID: d6998c7773e9c5f13c1cb597d5552e6b4dbad0c330e0a9ceeae23ca1d557a052
Opcode Fuzzy Hash: 547b775151929afabc5d2d2bea9209110085fe5c94b68aaef9cdd1a44a50063c
Instruction Fuzzy Hash: 53C1F2716082059FD702DF68C884E2AB7E9FF89744F10895DF98ADB251DB31ED05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003B7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003B7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 003B7B8F
SHGetDesktopFolder.SHELL32(?), ref: 003B7BA3
CoCreateInstance.OLE32(003DFD08,00000000,00000001,00406E6C,?), ref: 003B7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 003B7C74
CoTaskMemFree.OLE32(?,?), ref: 003B7CCC
SHBrowseForFolderW.SHELL32(?), ref: 003B7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 003B7D7A
CoTaskMemFree.OLE32(00000000), ref: 003B7D81
CoTaskMemFree.OLE32(00000000), ref: 003B7DD6
CoUninitialize.OLE32 ref: 003B7DDC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: c9b7be322e06c821b671868df0d78fd94649a6c9796aac76c08d45fb1cba1cd6
Instruction ID: 187036f186cf09afcbf8a99636dfedb1bc00bc5e1d1a28e5cc3bb6b45efb8359
Opcode Fuzzy Hash: c9b7be322e06c821b671868df0d78fd94649a6c9796aac76c08d45fb1cba1cd6
Instruction Fuzzy Hash: A9C12975A04109AFCB15DFA4C884DAEBBF9FF48308B148499E91A9B761D730EE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 003D5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003D5515
CharNextW.USER32(00000158), ref: 003D5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 003D5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 003D559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003D55AC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: d701b4fb207ddf05cadabc3f717d817a677a35b2d11ff334475318ff9f5580e4
Instruction ID: 77a60a9f89c260e9a39451a0841a2e007e4d769b246c3dd6e19c7a75030dc1e6
Opcode Fuzzy Hash: d701b4fb207ddf05cadabc3f717d817a677a35b2d11ff334475318ff9f5580e4
Instruction Fuzzy Hash: FB61C072904609EFDF128F65EC84DFE7BB9EB06321F148147F925AA390D7708A80DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0039FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0039FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0039FB08
VariantInit.OLEAUT32(?), ref: 0039FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0039FB3A
VariantCopy.OLEAUT32(?,?), ref: 0039FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0039FBA1
VariantClear.OLEAUT32(?), ref: 0039FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0039FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0039FBCC
VariantClear.OLEAUT32(?), ref: 0039FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0039FBE9

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 78d99e4c2e7dc54c9e08c9d37b3ce8d46046c25f0d6c0045c0dd702a64b90164
Instruction ID: 98c1ba35927e4358700ce455fcae5cd025254733161eb59b014f8eb37cf8827e
Opcode Fuzzy Hash: 78d99e4c2e7dc54c9e08c9d37b3ce8d46046c25f0d6c0045c0dd702a64b90164
Instruction Fuzzy Hash: F5416035A1021A9FCF06DF69D8549EEBBB9FF08344F008069E905EB261CB30A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003A9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003A9CA1
GetAsyncKeyState.USER32(000000A0), ref: 003A9D22
GetKeyState.USER32(000000A0), ref: 003A9D3D
GetAsyncKeyState.USER32(000000A1), ref: 003A9D57
GetKeyState.USER32(000000A1), ref: 003A9D6C
GetAsyncKeyState.USER32(00000011), ref: 003A9D84
GetKeyState.USER32(00000011), ref: 003A9D96
GetAsyncKeyState.USER32(00000012), ref: 003A9DAE
GetKeyState.USER32(00000012), ref: 003A9DC0
GetAsyncKeyState.USER32(0000005B), ref: 003A9DD8
GetKeyState.USER32(0000005B), ref: 003A9DEA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f29529fbd26a33115057a1ed4f0817d72968984ac658204353e8a6c31a820191
Instruction ID: 939372ca3e1bb70efcd0cc77b694eef50d6d072720b4055891c93fc70617827b
Opcode Fuzzy Hash: f29529fbd26a33115057a1ed4f0817d72968984ac658204353e8a6c31a820191
Instruction Fuzzy Hash: AC41D634504BCA6DFF33866498443B5BEA1EF13354F09805BDAC6665C2EBA499C8C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 003C055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003C05BC
inet_addr.WSOCK32(?), ref: 003C061C
gethostbyname.WSOCK32(?), ref: 003C0628
IcmpCreateFile.IPHLPAPI ref: 003C0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003C06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003C06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 003C07B9
WSACleanup.WSOCK32 ref: 003C07BF

Strings

Ping, xrefs: 003C0676

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 93079cd6a02e7551070eed8df26874e5f4dea453fa6898c886087a5fa9df6b6d
Instruction ID: 705045d67bced3a589654858556dae08125b3c017127bdfb382fcce111fb4026
Opcode Fuzzy Hash: 93079cd6a02e7551070eed8df26874e5f4dea453fa6898c886087a5fa9df6b6d
Instruction Fuzzy Hash: 87918935608281DFD72ADF15C889F1ABBE4AB44318F1585ADE469CF6A2C730ED45CF81

Uniqueness

Uniqueness Score: -1.00%

Function 003C8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 003C8CF3

Part of subcall function 003A8E54: _wcslen.LIBCMT ref: 003A8E77

_wcslen.LIBCMT ref: 003C8D4E
_wcslen.LIBCMT ref: 003C8D9C
_wcslen.LIBCMT ref: 003C8DDC
_wcslen.LIBCMT ref: 003C8E6E

Strings

none, xrefs: 003C8E65, 003C8E6A
stdcall, xrefs: 003C8DD6, 003C8DDB
cdecl, xrefs: 003C8D48, 003C8D4D
winapi, xrefs: 003C8D96, 003C8D9B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: b2e4224ab00b1a3d37ecf650d96658027c2ad8cb18e30e96b5e8b09f96357f47
Instruction ID: 342ed79be90318dfa43a9a67966d2ffc220b6a2989eaa6a6659a8d2ac7bfbcbb
Opcode Fuzzy Hash: b2e4224ab00b1a3d37ecf650d96658027c2ad8cb18e30e96b5e8b09f96357f47
Instruction Fuzzy Hash: E3518131A001169BCB16DF7CC940ABEB7E5BF65724B21462EE426EB2C5DB35EE40C790

Uniqueness

Uniqueness Score: -1.00%

Function 003C372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 003C3774
CoUninitialize.OLE32 ref: 003C377F
CoCreateInstance.OLE32(?,00000000,00000017,003DFB78,?), ref: 003C37D9
IIDFromString.OLE32(?,?), ref: 003C384C
VariantInit.OLEAUT32(?), ref: 003C38E4
VariantClear.OLEAUT32(?), ref: 003C3936

Strings

NULL Pointer assignment, xrefs: 003C381E
Failed to create object, xrefs: 003C37E4, 003C389A
Invalid parameter, xrefs: 003C3865

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: e9da4b83baed377cd4e2602f234c0b39fb53b6e2b57b0b35029ce55d86b1d2e6
Instruction ID: dc27e70d766fc7a71ae3122b2ddafd8afc9293a0fceb03990aa372a7cb7667dc
Opcode Fuzzy Hash: e9da4b83baed377cd4e2602f234c0b39fb53b6e2b57b0b35029ce55d86b1d2e6
Instruction Fuzzy Hash: D8616771608311AFD312DF54D888F6ABBE8EF49714F10885EF9859B291C770EE48CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003B3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 003B33CF

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 003B33F0

Strings

Line %d (File "%s"):, xrefs: 003B3443, 003B345C
"%s" (%d) : ==> %s:%s%s, xrefs: 003B3504
Incorrect parameters to object property !, xrefs: 003B34AB
Error: , xrefs: 003B34D1
^ ERROR , xrefs: 003B349E
"%s" (%d) : ==> %s:, xrefs: 003B3522

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 0560e9973409eb3b38848cfb40c2c57c26872b3b0d61f54dc43e208e62804ba1
Instruction ID: 14341f86f84cf922748a0bd93053e13cf22826a12740b7f0d2bab5389ee774c1
Opcode Fuzzy Hash: 0560e9973409eb3b38848cfb40c2c57c26872b3b0d61f54dc43e208e62804ba1
Instruction Fuzzy Hash: 53519332940219AADF16EBA0DD46EEEB3B8EF05340F104166F5057B0A2DB357F58CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003AB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003AB5FC
_wcslen.LIBCMT ref: 003AB608
_wcslen.LIBCMT ref: 003AB64D
_wcslen.LIBCMT ref: 003AB68C
_wcslen.LIBCMT ref: 003AB6C7

Strings

KEYS, xrefs: 003AB647, 003AB64C
EXISTS, xrefs: 003AB686, 003AB68B
REMOVE, xrefs: 003AB602, 003AB607
APPEND, xrefs: 003AB6C1, 003AB6C6

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 9c6da81f8903f2faf366bd73d3312117c84c7453e2377a57ea4f3c16f775a601
Instruction ID: 5bbae24284285b8c0aa6aadb0b0670a97dcfa014f17671d86ebbe896e163bf42
Opcode Fuzzy Hash: 9c6da81f8903f2faf366bd73d3312117c84c7453e2377a57ea4f3c16f775a601
Instruction Fuzzy Hash: B741E932A000279BCB116F7DC8905BEF7A5FF62754B26412AE461DB296E735CD81C790

Uniqueness

Uniqueness Score: -1.00%

Function 003B5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003B53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 003B5416
GetLastError.KERNEL32 ref: 003B5420
SetErrorMode.KERNEL32(00000000,READY), ref: 003B54A7

Strings

UNKNOWN, xrefs: 003B5444
READONLY, xrefs: 003B5452
INVALID, xrefs: 003B5459
READY, xrefs: 003B5460, 003B5468
NOTREADY, xrefs: 003B544B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 5024b3037a0cdf19938b00c02697b931188457c26b47f8972aa25078b5086290
Instruction ID: fd929c9dae3be1b7e44e84b19fb775dbaf4c9da0372c495824ac6f1d10f471c0
Opcode Fuzzy Hash: 5024b3037a0cdf19938b00c02697b931188457c26b47f8972aa25078b5086290
Instruction Fuzzy Hash: 7931D235A002059FD712DF69C484BEA7BF8EF45309F158066E602DF692DB71ED86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 003D3C79
SetMenu.USER32(?,00000000), ref: 003D3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003D3D10
IsMenu.USER32(?), ref: 003D3D24
CreatePopupMenu.USER32 ref: 003D3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003D3D5B
DrawMenuBar.USER32 ref: 003D3D63

Strings

0, xrefs: 003D3C54
F, xrefs: 003D3D4E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: a40d1fe6edf9e221f328d64eb94ca0db3b002545d79c55e05028dee7d058c48f
Instruction ID: e04a5fa0a239aa41004f6236934ce47591a4aff20539bfe0665f48b2255fb92e
Opcode Fuzzy Hash: a40d1fe6edf9e221f328d64eb94ca0db3b002545d79c55e05028dee7d058c48f
Instruction Fuzzy Hash: 91416DB5A1120AAFDB15CF64E844ADA77BAFF49350F15002AF94697360D730AE10CF55

Uniqueness

Uniqueness Score: -1.00%

Function 003A1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 003A3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 003A1F64
GetDlgCtrlID.USER32 ref: 003A1F6F
GetParent.USER32 ref: 003A1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 003A1F8E
GetDlgCtrlID.USER32(?), ref: 003A1F97
GetParent.USER32(?), ref: 003A1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 003A1FAE

Strings

ListBox, xrefs: 003A1F21
ComboBox, xrefs: 003A1EEC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 142db6702a21899ac03d154f476ec17af0ab98d34e4f00994464a6242a58df8d
Instruction ID: b6dc1effde540a4f7a7d1354bd60ab188068f0e7ce2dfba72d6c8cefd6141276
Opcode Fuzzy Hash: 142db6702a21899ac03d154f476ec17af0ab98d34e4f00994464a6242a58df8d
Instruction Fuzzy Hash: B321B074950214BFCF06AFA0DC85AEEFBB8EF06310F141256B9616B2D1CB34A904DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003D3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 003D3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 003D3AA0
GetWindowLongW.USER32(?,000000F0), ref: 003D3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003D3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 003D3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 003D3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 003D3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 003D3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 003D3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 003D3C13

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: f8d36e0cebab01fe6a5735167b3ac2f2dde81ba28bf91dad8347c2f835071580
Instruction ID: 911e39371470dc5c1bf84606e5e7f7f9a27a64745350b1411626d3027d986453
Opcode Fuzzy Hash: f8d36e0cebab01fe6a5735167b3ac2f2dde81ba28bf91dad8347c2f835071580
Instruction Fuzzy Hash: 62617C75900248AFDB11DFA8DC81EEE77B8EB09700F10419AFA15AB3A1D774AE45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003AB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003AB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB165
GetWindowThreadProcessId.USER32(00000000), ref: 003AB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 003AB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,003AA1E1,?,00000001), ref: 003AB21D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 306648011ed36d5eef23d8feff2f347093acb9731a6b4abbb4cd672fd5a6c6e2
Instruction ID: 76f4a9bb31010f806f8aa0283cb418a7c1a22d1b940da6b49544ea0efe28f3b9
Opcode Fuzzy Hash: 306648011ed36d5eef23d8feff2f347093acb9731a6b4abbb4cd672fd5a6c6e2
Instruction Fuzzy Hash: CB31CE71520204BFDB129F24EC48BADBBADFB56356F168426FA00D6191D7B4DE00CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00372C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00372C94

Part of subcall function 003729C8: HeapFree.KERNEL32(00000000,00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000), ref: 003729DE
Part of subcall function 003729C8: GetLastError.KERNEL32(00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000,00000000), ref: 003729F0

_free.LIBCMT ref: 00372CA0
_free.LIBCMT ref: 00372CAB
_free.LIBCMT ref: 00372CB6
_free.LIBCMT ref: 00372CC1
_free.LIBCMT ref: 00372CCC
_free.LIBCMT ref: 00372CD7
_free.LIBCMT ref: 00372CE2
_free.LIBCMT ref: 00372CED
_free.LIBCMT ref: 00372CFB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 74e5f4975fb695d6ef6d089fc4ccb3e3c121d4fca09e0d81fff98b407f725fdf
Instruction ID: 04d9c68e3bbab72f20ef5ee1c9ad4edc78b69fced551fa15b0179cf7e8ccca81
Opcode Fuzzy Hash: 74e5f4975fb695d6ef6d089fc4ccb3e3c121d4fca09e0d81fff98b407f725fdf
Instruction Fuzzy Hash: FC119676100108AFCB13EF65D842CDE7BA5FF06350F4585A5FA4C5F222D735EAA09B90

Uniqueness

Uniqueness Score: -1.00%

Function 003B7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003B7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 003B7FC1
GetFileAttributesW.KERNEL32(?), ref: 003B7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 003B8005
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8017
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 003B80B0

Strings

*.*, xrefs: 003B8066

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 56b5743821b65f175e61039a853b51df10cc677df7e971565ea7596dd55fe365
Instruction ID: 754d42074f1a9f71d16e228a2a14f793b8d1c5d3967d40f21eba1be1a9939570
Opcode Fuzzy Hash: 56b5743821b65f175e61039a853b51df10cc677df7e971565ea7596dd55fe365
Instruction Fuzzy Hash: BD81BF715182059BCB22EF14C440AEAB3E8FFC8358F154C5AFA85CBA50EB34ED49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00345BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00345C7A

Part of subcall function 00345D0A: GetClientRect.USER32(?,?), ref: 00345D30
Part of subcall function 00345D0A: GetWindowRect.USER32(?,?), ref: 00345D71
Part of subcall function 00345D0A: ScreenToClient.USER32(?,?), ref: 00345D99

GetDC.USER32 ref: 003846F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00384708
SelectObject.GDI32(00000000,00000000), ref: 00384716
SelectObject.GDI32(00000000,00000000), ref: 0038472B
ReleaseDC.USER32(?,00000000), ref: 00384733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 003847C4

Strings

U, xrefs: 00384693

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: cf3332dfa01989dc6a540fb25ba05e0b7bd4f4dbc1bb3414d8be9fd2aa57cbb8
Instruction ID: 32d69d7e6dfd0cd1b6f4ab3567b15efab51daa8db96172565a19b80b6a4f1796
Opcode Fuzzy Hash: cf3332dfa01989dc6a540fb25ba05e0b7bd4f4dbc1bb3414d8be9fd2aa57cbb8
Instruction Fuzzy Hash: 7E71D031800306DFCF23AF64C984ABA7BB5FF4A310F1942AAF9655A666D3319C41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 003B359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 003B35E4

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

LoadStringW.USER32(00412390,?,00000FFF,?), ref: 003B360A

Strings

Line %d (File "%s"):, xrefs: 003B366B
"%s" (%d) : ==> %s:%s%s, xrefs: 003B3724
Error: , xrefs: 003B36EF
"%s" (%d) : ==> %s:, xrefs: 003B3742
^ ERROR, xrefs: 003B36C9

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 51b11649b4abae28f7131294f007f67e2a14133cb4943b76232fde781ca54a94
Instruction ID: 2127967a987b2a837d856e2f9f0fdf14b77c00963444aa996632ab5e1576e20a
Opcode Fuzzy Hash: 51b11649b4abae28f7131294f007f67e2a14133cb4943b76232fde781ca54a94
Instruction Fuzzy Hash: D051A372940219BADF16EFA0DC42EEEBB78EF04300F144166F6057A0A1DB302B99DF65

Uniqueness

Uniqueness Score: -1.00%

Function 003BC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003BC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003BC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003BC2CA
GetLastError.KERNEL32 ref: 003BC322
SetEvent.KERNEL32(?), ref: 003BC336
InternetCloseHandle.WININET(00000000), ref: 003BC341

Strings

, xrefs: 003BC2BB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 3e83c00b709b743cac81ccda02dcdc70e15dfe71409dccbc365032e1d196825f
Instruction ID: 4b466f2a5275eb17c46f4b9797ef9d42ac64f842bdc80f85c2bbb6dc9c01e818
Opcode Fuzzy Hash: 3e83c00b709b743cac81ccda02dcdc70e15dfe71409dccbc365032e1d196825f
Instruction Fuzzy Hash: 85318FB5620204AFDB339F649884AEB7BFCEB49748F54951EF58AD6A00DB34DD04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00383AAF,?,?,Bad directive syntax error,003DCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 003A98BC
LoadStringW.USER32(00000000,?,00383AAF,?), ref: 003A98C3

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 003A9987

Strings

Line %d (File "%s"):, xrefs: 003A992D
Error: , xrefs: 003A9955
Line %d:, xrefs: 003A9912
%s (%d) : ==> %s.: %s %s, xrefs: 003A98F1
., xrefs: 003A996D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 8293758a0f9c033e2055ba0613c8b1c795c0bca3dab009b6158ecccb1f6ebef7
Instruction ID: 72cc6104095a17cfed588a8bb2334bc22df5a6dfc095482c511996ab894348fc
Opcode Fuzzy Hash: 8293758a0f9c033e2055ba0613c8b1c795c0bca3dab009b6158ecccb1f6ebef7
Instruction Fuzzy Hash: FD216F3295021AABDF16AF90CC0AFEE7779FF18300F04446AF5157A0A2DB35A628DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003A209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 003A20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 003A20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 003A214D

Strings

list, xrefs: 003A212F
largeicons, xrefs: 003A20E1
SHELLDLL_DefView, xrefs: 003A20CC
details, xrefs: 003A20FB
smallicons, xrefs: 003A2115

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: f008d75805d910b158eea22f22280a0fec0567a646e41dc1d553e0b0e46753df
Instruction ID: 0cbfd4fc0c91786c7bae8d59626ccd0e6a7ca8be01ae629fecd14c6a8c7f6e76
Opcode Fuzzy Hash: f008d75805d910b158eea22f22280a0fec0567a646e41dc1d553e0b0e46753df
Instruction Fuzzy Hash: 54113A76684307B9FA032224EC06DA7379CDF16324F204027F704B80D1EE75B8115A18

Uniqueness

Uniqueness Score: -1.00%

Function 0037CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0037CEB7
_free.LIBCMT ref: 0037CF22
_free.LIBCMT ref: 0037CF48
_free.LIBCMT ref: 0037CF71
_free.LIBCMT ref: 0037CFA9
_free.LIBCMT ref: 0037CFDA
_free.LIBCMT ref: 0037D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0037D09C
_free.LIBCMT ref: 0037D0B5

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 646a323dc1fda26d51a4e20ad882445b40d830888944a1a8940b241cf5241927
Instruction ID: f5d85f9d3b37c4a003bfa3f07d57af56057683fbf33724d0ba7e4ee2aa50eac6
Opcode Fuzzy Hash: 646a323dc1fda26d51a4e20ad882445b40d830888944a1a8940b241cf5241927
Instruction Fuzzy Hash: C2610671914301AFDB33AFB4A891AAE7BE5AF06320F05C16EF94CAB281D7399D41C750

Uniqueness

Uniqueness Score: -1.00%

Function 003D50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 003D5186
ShowWindow.USER32(?,00000000), ref: 003D51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 003D51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 003D51D1

Part of subcall function 003D6FBA: DeleteObject.GDI32(00000000), ref: 003D6FE6

GetWindowLongW.USER32(?,000000F0), ref: 003D520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 003D524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 003D5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 003D5296

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 5f991fc5aea1c1335a6e564976de5cb02aa014c6ef4f2b47a4702879e6d7312e
Instruction ID: 0b94da15a7dd1f8b97dca855d9f8f9c04fc3b1a29ee787b358aef8f0917d0419
Opcode Fuzzy Hash: 5f991fc5aea1c1335a6e564976de5cb02aa014c6ef4f2b47a4702879e6d7312e
Instruction Fuzzy Hash: C751D332A51A09FEEF229F24EC46BD83B75FB05361F144413FA259A3E0C375A988DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00358B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00396890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 003968A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 003968B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 003968D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 003968F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00358874,00000000,00000000,00000000,000000FF,00000000), ref: 00396901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0039691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00358874,00000000,00000000,00000000,000000FF,00000000), ref: 0039692D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: de9796ab8ae4d477df3fb1b23ed0d7265e243506e60a3b3c0f22e9ee56661262
Instruction ID: b98f946a0d326b092a1f202634666880337e053b6df141f33cf830d6c9f51610
Opcode Fuzzy Hash: de9796ab8ae4d477df3fb1b23ed0d7265e243506e60a3b3c0f22e9ee56661262
Instruction Fuzzy Hash: 40519CB0610205EFDF22CF25DC52FAA7BB9FB48361F104519F952A72A0DB70E950DB40

Uniqueness

Uniqueness Score: -1.00%

Function 003BC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003BC182
GetLastError.KERNEL32 ref: 003BC195
SetEvent.KERNEL32(?), ref: 003BC1A9

Part of subcall function 003BC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003BC272
Part of subcall function 003BC253: GetLastError.KERNEL32 ref: 003BC322
Part of subcall function 003BC253: SetEvent.KERNEL32(?), ref: 003BC336
Part of subcall function 003BC253: InternetCloseHandle.WININET(00000000), ref: 003BC341

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 24c4641d19329ea7ed9140e5ebccb6c038affc53678e88c1f4f59abfeac94ec5
Instruction ID: 40e9a5ab0bacaa2966cfe55da5195c0734e2b6fda519b196f45989c1bb840022
Opcode Fuzzy Hash: 24c4641d19329ea7ed9140e5ebccb6c038affc53678e88c1f4f59abfeac94ec5
Instruction Fuzzy Hash: 8B31A271621605AFDB329FA5DC04AA6BBFDFF54304B04681EFA56CAA10C730E910DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A3A57
Part of subcall function 003A3A3D: GetCurrentThreadId.KERNEL32 ref: 003A3A5E
Part of subcall function 003A3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003A25B3), ref: 003A3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 003A25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 003A25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 003A25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 003A25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 003A2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 003A2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 003A260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 003A2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 003A2627

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: ca4de7d6f49de8611c7eb9f997028549f6d7e621ff19612f7f8c1f2091d42bd3
Instruction ID: 9be8bea3e380ab3a6b46b34aa94a15a01a96ec766be0a6240a238cd9df82071e
Opcode Fuzzy Hash: ca4de7d6f49de8611c7eb9f997028549f6d7e621ff19612f7f8c1f2091d42bd3
Instruction Fuzzy Hash: 2001D8307A0320BBFB1167689C8AF597F5DDB4EB11F101002F354AF0D1C9E15444CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 003A1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,003A1449,?,?,00000000), ref: 003A180C
HeapAlloc.KERNEL32(00000000,?,003A1449,?,?,00000000), ref: 003A1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003A1449,?,?,00000000), ref: 003A1828
GetCurrentProcess.KERNEL32(?,00000000,?,003A1449,?,?,00000000), ref: 003A1830
DuplicateHandle.KERNEL32(00000000,?,003A1449,?,?,00000000), ref: 003A1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003A1449,?,?,00000000), ref: 003A1843
GetCurrentProcess.KERNEL32(003A1449,00000000,?,003A1449,?,?,00000000), ref: 003A184B
DuplicateHandle.KERNEL32(00000000,?,003A1449,?,?,00000000), ref: 003A184E
CreateThread.KERNEL32(00000000,00000000,003A1874,00000000,00000000,00000000), ref: 003A1868

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d7276f4e6be1111c9bdde344676588fa9c79385cf6c64a3bf89c21cc6bd7d34d
Instruction ID: 49c2b8757f36ebd2b97a1701dd6ed312907eaa979dbffe140ba6737827ff95d8
Opcode Fuzzy Hash: d7276f4e6be1111c9bdde344676588fa9c79385cf6c64a3bf89c21cc6bd7d34d
Instruction Fuzzy Hash: 3D01CDB52A1319BFE711AFB5EC4DF6B3BACEB89B11F005411FA05DB1A1CA749800CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00373E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00373F0B
__alldvrm.LIBCMT ref: 0037410C
__alldvrm.LIBCMT ref: 0037412E

Strings

}}6, xrefs: 003740CD
}}6, xrefs: 00373E8A
}}6, xrefs: 00373E96, 00373EF1, 00373F0A, 00374090

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}6$}}6$}}6
API String ID: 1036877536-1336002142
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 699ded05fe2ec5fdd819a02cb54e9f65d18968fedd10ad2d4f700d6bf4590666
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 66A13771E003869FD733DE18C8917AAFBE8EF65350F1581ADE5999B241C33CA981C751

Uniqueness

Uniqueness Score: -1.00%

Function 003CA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 003AD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 003AD501
Part of subcall function 003AD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 003AD50F
Part of subcall function 003AD4DC: CloseHandle.KERNEL32(00000000), ref: 003AD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 003CA16D
GetLastError.KERNEL32 ref: 003CA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 003CA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 003CA268
GetLastError.KERNEL32(00000000), ref: 003CA273
CloseHandle.KERNEL32(00000000), ref: 003CA2C4

Strings

SeDebugPrivilege, xrefs: 003CA18F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 6fd3ad7f53d8f20db6ff05c86df97acb80c0c1d732ef46d18c4d260e7bdf43bc
Instruction ID: 86f6019ae2180da0ffc993a02f53be84c56478f7b5768ccc0e60a82067c772ec
Opcode Fuzzy Hash: 6fd3ad7f53d8f20db6ff05c86df97acb80c0c1d732ef46d18c4d260e7bdf43bc
Instruction Fuzzy Hash: 9061BC302196429FD322DF18C494F16BBE5AF44318F19848CE4668FBA3C776EC49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003D3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 003D3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 003D393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 003D3954
_wcslen.LIBCMT ref: 003D3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 003D39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 003D39F4

Strings

SysListView32, xrefs: 003D38F7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: bcc76a5f41e2d9a8a8627856864a0aa2375a37be64758308d5cc585b78c6d486
Instruction ID: 359245bc7eb282acce5bdca0ecbd87f40fce6983391c5d806915b739a297da1f
Opcode Fuzzy Hash: bcc76a5f41e2d9a8a8627856864a0aa2375a37be64758308d5cc585b78c6d486
Instruction Fuzzy Hash: 2E41C272A00219ABEF229F64DC45BEA7BA9EF08350F110527F958E7281D771DE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003ABC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003ABCFD
IsMenu.USER32(00000000), ref: 003ABD1D
CreatePopupMenu.USER32 ref: 003ABD53
GetMenuItemCount.USER32(01076B30), ref: 003ABDA4
InsertMenuItemW.USER32(01076B30,?,00000001,00000030), ref: 003ABDCC

Strings

2, xrefs: 003ABD37
0, xrefs: 003ABCA8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 2fb9e5d07aed350a979afb0c92f292c6a6ef096f55303ecf43660d2691a56616
Instruction ID: 2e35a81ddc27244aee177928cbf246b24080c485535b08da5b695a9456115a74
Opcode Fuzzy Hash: 2fb9e5d07aed350a979afb0c92f292c6a6ef096f55303ecf43660d2691a56616
Instruction Fuzzy Hash: F051AD70A002459BDF12CFB9D888BAEFBF9FF47314F14825AE401AB292D7709944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00362D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00362D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00362D53
_ValidateLocalCookies.LIBCMT ref: 00362DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00362E0C
_ValidateLocalCookies.LIBCMT ref: 00362E61

Strings

csm, xrefs: 00362DF6
&H6, xrefs: 00362DFE, 00362E07, 00362E18

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H6$csm
API String ID: 1170836740-834592613
Opcode ID: 4ed2af78d02722541f54e43441e5328fa894939baa766714e5ed12595a49cf91
Instruction ID: ac8b97587b2ede492782c2dbdf1f6d5e07b4261b49983c6cec24d15311a00748
Opcode Fuzzy Hash: 4ed2af78d02722541f54e43441e5328fa894939baa766714e5ed12595a49cf91
Instruction Fuzzy Hash: 6D41C434A00609EBCF12DF68C885ADFBBB5BF45324F16C165E8246B396D7719A05CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 003AC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 003AC913

Strings

question, xrefs: 003AC8CC
warning, xrefs: 003AC8FC
stop, xrefs: 003AC8E4
blank, xrefs: 003AC895
info, xrefs: 003AC8B4

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 1f865fcfd700ea37f5394fb4f51591b632dddb332e71351ec6d401a05d3847bc
Instruction ID: 35b5347dfaf98c6f1fc0f5d5531d7b96e14db8f547cf24c4e29d5ac534170bd4
Opcode Fuzzy Hash: 1f865fcfd700ea37f5394fb4f51591b632dddb332e71351ec6d401a05d3847bc
Instruction Fuzzy Hash: 00112B35AA9306BAE7035B54DC82DAB27DCDF16314B21503FF500AA2C2D7B85D00926D

Uniqueness

Uniqueness Score: -1.00%

Function 003ADE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003ADE42
gethostname.WSOCK32(?,00000100), ref: 003ADE5C
gethostbyname.WSOCK32(?), ref: 003ADE69
inet_ntoa.WSOCK32(?), ref: 003ADEAB
_strcat.LIBCMT ref: 003ADEB9
WSACleanup.WSOCK32 ref: 003ADEDE

Strings

0.0.0.0, xrefs: 003ADE87

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 60c027b56506940f19ace5b7f9686c8b2ec6a1ebe4adf577088735dae7325031
Instruction ID: e74e2e408c7ea60c8876469b411de0631ca2b9f627d590ccd4dcc4585deaed1c
Opcode Fuzzy Hash: 60c027b56506940f19ace5b7f9686c8b2ec6a1ebe4adf577088735dae7325031
Instruction Fuzzy Hash: 64112931914115AFCB26BB70EC4AEEF77ACDF12711F01026AF556AE491EF718A81CA60

Uniqueness

Uniqueness Score: -1.00%

Function 003D9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

GetSystemMetrics.USER32(0000000F), ref: 003D9FC7
GetSystemMetrics.USER32(0000000F), ref: 003D9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 003DA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 003DA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 003DA263
ShowWindow.USER32(00000003,00000000), ref: 003DA282
InvalidateRect.USER32(?,00000000,00000001), ref: 003DA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 003DA2CA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: a8ff4bb2e5fa7e3270444375f1370ea5d38b8afbc847dcc192828a8dcf26fa25
Instruction ID: 032bfa090c0a2a9cf6c484d367a1019ebe6355315675371c60adeb43af3a6283
Opcode Fuzzy Hash: a8ff4bb2e5fa7e3270444375f1370ea5d38b8afbc847dcc192828a8dcf26fa25
Instruction Fuzzy Hash: 00B1D932600615EFCF16CF69DA857AE7BB2FF44301F09806AEC499B395D731AA40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003AED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 003AED2A
_wcslen.LIBCMT ref: 003AED3B
_wcslen.LIBCMT ref: 003AED79
_wcslen.LIBCMT ref: 003AEDAF
_wcslen.LIBCMT ref: 003AEDDF
_wcslen.LIBCMT ref: 003AEDEF
_wcslen.LIBCMT ref: 003AEE2B
_wcslen.LIBCMT ref: 003AEE5A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 0487f025143bc78773fc3ac9dd0cb205f53db8124c551f5ae8d43997480abb7d
Instruction ID: 94d1e69c1b494d37fd6c57c7d5a2d78740fdb919c1c9e14ea10112f5e23947c4
Opcode Fuzzy Hash: 0487f025143bc78773fc3ac9dd0cb205f53db8124c551f5ae8d43997480abb7d
Instruction Fuzzy Hash: 3541B065D1021876DB12EBF4888A9CFB7A8EF46310F50C862E518E7126FB34E255C3E6

Uniqueness

Uniqueness Score: -1.00%

Function 0035F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0039682C,00000004,00000000,00000000), ref: 0035F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0039682C,00000004,00000000,00000000), ref: 0039F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0039682C,00000004,00000000,00000000), ref: 0039F454

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0fca10d845d739e6383f2cb04a5f83b088d1a7d98b5370bae0f5947d3e2adb5a
Instruction ID: f948760d8ccb80b47bc03e882569be7d84232894d636cf5f11b8ffb3436a5904
Opcode Fuzzy Hash: 0fca10d845d739e6383f2cb04a5f83b088d1a7d98b5370bae0f5947d3e2adb5a
Instruction Fuzzy Hash: 8C415E31214E80BECB379B3DD888F6A7B99AF46316F15403DE84796970C732A888CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003D2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003D2D1B
GetDC.USER32(00000000), ref: 003D2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003D2D2E
ReleaseDC.USER32(00000000,00000000), ref: 003D2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 003D2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003D2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,003D5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 003D2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003D2DE1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: fd673b63c380fc11ad86dae2489b7507b4a90e4660443eb4cda0c5d54c923e08
Instruction ID: 787c321258883b8d80d1463c2bc5d110160d953e3d0b48950a8ae1127e5ba6e7
Opcode Fuzzy Hash: fd673b63c380fc11ad86dae2489b7507b4a90e4660443eb4cda0c5d54c923e08
Instruction Fuzzy Hash: 70318072222214BFEB124F50EC89FEB3FADEF19715F084056FE089A291D6759C50C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 003A5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 003A5637
_memcmp.LIBVCRUNTIME ref: 003A5659
_memcmp.LIBVCRUNTIME ref: 003A5671
_memcmp.LIBVCRUNTIME ref: 003A5684
_memcmp.LIBVCRUNTIME ref: 003A569E
_memcmp.LIBVCRUNTIME ref: 003A56B1
_memcmp.LIBVCRUNTIME ref: 003A56C9
_memcmp.LIBVCRUNTIME ref: 003A56E4

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d3a6154c1ebb8ab1a1e0930b7f3df44b14dcf59fe44217aafd088d7bf7c43f47
Instruction ID: e089fd36e07facd006f9a67a778785ad9f321665ff44a0b3a7f364b61d593151
Opcode Fuzzy Hash: d3a6154c1ebb8ab1a1e0930b7f3df44b14dcf59fe44217aafd088d7bf7c43f47
Instruction Fuzzy Hash: CC21C666641A09BBD21B56209EC2FFA335CEF22385F588021FD169FB95F721ED2081A5

Uniqueness

Uniqueness Score: -1.00%

Function 003C4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 003C502E, 003C5383
Not an Object type, xrefs: 003C5007

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 12e19275b1315baea382330d20fa478de62a893d3beb47fa7aee92e0163070a1
Instruction ID: 886c1f8b13b457c6130fc7aa744ed5ba161c9f71625bd23c0534c3a12db7f2d0
Opcode Fuzzy Hash: 12e19275b1315baea382330d20fa478de62a893d3beb47fa7aee92e0163070a1
Instruction Fuzzy Hash: 99D1AC75A0060A9FDF11CFA8C880FAEB7B5BB48344F15856DE915EB281E770ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00381522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 003815CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00381651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 003816E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 003816FB

Part of subcall function 00373820: RtlAllocateHeap.NTDLL(00000000,?,00411444,?,0035FDF5,?,?,0034A976,00000010,00411440,003413FC,?,003413C6,?,00341129), ref: 00373852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00381777
__freea.LIBCMT ref: 003817A2
__freea.LIBCMT ref: 003817AE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 78b8e99361463c050b0adc90be7e377c54697bcc03216a2b3a7ee65662507d30
Instruction ID: 5ee18da78a223c7781ecf8134feffc7751c74bee733826aa84af04eb874547eb
Opcode Fuzzy Hash: 78b8e99361463c050b0adc90be7e377c54697bcc03216a2b3a7ee65662507d30
Instruction Fuzzy Hash: 6A91C572E103169ADF22AE74CC81AEE7BBDAF49310F194699F805E7141D735CD46CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003C4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C4648
VariantInit.OLEAUT32(?), ref: 003C4749
VariantClear.OLEAUT32(?), ref: 003C4753
VariantClear.OLEAUT32(?), ref: 003C47B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 003C45D8, 003C4706, 003C47BE
Incorrect Object type in FOR..IN loop, xrefs: 003C472C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 7f7f2dde68cfd1943d92db8618a9652ef573ea8e04277e47c693c4b788c0b1d9
Instruction ID: 48c6cbb54dc80a603b891ecbfb2bad5d9a92f06e7e20ae0360590bf21a5934f2
Opcode Fuzzy Hash: 7f7f2dde68cfd1943d92db8618a9652ef573ea8e04277e47c693c4b788c0b1d9
Instruction Fuzzy Hash: 2A91AE71A00219ABDF22CFA4C894FAEBBB8EF46714F10855EF515EB280D7709D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003B1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 003B125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 003B1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 003B12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 003B12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 003B135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 003B13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 003B1430

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 432978746cf25585ebb30fcb2daad8583ad4d32813de7a154888038def690a32
Instruction ID: 6746600c9dd97550ff4aaf0d7806fca09d968ded89527c92c83879dc6b6322c7
Opcode Fuzzy Hash: 432978746cf25585ebb30fcb2daad8583ad4d32813de7a154888038def690a32
Instruction Fuzzy Hash: 59911471A102099FDB02DF95C8A4BFEB7B9FF45319F114429EA00EFA91D774A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0035948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 5afda1ef2afa12eaf23d8a8ffc5e37a3902cfb7d5f0e6b4eb4513a6a2ee0d767
Instruction ID: 368b0b03c29bfb2166220ae3a971ac1604658effd884542661211c83cebe9773
Opcode Fuzzy Hash: 5afda1ef2afa12eaf23d8a8ffc5e37a3902cfb7d5f0e6b4eb4513a6a2ee0d767
Instruction Fuzzy Hash: 84912771900219EFCB12CFA9CC84AEEBBB8FF49320F144556E915B7261D374A955CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003C3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C396B
CharUpperBuffW.USER32(?,?), ref: 003C3A7A
_wcslen.LIBCMT ref: 003C3A8A
VariantClear.OLEAUT32(?), ref: 003C3C1F

Part of subcall function 003B0CDF: VariantInit.OLEAUT32(00000000), ref: 003B0D1F
Part of subcall function 003B0CDF: VariantCopy.OLEAUT32(?,?), ref: 003B0D28
Part of subcall function 003B0CDF: VariantClear.OLEAUT32(?), ref: 003B0D34

Strings

AUTOIT.ERROR, xrefs: 003C3A80, 003C3A85
Incorrect Parameter format, xrefs: 003C39A6, 003C3BA1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 9edf0b67757a5653144ea4b88329861579680baa95beb3112be26b7fab486383
Instruction ID: a9cdfb32550c3f87faf72c16f5d4d607fe4a158ac3c1be8875438083f295f1e2
Opcode Fuzzy Hash: 9edf0b67757a5653144ea4b88329861579680baa95beb3112be26b7fab486383
Instruction Fuzzy Hash: BD912575A083059FC705DF28C481A6AB7E4FF89314F14896EF88A9B351DB31EE45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003C4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 003A000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?,?,003A035E), ref: 003A002B
Part of subcall function 003A000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?), ref: 003A0046
Part of subcall function 003A000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?), ref: 003A0054
Part of subcall function 003A000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?), ref: 003A0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 003C4C51
_wcslen.LIBCMT ref: 003C4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 003C4DCF
CoTaskMemFree.OLE32(?), ref: 003C4DDA

Strings

NULL Pointer assignment, xrefs: 003C4E23, 003C4E52

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: d8fb11d95d9e173c7ab7ea3a726812626a3567012381d6920b24a2f5a196e617
Instruction ID: 31e486a2d57fe49b86d6e52e19d98bf2af9119c7234bca4d24058ca3c7c3f366
Opcode Fuzzy Hash: d8fb11d95d9e173c7ab7ea3a726812626a3567012381d6920b24a2f5a196e617
Instruction Fuzzy Hash: 1A91F571D00219AFDF16DFA4D891EEEB7B8BF08314F11816AE915AB251DB30AE44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003D20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 003D2183
GetMenuItemCount.USER32(00000000), ref: 003D21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 003D21DD
_wcslen.LIBCMT ref: 003D2213
GetMenuItemID.USER32(?,?), ref: 003D224D
GetSubMenu.USER32(?,?), ref: 003D225B

Part of subcall function 003A3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A3A57
Part of subcall function 003A3A3D: GetCurrentThreadId.KERNEL32 ref: 003A3A5E
Part of subcall function 003A3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003A25B3), ref: 003A3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 003D22E3

Part of subcall function 003AE97B: Sleep.KERNEL32 ref: 003AE9F3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: a4d316c64cd2c715bff0705ca50d8313599df2613c4b854195d552579654b8d1
Instruction ID: 5834ba3fcb873590f6249021a71206967fc382bd304cab012fcd558a919ae88c
Opcode Fuzzy Hash: a4d316c64cd2c715bff0705ca50d8313599df2613c4b854195d552579654b8d1
Instruction Fuzzy Hash: 7D71AD76E00205AFCB02DF64D841AAEB7F5EF58310F15885AF816EB351DB35EE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 003D7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01076BD0), ref: 003D7F37
IsWindowEnabled.USER32(01076BD0), ref: 003D7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 003D801E
SendMessageW.USER32(01076BD0,000000B0,?,?), ref: 003D8051
IsDlgButtonChecked.USER32(?,?), ref: 003D8089
GetWindowLongW.USER32(01076BD0,000000EC), ref: 003D80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 003D80C3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 23baf10f6e91ed824d23dc75ffae3d9a8c7c7915eaa011f3b6f9c82e86904979
Instruction ID: 94485a8128d19f3a5d1137d0b0e1a016a7460a605dbab9e29916a8bea95d2de9
Opcode Fuzzy Hash: 23baf10f6e91ed824d23dc75ffae3d9a8c7c7915eaa011f3b6f9c82e86904979
Instruction Fuzzy Hash: 9771A076608204AFEB339F54E884FEABBBDEF09300F15405BE955973A1DB31A945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 003AAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 003AAEF9
GetKeyboardState.USER32(?), ref: 003AAF0E
SetKeyboardState.USER32(?), ref: 003AAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 003AAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 003AAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 003AAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 003AB020

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 1bfb8280f39c989943767dca72e73e37acfd8897d0624903207516af1b7ea24b
Instruction ID: 4b438c5ad840164e945430688b4b0087d4d220e49dc3e0930a913a303b42c135
Opcode Fuzzy Hash: 1bfb8280f39c989943767dca72e73e37acfd8897d0624903207516af1b7ea24b
Instruction Fuzzy Hash: BD51B1A1614BD53DFB3B82348C45BBABEA99B07304F09858AE1D9598C3C398A8C8D751

Uniqueness

Uniqueness Score: -1.00%

Function 003AACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 003AAD19
GetKeyboardState.USER32(?), ref: 003AAD2E
SetKeyboardState.USER32(?), ref: 003AAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 003AADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 003AADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 003AAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 003AAE38

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ba84b72c49b2c54a44e962533f441489802fba9eace6e226125cf9ac09ff2044
Instruction ID: c911c6ccbb5f66de5d72b2b4364086130ebe50e6366dc8e9a1a73485987dc865
Opcode Fuzzy Hash: ba84b72c49b2c54a44e962533f441489802fba9eace6e226125cf9ac09ff2044
Instruction Fuzzy Hash: 7A51E3A2514BD53DFB3783348C55B7ABEA8EB47300F088489E1D54A8C3D394EC88E762

Uniqueness

Uniqueness Score: -1.00%

Function 0037542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00383CD6,?,?,?,?,?,?,?,?,00375BA3,?,?,00383CD6,?,?), ref: 00375470
__fassign.LIBCMT ref: 003754EB
__fassign.LIBCMT ref: 00375506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00383CD6,00000005,00000000,00000000), ref: 0037552C
WriteFile.KERNEL32(?,00383CD6,00000000,00375BA3,00000000,?,?,?,?,?,?,?,?,?,00375BA3,?), ref: 0037554B
WriteFile.KERNEL32(?,?,00000001,00375BA3,00000000,?,?,?,?,?,?,?,?,?,00375BA3,?), ref: 00375584

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 2310e985948671fb10a51a4a5b54c278565070d982d92265baf5ac7bfbe27e5d
Instruction ID: fd83b5da430f6c74ae469eee20019c08b15fbe95f4fa8b44c483c12ff6f16549
Opcode Fuzzy Hash: 2310e985948671fb10a51a4a5b54c278565070d982d92265baf5ac7bfbe27e5d
Instruction Fuzzy Hash: A951F970A006499FDB26CFA8D841AEEBBF9EF09310F14811EF55AE7291D774DA41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003C10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003C307A
Part of subcall function 003C304E: _wcslen.LIBCMT ref: 003C309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 003C1112
WSAGetLastError.WSOCK32 ref: 003C1121
WSAGetLastError.WSOCK32 ref: 003C11C9
closesocket.WSOCK32(00000000), ref: 003C11F9

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: bb08c61c9ea4e64351fe7da1fac6e491db5f03b919244912a0b942693654023f
Instruction ID: 20a424ca23f7038fec94d79bd6234cee39e6fe8e02cad223318491e16a11c8dd
Opcode Fuzzy Hash: bb08c61c9ea4e64351fe7da1fac6e491db5f03b919244912a0b942693654023f
Instruction Fuzzy Hash: 21411431610205AFDB129F14D885FAAB7E9EF46324F188059FD16DF292C778EE41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003ACF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003ADDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003ACF22,?), ref: 003ADDFD

Part of subcall function 003ADDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003ACF22,?), ref: 003ADE16

lstrcmpiW.KERNEL32(?,?), ref: 003ACF45
MoveFileW.KERNEL32(?,?), ref: 003ACF7F
_wcslen.LIBCMT ref: 003AD005
_wcslen.LIBCMT ref: 003AD01B
SHFileOperationW.SHELL32(?), ref: 003AD061

Strings

\*.*, xrefs: 003ACFF3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: c28a9eacc191a97539df82b837e4dededaad825df017723f635bf9c672904e29
Instruction ID: 9142b6f4ff7e5964d1162aca6718c42b395cf1aaf1b81577ebbd5cefb1b606da
Opcode Fuzzy Hash: c28a9eacc191a97539df82b837e4dededaad825df017723f635bf9c672904e29
Instruction Fuzzy Hash: 994151719452199FDF13EBA4D981ADEB7BCEF09780F1000E6E505EB142EB34AB88CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003D2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 003D2E1C
GetWindowLongW.USER32(?,000000F0), ref: 003D2E4F
GetWindowLongW.USER32(?,000000F0), ref: 003D2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 003D2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 003D2EE0
GetWindowLongW.USER32(?,000000F0), ref: 003D2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D2F0B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2ed3bee5f2177a9f8116018ac6fcc812a45a265a0392db38d7cc7715b378cabe
Instruction ID: 78df12705a835ef0f1a393ea3f3c81ecb393331479f7bc51adf35cfdbbf28a11
Opcode Fuzzy Hash: 2ed3bee5f2177a9f8116018ac6fcc812a45a265a0392db38d7cc7715b378cabe
Instruction Fuzzy Hash: 973115326551419FDB22CF19EC84FA637E5FBAA710F1A51A6FA108F2B1CB71E840DB00

Uniqueness

Uniqueness Score: -1.00%

Function 003A7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A778F
SysAllocString.OLEAUT32(00000000), ref: 003A7792
SysAllocString.OLEAUT32(?), ref: 003A77B0
SysFreeString.OLEAUT32(?), ref: 003A77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 003A77DE
SysAllocString.OLEAUT32(?), ref: 003A77EC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c65092e675462dfa8b310d15bf7aabc2a429d8d057a143f664aaaedfcd41ff99
Instruction ID: c90a8b2171ddc100678d6786b7447156da6c8e3ce1980d459566e81a74b4e911
Opcode Fuzzy Hash: c65092e675462dfa8b310d15bf7aabc2a429d8d057a143f664aaaedfcd41ff99
Instruction Fuzzy Hash: EB21C476615219AFDF12DFA8DC88CFB73ACEB0A364B008126F914DB160D670DC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 003A77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A7868
SysAllocString.OLEAUT32(00000000), ref: 003A786B
SysAllocString.OLEAUT32 ref: 003A788C
SysFreeString.OLEAUT32 ref: 003A7895
StringFromGUID2.OLE32(?,?,00000028), ref: 003A78AF
SysAllocString.OLEAUT32(?), ref: 003A78BD

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 55af809f12b0f5b4def7d0a6084f35b4af2f46f99b5c5512c01d0f18af635dc8
Instruction ID: dfff66fe54ab91475e216b71c25dbb9b01914e442130f89c8fb7600d12fcdf15
Opcode Fuzzy Hash: 55af809f12b0f5b4def7d0a6084f35b4af2f46f99b5c5512c01d0f18af635dc8
Instruction Fuzzy Hash: 1821C131618205AFDB12AFB8DCCDDAA77ECEF0A360B108125F914CB2A4D678DC41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 003B04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 003B04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003B052E

Strings

nul, xrefs: 003B0567

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a8cb1505afb66f3459e3b53a31169df96630cb746d4f220899ebeb8887aa996a
Instruction ID: 10b85625f86f8093413fd94a651ce83fdc0cdd945aec232a4422e16e73b9dd13
Opcode Fuzzy Hash: a8cb1505afb66f3459e3b53a31169df96630cb746d4f220899ebeb8887aa996a
Instruction Fuzzy Hash: C12182755043059FDF359F69DC04ADB77E8AF46728F204A1AFAA1D69E0D7709940CF20

Uniqueness

Uniqueness Score: -1.00%

Function 003B05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 003B05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003B0601

Strings

nul, xrefs: 003B0639

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 3391fbb6624849df9755bb5e1146b17b8739173672523da165c4cc4227184952
Instruction ID: f9139d0d7b550ce5ab4ac1c1abae55e8223e88684bfb1954419cfe71fc3f63a8
Opcode Fuzzy Hash: 3391fbb6624849df9755bb5e1146b17b8739173672523da165c4cc4227184952
Instruction Fuzzy Hash: 312171755003059BDB269F69DC04BDB77E8FF95728F200B1AEAA1E76E0D7709860CB10

Uniqueness

Uniqueness Score: -1.00%

Function 003D40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0034604C
Part of subcall function 0034600E: GetStockObject.GDI32(00000011), ref: 00346060
Part of subcall function 0034600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0034606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 003D4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 003D411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 003D412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 003D4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 003D4145

Strings

Msctls_Progress32, xrefs: 003D40E3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f776c028c16318129e44126109be1c8e82e238ae7867d10ee8b077f080a2943f
Instruction ID: 0420a046dd932928cd7a41d0c76fc612d69b4b1a01aef5f1926f0165f5e3ea0d
Opcode Fuzzy Hash: f776c028c16318129e44126109be1c8e82e238ae7867d10ee8b077f080a2943f
Instruction Fuzzy Hash: D41193B2150219BFEF119F64DC86EE77F6DEF08798F014111B718A6190C6769C21DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0037D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0037D7A3: _free.LIBCMT ref: 0037D7CC

_free.LIBCMT ref: 0037D82D

Part of subcall function 003729C8: HeapFree.KERNEL32(00000000,00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000), ref: 003729DE
Part of subcall function 003729C8: GetLastError.KERNEL32(00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000,00000000), ref: 003729F0

_free.LIBCMT ref: 0037D838
_free.LIBCMT ref: 0037D843
_free.LIBCMT ref: 0037D897
_free.LIBCMT ref: 0037D8A2
_free.LIBCMT ref: 0037D8AD
_free.LIBCMT ref: 0037D8B8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: b41c83cf2b6ba47429a9b127b81e53f1e1f9620842be642776a701f50eadfbca
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 4D114F71540B44AAD533BFB4CC87FCBBBEC6F42700F448825B29DAE092DB6AB5554650

Uniqueness

Uniqueness Score: -1.00%

Function 003ADA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 003ADA74
LoadStringW.USER32(00000000), ref: 003ADA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 003ADA91
LoadStringW.USER32(00000000), ref: 003ADA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003ADADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 003ADAB9

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 1e62b4e6748a42a094396466925bc91774cdad267da7f123731ebad38d95ef92
Instruction ID: a7d8ed84bbc967b904ff0dc387030d503feb8ccc0ae34fe1214f6a340e4e6a8a
Opcode Fuzzy Hash: 1e62b4e6748a42a094396466925bc91774cdad267da7f123731ebad38d95ef92
Instruction Fuzzy Hash: CB0186F69202197FE7129BA4ED89EEB336CE709301F401593B746E2041EA749E848F74

Uniqueness

Uniqueness Score: -1.00%

Function 003B096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0106C380,0106C380), ref: 003B097B
EnterCriticalSection.KERNEL32(0106C360,00000000), ref: 003B098D
TerminateThread.KERNEL32(?,000001F6), ref: 003B099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 003B09A9
CloseHandle.KERNEL32(?), ref: 003B09B8
InterlockedExchange.KERNEL32(0106C380,000001F6), ref: 003B09C8
LeaveCriticalSection.KERNEL32(0106C360), ref: 003B09CF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 83e13c41e838a67109e423156d8146e93c8d583f8f82a8c2ebe8c5abac7fc921
Instruction ID: 8ea2016c27f67fe092f9cdb14b641e1ee9c6108911fc97eca91db530fc37b894
Opcode Fuzzy Hash: 83e13c41e838a67109e423156d8146e93c8d583f8f82a8c2ebe8c5abac7fc921
Instruction Fuzzy Hash: 34F019324A3A13ABDB565BA4EE88BD6BB39BF01702F402526F202908A0C7749465CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00345D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00345D30
GetWindowRect.USER32(?,?), ref: 00345D71
ScreenToClient.USER32(?,?), ref: 00345D99
GetClientRect.USER32(?,?), ref: 00345ED7
GetWindowRect.USER32(?,?), ref: 00345EF8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 9fc380b76b0cf1318a14c038b99e3e0a528b56693acaf20dbd8f7e07dc445264
Instruction ID: 6dd916f61d753c9053202efae1b541617f47121210f727ef008dde100a81905b
Opcode Fuzzy Hash: 9fc380b76b0cf1318a14c038b99e3e0a528b56693acaf20dbd8f7e07dc445264
Instruction Fuzzy Hash: 57B18834A10B4ADBDB11DFA9C4807EEB7F5FF48310F14941AE8A9DB650DB34AA81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003701B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 003700BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003700D6
__allrem.LIBCMT ref: 003700ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0037010B
__allrem.LIBCMT ref: 00370122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00370140

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 66b5ad4d9aff639cc0a99b3314eb6e5fb518c6a056a4227cb41a5a4f52a170ba
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: D4811575A00706DFE736AE28DC41B6BB3A8AF41724F25C23AF514DA681E7B8D9008B50

Uniqueness

Uniqueness Score: -1.00%

Function 003C1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,003C101C,00000000,?,?,00000000), ref: 003C3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 003C1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 003C1DE1
WSAGetLastError.WSOCK32 ref: 003C1DF2
inet_ntoa.WSOCK32(?), ref: 003C1E8C
htons.WSOCK32(?,?,?,?,?), ref: 003C1EDB
_strlen.LIBCMT ref: 003C1F35

Part of subcall function 003A39E8: _strlen.LIBCMT ref: 003A39F2

Part of subcall function 00346D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0035CF58,?,?,?), ref: 00346DBA
Part of subcall function 00346D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0035CF58,?,?,?), ref: 00346DED

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 84e2f05922b7742da515f02a4fe1e24922b23471548d3bf3dd0cbbb5fce80473
Instruction ID: 8eb4b146bf0b9069f48cd59d6ce8115db2d0c6d95ce4af1c0083a210feadd35d
Opcode Fuzzy Hash: 84e2f05922b7742da515f02a4fe1e24922b23471548d3bf3dd0cbbb5fce80473
Instruction Fuzzy Hash: DEA17B71104340AFC316DF24C895F2AB7E5AF86318F548A4CF4569F2A2CB71ED46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003761FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,003682D9,003682D9,?,?,?,0037644F,00000001,00000001,8BE85006), ref: 00376258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0037644F,00000001,00000001,8BE85006,?,?,?), ref: 003762DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 003763D8
__freea.LIBCMT ref: 003763E5

Part of subcall function 00373820: RtlAllocateHeap.NTDLL(00000000,?,00411444,?,0035FDF5,?,?,0034A976,00000010,00411440,003413FC,?,003413C6,?,00341129), ref: 00373852

__freea.LIBCMT ref: 003763EE
__freea.LIBCMT ref: 00376413

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: fab2e98e60ab201a055af7d443c20d70391f5649aa40711342584979d691d9df
Instruction ID: dcab09dae16ebbab21ed7a7140c519513fdc4361f3f144d5130dbcf344802a2d
Opcode Fuzzy Hash: fab2e98e60ab201a055af7d443c20d70391f5649aa40711342584979d691d9df
Instruction Fuzzy Hash: D251E272600A16ABEB378F64CC92EAF77A9EF44710F168629FC09DA151DB38DC44D760

Uniqueness

Uniqueness Score: -1.00%

Function 003CBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CB6AE,?,?), ref: 003CC9B5
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CC9F1
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA68
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003CBD25
RegCloseKey.ADVAPI32(00000000), ref: 003CBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003CBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003CBDF3
RegCloseKey.ADVAPI32(?), ref: 003CBDFF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: d0f7f2fa6b1e4cec04e23f4e7d7394bb386f1410bb6f8f3bc3fdecf8b2b95997
Instruction ID: 82b5528549c7a132485e4085fb5343295369d1e9559e3084b5205e6d826eb65f
Opcode Fuzzy Hash: d0f7f2fa6b1e4cec04e23f4e7d7394bb386f1410bb6f8f3bc3fdecf8b2b95997
Instruction Fuzzy Hash: E7816E70118241AFD716DF24C886E2ABBE9FF84308F14855DF55A8F2A2DB31ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0039F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0039F7B9
SysAllocString.OLEAUT32(00000001), ref: 0039F860
VariantCopy.OLEAUT32(0039FA64,00000000), ref: 0039F889
VariantClear.OLEAUT32(0039FA64), ref: 0039F8AD
VariantCopy.OLEAUT32(0039FA64,00000000), ref: 0039F8B1
VariantClear.OLEAUT32(?), ref: 0039F8BB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 6cb2f2323670133e87bafb7f343ee8fa98bf38f253f5546e48df1ffe9e3b1982
Instruction ID: c2d4ed1c96ee9dcc1355c1a83659b73933fadd33c984a46b6a1b3b5946b3f6db
Opcode Fuzzy Hash: 6cb2f2323670133e87bafb7f343ee8fa98bf38f253f5546e48df1ffe9e3b1982
Instruction Fuzzy Hash: 5C51EE31610310BEDF62AB65D895B69B3E8EF45320F249467E806DF296DB70DC40CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 003B910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00347620: _wcslen.LIBCMT ref: 00347625

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 003B94E5
_wcslen.LIBCMT ref: 003B9506
_wcslen.LIBCMT ref: 003B952D
GetSaveFileNameW.COMDLG32(00000058), ref: 003B9585

Strings

X, xrefs: 003B9412

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: c6d5cd40c88b10fa6b74a2846e01498ccb4a5a4d5ec310fa2d30e782b485cc8d
Instruction ID: 4e19c9f721b7aaf864c6b9356d1a0da025a6586e83503b6f41f8eb6ae10997bc
Opcode Fuzzy Hash: c6d5cd40c88b10fa6b74a2846e01498ccb4a5a4d5ec310fa2d30e782b485cc8d
Instruction Fuzzy Hash: 06E194315043409FD726DF24C481BAAB7E4BF85314F15896EFA899F2A2DB31ED05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0035920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

BeginPaint.USER32(?,?,?), ref: 00359241
GetWindowRect.USER32(?,?), ref: 003592A5
ScreenToClient.USER32(?,?), ref: 003592C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 003592D3
EndPaint.USER32(?,?,?,?,?), ref: 00359321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 003971EA

Part of subcall function 00359339: BeginPath.GDI32(00000000), ref: 00359357

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 5913b0a8f0011c26ffd7fc7bf7f241a4ec28a223ed1ce5c9fd23fc07e9e2bed0
Instruction ID: 7253b7ac838c07249e542582d90fd910251d762c89b57a181d943f6bc1029396
Opcode Fuzzy Hash: 5913b0a8f0011c26ffd7fc7bf7f241a4ec28a223ed1ce5c9fd23fc07e9e2bed0
Instruction Fuzzy Hash: D841BD70115301EFDB12DF24DC85FBA7BA8EB59321F04466AFAA48B2F1C7309849DB61

Uniqueness

Uniqueness Score: -1.00%

Function 003B07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 003B080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 003B0847
EnterCriticalSection.KERNEL32(?), ref: 003B0863
LeaveCriticalSection.KERNEL32(?), ref: 003B08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 003B08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 003B0921

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 0bc3c57dd21aa4f690fe602327f2035ed60d5169478e8882b6537c8555ebc2a2
Instruction ID: 79bc93b43662c14fbda756742c95ee85fc7efa2c52cebb8c929a433758d4018a
Opcode Fuzzy Hash: 0bc3c57dd21aa4f690fe602327f2035ed60d5169478e8882b6537c8555ebc2a2
Instruction Fuzzy Hash: AE416A71910205EFDF1AAF54DC85AAAB7B8FF04304F1440A5ED00EE2A6D730DE64DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 003D81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0039F3AB,00000000,?,?,00000000,?,0039682C,00000004,00000000,00000000), ref: 003D824C
EnableWindow.USER32(?,00000000), ref: 003D8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 003D82D1
ShowWindow.USER32(?,00000004), ref: 003D82E5
EnableWindow.USER32(?,00000001), ref: 003D830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 003D832F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1c5b13f7a81e1e85568aadf4017572bd866a3205a3b3ac93247ff90d5b71f418
Instruction ID: ea7b7205078ccd0a288153d1949eb664ef2bf372a20c4f6b0eb9fda88f363569
Opcode Fuzzy Hash: 1c5b13f7a81e1e85568aadf4017572bd866a3205a3b3ac93247ff90d5b71f418
Instruction Fuzzy Hash: 5841C379611640AFDB13CF25EC99BE47BF0BB0A714F1952AAE6184B372CB31B845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 003A4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 003A4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 003A4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 003A4CEA
_wcslen.LIBCMT ref: 003A4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 003A4D10
_wcsstr.LIBVCRUNTIME ref: 003A4D1A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a4968f2e52cfecc1a72e4d6c5c19361236fb08905fa22fe7f19ecdebda9414ad
Instruction ID: 402717229a7cd7305160df56f2e7ea2c73cd44284f0a4768c2cafde4cbbf5924
Opcode Fuzzy Hash: a4968f2e52cfecc1a72e4d6c5c19361236fb08905fa22fe7f19ecdebda9414ad
Instruction Fuzzy Hash: 2F21F9716152017BEB175B39AC4AE7BBB9CDF86750F15803AF809CE192EFA1DC00D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 003B581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00343AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00343A97,?,?,00342E7F,?,?,?,00000000), ref: 00343AC2

_wcslen.LIBCMT ref: 003B587B
CoInitialize.OLE32(00000000), ref: 003B5995
CoCreateInstance.OLE32(003DFCF8,00000000,00000001,003DFB68,?), ref: 003B59AE
CoUninitialize.OLE32 ref: 003B59CC

Strings

.lnk, xrefs: 003B5876, 003B58C1, 003B5985

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 20adf1783c094766da9dd1c471228a622518942bd0da01aa2c1bf0ebf15f2614
Instruction ID: 5dea710432acad5bb00ff658d4f75fa68fe8c16355a0bcf1df768481ac0772bd
Opcode Fuzzy Hash: 20adf1783c094766da9dd1c471228a622518942bd0da01aa2c1bf0ebf15f2614
Instruction Fuzzy Hash: 8FD18371A087019FC706DF24C480A6ABBE5FF89718F11885DF98A9B361DB31ED05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003A175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003A0FCA
Part of subcall function 003A0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003A0FD6
Part of subcall function 003A0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003A0FE5
Part of subcall function 003A0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003A0FEC
Part of subcall function 003A0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003A1002

GetLengthSid.ADVAPI32(?,00000000,003A1335), ref: 003A17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 003A17BA
HeapAlloc.KERNEL32(00000000), ref: 003A17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 003A17DA
GetProcessHeap.KERNEL32(00000000,00000000,003A1335), ref: 003A17EE
HeapFree.KERNEL32(00000000), ref: 003A17F5

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: d8f30255b438925e4ec8687a5360531d59296c555023ef7cf8a6fda1e9138ac0
Instruction ID: 8537bbce19202fd854eac356b7c7b857d6e9174cc90a7577143c2331f4505670
Opcode Fuzzy Hash: d8f30255b438925e4ec8687a5360531d59296c555023ef7cf8a6fda1e9138ac0
Instruction Fuzzy Hash: 1011BB32621216FFDB229FA4DC49FAE7BADEB42355F105019F481A7290C736A940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 003A14FF
OpenProcessToken.ADVAPI32(00000000), ref: 003A1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 003A1515
CloseHandle.KERNEL32(00000004), ref: 003A1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003A154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 003A1563

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 57aabb9fdfd9ee17ef63620bbfe9fca228c3f1df44397ed8b800dbbf31dafdf7
Instruction ID: 0299545a56ac6c06a0cbbc12c257ef2bc566b7b7bee8ee9a0654b4fa007e21cb
Opcode Fuzzy Hash: 57aabb9fdfd9ee17ef63620bbfe9fca228c3f1df44397ed8b800dbbf31dafdf7
Instruction Fuzzy Hash: E711267251120AAFDF128FA8ED49BDE7BADEF4A744F054125FA05A20A0C375CE60DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00363382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00363379,00362FE5), ref: 00363390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0036339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003633B7
SetLastError.KERNEL32(00000000,?,00363379,00362FE5), ref: 00363409

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9395268270f19ee582569738e57e297f9c22f37949b79b2bfcdb6faca69dc214
Instruction ID: d27ad6bfe0b8a7302133d76e1519cfdb64bc9971ae80f11773984a2cffd54b30
Opcode Fuzzy Hash: 9395268270f19ee582569738e57e297f9c22f37949b79b2bfcdb6faca69dc214
Instruction Fuzzy Hash: 3B012436609311BEEB2727B5BDC55672AA8EB05379730833AF410992F8EF214D11D548

Uniqueness

Uniqueness Score: -1.00%

Function 00372D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00375686,00383CD6,?,00000000,?,00375B6A,?,?,?,?,?,0036E6D1,?,00408A48), ref: 00372D78
_free.LIBCMT ref: 00372DAB
_free.LIBCMT ref: 00372DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0036E6D1,?,00408A48,00000010,00344F4A,?,?,00000000,00383CD6), ref: 00372DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0036E6D1,?,00408A48,00000010,00344F4A,?,?,00000000,00383CD6), ref: 00372DEC
_abort.LIBCMT ref: 00372DF2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: e289fc66e492274aad616838247ad4cd8f27cd41d5785a4b6ec2da3fad36b511
Instruction ID: 672df9f7ec762b14c5a18646f516866b9645fc7f449dbed8e57394dcca39993a
Opcode Fuzzy Hash: e289fc66e492274aad616838247ad4cd8f27cd41d5785a4b6ec2da3fad36b511
Instruction Fuzzy Hash: 60F0C83594560177C7332778BC06E5B266DAFC27A1F26C51DF83CAA1D6EF3C88419560

Uniqueness

Uniqueness Score: -1.00%

Function 003D8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00359639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00359693
Part of subcall function 00359639: SelectObject.GDI32(?,00000000), ref: 003596A2
Part of subcall function 00359639: BeginPath.GDI32(?), ref: 003596B9
Part of subcall function 00359639: SelectObject.GDI32(?,00000000), ref: 003596E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 003D8A4E
LineTo.GDI32(?,00000003,00000000), ref: 003D8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 003D8A70
LineTo.GDI32(?,00000000,00000003), ref: 003D8A80
EndPath.GDI32(?), ref: 003D8A90
StrokePath.GDI32(?), ref: 003D8AA0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: a9429a4173c02161bb885127caa6f4fc8aee0e680d89cdbc0596de50c48c944d
Instruction ID: bd2b9377e28705cb67c2dc3c01aa6c1c4aeb2f42bfdae1a0935e948aa624673d
Opcode Fuzzy Hash: a9429a4173c02161bb885127caa6f4fc8aee0e680d89cdbc0596de50c48c944d
Instruction Fuzzy Hash: 4C110576011149FFEF129F90EC88EEA7F6CEB08350F008022BA199A1A1C771AD55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003A51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003A5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 003A5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003A5230
ReleaseDC.USER32(00000000,00000000), ref: 003A5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 003A524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 003A5261

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 9776c559a17087fb628bd802a4a2092d4dd414a4fd48821aa258c837d593aee5
Instruction ID: 89f95d1b40aca86a16dfec3984ebbe57581d2ed480f114732476669407decc3e
Opcode Fuzzy Hash: 9776c559a17087fb628bd802a4a2092d4dd414a4fd48821aa258c837d593aee5
Instruction Fuzzy Hash: F8018F75E11719BBEB119BA59C49B4EBFB8EF48351F084066FA04AB280D670D800CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00341BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00341BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00341BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00341C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00341C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00341C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00341C22

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: b93b131f846331f39d19f2a8cc313dc89475f99894abe6915526237d77910694
Instruction ID: eea22b97b11070f2a7b8cb58b575ca73e755f3abd99df3d78a05cec913827947
Opcode Fuzzy Hash: b93b131f846331f39d19f2a8cc313dc89475f99894abe6915526237d77910694
Instruction Fuzzy Hash: A00167B0902B5ABDE3008F6A8C85B52FFA8FF19354F04411BA15C4BA42C7F5A864CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 003AEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003AEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 003AEB46
GetWindowThreadProcessId.USER32(?,?), ref: 003AEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003AEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003AEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003AEB75

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 96d3c222c710a6b3e6220ee2452911d479b72f4539065185b12cf6df95df1faa
Instruction ID: bbd0734d722502127f1e79e765a8a912bc0603e2d6f942a95910cce6720dc634
Opcode Fuzzy Hash: 96d3c222c710a6b3e6220ee2452911d479b72f4539065185b12cf6df95df1faa
Instruction Fuzzy Hash: 1FF05472162169BBEB225B52AC0EEEF7F7CEFCBB11F00115AF601D1191D7A05A01C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00397439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00397452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00397469
GetWindowDC.USER32(?), ref: 00397475
GetPixel.GDI32(00000000,?,?), ref: 00397484
ReleaseDC.USER32(?,00000000), ref: 00397496
GetSysColor.USER32(00000005), ref: 003974B0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: b026192c5929855a858889e43fb37d95949b0734b8e72424d399aab0c2d72ba9
Instruction ID: 85a56742d35c5137d6b8e51b0c56c20b78c8757c9b2b382cfb35e0ae15082814
Opcode Fuzzy Hash: b026192c5929855a858889e43fb37d95949b0734b8e72424d399aab0c2d72ba9
Instruction Fuzzy Hash: 25018B31425216EFEB125FA5EC08BEEBBBAFB04311F151161F925A21A1CB311E41EB10

Uniqueness

Uniqueness Score: -1.00%

Function 003A1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 003A187F
UnloadUserProfile.USERENV(?,?), ref: 003A188B
CloseHandle.KERNEL32(?), ref: 003A1894
CloseHandle.KERNEL32(?), ref: 003A189C
GetProcessHeap.KERNEL32(00000000,?), ref: 003A18A5
HeapFree.KERNEL32(00000000), ref: 003A18AC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 8796903c6fedf3bc07736031085206b06697f79302c557395d77c2252bef6796
Instruction ID: f183b75b134d702698441219ad4deb8b7366b7e4813033ca786c67f4a08af5b2
Opcode Fuzzy Hash: 8796903c6fedf3bc07736031085206b06697f79302c557395d77c2252bef6796
Instruction Fuzzy Hash: BAE0C236065112BBDB026BA1FD0C90ABB2DFB49B22B109222F225810B0CB329420DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0034BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0034BEB3

Strings

D%A, xrefs: 0034BCA2
D%AD%A, xrefs: 0034BCA5
D%A, xrefs: 0034BE9A
D%A, xrefs: 0034BDED, 0034BD91, 0034BD1B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%A$D%A$D%A$D%AD%A
API String ID: 1385522511-1146282348
Opcode ID: ea829e7d08dabdf15c73ce8b1b7db0b19beaf20813a146e2e1c520b4a02a249f
Instruction ID: 566d66a17263266b64db1723b3b27521f8a2726e04221c1127524cab3ab015b8
Opcode Fuzzy Hash: ea829e7d08dabdf15c73ce8b1b7db0b19beaf20813a146e2e1c520b4a02a249f
Instruction Fuzzy Hash: 4F914775A0021ADFCB19CF68C0D06AAFBF6FF59310B25816AD941AB350E771ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003C7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00360242: EnterCriticalSection.KERNEL32(0041070C,00411884,?,?,0035198B,00412518,?,?,?,003412F9,00000000), ref: 0036024D
Part of subcall function 00360242: LeaveCriticalSection.KERNEL32(0041070C,?,0035198B,00412518,?,?,?,003412F9,00000000), ref: 0036028A

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003600A3: __onexit.LIBCMT ref: 003600A9

__Init_thread_footer.LIBCMT ref: 003C7BFB

Part of subcall function 003601F8: EnterCriticalSection.KERNEL32(0041070C,?,?,00358747,00412514), ref: 00360202
Part of subcall function 003601F8: LeaveCriticalSection.KERNEL32(0041070C,?,00358747,00412514), ref: 00360235

Strings

5, xrefs: 003C7C78
+T9, xrefs: 003C7E2E
G, xrefs: 003C7C7F
Variable must be of type 'Object'., xrefs: 003C7C3A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T9$5$G$Variable must be of type 'Object'.
API String ID: 535116098-3698753954
Opcode ID: 390518e39a2ff410df9c8d082bbe2caaf5fd71eca85033a5839d579fc9cac08b
Instruction ID: 87b5666372d13839ec7df0fecde473f3a963c86268a2f79de92e644a5b67095c
Opcode Fuzzy Hash: 390518e39a2ff410df9c8d082bbe2caaf5fd71eca85033a5839d579fc9cac08b
Instruction Fuzzy Hash: 5B917A74A04209AFCB16EF94D895EADBBB5FF49300F10805DF806AB292DB71AE45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003AC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00347620: _wcslen.LIBCMT ref: 00347625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003AC6EE
_wcslen.LIBCMT ref: 003AC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003AC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 003AC7CA

Strings

0, xrefs: 003AC6AF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 7c84cb713e9cd5ba76eba40f3fa6b2c4d9728cdb232a17d861b1c80918a09c94
Instruction ID: c885fed532dd283669f84089d6bf2bc40d2c58d87a1d80cb202509e7c12be68d
Opcode Fuzzy Hash: 7c84cb713e9cd5ba76eba40f3fa6b2c4d9728cdb232a17d861b1c80918a09c94
Instruction Fuzzy Hash: F051FF716243009FD713DF28C885BABB7E8EF4A310F042A29F9A1D71A0DB65D804CF56

Uniqueness

Uniqueness Score: -1.00%

Function 003A719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 003A7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 003A723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 003A724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003A72CF

Strings

DllGetClassObject, xrefs: 003A7242

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 1af0e092d79911b9c82e4f7c63cdb6a50f4f70ce0603879d148260e33243ce4b
Instruction ID: f8888698807607cb02c74caf949aa6a2803031eef8509c7a1aa5f5d1e754cacd
Opcode Fuzzy Hash: 1af0e092d79911b9c82e4f7c63cdb6a50f4f70ce0603879d148260e33243ce4b
Instruction Fuzzy Hash: 0A418E71A04204EFDB16CF54CCC4B9A7BA9EF4A310F1584AABD059F20AD7B5D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003D3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003D3E35
IsMenu.USER32(?), ref: 003D3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003D3E92
DrawMenuBar.USER32 ref: 003D3EA5

Strings

0, xrefs: 003D3D89

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 93dd3290fa4d76db1d8158e297b9ab19a8999d2ccb6ab016deeb0fad198e235b
Instruction ID: 31091285d27ace7625e810515e868869be9bada30da726fcc49750f1e33ccfb1
Opcode Fuzzy Hash: 93dd3290fa4d76db1d8158e297b9ab19a8999d2ccb6ab016deeb0fad198e235b
Instruction Fuzzy Hash: D5414977A11209AFDB11DF50E884AEABBBAFF49350F05412AF9159B390D730AE44CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003A1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 003A3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 003A1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 003A1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 003A1EA9

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

Strings

ListBox, xrefs: 003A1E25
ComboBox, xrefs: 003A1DF0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 80daa1f794d4e95e7601cc5239cc9ee4e997c0a97c2ff04ee0e4a5f59e9d49f2
Instruction ID: 0cb7b409a288631a0467b3caf570eb280e0055c8093c82c23399dde37692c01c
Opcode Fuzzy Hash: 80daa1f794d4e95e7601cc5239cc9ee4e997c0a97c2ff04ee0e4a5f59e9d49f2
Instruction Fuzzy Hash: 3D212771A00104BEDB16AB64DC46DFFB7BDDF46360F14412AF825AB1E1DB345D09C620

Uniqueness

Uniqueness Score: -1.00%

Function 003CC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003CC9F1
_wcslen.LIBCMT ref: 003CCA68
_wcslen.LIBCMT ref: 003CCA9E
_wcslen.LIBCMT ref: 003CCAF9
_wcslen.LIBCMT ref: 003CCB2F
_wcslen.LIBCMT ref: 003CCB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 003CCA62, 003CCA67
HKLM, xrefs: 003CCA98, 003CCA9D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 4bd2b689bbbafa1e208816ce7eeacf6678ddb9e38f36df463c2ebcd48ad1e758
Instruction ID: 48fea151a7931fa22220e7ceaf75b2094c617204be21c78bc82db8e2a865b7de
Opcode Fuzzy Hash: 4bd2b689bbbafa1e208816ce7eeacf6678ddb9e38f36df463c2ebcd48ad1e758
Instruction Fuzzy Hash: 38310937A205694BCB22EF2C8844BBF33915B61750F17902EE849EF245E771DD4193A0

Uniqueness

Uniqueness Score: -1.00%

Function 003D2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 003D2F8D
LoadLibraryW.KERNEL32(?), ref: 003D2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 003D2FA9
DestroyWindow.USER32(?), ref: 003D2FB1

Strings

SysAnimate32, xrefs: 003D2F68

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: b0ae96bda4742fb8dc257631831f2a44e084e5079ba6b64a764aff0d83382658
Instruction ID: 1204b45bdbaf80d59b505e9d4f5a19b648668cc9f500efa596cfb5ba2ff5e2bc
Opcode Fuzzy Hash: b0ae96bda4742fb8dc257631831f2a44e084e5079ba6b64a764aff0d83382658
Instruction Fuzzy Hash: 5D21DC72214205ABEB124F64EC80EBB77BDEF69324F114A2AFA50D62A0C771DC41A760

Uniqueness

Uniqueness Score: -1.00%

Function 00364D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00364D1E,003728E9,?,00364CBE,003728E9,004088B8,0000000C,00364E15,003728E9,00000002), ref: 00364D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00364DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00364D1E,003728E9,?,00364CBE,003728E9,004088B8,0000000C,00364E15,003728E9,00000002,00000000), ref: 00364DC3

Strings

mscoree.dll, xrefs: 00364D86
CorExitProcess, xrefs: 00364D98

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e923a7022bcc5eaf846e587f51b6106581b35a54e81ddc3bb33d9896d66c8738
Instruction ID: 755168b9dec95b26ed964a663d0c374cad51b572927435a4b17cccbc8b597e41
Opcode Fuzzy Hash: e923a7022bcc5eaf846e587f51b6106581b35a54e81ddc3bb33d9896d66c8738
Instruction Fuzzy Hash: 97F0AF74A21219FBDB169F90EC49BEEBBB8EF44751F0042A5F805A22A0CF705980CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00344E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00344EDD,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00344EAE
FreeLibrary.KERNEL32(00000000,?,?,00344EDD,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00344EA8
kernel32.dll, xrefs: 00344E94

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: c75719e2882971a307ad11e9b9fa64405ae54d6aa44927a1fc9728cbc027faa0
Instruction ID: c9089dcc342479f80d427a8c5c3bd7efab8167f3391f02241840ea88d9d42e1c
Opcode Fuzzy Hash: c75719e2882971a307ad11e9b9fa64405ae54d6aa44927a1fc9728cbc027faa0
Instruction Fuzzy Hash: 86E08636A235339BD2231B257C1CB5BA69CAF81B62B060127FC01E6250DF64DD41C0A0

Uniqueness

Uniqueness Score: -1.00%

Function 00344E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00383CDE,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00344E74
FreeLibrary.KERNEL32(00000000,?,?,00383CDE,?,00411418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00344E87

Strings

kernel32.dll, xrefs: 00344E5B
Wow64RevertWow64FsRedirection, xrefs: 00344E6E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 74c3d586680a73727ee7c5891ca0fcc124e427cb232f3dfaf7c4d96369ce1e7d
Instruction ID: d9923990952d8f0d0a3cdf9dbdaff688784babdbf909362a69c7acdca28fff6b
Opcode Fuzzy Hash: 74c3d586680a73727ee7c5891ca0fcc124e427cb232f3dfaf7c4d96369ce1e7d
Instruction Fuzzy Hash: 3AD0C232533633678A231B247C08F8BAB5CAF81B113060233F801E7150CF20CD41C1D0

Uniqueness

Uniqueness Score: -1.00%

Function 003B2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003B2C05
DeleteFileW.KERNEL32(?), ref: 003B2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 003B2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003B2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003B2CC0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: f0fdc768b4a61527d148f9a500c855f2cd08feb932f18d32e47e7ef38935b4bb
Instruction ID: 244ad641ea1d72ea73a836e6fc0f1a5167e96e124f91ae961031bfc9af8fe904
Opcode Fuzzy Hash: f0fdc768b4a61527d148f9a500c855f2cd08feb932f18d32e47e7ef38935b4bb
Instruction Fuzzy Hash: D7B16F72D00119ABDF12DBA4CC85EDFBBBDEF49344F1041A6F609EA155EB309A448F61

Uniqueness

Uniqueness Score: -1.00%

Function 003CA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 003CA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 003CA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 003CA468
CloseHandle.KERNEL32(?), ref: 003CA63D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 6b46d25d632cb4bcb34260bc00302daa999264ba73b61791886576d4976575d8
Instruction ID: 3bc4c66edd1ec9d56738994ded4b070b29edcddf142bd679d7a50596ac95f1fb
Opcode Fuzzy Hash: 6b46d25d632cb4bcb34260bc00302daa999264ba73b61791886576d4976575d8
Instruction Fuzzy Hash: 06A1ACB16047009FD721DF24C886F2AB7E5AB84714F14885DF99ADF392DBB1EC058B82

Uniqueness

Uniqueness Score: -1.00%

Function 003AE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003ADDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003ACF22,?), ref: 003ADDFD

Part of subcall function 003ADDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003ACF22,?), ref: 003ADE16

Part of subcall function 003AE199: GetFileAttributesW.KERNEL32(?,003ACF95), ref: 003AE19A

lstrcmpiW.KERNEL32(?,?), ref: 003AE473
MoveFileW.KERNEL32(?,?), ref: 003AE4AC
_wcslen.LIBCMT ref: 003AE5EB
_wcslen.LIBCMT ref: 003AE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 003AE650

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 33d367a8e98e63224c48abb03a0ef96c22431db32daed2f2ac11814aca321b45
Instruction ID: 052bfeec8c07b91952901cdf9b693cb067fa384383a90f04a2c477073c172175
Opcode Fuzzy Hash: 33d367a8e98e63224c48abb03a0ef96c22431db32daed2f2ac11814aca321b45
Instruction Fuzzy Hash: EC5153B24083455BC726DB94DC81ADBB3ECEF95340F00492EF589D7151EF74A6888766

Uniqueness

Uniqueness Score: -1.00%

Function 003CB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CB6AE,?,?), ref: 003CC9B5
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CC9F1
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA68
Part of subcall function 003CC998: _wcslen.LIBCMT ref: 003CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003CBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003CBB63
RegCloseKey.ADVAPI32(?,?), ref: 003CBBA6
RegCloseKey.ADVAPI32(00000000), ref: 003CBBB3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6b7fe306f09948ec59deafd867aa344c5f2fdb39b1ce91cc7055820662a2a0f2
Instruction ID: d1e5f4008f6f5f75358dd98994d11e1fdf91b4a8c4c65a68267243b804f2957e
Opcode Fuzzy Hash: 6b7fe306f09948ec59deafd867aa344c5f2fdb39b1ce91cc7055820662a2a0f2
Instruction Fuzzy Hash: 45617D31218241AFD716DF14C491F2ABBE9FF84308F15859DF4998B2A2DB31ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003A8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003A8BCD
VariantClear.OLEAUT32 ref: 003A8C3E
VariantClear.OLEAUT32 ref: 003A8C9D
VariantClear.OLEAUT32(?), ref: 003A8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 003A8D3B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: e8810ca52a883aa645fa508903f7040e828dd7292cbf13d7f94e0d7d848d30fe
Instruction ID: c642d6c8df08647f91636ac3bc453c9dbd3a61272b9cabf5813828cadb2257ac
Opcode Fuzzy Hash: e8810ca52a883aa645fa508903f7040e828dd7292cbf13d7f94e0d7d848d30fe
Instruction Fuzzy Hash: 1D5189B1A1021AEFCB15CF28C884AAAB7F8FF89310F118559E905DB350E730E911CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003B8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 003B8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 003B8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 003B8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 003B8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 003B8C5F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: c31dfccd89b76609b51c97bd4b6c58c8c1b6a092729852f65ff0f971bec9841e
Instruction ID: 871aef33969ba5028427880474fe9c7bd9924de20112f325edc27def20e954b4
Opcode Fuzzy Hash: c31dfccd89b76609b51c97bd4b6c58c8c1b6a092729852f65ff0f971bec9841e
Instruction Fuzzy Hash: B0513875A002159FCB02DF64C881AAABBF5FF49314F088499E949AF362CB35FD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003C8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 003C8F40
GetProcAddress.KERNEL32(00000000,?), ref: 003C8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 003C8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 003C9032
FreeLibrary.KERNEL32(00000000), ref: 003C9052

Part of subcall function 0035F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,003B1043,?,753CE610), ref: 0035F6E6
Part of subcall function 0035F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0039FA64,00000000,00000000,?,?,003B1043,?,753CE610,?,0039FA64), ref: 0035F70D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 084f3f4fa330e1e07248d5f09e51757ae90e93f9d4e4ca231e83e2de5e753be6
Instruction ID: 823b57c082ade9a50bdf15298143962558160e0b42892748fff06d591e8f819b
Opcode Fuzzy Hash: 084f3f4fa330e1e07248d5f09e51757ae90e93f9d4e4ca231e83e2de5e753be6
Instruction Fuzzy Hash: 575106356052159FCB12DF58C484EA9BBF1FF49314B0580A9E80A9F762DB31EE86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 003D6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 003D6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 003D6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,003BAB79,00000000,00000000), ref: 003D6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 003D6CC7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 964c04a31c3b73da4d696087430595f68c68d4ef17a8c18cc3f48e2f55e95cee
Instruction ID: ea6a25d6c7b9c6eff27dc3dfcb828bff6735194c26f892e75b8bbe3693d346a4
Opcode Fuzzy Hash: 964c04a31c3b73da4d696087430595f68c68d4ef17a8c18cc3f48e2f55e95cee
Instruction Fuzzy Hash: E5411B76620104AFD726CF28EC56FB97BA9EB09350F16022AFD65A73E0C371ED50CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00372051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003720C3
_free.LIBCMT ref: 003720E3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b53a8cfc64f6dbadcb8e0132192248e3adde4c3f2463174b157fbe3f5c859833
Instruction ID: ffb19e77f6c972824176164c6670aa8cbd6944a5e638c828970b43028600cec5
Opcode Fuzzy Hash: b53a8cfc64f6dbadcb8e0132192248e3adde4c3f2463174b157fbe3f5c859833
Instruction Fuzzy Hash: 1541D432A002009FCB35DF78C981A5EB7F5EF89314F568568EA19EB351D735AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0035912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00359141
ScreenToClient.USER32(00000000,?), ref: 0035915E
GetAsyncKeyState.USER32(00000001), ref: 00359183
GetAsyncKeyState.USER32(00000002), ref: 0035919D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6e224512655a785aca29200deb86b15512ccbfaf6fd2b620c4d2a0e7f998acb2
Instruction ID: 0a20e314c62b6e0da46b26fad7b442d6773573c5b8aa83ff108c29412262e04c
Opcode Fuzzy Hash: 6e224512655a785aca29200deb86b15512ccbfaf6fd2b620c4d2a0e7f998acb2
Instruction Fuzzy Hash: EA417F71A1861BFBDF169F64D844BEEB774FB05321F218216E825A72E0C7306E54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003B3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 003B38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 003B3922
TranslateMessage.USER32(?), ref: 003B394B
DispatchMessageW.USER32(?), ref: 003B3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003B3966

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 7e1bda5f05f02abf34a603c348887dad2b429321db245555a11fc8fd0ce24c64
Instruction ID: 181e520b6dc1fe17860834c948f3f835bee3584293798a6e89e42468770fb4bf
Opcode Fuzzy Hash: 7e1bda5f05f02abf34a603c348887dad2b429321db245555a11fc8fd0ce24c64
Instruction Fuzzy Hash: DE31B770914366AEEB37CB359848BF637A8EB05308F05456DE662C29B0E7F4A685CB11

Uniqueness

Uniqueness Score: -1.00%

Function 003BCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 003BCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 003BCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,003BC21E,00000000), ref: 003BCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,003BC21E,00000000), ref: 003BCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,003BC21E,00000000), ref: 003BCFF2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 373b4d951a4994d381342b533d05805cc718db29888f7366f62fc82ba959d001
Instruction ID: 2efe82b2deffca89ef12fe3622e3fff390ac11a393a5e06f306c4b69716af7f9
Opcode Fuzzy Hash: 373b4d951a4994d381342b533d05805cc718db29888f7366f62fc82ba959d001
Instruction Fuzzy Hash: DD317F71620206AFDB32DFA5D8849BBBBFDEB04319B10546EF606D6911D730ED40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003A1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 003A19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 003A19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 003A19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 003A19E2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: e1feb6d9f60e02cbe592fbeb2236fee61126c5a8b3071f37586afb767622aaaa
Instruction ID: 16b4be065bfdcdbb51c5bf31b85ce780d0ac202ed00218b41056775402650218
Opcode Fuzzy Hash: e1feb6d9f60e02cbe592fbeb2236fee61126c5a8b3071f37586afb767622aaaa
Instruction Fuzzy Hash: 4831C072A10219EFCB01CFA8DD99ADF7BB9EB05315F104229F921AB2D1C7709944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 003D5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 003D579D
_wcslen.LIBCMT ref: 003D57AF
_wcslen.LIBCMT ref: 003D57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 003D5816

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: fd5490411688f97d25f81fac7b87c68767adc3521442d6428ba40f25b142747c
Instruction ID: fd0ff94b2a3e426ce0d096311b812a0bf16b789f56de1a63a419039e85f57fd3
Opcode Fuzzy Hash: fd5490411688f97d25f81fac7b87c68767adc3521442d6428ba40f25b142747c
Instruction Fuzzy Hash: AF218572904618DADB229F65EC85AEEB7BCFF04724F108217E929EA280D7708985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003C0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003C0951
GetForegroundWindow.USER32 ref: 003C0968
GetDC.USER32(00000000), ref: 003C09A4
GetPixel.GDI32(00000000,?,00000003), ref: 003C09B0
ReleaseDC.USER32(00000000,00000003), ref: 003C09E8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 915ce84f33d2b6b763d95abffa561e00a57edb40a6a97809be5e7d7b0c7b9310
Instruction ID: 60054b874b6c6780a630244d83aa190e72b27a4776ee4b85013c37069250a0ab
Opcode Fuzzy Hash: 915ce84f33d2b6b763d95abffa561e00a57edb40a6a97809be5e7d7b0c7b9310
Instruction Fuzzy Hash: 69216D35A11214AFD705EF69D884AAEBBF9EF48700F04806DE84ADB762CB30EC04CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0037CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0037CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0037CDE9

Part of subcall function 00373820: RtlAllocateHeap.NTDLL(00000000,?,00411444,?,0035FDF5,?,?,0034A976,00000010,00411440,003413FC,?,003413C6,?,00341129), ref: 00373852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0037CE0F
_free.LIBCMT ref: 0037CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0037CE31

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 67d09e84959f00226970bdb8111a17b6c1744a0ca1b4a149b384ed7bd2871d83
Instruction ID: f29744f154021542fcdb9da1f8b631b0c8cf68a2d723ce0f351427088e73752b
Opcode Fuzzy Hash: 67d09e84959f00226970bdb8111a17b6c1744a0ca1b4a149b384ed7bd2871d83
Instruction Fuzzy Hash: C00128726226113F673316B66C48C3B6A6CEFC7BA2315912EF908C7500DA288D01C1B0

Uniqueness

Uniqueness Score: -1.00%

Function 00359639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00359693
SelectObject.GDI32(?,00000000), ref: 003596A2
BeginPath.GDI32(?), ref: 003596B9
SelectObject.GDI32(?,00000000), ref: 003596E2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7da836792fa8e91c508f1fef944a941041a8776f3d35b574ba95dfa7b7ac9dfb
Instruction ID: 0e582a41aa1bc799a89d7c8194391772b88deb8b25df5c10a7344294aeb808e8
Opcode Fuzzy Hash: 7da836792fa8e91c508f1fef944a941041a8776f3d35b574ba95dfa7b7ac9dfb
Instruction Fuzzy Hash: FB21AAB0822306DFDB129F14EC15BE97B79BB00326F118227F920961F0D3749859CF98

Uniqueness

Uniqueness Score: -1.00%

Function 003A5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 003A5726
_memcmp.LIBVCRUNTIME ref: 003A5744
_memcmp.LIBVCRUNTIME ref: 003A5757
_memcmp.LIBVCRUNTIME ref: 003A576F
_memcmp.LIBVCRUNTIME ref: 003A5787

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 912abbd370e8362ff841575d0eab15afcf96be0a40850f3bea8f060ca524058f
Instruction ID: a8bb463a3b7bbaf0d3c4c04af96ce478c01fd663037a453c348691be9cc1da61
Opcode Fuzzy Hash: 912abbd370e8362ff841575d0eab15afcf96be0a40850f3bea8f060ca524058f
Instruction Fuzzy Hash: EC0196A6641A15BED21A56109D82EFA635CDB223A4B148421FD16AF741F762ED1082A0

Uniqueness

Uniqueness Score: -1.00%

Function 00372DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0036F2DE,00373863,00411444,?,0035FDF5,?,?,0034A976,00000010,00411440,003413FC,?,003413C6), ref: 00372DFD
_free.LIBCMT ref: 00372E32
_free.LIBCMT ref: 00372E59
SetLastError.KERNEL32(00000000,00341129), ref: 00372E66
SetLastError.KERNEL32(00000000,00341129), ref: 00372E6F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 18bac245782dc18d2e3455e659e57cf1a0a3563955e28596311a28d16677818e
Instruction ID: 162e19351e293832f00eb6afb50ce9a2e480fb15d9cee70806a4dec96f4ff3cb
Opcode Fuzzy Hash: 18bac245782dc18d2e3455e659e57cf1a0a3563955e28596311a28d16677818e
Instruction Fuzzy Hash: 4D01283664560177C73327347C85E2B265DABC63B1F26C529F82DA6AD3EF7C8C418420

Uniqueness

Uniqueness Score: -1.00%

Function 003A000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?,?,003A035E), ref: 003A002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?), ref: 003A0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?), ref: 003A0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?), ref: 003A0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0039FF41,80070057,?,?), ref: 003A0070

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 25b1e54a7d46763ae8b545b844843cde855d7d6afeca7bdfaa266df5c4fc95d8
Instruction ID: 90317e5a62cc6bb6212c69bb9f08e7546f8d13427e893557e718bcacf362d6fc
Opcode Fuzzy Hash: 25b1e54a7d46763ae8b545b844843cde855d7d6afeca7bdfaa266df5c4fc95d8
Instruction Fuzzy Hash: BA01DB72621205BFDB168F68EC04FAA7BAEEB49392F104125F905D2210E774CD00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003AE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 003AE997
QueryPerformanceFrequency.KERNEL32(?), ref: 003AE9A5
Sleep.KERNEL32(00000000), ref: 003AE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 003AE9B7
Sleep.KERNEL32 ref: 003AE9F3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d89342ee99e18af9bf9620b738b52478bc15c93ffef2242cd581c38f3b7da4ac
Instruction ID: ad042039c8d567658c23447a5527800d822bd01b772f34a40e5cdfdbf22d31df
Opcode Fuzzy Hash: d89342ee99e18af9bf9620b738b52478bc15c93ffef2242cd581c38f3b7da4ac
Instruction Fuzzy Hash: 3F012D31C1162ADBCF02AFE5EC59AEEBB7CFF0A701F01055AE502B2141CB389555C761

Uniqueness

Uniqueness Score: -1.00%

Function 003A10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 003A1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,003A0B9B,?,?,?), ref: 003A1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 003A114D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 00bf7259f47eb065323ae98ceedbebe7c1a0581e2a18df4557ae1fd4e962250e
Instruction ID: 91f4972fb37aa93431a65efe0c88789d1ecc9c12ffe183106b0cf49d761af514
Opcode Fuzzy Hash: 00bf7259f47eb065323ae98ceedbebe7c1a0581e2a18df4557ae1fd4e962250e
Instruction Fuzzy Hash: D3016D75111216BFDB124F64EC49A6A3B6EEF86364F110415FA41C3350DA31DC00DA60

Uniqueness

Uniqueness Score: -1.00%

Function 003A0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003A0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003A0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003A0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003A0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003A1002

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3f525efd0ed4cc719a70810f5ae7814d45d2579b1e50fbe83c45ab2ecf0e3fef
Instruction ID: fd4162ac161138e2c5c6e03bf2c3aab7344e316c020231907ee6c3bb5c73188c
Opcode Fuzzy Hash: 3f525efd0ed4cc719a70810f5ae7814d45d2579b1e50fbe83c45ab2ecf0e3fef
Instruction Fuzzy Hash: DDF06D39261312EBDB224FA4EC4DF563BADEF8A762F154416FA45C7291CA70DC40CA60

Uniqueness

Uniqueness Score: -1.00%

Function 003A1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 003A102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 003A1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003A1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 003A104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003A1062

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 52483090e029549567a4b9e0688fe232e70d2708fb09036dfc1707f2ca36c4d4
Instruction ID: a6d1b031ed834ae8410d0a4bab79c4cb9f2c4cfbb6d8f1366128c0dd5355710f
Opcode Fuzzy Hash: 52483090e029549567a4b9e0688fe232e70d2708fb09036dfc1707f2ca36c4d4
Instruction Fuzzy Hash: 38F06D39261312EBDB235FA4EC49F563BADEF8A761F150416FA45C7290CA74D840CA60

Uniqueness

Uniqueness Score: -1.00%

Function 003B030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,003B017D,?,003B32FC,?,00000001,00382592,?), ref: 003B0324
CloseHandle.KERNEL32(?,?,?,?,003B017D,?,003B32FC,?,00000001,00382592,?), ref: 003B0331
CloseHandle.KERNEL32(?,?,?,?,003B017D,?,003B32FC,?,00000001,00382592,?), ref: 003B033E
CloseHandle.KERNEL32(?,?,?,?,003B017D,?,003B32FC,?,00000001,00382592,?), ref: 003B034B
CloseHandle.KERNEL32(?,?,?,?,003B017D,?,003B32FC,?,00000001,00382592,?), ref: 003B0358
CloseHandle.KERNEL32(?,?,?,?,003B017D,?,003B32FC,?,00000001,00382592,?), ref: 003B0365

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8f9fcbd64347be80e7b5705d367450eab5c6d183773addf9b9a910a4703745a1
Instruction ID: 9cc7f4cf4b84d2db252dc20ab471ba8db488c25c301b239d58f81c593e7a8719
Opcode Fuzzy Hash: 8f9fcbd64347be80e7b5705d367450eab5c6d183773addf9b9a910a4703745a1
Instruction Fuzzy Hash: D701E276800B058FC7329F66D880447F7F9BF503093068A3FD29A52930C370A944CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0037D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0037D752

Part of subcall function 003729C8: HeapFree.KERNEL32(00000000,00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000), ref: 003729DE
Part of subcall function 003729C8: GetLastError.KERNEL32(00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000,00000000), ref: 003729F0

_free.LIBCMT ref: 0037D764
_free.LIBCMT ref: 0037D776
_free.LIBCMT ref: 0037D788
_free.LIBCMT ref: 0037D79A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ea67faf32414772eda258d9a93ab332dbf3b20d7c062e8e0dd8e50b351813208
Instruction ID: b4bf36415cb4c4937b012798f36d9f073f4276abbb22999643112d55615e5c35
Opcode Fuzzy Hash: ea67faf32414772eda258d9a93ab332dbf3b20d7c062e8e0dd8e50b351813208
Instruction Fuzzy Hash: 58F03C72500244ABC636EB68FAC1C17B7EDBF46311B998815F14CEB502C738FC808668

Uniqueness

Uniqueness Score: -1.00%

Function 003A5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 003A5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 003A5C6F
MessageBeep.USER32(00000000), ref: 003A5C87
KillTimer.USER32(?,0000040A), ref: 003A5CA3
EndDialog.USER32(?,00000001), ref: 003A5CBD

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: daa71934af09e624b00113477c2f174add6b65576df052e563926e7a6b1a1ab1
Instruction ID: db99d0dfeaf63a4ec8abb563a1cf4f2d61f838f7da6eff884bbf2531595380b9
Opcode Fuzzy Hash: daa71934af09e624b00113477c2f174add6b65576df052e563926e7a6b1a1ab1
Instruction Fuzzy Hash: C2018630511B05ABEB225B10ED4EFA677BCFB01B05F04165AA583A14E1DBF4A988CA90

Uniqueness

Uniqueness Score: -1.00%

Function 003722A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003722BE

Part of subcall function 003729C8: HeapFree.KERNEL32(00000000,00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000), ref: 003729DE
Part of subcall function 003729C8: GetLastError.KERNEL32(00000000,?,0037D7D1,00000000,00000000,00000000,00000000,?,0037D7F8,00000000,00000007,00000000,?,0037DBF5,00000000,00000000), ref: 003729F0

_free.LIBCMT ref: 003722D0
_free.LIBCMT ref: 003722E3
_free.LIBCMT ref: 003722F4
_free.LIBCMT ref: 00372305

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1283788ad74bc8da5ff266be15f6479ce721d6ecfd4f3e8ee5edf08c6346c64c
Instruction ID: 794527137c4e5a5d7d56c4b330976f47797cf0ee2378cf50f6e6f25f4469b730
Opcode Fuzzy Hash: 1283788ad74bc8da5ff266be15f6479ce721d6ecfd4f3e8ee5edf08c6346c64c
Instruction Fuzzy Hash: ADF03071501110CBC723BF64BC4288A7BA4B71A751B06CA66F518E62B1C7B904A29BAC

Uniqueness

Uniqueness Score: -1.00%

Function 003595C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 003595D4
StrokeAndFillPath.GDI32(?,?,003971F7,00000000,?,?,?), ref: 003595F0
SelectObject.GDI32(?,00000000), ref: 00359603
DeleteObject.GDI32 ref: 00359616
StrokePath.GDI32(?), ref: 00359631

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 59311219117bd3d32a12b48982693c9eca85e98f6c9ef09fb2858cc48b65c51a
Instruction ID: e19885ae9f8d6db7cb64567ea1002277cecc9005c6b783a9c234c3ece3a96e8f
Opcode Fuzzy Hash: 59311219117bd3d32a12b48982693c9eca85e98f6c9ef09fb2858cc48b65c51a
Instruction Fuzzy Hash: 93F03CB0026205EBDB135F65ED1CBA43B69AB01332F04C226FA25590F0C73489A9DF28

Uniqueness

Uniqueness Score: -1.00%

Function 00370F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 003710F9
__freea.LIBCMT ref: 00371117

Part of subcall function 00371537: _free.LIBCMT ref: 0037154F

Strings

am/pm, xrefs: 0037117A
a/p, xrefs: 003711DE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 9ffa97f2f9b6bd700a8210d077d589a18f1653c826df94b6eb069d2878767104
Instruction ID: 0c42ed0efd590111901dfd100248df605beb1db63dea17e9b7e31bc2c0c0327c
Opcode Fuzzy Hash: 9ffa97f2f9b6bd700a8210d077d589a18f1653c826df94b6eb069d2878767104
Instruction Fuzzy Hash: C1D1F237910205CAEB3A9F6CC8957BAB7B4EF05700F298159E909ABA51D33D9D80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003C61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00360242: EnterCriticalSection.KERNEL32(0041070C,00411884,?,?,0035198B,00412518,?,?,?,003412F9,00000000), ref: 0036024D
Part of subcall function 00360242: LeaveCriticalSection.KERNEL32(0041070C,?,0035198B,00412518,?,?,?,003412F9,00000000), ref: 0036028A

Part of subcall function 003600A3: __onexit.LIBCMT ref: 003600A9

__Init_thread_footer.LIBCMT ref: 003C6238

Part of subcall function 003601F8: EnterCriticalSection.KERNEL32(0041070C,?,?,00358747,00412514), ref: 00360202
Part of subcall function 003601F8: LeaveCriticalSection.KERNEL32(0041070C,?,00358747,00412514), ref: 00360235

Part of subcall function 003B359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 003B35E4
Part of subcall function 003B359C: LoadStringW.USER32(00412390,?,00000FFF,?), ref: 003B360A

Strings

x#A, xrefs: 003C633A
x#A, xrefs: 003C6353
x#A, xrefs: 003C636F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#A$x#A$x#A
API String ID: 1072379062-3459604138
Opcode ID: c396872a49f20d372b6fa56af81c5be21f3ba816cb38a942ac7bad912e314f98
Instruction ID: c0b8afd901b486bafbbf2628ac01d4f292cf261cbe6a9b1d53f2ce7f59c77a43
Opcode Fuzzy Hash: c396872a49f20d372b6fa56af81c5be21f3ba816cb38a942ac7bad912e314f98
Instruction Fuzzy Hash: C4C15B71A00109AFCB16DF58C892EBEB7B9EF49300F15846EE915DB291DB70ED45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00375AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO4, xrefs: 00375BA8, 00375C6C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: JO4
API String ID: 0-3558438523
Opcode ID: 48df31203667a2d95f76b97e7801f3c844a096388e647cee2a968612b7556b4c
Instruction ID: acf4aa6b9424a02c3497e4fbe3b0c5a3959435d7e1db0af92f6b5ffd7f61fc77
Opcode Fuzzy Hash: 48df31203667a2d95f76b97e7801f3c844a096388e647cee2a968612b7556b4c
Instruction Fuzzy Hash: C651B075D0060A9FCB3B9FA4D885FBE7BB8AF05310F158059F409AB291D7B99901CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00378A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00378B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00378B7A
__dosmaperr.LIBCMT ref: 00378B81

Strings

.6, xrefs: 00378A63

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .6
API String ID: 2434981716-1713163095
Opcode ID: a0cb59738e8578db40ae76cf056139c1a95d2962ea2bcd3e4b9bc51e93fd3a74
Instruction ID: 4a02ee4651363cc2a4df871bd0ae0190684e97274b689e1aa8ec03f47785e3de
Opcode Fuzzy Hash: a0cb59738e8578db40ae76cf056139c1a95d2962ea2bcd3e4b9bc51e93fd3a74
Instruction Fuzzy Hash: D0418E70604045AFD7369F28C889AB97FA5DF45304F29C5A9F48D8B542DE398C02D794

Uniqueness

Uniqueness Score: -1.00%

Function 003A2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003AB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003A21D0,?,?,00000034,00000800,?,00000034), ref: 003AB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 003A2760

Part of subcall function 003AB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003A21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 003AB3F8

Part of subcall function 003AB32A: GetWindowThreadProcessId.USER32(?,?), ref: 003AB355
Part of subcall function 003AB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,003A2194,00000034,?,?,00001004,00000000,00000000), ref: 003AB365
Part of subcall function 003AB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,003A2194,00000034,?,?,00001004,00000000,00000000), ref: 003AB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003A27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003A281A

Strings

@, xrefs: 003A2832

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 2beb0ca2931ffefc7622486289eba1339e0d19b7c88b286564a4ef7dafce080e
Instruction ID: 0a5f1cd94466b6810caf88b8b74827c8acdf64f161932734c915d20148bcb3a3
Opcode Fuzzy Hash: 2beb0ca2931ffefc7622486289eba1339e0d19b7c88b286564a4ef7dafce080e
Instruction Fuzzy Hash: 54412C76900218AFDB11DFA8CD45AEEBBB8EF0A700F104095FA55BB181DB716F45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0037172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\HxesZl7bIx.exe,00000104), ref: 00371769
_free.LIBCMT ref: 00371834
_free.LIBCMT ref: 0037183E

Strings

C:\Users\user\Desktop\HxesZl7bIx.exe, xrefs: 00371760, 00371767, 00371796, 003717CE

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\HxesZl7bIx.exe
API String ID: 2506810119-3939545726
Opcode ID: 87b855728bb0a8c451b72bffca6664b2bddc9777015c6e193490262e1a563aba
Instruction ID: a30bc27c99de22bf5d7702f1828c8064068e1c40f4c85d83e3156ea983d5128b
Opcode Fuzzy Hash: 87b855728bb0a8c451b72bffca6664b2bddc9777015c6e193490262e1a563aba
Instruction Fuzzy Hash: 13318376A00258BFDB36DF99D881D9EBBFCEB85310B1581A6E90897211D7748A40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003AC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 003AC306
DeleteMenu.USER32(?,00000007,00000000), ref: 003AC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00411990,01076B30), ref: 003AC395

Strings

0, xrefs: 003AC2DF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: e02546e098bbda95026df6e16ef9af1cf3f9ee7febb3648948848c6a9fad6b77
Instruction ID: c1a0467dc79609d049057ee99590feb8c6dbed3382724c67cb77225bb798c3bd
Opcode Fuzzy Hash: e02546e098bbda95026df6e16ef9af1cf3f9ee7febb3648948848c6a9fad6b77
Instruction Fuzzy Hash: 1041D2352183019FDB22DF25D844B1ABBE8EF86310F009A1EF9A59B2D1C734EC04CB52

Uniqueness

Uniqueness Score: -1.00%

Function 003D4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,003DCC08,00000000,?,?,?,?), ref: 003D44AA
GetWindowLongW.USER32 ref: 003D44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D44D7

Strings

SysTreeView32, xrefs: 003D447C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d0a7a00c43b186eb4db7c5bbd862d8656af83cb71a2dbdbc01744a53b9b16d51
Instruction ID: 7898cc8c442665a2c980d89f5062336880560a02b8ac931d127a9b8fd65c5786
Opcode Fuzzy Hash: d0a7a00c43b186eb4db7c5bbd862d8656af83cb71a2dbdbc01744a53b9b16d51
Instruction Fuzzy Hash: CB318F32210605AFDB229F38EC45BDA77A9EB09334F214716F975972E0D770EC909750

Uniqueness

Uniqueness Score: -1.00%

Function 003A6E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 003A6EED
VariantCopyInd.OLEAUT32(?,?), ref: 003A6F08
VariantClear.OLEAUT32(?), ref: 003A6F12

Strings

*j:, xrefs: 003A6E8B, 003A6E90, 003A6EF8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j:
API String ID: 2173805711-2474983611
Opcode ID: 72a10098ced5874aa63be6511b78366ac0657188c4f1c69c24a99f5cb09dc37d
Instruction ID: 117f016b4cbe98b5c1ed7f4b3b70b5539bece2839f2022dcb541909b04e2dd94
Opcode Fuzzy Hash: 72a10098ced5874aa63be6511b78366ac0657188c4f1c69c24a99f5cb09dc37d
Instruction Fuzzy Hash: 9B314171604255DFCB07AFA4E8529BE77BAEF86304B141499F9024F2A1C734E922DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 003C304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,003C3077,?,?), ref: 003C3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003C307A
_wcslen.LIBCMT ref: 003C309B
htons.WSOCK32(00000000,?,?,00000000), ref: 003C3106

Strings

255.255.255.255, xrefs: 003C3095, 003C309A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 57841071828c5f05147a1ca9ed005e0c8b4a4406552087c5f63d813a0f4a6964
Instruction ID: 00c0485ffbeee0a4d5a5c3faee94ee7d8a135ca3e3e5d1c66ffdfdd70fd41241
Opcode Fuzzy Hash: 57841071828c5f05147a1ca9ed005e0c8b4a4406552087c5f63d813a0f4a6964
Instruction Fuzzy Hash: E431AE3A6042019FCB12DF28C885FAA77E4AF14318F29C059E916CB792DB32EE45C761

Uniqueness

Uniqueness Score: -1.00%

Function 003D3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 003D3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 003D3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 003D3F78

Strings

SysMonthCal32, xrefs: 003D3F0B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5f2fd613e185841ba4c88e3fd6ea2bf6783fb5cbf9b2936d03897f42533614b1
Instruction ID: 8e27fbbfab26acef2e20b25796bbc60abc213924cea4f5202c870db14819d63c
Opcode Fuzzy Hash: 5f2fd613e185841ba4c88e3fd6ea2bf6783fb5cbf9b2936d03897f42533614b1
Instruction Fuzzy Hash: 16218B33610219BFDF229F50EC46FEA3B79EB48714F110215FA15AB2D0D6B5AD50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003D4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 003D4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 003D4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 003D471A

Strings

msctls_updown32, xrefs: 003D4684

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 25f12f62630241637f304df389c394fccb64627279f33688bffbb9e6e7661ae9
Instruction ID: 636db024ec7a8e8e10469b0dd3ebc876621f8dcf63f478fae77c41f66f18da75
Opcode Fuzzy Hash: 25f12f62630241637f304df389c394fccb64627279f33688bffbb9e6e7661ae9
Instruction Fuzzy Hash: 7D2132B5614205AFDB12DF64ECC1DB737ADEB5A394B15005AF6109B361CB71EC11CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003A961D

Strings

#requireadmin, xrefs: 003A95D9
#OnAutoItStartRegister, xrefs: 003A95F3
#notrayicon, xrefs: 003A95B7

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 6280b44dd013f8c1377929f54248975a3ee803fa2645eb865b3128a55006a782
Instruction ID: 3e0842e21999ec48e0caf0be7ac9a47623520c1a6001815a432c56c6177798ab
Opcode Fuzzy Hash: 6280b44dd013f8c1377929f54248975a3ee803fa2645eb865b3128a55006a782
Instruction Fuzzy Hash: 232157326046106AD333AB249C43FBB73DCDF97320F118427F94AAF191EB55AD55C295

Uniqueness

Uniqueness Score: -1.00%

Function 003D37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 003D3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 003D3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 003D3876

Strings

Listbox, xrefs: 003D380F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 197b7fe3ad18bdd8e323271ba469387cc90d489cdd57339e679cfe72816868d7
Instruction ID: f8ae3d1b35b6c05a497c1cf48f83c2fb14b9006dc7876d457b8bd1454c62e989
Opcode Fuzzy Hash: 197b7fe3ad18bdd8e323271ba469387cc90d489cdd57339e679cfe72816868d7
Instruction Fuzzy Hash: 6221F273610118BBEF128F54EC41FBB376EEF89750F118126F9009B290C671EC1187A0

Uniqueness

Uniqueness Score: -1.00%

Function 003B49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003B4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 003B4A5C
SetErrorMode.KERNEL32(00000000,?,?,003DCC08), ref: 003B4AD0

Strings

%lu, xrefs: 003B4A6F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 809b196fbb78209f330c8b48a097b292465bb0f7144f84461e4bea10de30941f
Instruction ID: d1646e5bf26df4e52e89e12b778f813c7f448fbbb1dec94a9f03c80fbd03af47
Opcode Fuzzy Hash: 809b196fbb78209f330c8b48a097b292465bb0f7144f84461e4bea10de30941f
Instruction Fuzzy Hash: 1A315E71A00219AFDB12DF54C885EAA7BF8EF08308F1480A5F909DF262D771ED46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003D41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 003D424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 003D4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 003D4271

Strings

msctls_trackbar32, xrefs: 003D4226

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 204831913ed0ca11551dde66f2009fbad35cc1bfdd6879b92d435b12a7385b80
Instruction ID: 6ed80a11fa028c1e7d308cc12be66a6c46d2360a3800b8c6a981e1fff5ea2b99
Opcode Fuzzy Hash: 204831913ed0ca11551dde66f2009fbad35cc1bfdd6879b92d435b12a7385b80
Instruction Fuzzy Hash: 16110632250208BFEF225F38DC06FAB7BACEF95B54F120525FA55E61A0D671DC119B14

Uniqueness

Uniqueness Score: -1.00%

Function 003A2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

Part of subcall function 003A2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 003A2DC5
Part of subcall function 003A2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A2DD6
Part of subcall function 003A2DA7: GetCurrentThreadId.KERNEL32 ref: 003A2DDD
Part of subcall function 003A2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 003A2DE4

GetFocus.USER32 ref: 003A2F78

Part of subcall function 003A2DEE: GetParent.USER32(00000000), ref: 003A2DF9

GetClassNameW.USER32(?,?,00000100), ref: 003A2FC3
EnumChildWindows.USER32(?,003A303B), ref: 003A2FEB

Strings

%s%d, xrefs: 003A2FFF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: effc95dfe6450bc6d60f3ea33d1116c7f7c7e7f5e13ce8fddb90f8d66644d32f
Instruction ID: f0286dce4c12a8d3d3a2adb8421840feccdbc9a0ce80c8a986c937bfe5203f1b
Opcode Fuzzy Hash: effc95dfe6450bc6d60f3ea33d1116c7f7c7e7f5e13ce8fddb90f8d66644d32f
Instruction Fuzzy Hash: 0611E171200205ABCF56BF749C96EEE37AAEF86304F044076FD099F292DE309909CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003D5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 003D58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 003D58EE
DrawMenuBar.USER32(?), ref: 003D58FD

Strings

0, xrefs: 003D588F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 85c09a5c8bea86d365fa6842baea42d34f714011bc7c5dc37461ca0df9f13a27
Instruction ID: eb652204661c1742d10819df8e9299439281deccda6e405c50815ddc8c88c210
Opcode Fuzzy Hash: 85c09a5c8bea86d365fa6842baea42d34f714011bc7c5dc37461ca0df9f13a27
Instruction Fuzzy Hash: 92018432510218EFDB129F15FC45FAEBBB9FF45361F10809AE849DA261DB308A94DF21

Uniqueness

Uniqueness Score: -1.00%

Function 0039D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0039D3BF
FreeLibrary.KERNEL32 ref: 0039D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0039D3B9
X64, xrefs: 0039D2A8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 11473a8f5c1505e86372c32784db55893abb5d7633343d12d74c9cdf443b4aab
Instruction ID: caf694daa01c8f9f7be4d7656075e6dfce9df45eecee67b5d8c3e27b4764e40c
Opcode Fuzzy Hash: 11473a8f5c1505e86372c32784db55893abb5d7633343d12d74c9cdf443b4aab
Instruction Fuzzy Hash: 84F05579011B128AEF3B27108C8A969331CBF10302FA68A1BE453E24A4CB20CC81CA42

Uniqueness

Uniqueness Score: -1.00%

Function 003A007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebcb35bdc67f08fd8314d6cc538d3d8effcda27898ab28b9eb0f7651b3be8fc
Instruction ID: 99cd0ec36ee998850831ddeda34cb2eddaeeab49f93a655f486a55b4be2b0ccb
Opcode Fuzzy Hash: 6ebcb35bdc67f08fd8314d6cc538d3d8effcda27898ab28b9eb0f7651b3be8fc
Instruction Fuzzy Hash: 06C14C75A0020AEFDB19CFA4C898BAEB7B5FF49704F118598E505EB291D731ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003C342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003C3459
CoUninitialize.OLE32 ref: 003C3463
VariantInit.OLEAUT32(?), ref: 003C346E
VariantClear.OLEAUT32(?), ref: 003C371B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: ed758129a53659f9e34c1bf1bdb525123541176a5fa8e7b34566384f11e220ad
Instruction ID: cf84c6a7356074ba1e47a896fe5cf46605967f17a0e745f7a784e62dbe0450fa
Opcode Fuzzy Hash: ed758129a53659f9e34c1bf1bdb525123541176a5fa8e7b34566384f11e220ad
Instruction Fuzzy Hash: AAA1F3756042109FC712DF28C485E2AB7E9EF89714F05889DF98A9F362DB31EE05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003A0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,003DFC08,?), ref: 003A05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,003DFC08,?), ref: 003A0608
CLSIDFromProgID.OLE32(?,?,00000000,003DCC40,000000FF,?,00000000,00000800,00000000,?,003DFC08,?), ref: 003A062D
_memcmp.LIBVCRUNTIME ref: 003A064E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 77db0b50434f7e01a8d8d7572cf7cd6df75086e09025dde22c2398a3a66b0bc8
Instruction ID: fe7fcc926c1b74d09d14c400f9d4a29bbc5757542168e5f2ca79a110d4d2ef9b
Opcode Fuzzy Hash: 77db0b50434f7e01a8d8d7572cf7cd6df75086e09025dde22c2398a3a66b0bc8
Instruction Fuzzy Hash: 85812C75A00109EFCB05DFA4C984EEEB7B9FF8A315F204559E506AB250DB71AE06CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00381391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003814C0

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d20c41ad9c20bb28d1dcce7980b128f73792085c3bb993be70f057fffc9b9fa7
Instruction ID: 015de7ba486c61efa2a7139eaedff4cfb09ddb7c0774c7394039bbcca410df8f
Opcode Fuzzy Hash: d20c41ad9c20bb28d1dcce7980b128f73792085c3bb993be70f057fffc9b9fa7
Instruction Fuzzy Hash: 49413B35A00300ABDB237BBA9C45ABE3BBCEF46330F1586A5F419DB192E67449425761

Uniqueness

Uniqueness Score: -1.00%

Function 003D6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003D62E2
ScreenToClient.USER32(?,?), ref: 003D6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 003D6382

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: abc55191cbd22a905c721364ab2d01de73409d5b76bae85e656cc6aa8fc75163
Instruction ID: df14f2af99d537c20b89cf5a6d29ef5e49b7584d474e4f09bd1d7ffc66f469a1
Opcode Fuzzy Hash: abc55191cbd22a905c721364ab2d01de73409d5b76bae85e656cc6aa8fc75163
Instruction Fuzzy Hash: A5513C75A00209AFCF11DF68E8819AE7BB5FF55360F11826AF9259B3A1D730ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003C1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 003C1AFD
WSAGetLastError.WSOCK32 ref: 003C1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 003C1B8A
WSAGetLastError.WSOCK32 ref: 003C1B94

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: d2e83b407d69c8473f5ab7e823c38954da54b88fd501a040e172b31f2cd39afa
Instruction ID: 84187bd58e47817e8d2155abd28c5911fb85f6b70bb23160744c0d35556020dc
Opcode Fuzzy Hash: d2e83b407d69c8473f5ab7e823c38954da54b88fd501a040e172b31f2cd39afa
Instruction Fuzzy Hash: B8419A74600201AFE722AF24C886F3A77E5AB45718F54848CF91A9F3D3D772ED428B90

Uniqueness

Uniqueness Score: -1.00%

Function 0037B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921cd4c8b746f54d1dce4b681f6a7392696a8fbb746962dd96dfecf993661ec4
Instruction ID: ebf3c727537835971dce0e1523a2817615cfa56d48bdc5357cb81412869bff73
Opcode Fuzzy Hash: 921cd4c8b746f54d1dce4b681f6a7392696a8fbb746962dd96dfecf993661ec4
Instruction Fuzzy Hash: 2B41F775A00304AFD736AF79CC41B6ABBF9EB84720F10C56AF549DF682D775A9018780

Uniqueness

Uniqueness Score: -1.00%

Function 003B56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 003B5783
GetLastError.KERNEL32(?,00000000), ref: 003B57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 003B57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 003B57FA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: fbdbbe8659832671237e5b1f5a7034120f68d7c4b055a029ed4a70531b7a69a0
Instruction ID: 6522f73e4667524f3a616c6faa45ce6cd07c5a6e9f74f946a2953f08476e2121
Opcode Fuzzy Hash: fbdbbe8659832671237e5b1f5a7034120f68d7c4b055a029ed4a70531b7a69a0
Instruction Fuzzy Hash: 01413D39710610DFCB12DF15C545A5EBBE2EF89724B198888E94AAF362CB35FD00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0037D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00366D71,00000000,00000000,003682D9,?,003682D9,?,00000001,00366D71,?,00000001,003682D9,003682D9), ref: 0037D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0037D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0037D9AB
__freea.LIBCMT ref: 0037D9B4

Part of subcall function 00373820: RtlAllocateHeap.NTDLL(00000000,?,00411444,?,0035FDF5,?,?,0034A976,00000010,00411440,003413FC,?,003413C6,?,00341129), ref: 00373852

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: c939b8f613b393175007fb612d87f10227134706ee54aeba539a37c107e09d20
Instruction ID: c8d9555682277d922ae551c18d976a0f7842c4fd434ffef28edb7d1e814d53b8
Opcode Fuzzy Hash: c939b8f613b393175007fb612d87f10227134706ee54aeba539a37c107e09d20
Instruction Fuzzy Hash: 3D31A072A1021AABDB269F64DC41EAE7BB5EF41310F168269FD08DA150E739CD50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 003D5352
GetWindowLongW.USER32(?,000000F0), ref: 003D5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003D53A8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 53cc8347adf9428be59f721804d83fe26d3466714b3e2b64fee1fedc1d23b039
Instruction ID: b12bcb867474f174874c982eb0f030eeae88c84fb6a4cc5f991f19fc5bd750de
Opcode Fuzzy Hash: 53cc8347adf9428be59f721804d83fe26d3466714b3e2b64fee1fedc1d23b039
Instruction Fuzzy Hash: D031C33AA65A08EFEB379F14EC05FE8776AAB04390F594103FA10963E1C7B09E50DB41

Uniqueness

Uniqueness Score: -1.00%

Function 003AAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 003AABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 003AAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 003AAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 003AACC6

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9e8971b448ee34b631c87720bd511f676bd8ec404d4a65bf18395bdf86be1c05
Instruction ID: ad8ac8732812bd7b3de54e3e7855f3f01573e80801debc6166dffe7f487e2f18
Opcode Fuzzy Hash: 9e8971b448ee34b631c87720bd511f676bd8ec404d4a65bf18395bdf86be1c05
Instruction Fuzzy Hash: 39311872A14A186FFF278B6588087FA7BAAEB47330F04421AE481D61D1C3798981C752

Uniqueness

Uniqueness Score: -1.00%

Function 003D7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 003D769A
GetWindowRect.USER32(?,?), ref: 003D7710
PtInRect.USER32(?,?,003D8B89), ref: 003D7720
MessageBeep.USER32(00000000), ref: 003D778C

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: f12339e20bfa7423e901f0a6bf0171f86de58111bc334e365cc1dddf7f1075fc
Instruction ID: 2563bc140683cbc8f2fa5739d60b910bac713a869d5817a7f2affd3aeca04ab0
Opcode Fuzzy Hash: f12339e20bfa7423e901f0a6bf0171f86de58111bc334e365cc1dddf7f1075fc
Instruction Fuzzy Hash: 1A41BC76A092149FCB02CF58E884EA877F5BB49310F1984AAE5249B360E330E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003D16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 003D16EB

Part of subcall function 003A3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A3A57
Part of subcall function 003A3A3D: GetCurrentThreadId.KERNEL32 ref: 003A3A5E
Part of subcall function 003A3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003A25B3), ref: 003A3A65

GetCaretPos.USER32(?), ref: 003D16FF
ClientToScreen.USER32(00000000,?), ref: 003D174C
GetForegroundWindow.USER32 ref: 003D1752

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: b8dafef2a5cd651c80a103148b5e84a73e94eb84342508cb02c64f14242ae948
Instruction ID: 2b8f180e51b9dc6d352f0bdb27da2a28a8c08b52a18ce5c379d2f69d649dd3b7
Opcode Fuzzy Hash: b8dafef2a5cd651c80a103148b5e84a73e94eb84342508cb02c64f14242ae948
Instruction Fuzzy Hash: 21316175D11249AFC701DFA9D881CAEB7FDEF49304B5080AAE415EB211D731EE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003ADF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00347620: _wcslen.LIBCMT ref: 00347625

_wcslen.LIBCMT ref: 003ADFCB
_wcslen.LIBCMT ref: 003ADFE2
_wcslen.LIBCMT ref: 003AE00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 003AE018

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 9ac85a4530830630eb94eb0ccf6d1dccdb97b0b7f1c41adca43b382c89b78457
Instruction ID: bd9fc8630335520337a1c66c5bbf6c6b332bf0a1ea36f615c4c5221d494c5a1e
Opcode Fuzzy Hash: 9ac85a4530830630eb94eb0ccf6d1dccdb97b0b7f1c41adca43b382c89b78457
Instruction Fuzzy Hash: 7321E271D00214AFCB22EFA8D982BAEB7F8EF46710F114065E805BF285D7709E40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003AD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 003AD501
Process32FirstW.KERNEL32(00000000,?), ref: 003AD50F
Process32NextW.KERNEL32(00000000,?), ref: 003AD52F
CloseHandle.KERNEL32(00000000), ref: 003AD5DC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9e221325095b29e18fad5848d415ca4652fbfa666ef25acf7e9e1d2b802e7b85
Instruction ID: 132897563cb4a28965b0ce3303d9ae4f290bd1b1f4a19578ef64a0e10d7fab51
Opcode Fuzzy Hash: 9e221325095b29e18fad5848d415ca4652fbfa666ef25acf7e9e1d2b802e7b85
Instruction Fuzzy Hash: 2D31A9715043019FD302DF54D885A6F7BF8EF9A354F14051DF5828A1A2EB71A944C792

Uniqueness

Uniqueness Score: -1.00%

Function 003D8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

GetCursorPos.USER32(?), ref: 003D9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00397711,?,?,?,?,?), ref: 003D9016
GetCursorPos.USER32(?), ref: 003D905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00397711,?,?,?), ref: 003D9094

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: cf9424d601a989adadef03f962c185a34d6f71104ce30d7917fea21708ff835c
Instruction ID: b635f3135d13f7f078e96659f7e4df07a196f639b50c35bb430c5270661252a4
Opcode Fuzzy Hash: cf9424d601a989adadef03f962c185a34d6f71104ce30d7917fea21708ff835c
Instruction Fuzzy Hash: 0E219F36611018EFDB269F94E858FEA7BB9EF4A350F0481A7F9059B261C3319D90DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003AD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,003DCB68), ref: 003AD2FB
GetLastError.KERNEL32 ref: 003AD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 003AD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,003DCB68), ref: 003AD376

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 8f767fc5255f6705d632ab28e6144dacc0a3f8bc6f5660b06603a0ea94060b19
Instruction ID: 381529f4c037d10dfe92ffe8c8366bbe6a065d026195522ea402c1bf9ff4efb1
Opcode Fuzzy Hash: 8f767fc5255f6705d632ab28e6144dacc0a3f8bc6f5660b06603a0ea94060b19
Instruction Fuzzy Hash: BE2191745152029F8B02DF28D8814AEB7E8EF57324F104A5EF49ACB2E1D731D945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 003A1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 003A102A
Part of subcall function 003A1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 003A1036
Part of subcall function 003A1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003A1045
Part of subcall function 003A1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 003A104C
Part of subcall function 003A1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003A1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003A15BE
_memcmp.LIBVCRUNTIME ref: 003A15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A1617
HeapFree.KERNEL32(00000000), ref: 003A161E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: a53d48def35ea7a40159a18c65ca06c75f64cb03d0e0abf0f003630595a61dfb
Instruction ID: 43e0f4193f1d0bfce724715691d0abbf2512f8acec8fb00102cd76e430cbb589
Opcode Fuzzy Hash: a53d48def35ea7a40159a18c65ca06c75f64cb03d0e0abf0f003630595a61dfb
Instruction Fuzzy Hash: 3E21AC31E51109EFDF11DFA4C945BEEB7B8EF46344F198459E841EB251E730AA05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003D2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 003D280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003D2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003D2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003D2840

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: cc13f8dbe8cb4f0bf905f00be2d34d3e294ea5f78249e520eef9aadb4a658ea4
Instruction ID: dc79135096b67ccf3f11894a847a37ad6f5627c806efabf805f93730c93c2ed0
Opcode Fuzzy Hash: cc13f8dbe8cb4f0bf905f00be2d34d3e294ea5f78249e520eef9aadb4a658ea4
Instruction Fuzzy Hash: 4E210632215111AFD7169B24E844F6BB79AEF56324F14815AF4268F7E2CB71FC42C790

Uniqueness

Uniqueness Score: -1.00%

Function 003A78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003A8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,003A790A,?,000000FF,?,003A8754,00000000,?,0000001C,?,?), ref: 003A8D8C
Part of subcall function 003A8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 003A8DB2
Part of subcall function 003A8D7D: lstrcmpiW.KERNEL32(00000000,?,003A790A,?,000000FF,?,003A8754,00000000,?,0000001C,?,?), ref: 003A8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,003A8754,00000000,?,0000001C,?,?,00000000), ref: 003A7923
lstrcpyW.KERNEL32(00000000,?), ref: 003A7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,003A8754,00000000,?,0000001C,?,?,00000000), ref: 003A7984

Strings

cdecl, xrefs: 003A797B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: a2238be23cbc5d2f47b197be09d26e355ad056c7652afa42762121b61c18e933
Instruction ID: 06a6d27922125bc36bf3583643dce575f37d7e07007e8a35a6f3cb288c967324
Opcode Fuzzy Hash: a2238be23cbc5d2f47b197be09d26e355ad056c7652afa42762121b61c18e933
Instruction Fuzzy Hash: 1511D63A211242AFDB169F34DC45E7B77A9FF46350B50402FF946CB2A4EB319811C791

Uniqueness

Uniqueness Score: -1.00%

Function 003D7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 003D7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 003D7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 003D7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,003BB7AD,00000000), ref: 003D7D6B

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: f818df69ecef76aeb48bb77cb01d881a63123bad95f6766b4f6e65008b2fa0cf
Instruction ID: 6e33c843896defb1642d34b6a8c2d58dd53fc5f91b9ad4e7a6c5807538df9eb8
Opcode Fuzzy Hash: f818df69ecef76aeb48bb77cb01d881a63123bad95f6766b4f6e65008b2fa0cf
Instruction Fuzzy Hash: A311A5326256159FCB129F28EC04EA63BAAAF45370F158726F935C72F0E7309951DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003D5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 003D56BB
_wcslen.LIBCMT ref: 003D56CD
_wcslen.LIBCMT ref: 003D56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 003D5816

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 9d86986cfabf9a1a0ebf551076ebb7039ccdb658a09bc2cb03d206dafe961ad1
Instruction ID: 951de1e93d2f3e5187743c6f42bffc2a8b7c6f7d24d516302ae85729dc46187f
Opcode Fuzzy Hash: 9d86986cfabf9a1a0ebf551076ebb7039ccdb658a09bc2cb03d206dafe961ad1
Instruction Fuzzy Hash: 4511D676A0460896DB229F65EC85AFE77BCEF10760F10802BF915D6281EB70C984CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00371D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75cf428a027ae075b46ae9723bcdcf75e29f509dd23f94ea044186d619c6cdf
Instruction ID: 1cf39c4c4d502cec897a7662308c531322ebb99b57f7e769ab702154ed7c0432
Opcode Fuzzy Hash: b75cf428a027ae075b46ae9723bcdcf75e29f509dd23f94ea044186d619c6cdf
Instruction Fuzzy Hash: ED017CB32156163EEA3316787CC1F77665CEF423B8F35832AF529A51D2DB688C405560

Uniqueness

Uniqueness Score: -1.00%

Function 003A1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 003A1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003A1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003A1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003A1A8A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ef40ec7498241ab9fc51e3f0bd27f470c03b896107a33597e7c226e38ec97493
Instruction ID: 9956f6e4b22bac0f98fd32790fa9c902f9138a0dcc3ce6c07b955aa8085ca08b
Opcode Fuzzy Hash: ef40ec7498241ab9fc51e3f0bd27f470c03b896107a33597e7c226e38ec97493
Instruction Fuzzy Hash: FF113C3AD01219FFEB11DBA4CD85FADFB78EB05750F200091E600B7290D671AE50DB94

Uniqueness

Uniqueness Score: -1.00%

Function 003AE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003AE1FD
MessageBoxW.USER32(?,?,?,?), ref: 003AE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003AE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003AE24D

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3a470e9a626f6ef2d2966a2602abb98312d843f73a7803828c1c777d3fbc5164
Instruction ID: a58fbe9cf072286106e9a81a0b705ea44178bfd02c65b4c54c70edaa6192e1e4
Opcode Fuzzy Hash: 3a470e9a626f6ef2d2966a2602abb98312d843f73a7803828c1c777d3fbc5164
Instruction Fuzzy Hash: 6C11C87691425DBBD712ABA8EC09BDE7FACEB46310F048666F924D3291D674C90487A0

Uniqueness

Uniqueness Score: -1.00%

Function 0036D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0036CFF9,00000000,00000004,00000000), ref: 0036D218
GetLastError.KERNEL32 ref: 0036D224
__dosmaperr.LIBCMT ref: 0036D22B
ResumeThread.KERNEL32(00000000), ref: 0036D249

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: b9cf4cda66216b0d2884caae4a210de5e0a67195fe963ff38f3cc1c38ed421fb
Instruction ID: 28a9639c0aa056286421d719b78f05696415ff56d84910ebd120ee5598e96cef
Opcode Fuzzy Hash: b9cf4cda66216b0d2884caae4a210de5e0a67195fe963ff38f3cc1c38ed421fb
Instruction Fuzzy Hash: 8E01D636D151047BC7135BA5EC05BAA7B6DEF81330F118619F9259A1D4CB71C941C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 003D9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00359BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00359BB2

GetClientRect.USER32(?,?), ref: 003D9F31
GetCursorPos.USER32(?), ref: 003D9F3B
ScreenToClient.USER32(?,?), ref: 003D9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 003D9F7A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 5c2aae7fde85fc92f737031356f50b5e4155d2eeb58ae39bac5bbf441f36af00
Instruction ID: a2e3b1d659f306d1d19a90b51f47158f7f550a5a76a776cd6b05299deb0efe9d
Opcode Fuzzy Hash: 5c2aae7fde85fc92f737031356f50b5e4155d2eeb58ae39bac5bbf441f36af00
Instruction Fuzzy Hash: FD11483291011AABDB02DF68E845EEE77BDFB05312F404553F911E7250D330BA95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0034600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0034604C
GetStockObject.GDI32(00000011), ref: 00346060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0034606A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: ac14fe90671f9c2040f1352f1ea4446f5b3a89dda11f08387d1c3badd4ca14e0
Instruction ID: 3fb4668e6b60cea176bb68cbec9a56fdbe8f72d0e1181772480e4daacaaf4309
Opcode Fuzzy Hash: ac14fe90671f9c2040f1352f1ea4446f5b3a89dda11f08387d1c3badd4ca14e0
Instruction Fuzzy Hash: D411A1B2516609BFEF134F94DC45EEABBADEF09355F050212FA1456010C732EC60DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00363B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00363B56

Part of subcall function 00363AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00363AD2
Part of subcall function 00363AA3: ___AdjustPointer.LIBCMT ref: 00363AED

_UnwindNestedFrames.LIBCMT ref: 00363B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00363B7C
CallCatchBlock.LIBVCRUNTIME ref: 00363BA4

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 5c97a436c4ef33cac304e95f88400430b44b66b0a2b6a2b0864f45630aada460
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: AB012932500149BBDF135E95CC42EEB3F69EF49754F058014FE485A125C732E961EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00373073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,003413C6,00000000,00000000,?,0037301A,003413C6,00000000,00000000,00000000,?,0037328B,00000006,FlsSetValue), ref: 003730A5
GetLastError.KERNEL32(?,0037301A,003413C6,00000000,00000000,00000000,?,0037328B,00000006,FlsSetValue,003E2290,FlsSetValue,00000000,00000364,?,00372E46), ref: 003730B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0037301A,003413C6,00000000,00000000,00000000,?,0037328B,00000006,FlsSetValue,003E2290,FlsSetValue,00000000), ref: 003730BF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: c5583b31657c2b631108b1cf0765fcf6a741cbeea86853ea0ebf956adbfdc652
Instruction ID: f2debc3a74d2a4e97e122969068433c9bb05f7fc8ab2b2f0cf38754113aba584
Opcode Fuzzy Hash: c5583b31657c2b631108b1cf0765fcf6a741cbeea86853ea0ebf956adbfdc652
Instruction Fuzzy Hash: 4A01F732762223ABCB334B78AC449677B9CAF05B61F218720F90BE7180D729D901D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 003A7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 003A747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 003A7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 003A74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 003A74CA

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 33933c96d2f6ace4a074788eddad1dbe47874855db26fb2086c20be96c26c86b
Instruction ID: e5260b37d6d1bb5bf06b2d3f4a3e84c195eab0cfb89a8b460682eac8644db0af
Opcode Fuzzy Hash: 33933c96d2f6ace4a074788eddad1dbe47874855db26fb2086c20be96c26c86b
Instruction Fuzzy Hash: 8111D6B12163119FE722CF16EC48FA27FFCEB05B00F10856AA616D7551D770E904DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003AB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,003AACD3,?,00008000), ref: 003AB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,003AACD3,?,00008000), ref: 003AB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,003AACD3,?,00008000), ref: 003AB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,003AACD3,?,00008000), ref: 003AB126

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 06851b4d542373ca827079fc04e0a837ec4db0224f62c66284f3b8fc947ed776
Instruction ID: 090ffa24c48ec07ad9e437097fc26591fbf622fc0943b07c7c3e3d84b173782c
Opcode Fuzzy Hash: 06851b4d542373ca827079fc04e0a837ec4db0224f62c66284f3b8fc947ed776
Instruction Fuzzy Hash: E2113931C11529E7CF06AFA4E958AEEFB78FF0A711F114096D981B2182CB305650CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003D7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003D7E33
ScreenToClient.USER32(?,?), ref: 003D7E4B
ScreenToClient.USER32(?,?), ref: 003D7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 003D7E8A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 696767eba902934941c2dd7dd3ee08272163cb12d69a2a5cb8591cdfeb8a5fd3
Instruction ID: b109392c3483b8399e073bf0bfa9a2cab994f98ce19bec836cfd701b8a33a2ec
Opcode Fuzzy Hash: 696767eba902934941c2dd7dd3ee08272163cb12d69a2a5cb8591cdfeb8a5fd3
Instruction Fuzzy Hash: F51156B9D1020AAFDB41CF98D884AEEBBF9FF08310F505156E915E3210D735AA54CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003A2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 003A2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 003A2DD6
GetCurrentThreadId.KERNEL32 ref: 003A2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 003A2DE4

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b2733a6240e814978e561a1c74a1738823718e1d3cda2949e1707cd26d3bfd2d
Instruction ID: 45421187be8a317d64677530e5b8471e178679b799fc727179f3951a764bc2fd
Opcode Fuzzy Hash: b2733a6240e814978e561a1c74a1738823718e1d3cda2949e1707cd26d3bfd2d
Instruction Fuzzy Hash: FFE09271122225BBDB221B76AC0DFEB3F6CFF43BA1F041116F505D10819AA4C840C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 003D8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00359639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00359693
Part of subcall function 00359639: SelectObject.GDI32(?,00000000), ref: 003596A2
Part of subcall function 00359639: BeginPath.GDI32(?), ref: 003596B9
Part of subcall function 00359639: SelectObject.GDI32(?,00000000), ref: 003596E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 003D8887
LineTo.GDI32(?,?,?), ref: 003D8894
EndPath.GDI32(?), ref: 003D88A4
StrokePath.GDI32(?), ref: 003D88B2

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: bda64bfe03f40f9f1c7d7751a9d19330538376918c0e1b4cc1275f6375068be3
Instruction ID: 0be0337a0eec238cae7df048161a1cb37ca39dbecfc4ec800ace3f8137392bdc
Opcode Fuzzy Hash: bda64bfe03f40f9f1c7d7751a9d19330538376918c0e1b4cc1275f6375068be3
Instruction Fuzzy Hash: F6F03A36066259FADB135F94AC09FCA3B5DAF06311F048002FA21651E1C7756511DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 003598B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 003598CC
SetTextColor.GDI32(?,?), ref: 003598D6
SetBkMode.GDI32(?,00000001), ref: 003598E9
GetStockObject.GDI32(00000005), ref: 003598F1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: be06ec522ccbf20088b1d1aa3886af5de12f3ad503fdeec9dcbf472e30921255
Instruction ID: 40e9791b8dd90134493cbe32de041c62b4835ce945ceb8be16777e1f31644f52
Opcode Fuzzy Hash: be06ec522ccbf20088b1d1aa3886af5de12f3ad503fdeec9dcbf472e30921255
Instruction Fuzzy Hash: 42E06D31265291AADF225B75BC0DBE83F25AB12336F05821BF6FA980E1C3714644DB10

Uniqueness

Uniqueness Score: -1.00%

Function 003A162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 003A1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,003A11D9), ref: 003A163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,003A11D9), ref: 003A1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,003A11D9), ref: 003A164F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 08b21a5098d2fcb363d1df4bf0eb070c49d089c64566c5bcf7ffd99de17763fb
Instruction ID: 88a844bacb3021cd243109e93b34cc1406b46aa34ea53f3eff87c4a1172efe27
Opcode Fuzzy Hash: 08b21a5098d2fcb363d1df4bf0eb070c49d089c64566c5bcf7ffd99de17763fb
Instruction Fuzzy Hash: A0E08631A23212DBDB211FE0BE0DB463B7CFF457A1F154809F645C9090D6348440C750

Uniqueness

Uniqueness Score: -1.00%

Function 0039D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0039D858
GetDC.USER32(00000000), ref: 0039D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0039D882
ReleaseDC.USER32(?), ref: 0039D8A3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 7e76772e42068e47d5dfe01506383cd0998d4201767e28b203da32bc8d5ebba4
Instruction ID: da243522d16b4df4c6bac6a5bdb0a22b0e2dbd4893df9df94c7cbedcc6e095df
Opcode Fuzzy Hash: 7e76772e42068e47d5dfe01506383cd0998d4201767e28b203da32bc8d5ebba4
Instruction Fuzzy Hash: CDE01AB0C21206DFCF429FA0E808A6DBBB9FB08311F18A00AE806E7650C7389905EF40

Uniqueness

Uniqueness Score: -1.00%

Function 0039D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0039D86C
GetDC.USER32(00000000), ref: 0039D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0039D882
ReleaseDC.USER32(?), ref: 0039D8A3

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 69a1b4429559e517a79b7c26b1ea3d65b34cc9dfc9200b51afe76ad16215ec8c
Instruction ID: bb2351c654763c2939f6c543a119ed5abb8183418200d96fd19645156ed75e6f
Opcode Fuzzy Hash: 69a1b4429559e517a79b7c26b1ea3d65b34cc9dfc9200b51afe76ad16215ec8c
Instruction Fuzzy Hash: 25E09A75C21205DFCB529FA0E80866DBBB9FB08311F18A44AE946E7250C7399905DF50

Uniqueness

Uniqueness Score: -1.00%

Function 003B4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00347620: _wcslen.LIBCMT ref: 00347625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 003B4ED4

Strings

*, xrefs: 003B4E10
LPT, xrefs: 003B4DFB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 4998e467f2d420ca3ae526c11b7f8a7f4f8d8afbda75ae7113edc43fe6df081b
Instruction ID: 0eb38a0759b1eb21b934924d134c25ca2207f0e28f7c5894eb64d26a966a48d3
Opcode Fuzzy Hash: 4998e467f2d420ca3ae526c11b7f8a7f4f8d8afbda75ae7113edc43fe6df081b
Instruction Fuzzy Hash: D3918075A002149FCB16DF58C484EAABBF5BF44308F198099E90A9F763C735ED85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0036E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0036E30D

Strings

pow, xrefs: 0036E2E5, 0036E302

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: fd65d5a3ad404719e90805af6d94d6d6b2379804570d48b9a18e5c60214a9d7a
Instruction ID: 45ba58e02dd8e61f8e6d48fd5178672b010dab77b0a554041c79c98b8a2e2061
Opcode Fuzzy Hash: fd65d5a3ad404719e90805af6d94d6d6b2379804570d48b9a18e5c60214a9d7a
Instruction Fuzzy Hash: FA517F69A0C10296CB377714C9413BA3BACDB40740F35CD69E0D9877EDDF398C999A86

Uniqueness

Uniqueness Score: -1.00%

Function 003C7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0039569E,00000000,?,003DCC08,?,00000000,00000000), ref: 003C78DD

Part of subcall function 00346B57: _wcslen.LIBCMT ref: 00346B6A

CharUpperBuffW.USER32(0039569E,00000000,?,003DCC08,00000000,?,00000000,00000000), ref: 003C783B

Strings

<s@, xrefs: 003C77C8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s@
API String ID: 3544283678-2701045315
Opcode ID: 6a8d56519b08da7913e41bb8d1e2c55feaefb0adabd395bf81422f3e40cf3405
Instruction ID: 8fcc631bddff1ebb411d5859b15eea09009cf2718cd7d1614ff8f80f66956126
Opcode Fuzzy Hash: 6a8d56519b08da7913e41bb8d1e2c55feaefb0adabd395bf81422f3e40cf3405
Instruction Fuzzy Hash: DD6132769141199ACF06EFA4CC52EFDB3B8FF14300B545529E942BB091EF346E05DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0035E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0035E1B1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 5432a1f18c408e600419aa7ed0723411b3916f224259ba39108de7c6e6c78e34
Instruction ID: f4a2e5c99fcc6cf7758f1c680b2be355c5d9b5d2c0fce2046b0f44aa1b5a8713
Opcode Fuzzy Hash: 5432a1f18c408e600419aa7ed0723411b3916f224259ba39108de7c6e6c78e34
Instruction Fuzzy Hash: CF512335904346DFDF1BEFA8C481ABA7BA8EF15310F244455EC919B2E0D734AE46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0035F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0035F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0035F2BB

Strings

@, xrefs: 0035F2AF

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 1314fb70c76aad2fbfce6ed6c5a018edcd15c42d3873c4bffec436ed8a402392
Instruction ID: c3841a1de0156bf28ccdd487bd895b5fdd6c8dd64115f5fb89c3d79ea47711f8
Opcode Fuzzy Hash: 1314fb70c76aad2fbfce6ed6c5a018edcd15c42d3873c4bffec436ed8a402392
Instruction Fuzzy Hash: 335174714187459BD321AF50E886BABBBF8FB84304F81884CF1D9490A5EB319528CB67

Uniqueness

Uniqueness Score: -1.00%

Function 003C5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 003C57E0
_wcslen.LIBCMT ref: 003C57EC

Strings

CALLARGARRAY, xrefs: 003C57E6, 003C57EB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: e352c585fbe2a65d837323b5674cda36d007ff5a8ba31ae3328eff728fa33e1c
Instruction ID: bd29b67967eecb5b889b43ebe17fda3c9c6a30708c7246eee29a6f8cd7c926f4
Opcode Fuzzy Hash: e352c585fbe2a65d837323b5674cda36d007ff5a8ba31ae3328eff728fa33e1c
Instruction Fuzzy Hash: 54418D71E002199FCB16DFA9C881EAEBBB5EF59350F15406DE505AB291E730AD81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 003BD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003BD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 003BD13A

Strings

|, xrefs: 003BD10B

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 60252cf8de428b2a2203dfce28c317d02c15638f8a65ac8e84e6788b477a9874
Instruction ID: 19977590fac556041d38a17e85f0f5b9cf2b8c427b63e2eb907980d990b62966
Opcode Fuzzy Hash: 60252cf8de428b2a2203dfce28c317d02c15638f8a65ac8e84e6788b477a9874
Instruction Fuzzy Hash: 16312C71D01209ABCF16EFA4CD85AEEBFB9FF05304F104019F915AA166E731AA56CF60

Uniqueness

Uniqueness Score: -1.00%

Function 003D356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 003D3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 003D365C

Strings

static, xrefs: 003D35BC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 4adbafb72d22b4504499feb53b9dde1930afdf67d776c29089b96db5ef49f55f
Instruction ID: 4e8c432aef2287d37d302ea61b893340005512d3c5d0832664627010d625ce4b
Opcode Fuzzy Hash: 4adbafb72d22b4504499feb53b9dde1930afdf67d776c29089b96db5ef49f55f
Instruction Fuzzy Hash: 1431B072110604AEDB119F38EC81EFB73A9FF48720F01961AF8A597290DA35ED81C761

Uniqueness

Uniqueness Score: -1.00%

Function 003D4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 003D461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003D4634

Strings

', xrefs: 003D458E

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: d835d4c7d3e57e62eed03171cdd3582128aec2b47a298369bb0df54ff225e22b
Instruction ID: 3c5cb2a4b3b2b05d2f72b681fde8d99d4849d95d5e8cc0ee7e4f0683d88b078f
Opcode Fuzzy Hash: d835d4c7d3e57e62eed03171cdd3582128aec2b47a298369bb0df54ff225e22b
Instruction Fuzzy Hash: 8A3128B5A013099FDB15CF69E981BDABBB6FF0A300F14406AE905AB351D770E941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003D31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 003D327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003D3287

Strings

Combobox, xrefs: 003D3249

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: fef405e52b04f73968efb699584787eb6d8db9b11af32b358285d3aa4b4430a2
Instruction ID: b5ab01dc7eef0d9c8039c5d38a6fd7a7dab70b960a767208c23d7f04eb20229c
Opcode Fuzzy Hash: fef405e52b04f73968efb699584787eb6d8db9b11af32b358285d3aa4b4430a2
Instruction Fuzzy Hash: 0D11E672B001087FEF129F54EC81EBB375AEB94364F114526F5149B390D631DD518761

Uniqueness

Uniqueness Score: -1.00%

Function 003D3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0034600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0034604C
Part of subcall function 0034600E: GetStockObject.GDI32(00000011), ref: 00346060
Part of subcall function 0034600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0034606A

GetWindowRect.USER32(00000000,?), ref: 003D377A
GetSysColor.USER32(00000012), ref: 003D3794

Strings

static, xrefs: 003D3757

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6ddf4bf40aed69fa224c0501cc05a0b22076541249197008616de5867a3bb9d2
Instruction ID: 7ef2d5fddef09431b091130b16b4a36788f4cf9290d213f5b820de1c9f6472b8
Opcode Fuzzy Hash: 6ddf4bf40aed69fa224c0501cc05a0b22076541249197008616de5867a3bb9d2
Instruction Fuzzy Hash: 16116AB262060AAFDF02DFA8DC46EEA7BF8FB08304F014516F955E2250D735E810DB60

Uniqueness

Uniqueness Score: -1.00%

Function 003BCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003BCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 003BCDA6

Strings

<local>, xrefs: 003BCD66

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 83aeae7fdf58dadc1cb3f0687f8abbcb4d33286ca6914a988769adc6a5925bb2
Instruction ID: 69ab5a4e8ff9f8ebdef028432a1f44ffb345941f10d1002dab28e11fa118aa36
Opcode Fuzzy Hash: 83aeae7fdf58dadc1cb3f0687f8abbcb4d33286ca6914a988769adc6a5925bb2
Instruction Fuzzy Hash: E01106792216327AD7364B668C44FE7BE6CEF127A8F40523EB24983880D7709940D6F0

Uniqueness

Uniqueness Score: -1.00%

Function 003D3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 003D34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003D34BA

Strings

edit, xrefs: 003D348F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: d925acc24a22241a12da072b6c9baf33b0c2a7519d9652907b079c26a96269a8
Instruction ID: 6392216a58945ed9c4b0b3227f8a6ac794357fee31f3e560520520e77bad5fd5
Opcode Fuzzy Hash: d925acc24a22241a12da072b6c9baf33b0c2a7519d9652907b079c26a96269a8
Instruction Fuzzy Hash: 10119D72110108AAEB134F65FC40AFB376AEB05374F514326F960972E0C779EC519752

Uniqueness

Uniqueness Score: -1.00%

Function 003A6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

CharUpperBuffW.USER32(?,?,?), ref: 003A6CB6
_wcslen.LIBCMT ref: 003A6CC2

Strings

STOP, xrefs: 003A6CBC, 003A6CC1

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 878e71e8ef7b7dd041af9e7ade08a50f3d2afddfe5ea1e74decb2804ae1e9f95
Instruction ID: 260005997348112038ae61bb27cd1797618f1ad0b0b3058ce890d10981c703be
Opcode Fuzzy Hash: 878e71e8ef7b7dd041af9e7ade08a50f3d2afddfe5ea1e74decb2804ae1e9f95
Instruction Fuzzy Hash: 560108326105278BCB129FBDDC829BF33E8EE627607060535E4629A195EB31D900C650

Uniqueness

Uniqueness Score: -1.00%

Function 003A1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 003A3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 003A1D4C

Strings

ListBox, xrefs: 003A1D16
ComboBox, xrefs: 003A1CEB

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7db816a35605889734e11f24bef6c1a256e0afd2104241494d1d29151c7800b0
Instruction ID: 8cba7c126906aaec01c59a5aba45ca87c846c6fe08bbb425b289a19e7c962bb3
Opcode Fuzzy Hash: 7db816a35605889734e11f24bef6c1a256e0afd2104241494d1d29151c7800b0
Instruction Fuzzy Hash: E501D875651214ABCB06FBA4DC55DFFB7A8EB57350F14061AF8326F2C1EA346908C660

Uniqueness

Uniqueness Score: -1.00%

Function 003A1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 003A3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 003A1C46

Strings

ListBox, xrefs: 003A1C10
ComboBox, xrefs: 003A1BE5

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 40d1e47268abb955b2d6dc2976cfb2ff5c9e1977c6da7ac690ca265a3697e6fc
Instruction ID: df72fbd838ed9fe69f393f3119b7c9ab641fd34bff497056f628bff1138ad6ac
Opcode Fuzzy Hash: 40d1e47268abb955b2d6dc2976cfb2ff5c9e1977c6da7ac690ca265a3697e6fc
Instruction Fuzzy Hash: 1D01A775AC110466CB06EB90DD51AFF77ECDB12350F14001AB4067B2C2EA24AE08C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 003A1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 003A3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 003A1CC8

Strings

ListBox, xrefs: 003A1C94
ComboBox, xrefs: 003A1C69

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c80c6c43bb8e68ebbbb8da2ad16feca82221cec90b4cf063902bc306d07109ed
Instruction ID: 5ecd6e2bf6194d672dbc49364b748ba52cd42fad9c0516e4d54a7ca9cc82ca1a
Opcode Fuzzy Hash: c80c6c43bb8e68ebbbb8da2ad16feca82221cec90b4cf063902bc306d07109ed
Instruction Fuzzy Hash: 350186B5A8111867CF16EBA4DE55BFF77ECDB12350F140116B8027B282EA65AF08C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0035A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0035A529

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Strings

,%A, xrefs: 0035A509
3y9, xrefs: 0035A545, 0035A54D, 0035A552

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%A$3y9
API String ID: 2551934079-252068093
Opcode ID: cdbeb1af9d4d662f7dbc59746f8fddfb3af25fa018c15413593f404a63795d32
Instruction ID: dda52000969971a12f7b29698a8619feebcb26cd1b6a4a11a525fab8067439cf
Opcode Fuzzy Hash: cdbeb1af9d4d662f7dbc59746f8fddfb3af25fa018c15413593f404a63795d32
Instruction Fuzzy Hash: 52017B31700A1097C507F7A8E85BFAE3394DB06711F404565F9025F2D3EE906D49969B

Uniqueness

Uniqueness Score: -1.00%

Function 003A1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00349CB3: _wcslen.LIBCMT ref: 00349CBD

Part of subcall function 003A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 003A3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 003A1DD3

Strings

ListBox, xrefs: 003A1DA0
ComboBox, xrefs: 003A1D75

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 59784af09810ff7ece6606609ed645911f820c06194876538287b92fd1921d82
Instruction ID: d0b4b8151b9488fe57157cc8b5db5f2b4bfb07e1b14a22fafe57af05e02a626a
Opcode Fuzzy Hash: 59784af09810ff7ece6606609ed645911f820c06194876538287b92fd1921d82
Instruction Fuzzy Hash: D9F0C871B9121466DB06F7A4DD96FFF77BCEB03350F140916B8227B2C2DA70790886A0

Uniqueness

Uniqueness Score: -1.00%

Function 003D8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00413018,0041305C), ref: 003D81BF
CloseHandle.KERNEL32 ref: 003D81D1

Strings

\0A, xrefs: 003D818A

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0A
API String ID: 3712363035-1148864819
Opcode ID: 3a74f05ad0e6867a7dbeba1b7c8e3e904e65f954e589c73b437200eaeffeeea4
Instruction ID: 13ad58641849de49ddac76d8972d8f9bcde13ad3856d090fdaf8dca915bb842c
Opcode Fuzzy Hash: 3a74f05ad0e6867a7dbeba1b7c8e3e904e65f954e589c73b437200eaeffeeea4
Instruction Fuzzy Hash: CCF05EB5650300BAE7216F61AC45FF73E9CDB09752F018432BB08D91A6D7799F4482BC

Uniqueness

Uniqueness Score: -1.00%

Function 003C747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003C7493
_wcslen.LIBCMT ref: 003C74B9

Strings

3, 3, 16, 1, xrefs: 003C7483

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 7a583c0dcdeb2f07df67097c95a7a66e347a9398a61b04b26c1a3c7c436042a9
Instruction ID: f133ae9910c7e250a3ee30b93aa842cb083543c28a1b3cb4ee5418b3cf8b8718
Opcode Fuzzy Hash: 7a583c0dcdeb2f07df67097c95a7a66e347a9398a61b04b26c1a3c7c436042a9
Instruction Fuzzy Hash: D9E02B02A4462010A237127B9CC5F7F56CADFC5790710182FFD81C626AEB948DA193A1

Uniqueness

Uniqueness Score: -1.00%

Function 003A0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 003A0B23

Strings

Error allocating memory., xrefs: 003A0B1C
AutoIt, xrefs: 003A0B17

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: d665b1a006d44b846602498e629e2a93aa1b9e98fee9fb3dc7c0671f00170602
Instruction ID: 47203828a132fca2974fff4eb46f7308776f15e490c26a6730cd2f869dd9a23a
Opcode Fuzzy Hash: d665b1a006d44b846602498e629e2a93aa1b9e98fee9fb3dc7c0671f00170602
Instruction Fuzzy Hash: 46E0D8322643092AD2163794BC03FC97BC4CF05B11F100427FB485D5D38AE2645086A9

Uniqueness

Uniqueness Score: -1.00%

Function 00360D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0035F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00360D71,?,?,?,0034100A), ref: 0035F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0034100A), ref: 00360D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0034100A), ref: 00360D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00360D7F

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 68331a9c37f6212f499e4ec9152764d20cf2d031af094871cf8bca88e3b7b648
Instruction ID: 79dc6333d28a84b9c9b48578de4bcac0a7d89dc7846326d2f1cf826932100c0d
Opcode Fuzzy Hash: 68331a9c37f6212f499e4ec9152764d20cf2d031af094871cf8bca88e3b7b648
Instruction Fuzzy Hash: 1BE06D742003018FD7269FB8E4457827BE4AB04745F008A2EE882CA769DBB0E448CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0035E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0035E3D5

Strings

8%A, xrefs: 0035E3CA
0%A, xrefs: 0035E3B5

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%A$8%A
API String ID: 1385522511-3959272176
Opcode ID: 8e3378285e835c1213e0a97e2c3d84a75ede7c067c91064aaf660dc05233a85b
Instruction ID: 2d03a91a131d22a7889b546f6e288a3783121ec24c472490df4d8f76b4383d5f
Opcode Fuzzy Hash: 8e3378285e835c1213e0a97e2c3d84a75ede7c067c91064aaf660dc05233a85b
Instruction Fuzzy Hash: F1E02639400910EBC60E9718FBE5ECA3357AB05321B918175E802CB1E1DBB42985865C

Uniqueness

Uniqueness Score: -1.00%

Function 003B3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 003B302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 003B3044

Strings

aut, xrefs: 003B3038

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 92168af3c84d0048109c806ee976b3065e3acff17eef6a1ad05e7414fd16b5ac
Instruction ID: 12141c3fcc7f6778642d27780900eb9075bd91421b9c85122385169d7cb4e37a
Opcode Fuzzy Hash: 92168af3c84d0048109c806ee976b3065e3acff17eef6a1ad05e7414fd16b5ac
Instruction Fuzzy Hash: DFD05B7151131467DE20A7A4AC0DFC73B6CD705750F000662B655E20D1DBB49544CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 0039D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0039D220

Strings

%.3d, xrefs: 0039D22B
X64, xrefs: 0039D2A8

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 358e39160da5c9f843e61d623286ed0ed0faae022eab795747aeddbc96b13d35
Instruction ID: 112eff198c77a7f9fa2f7ee786fdc6e3968eea4b5d00c45b11757195e2345ccd
Opcode Fuzzy Hash: 358e39160da5c9f843e61d623286ed0ed0faae022eab795747aeddbc96b13d35
Instruction Fuzzy Hash: E6D01261C09109E9CF5297D0DC46DB9B37CBB18301F608862FC46A2881D634D508A761

Uniqueness

Uniqueness Score: -1.00%

Function 003D2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003D232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 003D233F

Part of subcall function 003AE97B: Sleep.KERNEL32 ref: 003AE9F3

Strings

Shell_TrayWnd, xrefs: 003D2325

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5b6e9d29f960f933132cc4faa4b5b47050a4cc98e7b43de55ad654718ccc0341
Instruction ID: b0c5d4f234a692848336931e8d3e93c0884755392bf6c77e082856e0d7b0ece8
Opcode Fuzzy Hash: 5b6e9d29f960f933132cc4faa4b5b47050a4cc98e7b43de55ad654718ccc0341
Instruction Fuzzy Hash: 52D0A9323A1310B6EA64A330AC0FFC6BA089B01B00F0009277206AA0D0CAB4A800CA08

Uniqueness

Uniqueness Score: -1.00%

Function 003D2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003D236C
PostMessageW.USER32(00000000), ref: 003D2373

Part of subcall function 003AE97B: Sleep.KERNEL32 ref: 003AE9F3

Strings

Shell_TrayWnd, xrefs: 003D2365

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 7ef4bc8be5414b5fe5878b1188e60715b847af54c12b114b406facae7b8c349a
Instruction ID: 1ab152f1410052bb1f773c24254fb82c5765453634423f75a64e776dc37878d5
Opcode Fuzzy Hash: 7ef4bc8be5414b5fe5878b1188e60715b847af54c12b114b406facae7b8c349a
Instruction Fuzzy Hash: 5BD0A9323A23107AEA65A330AC0FFC6B6089B02B00F0009277202AA0D0CAB4A800CA08

Uniqueness

Uniqueness Score: -1.00%

Function 0037BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0037BE93
GetLastError.KERNEL32 ref: 0037BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0037BEFC

Memory Dump Source

Source File: 00000000.00000002.1651226949.0000000000341000.00000020.00000001.01000000.00000003.sdmp, Offset: 00340000, based on PE: true

Associated: 00000000.00000002.1651178357.0000000000340000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.00000000003DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651299566.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651344028.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651360722.0000000000414000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_340000_HxesZl7bIx.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 71347e31c11b869a6aedf007c967ddc32bbe34e0adab91a32af981c6a0985df0
Instruction ID: c2d68835539bcd9721e0cc163a2fb369a738c16328e91fed2fd2c2e67ea38b47
Opcode Fuzzy Hash: 71347e31c11b869a6aedf007c967ddc32bbe34e0adab91a32af981c6a0985df0
Instruction Fuzzy Hash: 9841C434601216AFDB338F64DC54BAAFBB9AF41B10F15C169F95D9B2A1DB348D00CB60

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HxesZl7bIx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Windows Analysis Report
HxesZl7bIx.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre